# Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226, Article 56: Data protection

Extent: E+W+S+N.I.

1. Regulation (EC) No 45/2001 shall apply to the processing of personal data by the European Border and Coast Guard Agency and eu-LISA.
2. Regulation (EU) 2016/679 shall apply to the processing of personal data by the ETIAS National Units assessing applications, by border authorities and by immigration authorities.
Where the processing of personal data by the ETIAS National Units is performed by competent authorities assessing the applications for the purposes of the prevention, detection or investigation of terrorist offences or other serious criminal offences, Directive (EU) 2016/680 shall apply.
Where the ETIAS National Unit decides on the issue, refusal, revocation or annulment of a travel authorisation, Regulation (EU) 2016/679 shall apply.
3. Directive (EU) 2016/680 shall apply to the processing of personal data by Member States’ designated authorities for the purposes of Article 1(2) of this Regulation.
4. Regulation (EU) 2016/794 shall apply to the processing of personal data by Europol pursuant to Articles 29 and 53 of this Regulation.

---
Source: https://www.legislation.gov.uk/eur/2018/1240/article/56 (the official version)
Page: https://openlegislation.uk/eu-regulation-2018-1240/article-56
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.