Who keeps your passport and biometric data at the airport

Your data passes through several hands

A single trip can put your passport data in four or more places. The airline holds your booking in its reservation system ². At check-in it reads your passport and builds an advance passenger information (API) record. In the EU, carriers must read the machine-readable zone by automated means ¹. The airline sends API and booking data (PNR) to the destination government ^1,14.

The airport may run its own systems, such as face scans at security, bag drop or boarding gates. The European Data Protection Board (EDPB) looked at these uses in Opinion 11/2024, adopted on 23 May 2024 ³. Border agencies capture data at passport control. The US, for example, photographs travellers at entry ⁴, and the EU Entry/Exit System records fingerprints and face images of non-EU visitors ⁶.

Contractors often run the technology. Under the EU General Data Protection Regulation (GDPR), a contractor acting for an airline or airport is a processor. It may handle the data only on documented instructions from the controller and under a binding contract ¹⁰.

What the airline keeps

IATA says airlines collect PNR for their own business. The record holds data given at booking and stays in the reservation system until check-in ². IATA notes that PNR accuracy is not guaranteed and that it can contain sensitive data ².

API is narrower. Under EU Regulation 2025/12 it covers name, date of birth, sex, nationality, document type, number, issuing country and expiry, plus the booking locator, seat and baggage details where available ¹. Biometric data is excluded ¹. Carriers must store API for 48 hours after the router receives it, then delete it. They may keep data longer for normal business use where other law allows ¹.

What the airport keeps when you use your face

Some airports and airlines let you pass security, bag drop, lounges or boarding by face scan. The EDPB tested four storage models ³.

In the first, the face template stays only on your own device. In the second, the airport holds it in encrypted form and only you hold the key. The EDPB said both could in principle comply with GDPR, with safeguards ³. In the third, the airport holds templates in a central database it controls. In the fourth, an airline or cloud provider holds them, possibly for as long as you keep an account. The EDPB said these two models, as described, cannot comply with GDPR data protection by design ³.

The opinion has limits. It does not cover border control or law enforcement use. It does not rule on the legal basis or the validity of consent ³. It urges the shortest possible retention period ³.

What border agencies keep, and for how long

Border agencies keep the longest records. In the EU, border authorities must delete API data 48 hours after receipt. They may keep data on passengers who did not reach a border crossing point for up to 48 more hours ¹. PNR is kept by Passenger Information Units for five years under the EU PNR Directive, masked after six months ¹⁴. The EU Court of Justice ruled in 2022 that keeping all passengers' PNR beyond six months goes too far without objective evidence of a link to terrorism or serious crime ¹⁵.

The EU Entry/Exit System, run by eu-LISA, records name, travel document data, fingerprints, face images and the date and place of each entry and exit for non-EU visitors ⁶. It began a gradual launch on 12 October 2025 and replaced passport stamping on 10 April 2026 ⁶. Its founding regulation sets three years for most records and refusals of entry. It sets five years for people who overstayed ⁷.

In the US, CBP keeps photos of US citizens for no more than 12 hours after identity checks. US citizens can opt out and ask for a manual document check ⁴. Non-citizens are enrolled in the DHS biometric database IDENT ⁴. Under a rule finalised in October 2025 and effective from 26 December 2025, CBP may photograph non-citizens at all entry and exit points. IBTimes reported that the photos can be kept for up to 75 years ⁵. The EU-US PNR agreement lets DHS keep PNR for up to five years in an active database and up to ten more in a dormant one ¹⁶.

How to ask for your data in the EU

The GDPR gives you a right of access. You can get a copy of your data, the purposes of processing, the recipients, the planned retention period, the source of the data and whether automated decisions are made about you ⁹. The controller must reply within one month. It can extend by two months for complex or numerous requests, but must tell you why within the first month ⁸. Access is free in most cases. A fee or refusal is possible only for requests that are manifestly unfounded or excessive ⁸.

Send separate requests to the airline, the airport and any border or police body. Each one decides its own answer. Look for the data protection officer in each privacy notice. If you get no reply, you can complain to a data protection authority ⁹.

Police and border data follow other rules. GDPR does not cover processing for criminal law enforcement, which falls under Directive (EU) 2016/680. National law can restrict access rights to protect public security or prevent crime ¹⁷. Requests about PNR or Entry/Exit records go to national authorities. They can be partly refused.

• Name the trip, dates, flight numbers and booking reference.
• Ask for API, PNR, boarding records and any face images or templates.
• Ask who received the data and how long it will be kept ⁹.
• Keep a record of when you sent the request.

Non-EU examples: the UK and the US

The UK keeps a GDPR-style right of access, called a subject access request. The Information Commissioner's Office (ICO) says organisations normally have one month to reply, with up to two more months for complex requests ^11,12. They normally cannot charge. Intelligence services may charge £10 ¹². The extension does not apply to information held for law enforcement ¹². Requests can go online, by email, by post, by phone or in person ¹¹.

In the US, the main route is the Freedom of Information Act. CBP accepts requests through its FOIA SecureRelease portal or by post, and points users to the DHS portal ¹³. If you think a watch list or screening problem caused delays or denied boarding, the separate DHS Traveler Redress Inquiry Program (DHS TRIP) handles that ¹⁸.