1.
eu-LISA shall keep logs of all data processing operations within the ETIAS Information System. Those logs shall include the following:
(a)
the purpose of the access;
(b)
the date and time of each operation;
(c)
the data used for the automated processing of the applications;
(ca)
where relevant, a reference to the use of the ESP to query the ETIAS Central System as referred to in Article 7(2) of Regulation (EU) 2019/817;
(d)
the hits triggered while carrying out the automated processing laid down in Article 20;
(e)
the data used for the verification of identity stored in the ETIAS Central System or other information systems and databases;
(ea)
where relevant, a reference to queries entered in the ETIAS Central System for the purposes of Articles 14 and 15 Regulation (EU) 2024/1356, the hits triggered and the results of this query;
(f)
the results of the verification process referred to in Article 2; and
(g)
the staff member having performed i.
2. The ETIAS Central Unit shall keep records of the staff members duly authorised to perform the identity verifications.
The ETIAS National Unit of the Member State responsible shall keep records of the staff member duly authorised to enter or retrieve the data.
3. eu-LISA shall keep logs of all data processing operations within the ETIAS Information System involving the access by border authorities referred to in Article 47 and the access by immigration authorities referred to in Article 49. Those logs shall show the date and time of each operation, the data used for launching the search, the data transmitted by the ETIAS Central System and the name of the border authorities and immigration authorities entering and retrieving the data.
In addition, the competent authorities shall keep records of the staff members duly authorised to enter and retrieve the data.
4. Such logs may be used only for monitoring the admissibility of data processing and to ensure data security and integrity. The logs shall be protected by appropriate measures against unauthorised access. They shall be deleted one year after the retention period referred to in Article 54 has expired, if they are not required for monitoring procedures which have already begun.
eu-LISA and the ETIAS National Units shall make the logs available to the European Data Protection Supervisor and to the competent supervisory authorities on request.