Dutch participation in European DTC pilot
At the request of the European Commission (EC), the Netherlands is conducting a pilot with a Digital Travel Credential (DTC) to allow for processes at and around the border to be carried out more effectively and efficiently and to facilitate travelers, while respecting their security and privacy. The implementation of the pilot is scheduled for January 2024. Holders of Dutch, Belgian and Canadian passports who have booked a KLM-flight from Canada to the Netherlands will be invited to participate in the pilot. The pilot is a collaboration of the Ministry of Justice and Security (JenV), the Ministry of the Interior and Kingdom Relations (BZK), the Royal Netherlands Marechaussee (KMar), the National Office for Identity Data (RvIG), Royal Dutch Airlines (KLM) and Amsterdam Airport Schiphol (Schiphol). The technology is provided by IDEMIA.
What is a DTC?
The DTC standard was developed by the International Civil Aviation Organization (ICAO), which forms part of the United Nations. This standard describes multiple options. In DTC1, the DTC is linked to a passport, while in DTC2 and DTC3 it is linked to a telephone.
The standard describes multiple options where the data from the passport is uploaded to the telephone by the traveler (DTC1) or by the government (DTC2, DTC3). This pilot uses the DTC1 standard, where the participant in the pilot will load the passport data onto the mobile telephone.
Briefly summarized, a DTC1 is a copy of the digital information contained on the chip of the passport. Therefore, the DTC1 is not an autonomous digital proof of identity. The passport, from which the DTC1 is derived, is the proof of identity.
Do I still require a passport to travel?
Yes, a physical passport is still required to support the boarding process and the border passage, because with the DTC1, the digital data are linked to the passport. The passport may be closed when presented, in order for the chip to be read out and opening it during these processes is no longer required.
The purpose of the pilot
The purpose of a DTC is to enable a more effective and more efficient performance of processes on and around the border. This will result in advantages for the airline company (KLM), the border control authority (KMar) and the traveler. Since KMar will be able to perform several checks that are usually carried out at the border crossing at an earlier stage, it is expected that the traveler arriving at the airport will be able to go through the border process at a faster rate.
At the request of the European Commission, the pilot will serve to test the DTC in practice. The results of the pilot will be shared with the European Commission, which will enable it to use these results for new European legislation for a digital travel document and to facilitate travel.
Who can participate in the pilot?
KLM passengers aged 18 and older, with a Dutch, Belgian or Canadian passport, traveling on a flight from Canada to Amsterdam Airport Schiphol may be invited to participate in (parts of) the pilot.
Why can only holders of Dutch, Belgian and Canadian passports participate in the pilot?
The largest groups of passport holders traveling on KLM flights from Canada to the Netherlands and the technical specifications of the passport were considered for the pilot. The pilot system has been technically prepared for only these three target groups, to wit: holders of Dutch, Belgian and Canadian passports.
What does the pilot entail?
Travelers who are eligible to participate in the pilot will receive an invitation by email at the email address that was used to book the KLM flight.
Potential participants are invited to download an application - developed specifically for the pilot - on their telephone. The pilot participants first need to use their phone to scan the Machine Readable Zone (MRZ) at the bottom of the page of the passport holder. After that, the passport must be held against the telephone to read out the passport chip.
Upon creating the DTC, the pilot participant is asked to take a ‘selfie’, a photo, which is then compared to the photo contained on the passport chip. This will prevent a person other than the passport holder from creating a DTC. Prior to the journey, the data can then be shared with KMar for the border process and / or with KLM for the boarding process.
Upon their arrival at Amsterdam Airport Schiphol, pilot participants who share their DTC with KMar may use a special DTC tap & go border gate. Based on the DTC, KMar will already have performed relevant border control processes prior to arrival at the border.
The DTC will be retrieved at the border based on a facial scan. Pilot participants will then hold their (closed) passport against the border gate. If there is a match between the DTC and the passport presented and no particulars have arisen from the checks previously performed, the pilot participant may pass through the border. A physical passport is therefore still required for the border passage.
