The EU PNR Directive: how airline booking data is used against terrorism and serious crime

What the Directive does

The European Parliament and the Council adopted Directive (EU) 2016/681 on 27 April 2016. It covers the transfer by air carriers of passenger name record (PNR) data for extra-EU flights, and the collection, use, retention and exchange of those data by member states ¹. PNR data is the booking record an airline holds. The Directive allows the data to be processed only to prevent, detect, investigate and prosecute terrorist offences and serious crime ¹.

Member states had to bring national laws into force by 25 May 2018 ¹. Denmark took no part in adopting the Directive and is not bound by it. The United Kingdom and Ireland notified their wish to take part when it was adopted ¹.

Serious crime means the offences listed in Annex II that carry a maximum prison term of at least three years under national law. Annex II lists 26 types of offence, from trafficking in human beings and drugs to cybercrime, fraud, murder, rape and unlawful seizure of aircraft ¹.

What data airlines send, and when

Annex I lists 19 headings of PNR data, as far as the airline has collected them in the normal course of business. They include the record locator, dates of booking and travel, names, address and contact details, payment information, the full itinerary, frequent flyer details, travel agent, seat number, baggage information and any advance passenger information (API) such as passport details ¹.

Airlines must push the data to the PIU of the member state where the flight lands or departs. They send it 24 to 48 hours before departure and again right after flight closure, once passengers have boarded and no one can board or leave. Member states may let airlines limit the second transfer to updates ¹. A PIU can ask for data at other times when it needs to respond to a specific and actual threat ¹.

If an airline sends data outside Annex I, the PIU must delete it at once ¹. The Directive bars risk criteria based on race or ethnic origin, political opinions, religion or beliefs, trade union membership, health, sexual life or sexual orientation ¹.

Passenger Information Units

Each member state must set up or name a PIU inside an authority that fights terrorism and serious crime ¹. The PIU collects and stores PNR data, processes it, and passes data or results to national competent authorities, to the PIUs of other member states and to Europol ¹. Each PIU must have a data protection officer ¹.

The PIU may use the data for three purposes. It can assess passengers before arrival or departure to find people who need further checks. It can answer reasoned requests from competent authorities in specific cases. It can analyse data to update or create risk criteria ¹. For the advance assessment, the PIU compares data against relevant databases and against pre-determined criteria. Every automated match must be reviewed by a person before any action is taken ¹.

The European Commission says PIUs compare data against law enforcement databases, process it against pre-determined criteria and share results with national authorities, Europol and other PIUs ⁴.

Retention and masking

The Directive sets a retention period of five years from transfer to the PIU ¹. After six months, the PIU must mask data elements that could identify a passenger directly. These include names, address and contact details, payment information, frequent flyer information, identifying general remarks and any API data ¹. After six months, full data can be disclosed only if it is believed necessary for a specific case and a judicial authority or another competent national authority approves ¹.

The Court of Justice changed how this works in practice. In its 2022 ruling it held that a general five-year retention period applied to all passengers is not compatible with the Charter of Fundamental Rights. After the first six months, data may be kept only for passengers where objective evidence links them to terrorism or serious crime, such as a verified match in the advance assessment ². During the first six months, keeping the data of all passengers does not in principle go beyond what is strictly necessary ².

Intra-EU flights

Article 2 lets a member state apply the Directive to all or selected flights between EU countries by notifying the Commission. It can change or revoke that choice at any time ¹.

In its July 2020 review, the Commission said all member states except one had extended PNR collection to intra-EU flights. It did not see a need to make intra-EU collection mandatory at that stage ³.

The 2022 ruling narrowed this option. Applying the Directive to all intra-EU flights is allowed only where a member state shows a terrorist threat that is genuine and present or foreseeable, for a limited period that can be extended. Without such a threat, a state must limit collection to selected routes, travel patterns or airports for which there are indications that justify it, and review the selection regularly. The choice must be open to review by a court or an independent body whose decision is binding ². The Court said EU law does not allow the system to be used to improve border controls or fight illegal immigration ².

The CJEU ruling of 21 June 2022 (C-817/19)

Legal analysts at eucrim called the judgment a landmark ruling ⁵. The case began when the Belgian human rights group Ligue des droits humains asked Belgium's Constitutional Court in July 2017 to annul the Law of 25 December 2016, which transposed the Directive. In October 2019 the Belgian court sent ten questions to the EU Court of Justice ².

The Court found nothing that affects the validity of the Directive, provided it is read in line with the Charter. It said the Directive entails undeniably serious interferences with the rights to private life and data protection, as it sets up a surveillance regime that is continuous, untargeted and systematic ².

The Court then set limits. Data headings in Annex I must be read precisely. The system may be used only for terrorist offences and for serious crime with an objective link, even an indirect one, to air travel. Advance assessments may compare data only with databases on persons or objects sought or under alert. PIUs may not use self-learning machine learning systems that can change the assessment criteria without human review ². The Court pointed to a fairly substantial number of false positives in 2018 and 2019, and said member states must set clear rules for the human review of every match ². Later access to data after a passenger has travelled needs prior review by a court or an independent administrative authority, except in duly justified urgent cases ².

On 12 October 2023 Belgium's Constitutional Court applied the ruling. It upheld the database, pre-screening and retention rules subject to interpretation, and annulled other parts. These included access to the data by the public prosecutor and the intelligence and security services, and rules that let API and PNR data sit in one database. Belgium applies PNR rules to train and bus transport as well as air travel ⁶.

Reviews and what comes next

Article 19 required the Commission to review the Directive by 25 May 2020 ¹. Its report of 24 July 2020 found that 24 of 26 member states had notified full transposition. Slovenia had notified partial transposition, and Spain, which had notified none, was referred to the Court of Justice on 2 July 2020 ³. The Commission called its assessment overall positive and proposed no amendments at that stage ³.

The review flagged a gap. Member states said many bookings made through tour operators and travel agencies are not covered. The Commission said any extension to such operators, or to sea, rail and road transport, would need a full impact assessment and a fundamental rights check ³.

As of 19 October 2026, the Commission says it is evaluating the Directive ⁴. Two API regulations adopted in December 2024, Regulation (EU) 2025/12 and Regulation (EU) 2025/13, will route API data and, in phases, PNR data through an EU-level router to PIUs ⁴.