API and PNR: how airlines share passenger data with governments

API and PNR are two different things

Advance passenger information, or API, identifies the traveller. IATA says it usually comes from the machine-readable zone of a passport. It covers full name, date of birth, gender, passport number, citizenship and the country that issued the passport ¹¹. EU law adds flight details such as the flight number, departure and arrival airports and times ¹².

A passenger name record, or PNR, is different. IATA describes it as data collected by airlines for their own business purposes ¹⁰. It holds what a traveller or travel agent gave at booking and sits in the airline reservation system until check-in ¹¹. A PNR can be as thin as a name, an itinerary and a ticket indicator. IATA warns that PNR accuracy is not guaranteed and that it can contain sensitive personal data ¹⁰.

The EU PNR Directive defines PNR as a record of each passenger's travel requirements held in reservation and departure control systems. Its Annex I lists 19 categories of PNR data. The last category covers the history of changes to the first 18 ¹.

Who sends the data and who receives it

Airlines send the data. Governments receive it. Under the EU PNR Directive each member state names a Passenger Information Unit, or PIU. The PIU collects PNR from air carriers, stores and processes it, passes results to competent authorities and swaps data with other PIUs and Europol ¹.

Carriers push PNR to the PIU 24 to 48 hours before scheduled departure and again right after flight closure. The second transfer can be limited to updates ¹. Under the EU-US agreement, carriers start sending PNR to the US Department of Homeland Security 96 hours before departure ¹³.

API in the EU works through a central router. Regulation (EU) 2025/12 of 19 December 2024 requires air carriers flying into the Union to collect API from the travel document by automated means. They send it, encrypted, to a router run by the EU agency eu-LISA. The router forwards it to border authorities of the member state concerned ¹². The regulation excludes biometric data from API ¹².

ICAO Annex 9 asks each state to have only one entry point for API, interactive API and PNR messages. A passenger data single window meets that rule ⁶.

Batch API and interactive API

Batch API means the airline sends a list of passengers, often at flight closure. Interactive API, or iAPI, goes a step further. IATA says it lets a government send an instant reply to the airline based on its checks. The airline can then confirm a passenger holds the right document and entry permission, such as a visa, before boarding ¹⁰.

Annex 9 makes an API system a Standard for every state. iAPI stays a Recommended Practice that states should consider ^6,7. ICAO reported that the UK began iAPI in 2015 ⁹. In the EU, carriers send API per passenger at check-in, no earlier than 48 hours before departure, and again for all boarded passengers after flight closure ¹².

The global rules: UN resolutions and ICAO Annex 9

UN Security Council resolution 2178, adopted unanimously on 24 September 2014, called on states to require airlines in their territories to provide advance passenger information. The aim was to detect the travel of people designated under UN sanctions regimes ⁵.

Resolution 2396, adopted unanimously in December 2017, went further. It decided that states shall require airlines to provide API to national authorities to detect foreign terrorist fighters. It decided that states shall develop the capability to collect, process and analyse PNR data. It urged ICAO to set a standard on PNR ⁴. The same resolution called for watch lists and biometric systems. It noted that PNR and biometric systems can take a long time and many resources to build ⁴.

ICAO acted through two amendments to Annex 9 of the Chicago Convention. Amendment 26 revised the API rules, largely in response to resolution 2178. It added Standard 9.7, which requires every state to set up an API system, and Standard 9.8, which requires legal authority and use of international standards ^6,7. Amendment 28 added PNR rules: 11 Standards and 6 Recommended Practices ⁶. The ICAO Council adopted it on 23 June 2020. It became applicable on 28 February 2021 ⁸.

Under Standard 9.24, states must develop the capability to collect, use, process and protect PNR. Their programmes should align with ICAO Doc 9944, the PNR guidelines, and use the PNRGOV message format for airline-to-government transfer ⁷.

How governments use the data for risk assessment

The EU PNR Directive allows three uses. A PIU can assess passengers before arrival or departure. It can answer reasoned requests from competent authorities. It can analyse PNR to update its assessment criteria ¹. All three must serve the fight against terrorist offences and serious crime ¹.

The Court of Justice of the EU set limits in its June 2022 ruling. The advance assessment may compare PNR only against non-discriminatory databases of persons or objects sought or under alert. Pre-set criteria must target people reasonably suspected of terrorism or serious crime and must weigh evidence for and against ². The court said automated processing produces many false positives. A positive result must be checked by PIU staff by non-automated means ². PIUs may not use self-learning systems that change criteria without human review ^2,3.

The Directive bans processing of PNR that reveals race or ethnic origin, political opinions, religion, trade union membership, health, sex life or sexual orientation. Any such data received must be deleted at once ¹.

How long the data is kept

The EU PNR Directive sets a five-year retention period at the PIU. After six months the data must be depersonalised by masking names, contact details, payment and frequent flyer data, some remarks and any API data. Unmasking needs approval from a judicial or other competent national authority ¹.

On 21 June 2022 the Court of Justice ruled in case C-817/19, Ligue des droits humains, brought from Belgium. It upheld the Directive but read it narrowly ^2,3. Keeping all passengers' data for six months is in principle acceptable. Keeping it beyond six months is allowed only where objective evidence links a passenger to terrorism or serious crime. A general five-year period for everyone is ruled out ². Member states may not apply the system to all intra-EU flights without a genuine and present or foreseeable terrorist threat. Using PNR to improve border control or fight illegal immigration is ruled out ².

Rules differ by country and agreement. The 2012 EU-US PNR agreement lets DHS keep PNR in an active database for up to five years, depersonalised after six months, then in a dormant database for up to ten more years ¹³. For API, the EU regulation tells carriers and border authorities to delete data 48 hours after transfer or receipt, with some exceptions ¹².

Critics remain. On 6 July 2022 the digital rights group EDRi wrote that the court had in effect amended the Directive to make it fit fundamental rights, instead of striking it down. EDRi said the ruling still tolerates broad data collection and error-prone automated profiling ¹⁴.

PNRGOV and the API-PNR toolkit

PNRGOV is the standard message format for sending PNR from airlines to governments. Annex 9 requires states to deploy it ⁷. API uses the PAXLST message, set out in a guide agreed by the World Customs Organization and IATA ⁶. The WCO, IATA and ICAO agreed the joint API guidelines, which define the API data set ⁷.

The API-PNR toolkit, known as the Passenger Data Toolkit on some pages, was built jointly by IATA, ICAO and the WCO. It is free to read on the IATA website. It holds introductory material, checklists, message guides and notes on data elements, timing, privacy and the single window. It aims to help governments design programmes that match global standards ¹⁰.