Which airports are included in the pilot?
The DTC pilot is planned for KLM flights departing from Canada to the Netherlands.
Holders of Dutch, Belgian and Canadian passports traveling on a KLM flight from Calgary (YYV), Edmonton (YEG), Toronto (YYZ) and Vancouver (YVR) airports, to Amsterdam Airport Schiphol (AMS) may participate in the border check component of the pilot.
Holders of Belgian, Canadian and Dutch passports issued after September 2021 traveling from Montreal (YUL) airport may participate in both the boarding component as well as the border component of the DTC pilot. The electronic gates enabling this process are only available in Montreal and not at the other Canadian airports.
Due to technical reasons, holders of Dutch passports issued before September 2021 are ineligible for participation in the boarding component of the passport.
What about the security of my data and the protection of my privacy?
See the privacy statement below this document.
Is participation in the pilot obligatory?
No, participation in the pilot is on a voluntary basis. There are no adverse effects for travelers who do not wish to participate in the pilot, they can follow the regular processes at the airport. Each participant is requested to grant express permission for the pilot. This means that the pilot complies with the legal conditions of the General Data Protection Regulation (GDPR), in which the permission provided constitutes a legal basis for processing data. Pilot participants may withdraw their permission to participate at any moment in time and travel according to the regular procedure.
What happens after the pilot has been completed?
The European Commission has requested this pilot in order to determine the extent to which the processes at and around the border can be carried out more effectively and more efficiently with the use of a DTC. The results of the pilot will be shared with the European Commission, which will use these results for the development of regulations for a digital travel document and to facilitate travel. Traveling with a DTC is currently only possible during the pilot.
Questions regarding the pilot
For specific questions regarding the DTC boarding component offered for KLM flights from Montreal to Amsterdam, send an email to: dtc1pilot@klm.com
For specific questions regarding the DTC border component, send an email to: dtc1pilot@rijksoverheid.nl .
Other links:
- Deelname Nederland aan Europese pilot met digitaal reisdocument on the participation of the Netherlands in the European pilot with the digital travel document.
Digital Travel Credential Pilot - Privacy statement
Digital Travel Credential Pilot - Privacy Statement
This privacy statement explains how your personal data are processed if you decide to participate in the Digital Travel Credential (DTC) Pilot. During the DTC Pilot, travelers on KLM flights from Canada to the Netherlands can choose to have a digital travel document (the Digital Travel Credential (DTC) generated to run through the border process in the Netherlands. In addition, people traveling on KLM flights from Montreal-Trudeau International Airport to the Netherlands may also opt to use the DTC to complete the boarding process in Canada.
The General Data Protection Regulation (GDPR) applies to the data processed during this Pilot.
Controllership
The DTC Pilot is a joint project of the Royal Netherlands Marechaussee (KMar, which forms part of the Ministry of Defence), the Ministry of Justice and Security (J&V), the National Office for Identity Data (RvIG, which forms part of the Ministry of the Interior), the Royal Dutch Airlines (KLM) and Amsterdam Airport Schiphol (Schiphol). The project is supported and partly funded by the European Commission.
The controllership for the data processed during the Pilot is divided as follows, in chronological order:
- KLM is the independent data controller for inviting travelers to participate in the Pilot.
- The Minister of Defence and the Minister of Justice and Security are joint data controllers for the creation of the DTC.
- KLM is the independent data controller for the processing of personal data during the boarding process.
- The Minister of Defence and the Minister of Justice and Security are joint data controllers for the processing of personal data during the border process.
Processors
The data controlling parties have engaged the following organization for the processing of personal data for the purposes of facilitating the necessary technology. Processing agreements have been concluded with this organization, obliging it to comply with the terms and conditions pursuant to this privacy statement.
- Idemia The Netherlands B.V. (processor)
The personal data processed
Only persons traveling with a Dutch, Belgian or Canadian passport will be able to take part in the Pilot. The following personal data of the participants will be processed during the Pilot:
- The email address that is used to book the flight.
