Passenger data breaches

Last checked: 21 October 2026 · How passenger data works

A passenger data breach is unauthorised access to, copying, loss or disclosure of traveller records such as PNR or biometric data ^1,3. EU law requires a Passenger Information Unit to tell travellers and the national supervisory authority without undue delay when a breach is likely to cause high risk ¹. EU law enforcement controllers must notify the authority within 72 hours where feasible ². In 2019 traveller images from a US border biometric pilot were stolen from a subcontractor's network ³.

EU PNR breach rule: Article 13(8), Directive (EU) 2016/681 ¹
EU authority deadline: Without undue delay, and where feasible within 72 hours ²
Philippine rule: Section 20(f), Data Privacy Act of 2012 ⁴
Case example: CBP biometric pilot, Anzalduas, Texas, 2019 ³

Who must be told

Under Article 30(1) of Directive (EU) 2016/680, no notification is needed if the breach is unlikely to put rights and freedoms at risk ². A late notification must give reasons for the delay ².

The Philippine duty applies to sensitive personal information or information that could enable identity fraud ⁴. The National Privacy Commission may exempt a controller from notification or allow it to be postponed in some cases ⁴.

Kenya's Data Protection Act 2019 has a section 43 headed Notification and communication of breach ⁵. Its deadline is not stated here. The full text could not be opened for this page.

Law	Who is notified	Trigger and timing
EU PNR Directive, Article 13(8) ¹	Data subject and national supervisory authority ¹	Breach likely to cause high risk, without undue delay ¹
Directive (EU) 2016/680, Article 30(1) ²	Supervisory authority ²	Without undue delay and where feasible within 72 hours ²
Directive (EU) 2016/680, Article 31(1) ²	Data subject ²	Breach likely to cause high risk, without undue delay ²
Philippine Data Privacy Act, Section 20(f) ⁴	National Privacy Commission and affected data subjects ⁴	Real risk of serious harm, promptly ⁴

Case: the 2019 CBP biometric pilot

US Customs and Border Protection ran a Vehicle Face System pilot at the Anzalduas, Texas port of entry ³. The DHS Office of Inspector General (OIG) published its review, OIG-20-71, on 21 September 2020 ³.

The OIG found that subcontractor Perceptics, LLC transferred copies of CBP biometric data to its own company network using an unencrypted USB hard drive ³. Downloads took place on 31 August 2018, 2 November 2018 and 31 January 2019 ³. The network was hit by a ransomware attack at some point before 13 May 2019 ³.

CBP first learned of the breach on 24 May 2019 and DHS declared a major cybersecurity incident on 3 June 2019 ³. CBP first estimated about 184,000 traveller images, then reduced it to 100,000 individual images after removing duplicates ³. At least 19 images were posted to the dark web ³. About 105,000 licence plate images from earlier pilot work were stored on the subcontractor network ³.

Official finding and response

The OIG concluded that CBP did not adequately safeguard sensitive data on an unencrypted device used during the pilot ³. It said CBP's information security practices were inadequate to prevent the subcontractor's actions ³.

CBP concurred with all three recommendations and asked for them to be closed as implemented ³. The OIG kept them open and resolved pending further documentation ³. The prime contractor was Unisys Corporation ³. The report does not include a company statement from Perceptics ³.

What a breach can expose

PNR records can hold names, contact details, payment information and frequent flyer data, the fields the EU masks after six months ¹.
Biometric pilots can hold face images and licence plate images, as in the CBP case ³.
The Philippine rule targets data that could enable identity fraud ⁴.

Common questions

How fast must an EU authority report a passenger data breach?

Without undue delay and, where feasible, within 72 hours of becoming aware of it under Directive (EU) 2016/680 ².

Will I be told if my PNR data is breached in the EU?

The PNR Directive requires the PIU to tell data subjects when a breach is likely to cause high risk ¹.

Were traveller face images ever stolen from a border system?

Yes. The DHS OIG reported that images from a 2019 CBP pilot were stolen from a subcontractor network and at least 19 were posted to the dark web ³.

Who do I contact in the Philippines about a breach?

Controllers must notify the National Privacy Commission and affected data subjects ⁴.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.

Sources

Access logging and audit trails
What access logs for passenger data must record, how long logs are kept, who may read them, and what an audit found when controls failed.
Biometric data at borders
Which fingerprints and facial images border agencies collect from travellers, the legal basis, who holds the records and how long they are kept.
Where passenger data is hosted
Where governments store API, PNR and biometric passenger records, what laws say about servers and location, and how donated and vendor systems fit in.
Who oversees passenger data
The bodies that check how governments use API and PNR data: data protection authorities, data protection officers, courts and UN standards.
How to request your passenger data
Official routes to ask for your API, PNR and border records in the EU, UK, US, Canada and Kenya, and what an authority may withhold.