EU PNR Directive (EU) 2016/681

What the Directive covers

Article 1 covers the transfer by air carriers of PNR data of passengers on extra-EU flights ¹. Article 1(2) says PNR data may be processed only for preventing, detecting, investigating and prosecuting terrorist offences and serious crime ¹.

Under Article 2, a Member State that chooses to extend the Directive to intra-EU flights must notify the Commission in writing. It can give or revoke the notification at any time ¹. Annex I lists 19 categories of PNR data, as far as carriers collect them ¹.

Passenger information units

Article 4 requires each Member State to set up or designate a passenger information unit (PIU) to process the data ¹.

Article 8 requires carriers to send PNR data 24 to 48 hours before the scheduled flight departure time. They must send it again immediately after flight closure, when boarding is complete ¹.

Retention and depersonalisation

Article 12 says PNR data is kept in a database at the PIU for five years from transfer ¹. After six months the data is depersonalised by masking the elements that could directly identify a passenger ¹.

The EU Court of Justice held in June 2022 that a general five-year period is precluded. After the first six months, retention must be limited to passengers for whom there is objective evidence of risk ².

Court of Justice ruling of 21 June 2022

In Case C-817/19, Ligue des droits humains, the Court found that its review revealed nothing capable of affecting the validity of the Directive, read in line with the Charter of Fundamental Rights ². The Commission summarises the ruling as confirming the Directive is valid provided some provisions are strictly interpreted ³.

• Without a genuine and present or foreseeable terrorist threat, Member States may not extend the system to all intra-EU flights ².
• Where such a threat exists, extension may be allowed for a limited period, subject to effective review ².
• PIUs may not use self-learning artificial intelligence that can change assessment criteria without human review ².
• National law may not allow PNR processing for purposes other than those listed in Article 1(2) ².

Reviews and related EU action

Article 19 required the Commission to review the Directive by 25 May 2020 ¹. The Commission adopted its review report in July 2020, and it reviewed the implementing decision on data formats in 2021 ³. The Commission says an evaluation of the Directive is ongoing ³.

On 28 November 2019 the Council of the EU set the EU position for the ICAO Council on new PNR standards in Annex 9 ⁴. The Decision says that position follows existing EU data protection and PNR law and the Charter ⁴.

Which countries take part

Recital 39 says the United Kingdom and Ireland notified their wish to take part in the Directive ¹. Recital 40 says Denmark does not take part and is not bound by it ¹. PNR transfers with the United Kingdom are now covered by the EU-UK Trade and Cooperation Agreement, in force since May 2021 ³.