- Flight number and date of flight.
- Personal data taken from the travel document (full name, date and place of birth, nationality, sex, document reference, citizen service number or a personal identification number of a similar nature, country of issue, validity date).
- Biometric personal data (photo from the travel document, a live photo of the face and the result of the facial comparison).
- The DTC.
- Permission for the creation of the DTC, for submitting the DTC to KLM and / or KMar and for verification by way of facial comparison.
- For Canadian travelers: the answers provided to questions relating to the purpose, duration and means of the trip.
- Approval or rejection for border passage in this Pilot based on a prescreening by KMar.
- An online identifier (i.e. a digital representation of the boarding pass) for the KLM boarding process in this Pilot.
Legal basis for processing your personal details
Participation in this Pilot is entirely voluntary. Except for the invitation to participate, the processing of the statutory identification number and the processing of certain mandatory data in the border process, all data will be processed on the basis of your express permission within the meaning of Article 6(1) sub a and Article 9(2) sub a of the GDPR. You may withdraw this permission at all times, after which your participation in the Pilot will be terminated and the data will be erased. Even without withdrawing your permission, at any point during your trip you may decide as yet to use the regular means of boarding or border passage (by using the assistance of ground staff and / or border patrol at the airports) without the use of the DTC.
If you grant permission for this, your data will be submitted to KLM for the boarding process and to KMar for the performance of the border check within the scope of the Pilot. If you are a Canadian national, you will also need to answer questions for KMar concerning the purpose, the duration and the means of your trip to the Netherlands.
Participation in the Pilot and the use of a DTC for the border process are voluntary. However, border control is not. If you do not take part in the Pilot, the border control will still be carried out in the regular manner through the manual desk, without the use of the DTC. The processing basis for the border process is therefore necessary for the purposes of performing a task in the public interest within the meaning of Article 6(1) sub e GDPR. This means the performance of the border control as entrusted to KMar in Article 4(1) sub f of the Police Act 2012 of the Netherlands, Article 46(1) sub a of the Aliens Act 2000 of the Netherlands and Article 8 of the Schengen Borders Code.
How your personal data is used
If you fall within the target group of the Pilot, an invitation to participate in the Pilot will be sent to the email address you used to book your KLM flight. If you wish to take part, you will then need to download the app of the Pilot on your telephone, where you will need to enter your passport details and a live photo of your face. The (biometric) photo of your face will be compared with the photo in your passport through facial comparison, in order to verify that you are the legal owner of this document. After this, your DTC will be created.
If you grant permission for this, the details from your passport and the DTC will be presented to KMar for the border process and your DTC will be used during the boarding process with KLM. For the border process, participants with the Canadian nationality will also be required to answer questions from KMar through a website, which questions pertain to the purpose, the duration and the means of your trip. For the KLM boarding process, you will be required to share certain information with KLM (to wit: your given name / names, surname, flight number, flight date, passport number, date of birth) to enable the validation of your data and an online identifier will be linked to these data. During the boarding process your DTC is processed by the Processor (Idemia) in order to enable your biometric identification. KLM will use the aforementioned data to facilitate your boarding on your flight by scanning your face and placing your travel document against a self-service terminal.
KMar will first use the data (without the DTC) to conduct a preventive border check prior to your landing at Schiphol Airport. Such prescreenings are conducted as a standard, also without the Pilot, based on the API Directive (2004/82/EC) and these therefore form part of the regular border process. If approval is given based on this prescreening, you will be able to cross the border at Schiphol by having your face scanned again and by placing your passport against a self-service terminal.
Facial comparison will again be carried out with a live photo, both during boarding and upon the border passage, in order to verify that you are the same person who generated the DTC.
The parties involved will not use your personal data for purposes other than those set out in this statement. Your personal data will therefore explicitly not be sold, leased or used for any other commercial purpose.
Your personal data will not be shared with third parties, unless these should be demanded by other government authorities on the basis of a legal obligation, for example for prosecution purposes.
