New EU Decision on ETIAS Data Handling Enters into Force – Austrian Border Systems Must Update APIs

Commission Implementing Decision (EU) 2026/1970, published earlier this month, took legal effect on 28 September 2026, setting detailed rules for accessing, amending and deleting personal data in the European Travel Information and Authorisation System (ETIAS) Central System. Although highly technical, the decision forces immediate software changes for all Member-State ETIAS National Units, including Austria’s located within the Federal Criminal Intelligence Service (BK). Key provisions specify the message formats and encryption standards that border authorities must use when processing travellers’ rectification or erasure requests. They also introduce an “advance erase” function allowing data to be purged automatically once an ETIAS authorisation expires. For carriers, the decision harmonises the Application Programming Interface (API) call that airlines must send to check the validity of an ETIAS before boarding. Lufthansa Group IT confirmed that the updated schema was rolled out to Austrian Airlines’ departure-control system overnight on 28 September. From a traveller’s viewpoint, the change is invisible but should reduce false ‘red-flag’ hits at e-gates. Importantly, business-jet operators using the Business Aviation Pre-Departure Forms (BAPF) must migrate to the new XML version before 12 October or risk fines. Data-protection officers in multinational firms will welcome the clarified deletion timelines, which align with Austria’s DSGVO rules and may simplify internal retention policies for employee travel records. The Ministry of the Interior will issue a national guidance note next week; until then, travel-management companies should monitor the ETIAS National Unit’s web service for downtime windows.