International PNR data-sharing agreements: dates, retention and status

Why the EU signs PNR agreements

A Passenger Name Record (PNR) is the booking data an airline holds on a passenger. Many countries require airlines to send it before a flight arrives. The European Commission says transferring PNR data to non-EU countries interferes with the protection of personal data. Such a transfer needs a legal basis under EU law and must be necessary, proportionate and subject to strict limits and safeguards. The Commission set out its approach to such transfers in a 2003 Communication and reviewed it in 2010 ¹.

This page covers agreements between the EU and other countries. Rules on which countries collect PNR, and which agency receives it, are in our API and PNR by country table.

Agreement table

Status as listed by the European Commission, checked 19 October 2026. Other sources are cited where used.

Opinion 1/15: the court case that reset the rules

The EU and Canada signed a PNR agreement in 2014. The European Parliament asked the Court of Justice whether it was compatible with EU law. The court said it was the first time it had ruled on whether a draft international agreement fitted the EU Charter of Fundamental Rights ⁴.

On 26 July 2017 the court found that the systematic transfer, retention and use of all passengers' data was permissible in essence, but that several provisions breached fundamental rights. Transfers of sensitive data, such as data revealing racial or ethnic origin, religion or health, lacked any justification. Keeping the data of all passengers after they left Canada went beyond what was strictly necessary. The court said data could be kept beyond departure, even for five years, only for passengers where objective evidence suggested a continuing risk ⁴.

The court said the agreement should define the data more clearly, use specific, reliable and non-discriminatory criteria for automated processing, limit the databases checked, restrict onward transfers to countries with an equivalent EU agreement or adequacy decision, and give passengers a right to individual notification. Use of the data during a passenger's stay in Canada should, except in urgent cases, need prior review by a court or independent body ⁴.

The new EU and Canada agreement

Negotiations on a new text ended on 27 November 2023. The Council decided to sign on 13 June 2024, and the agreement was signed on 4 October 2024. The Commission says it addresses all the requirements in Opinion 1/15 ¹.

The Commission's proposal, summarised by the European Parliament, lists the main terms. Canada may not process sensitive data and must delete any it receives. Independent public authorities oversee compliance. Passengers are notified of the use of their data and may access and correct their own records. Automated processing must rely on non-discriminatory and reliable criteria. Any use for purposes other than security and border checks needs prior review by a court or independent authority. Onward transfers outside Canada are limited to countries with a comparable EU agreement or an adequacy decision ⁵.

Parliament consented on 12 March 2025 and the Council concluded the agreement on 14 April 2025. eucrim reported that Canada still needed to ratify it before it became binding on both sides ⁶. Canada's own rules for PNR it collects say the CBSA keeps API and PNR data for three and a half years from receipt, or up to six years if the person is under active investigation ⁸.

The EU and UK under the TCA

Since Brexit, the UK's use of PNR on flights between the EU and the UK falls under the Trade and Cooperation Agreement, signed in December 2020 and in force since May 2021 ¹. A UK Home Office memorandum of 6 December 2022 says the TCA requires deletion of certain passengers' data after they leave the UK. The data may be kept only where a risk assessment based on objective evidence shows the need (Article 552(4)) ⁷.

The UK needed time to change systems built for the EU PNR Directive. The TCA allowed a temporary derogation. The Partnership Council extended it on 21 December 2021 to 31 December 2022, then for a second and final year. The memorandum says the derogation would end on 31 December 2023 and that the UK had to finish the technical changes by then ⁷.

How these compare with EU rules at home

Inside the EU, the PNR Directive requires data to be depersonalised after 6 months and deleted after 5 years. Each Passenger Information Unit must have a data protection officer, and independent national authorities oversee the processing ¹. On 21 June 2022 the Court of Justice confirmed the directive was valid in the Ligue des droits humaines case, on condition that some provisions are read strictly in line with fundamental rights ¹.

The US agreement allows longer storage than the directive, with up to 15 years across the active and dormant databases. It states that the need for the 10-year dormant period would be considered in the joint evaluation ². The Australia agreement sets a shorter total of five and a half years ³.

Limits of this table

We list only agreements and dates we could confirm in sources we opened. Earlier EU agreements, including the first EU and US arrangements of the 2000s and an earlier deal with Canada, are not covered here. We could not read the full PNR title of the TCA, so this page does not state the maximum UK retention period. Retention terms for the Norway, Iceland and Switzerland agreements were not published on the Commission page we checked ¹.