Locations where your personal data are processed
Your personal data are processed in the following locations:
- Canada: by KLM for the purpose of the boarding process;
- The Netherlands: by Kmar for the purpose of performing the border control and facilitating the border passage;
- France: by Processor Idemia for the creation and storage of the DTC in its data center located there.
Your personal data will only be processed in these locations by the parties involved in the Pilot. Other parties will not have access to your personal data. No personal data will be shared with the Canadian or other authorities.
Retention method and duration of your personal data
The parties involved in the Pilot have taken proper and organizational measures to protect personal data. An integrated security system is used that includes physical, informational and personal security measures. Furthermore, an authorisation policy is applied, allowing access to your personal data for only necessary, screened employees of the parties in question.
Your personal data will be retained for a maximum of 96 hours after your registration for the Pilot, after which we will destroy them. This time period is necessary, as it may take up to 3 days for the flights to be carried out after the registration for the Pilot.
The parties involved will also retain your biometric data (facial photos) for a maximum of 96 hours in order to identify you during the boarding process in Canada and the border process in the Netherlands, thus facilitating your participation in the Pilot. As with your other personal data, your biometric data will not be used for any other purpose and will be irrevocably erased by all parties involved, once the aforementioned retention period has lapsed.
Please note: we cannot erase your DTC from your telephone. You need to do this yourself. We recommend that you destroy the DTC as soon as possible after you have crossed the border at Schiphol. Your DTC will no longer be valid or fit for use as proof of identity, travel document or any other means after your participation in the Pilot.
Your rights
The parties involved in the Pilot wish to fully inform you of your rights with regard to your personal data. Each participant has the following rights:
The right to withdraw your permission – At all times, you have the right to withdraw the permission you granted earlier. Your participation will then be stopped and your personal data will be erased.
The right of inspection / provision - You have the right to view the personal data collected of you and to request to be provided with a copy of your personal data.
The right of rectification - You have the right to request amendment of personal data you consider to be incorrect or incomplete.
The right of destruction - You have the right to request the destruction of your personal data.
The right of limitation - You have the right to request for the processing of your personal data to be limited.
The right of objection – You have the right to object against processing of your personal data.
The right of portability – You have the right to request our organization to make your personal data available to another organization.
The right not to be subjected to automated individual decision-making -
There is no automated individual decision-making included in the Pilot. A facial comparison will be made with your permission, however this will not result in decisions with legal consequences or consequences that will substantially affect you. Even if the facial comparison is unsuccessful, this will by no means result in you being unable to board or cross the border manually, outside the use of the Pilot.
How to withdraw your permission
You can withdraw your permission at all times by sending an email message to dtc1pilot@rijksoverheid.nl.
In your email message, please state your first name(s) and last name and the reference code of the travel document you used. It is not necessary to include a copy of your travel document or any other proof of identity.
After withdrawing your permission, you will receive instructions on how to continue your journey in regular fashion. The parties involved with the Pilot, KLM included, will be notified that you no longer wish to participate.
Your DTC and other personal data will be destroyed as soon as possible, yet no later than after 96 hours. All mail traffic pertaining to the withdrawal of your permission will also be destroyed no later than 3 weeks after having been received. There will be no further consequences for you resulting from dropping out of your participation in the Pilot. The KMar border guards at Schiphol will not be notified of this.
Contact
If you have any questions pertaining this privacy statement, the processing of your personal data or if you wish to invoke one of the aforementioned rights, you may contact us through the email address set out below. The GDPR dictates that we respond to your requests within one month, which period may be extended by another two months, subject to conditions.
Complaints supervisory authority
If you wish to file a complaint regarding the processing of your personal data or if you consider that a request made in this regard was incorrectly processed, please contact the Data Protection Authority.
Website: www.autoriteitpersoonsgegevens.nl
Email: info@autoriteitpersoonsgegevens.nl
Mailing address:
Dutch Data Protection Authority
P.O. Box 93374
2509 AJ The Hague
The Netherlands
Version
This privacy statement was most recently changed on 15 December 2023.