The EU PNR Directive (Directive (EU) 2016/681)

What the Directive requires

The Directive covers the transfer by air carriers of PNR data on extra-EU flights ¹. A Member State may apply it to intra-EU flights by notifying the Commission in writing ¹.

Each Member State must establish or designate a Passenger Information Unit (PIU) to collect, store and process the data ¹. Air carriers send PNR data 24 to 48 hours before scheduled departure and again immediately after flight closure, once passengers have boarded ¹. Each Member State publishes a list of competent authorities that may request or receive data from its PIU ¹.

Which data fields are covered

Annex I lists 19 elements. They are the booking reference, reservation and ticket dates, travel dates, names, contact details, payment and billing information, full itinerary, loyalty programme details, travel agency, booking and check-in status, split booking details, general remarks, ticketing details, seat information, codeshare details, baggage details, co-traveller names and numbers, any advance passenger information collected, and the history of changes to these items ¹.

Article 13 prohibits processing of PNR data revealing a person's race or ethnic origin, among other listed categories. Such data must be deleted immediately if received ¹. The Court of Justice ruled that Annex I must cover only clearly identifiable and circumscribed information within its headings ².

Retention and masking

Article 12 says PNR data are kept at the PIU for five years after transfer. After six months, the data must be depersonalised by masking names, address and contact details, payment and frequent flyer information, general remarks that could identify the passenger, and any API data ¹.

The Commission's review report of 24 July 2020 described retention of all passengers' data for five years as necessary ⁴. The Court of Justice ruled on 21 June 2022 that the Directive, read with the Charter, precludes a general five-year retention period applied to all air passengers. It said keeping all passengers' data for the first six months does not, in principle, go beyond what is necessary ².

What the Court of Justice ruled

The Ligue des droits humains challenged the Belgian law of 25 December 2016 that transposed the Directive. Belgium's Constitutional Court referred ten questions in October 2019 ². The Court said the Directive entails "undeniably serious interferences" with Articles 7 and 8 of the Charter of Fundamental Rights ².

• Intra-EU flights: all intra-EU flights may be covered only where there is a genuine and present or foreseeable terrorist threat, for a limited period that can be reviewed. Otherwise coverage must be limited to selected routes, travel patterns or airports ².
• Purpose: national laws may not use the data for purposes beyond the Directive, such as improving border controls and combating illegal immigration ².
• Automated analysis: PIUs must use pre-determined criteria and may not use self-learning artificial intelligence ².
• Later access: disclosure after arrival or departure needs prior review by a court or an independent administrative authority, except in duly justified urgency ².

Reviews, related law and country examples

The Commission's 2020 review found that 24 of 26 Member States had notified full transposition. All Member States except one had extended collection to intra-EU flights ⁴. The Commission says it is now evaluating the Directive, on a page dated 4 August 2026 ³.

Regulation (EU) 2025/13 of 19 December 2024 adds API data sent through a central router to PIUs. For intra-EU flights, it applies only where a Member State has notified that it applies the PNR Directive to such flights ⁵.

• Belgium: its law of 25 December 2016 led to the 2022 Court of Justice ruling ².
• Spain: it had notified no transposition measures and was referred to the Court of Justice on 2 July 2020 ⁴.
• Slovenia: it had notified partial transposition by the time of the 2020 review ⁴.
• Canada: an EU and Canada PNR agreement was signed on 4 October 2024 and the Council adopted a decision to conclude it on 14 April 2025 ³.