European Commission: Home Affairs

Terrorism and organised crime often involve international travel. Therefore, travel information gathered by carriers is an important instrument for law enforcement authorities to prevent, detect and investigate crime and prosecute perpetrators. The EU approach guarantees more security and a high level of protection of privacy and personal data.

What is PNR?

PNR data is information provided by passengers during the reservation and booking of tickets and when checking in on flights, as well as collected by air carriers for their own commercial purposes. It contains several different types of information, such as travel dates, travel itinerary, ticket information, contact details, travel agent through which the flight was booked, means of payment used, seat number and baggage information. The data is stored in the airlines' reservation and departure control databases.

Many states access PNR data for the purpose of fighting serious crime and terrorism. PNR data has been used manually for almost 60 years by customs and law enforcement authorities around the world. Technological developments have made it possible to use PNR data more systematically for law enforcement purposes.

Proposal for an EU PNR

Following the entry into force of the Treaty of Lisbon, the initial Commission proposal of 2007 to collect, store and analyse PNR data for law enforcement purposes elapsed. Therefore, the Commission re-submitted its proposal in 2011.

The Commission proposes:

• that air carriers transfer data on international flight passengers held in their reservation systems to a dedicated unit in the EU State of arrival or departure. EU States should analyse and retain this data for the purposes of preventing, detecting, investigating and prosecuting serious crime and terrorist offences
• to strongly protect privacy and personal data. PNR data may only be used for the purpose of fighting serious crime and terrorist offences. Law enforcement authorities in EU States must depersonalise the data one month after the flight and may not retain it for more than five years in total. Sensitive data that could reveal racial or ethnic origin, political opinions or religious beliefs may never be transferred by air carriers to, or used in any way by, EU States. EU States should not be able to access the databases of air carriers. They must request for the data, which is then sent by the air carriers concerned ("push method"). EU States must set up dedicated units to handle the data and keep it secure, as well as ensure that these units are monitored by an independent supervisory authority. Clear rules on passengers' right to accurate information about the collection of PNR data are also provided for, as well as rules giving passengers the right to access, rectify and delete their data and the right to compensation and to judicial remedies
• clear rules on how data should be transferred, for example, how many times data may be transferred by the air carriers to EU States and how to secure such transfers, in order to limit the impact on privacy and minimise the costs for air carriers.

The Commission is currently negotiating the proposal with the Council of Ministers and the European Parliament.