Passenger Data Explained
Menu

Risk assessment and traveller targeting

Last checked: 21 October 2026 · How passenger data works

Risk assessment is the automated check of passenger data before a flight arrives or leaves, to pick out people for closer examination. In the EU a Passenger Information Unit compares PNR data with databases and with pre-determined criteria 1. In the United States the Automated Targeting System applies rules built from patterns that CBP analysts identify 3. The EU Court of Justice ruled on 21 June 2022 that criteria must be non-discriminatory and that self-learning systems may not be used 2.
What is checked
API and PNR data, against databases and pre-determined criteria 1
EU legal basis
Directive (EU) 2016/681, Article 6 1
US system
Automated Targeting System, DHS/CBP-006 3
Machine learning in EU PIUs
Not allowed for the advance assessment, per C-817/19 2
Human review of hits
Required in the EU before data go to competent authorities 1
Germany, 2024 hits
207,409 database hits and 6,831 pattern hits 5
Date checked
21 October 2026 1,3 5

Two kinds of check

The EU PNR Directive lets a Passenger Information Unit (PIU) assess passengers before arrival or departure to find people who need further examination by the competent authorities 1. The PIU may compare PNR data against databases on persons or objects sought or under alert. It may process PNR data against pre-determined criteria 1.

The first check is a match against a list. The second is a rules-based check. A rule describes a pattern of travel or booking behaviour that analysts consider worth a closer look. In the US, the ATS system of records notice says rules compare traveller and cargo information with patterns based on officer experience, trends of suspicious activity and intelligence 3.

How the US Automated Targeting System works

ATS is a CBP system for risk assessments on international travellers. It compares traveller data against law enforcement and intelligence databases and applies rules developed by analysts 3. It holds copies of APIS and ESTA data and is the official record for PNR 3,4.

The DHS privacy impact assessment update of 13 January 2017 says travellers identified by risk-based targeting scenarios are not assigned scores. Scores are used for cargo and conveyances 4. Matches on travellers are reviewed by CBP officers 4.

Retention of official ATS records may not exceed 15 years. PNR sits in an active database for up to five years and is depersonalised after the first six months. It then moves to a dormant database for up to ten years 3. The assessment says data may be stale or inaccurate and that this risk cannot be fully mitigated 4. It points travellers to DHS TRIP to seek correction 4.

DHS lists a privacy impact assessment of January 2017 with a May 2020 addendum, and says the ATS system of records notice was last published on 6 May 2021 7. The retention periods above come from the 22 May 2012 notice 3.

Limits set by EU law and the Court of Justice

Article 6(4) of the Directive says pre-determined criteria must be targeted, proportionate and specific, applied in a non-discriminatory manner, and set and regularly reviewed by the PIU. They may never be based on race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation 1. Article 7(6) bars decisions with an adverse legal effect taken only by reason of automated processing 1.

On 21 June 2022, in Case C-817/19 Ligue des droits humains, the Court of Justice added further limits 2:

  • Criteria must target individuals who might reasonably be suspected of involvement in terrorist offences or serious crime, and take account of incriminating and exonerating evidence 2.
  • The PIU may not use artificial intelligence in self-learning systems for the advance assessment 2.
  • Databases used for matching are limited to databases on persons or objects sought or under alert 2.
  • Member States must lay down clear and precise rules to guide PIU agents who review hits 2.

False positives and human review

The Directive requires that any positive match from automated processing is individually reviewed by non-automated means 1. The Court of Justice said the margin of error inherent in automated processing makes the quality of this second-stage review central 2. In Opinion 1/15 of 26 July 2017, it said models and criteria used in automated analysis must be specific, reliable and non-discriminatory 8.

Germany publishes figures. In an answer to the Bundestag dated 22 October 2025, the federal government said its PIU processed 547,988,627 PNR records on 153,701,804 passengers in 2024 5. Matching against databases produced 207,409 technical hits and matching against patterns produced 6,831. After review, 89,982 cases were passed to the competent authorities 5. The answer does not explain the gap between hits and cases passed on 5.

The European Commission's review report of 24 July 2020 said only a very small fraction of passengers' data are transferred for further examination. It said Member State statistics are not fully standardised and not suited to hard quantitative analysis 6.

Who oversees the rules

Each EU PIU must appoint a data protection officer with access to all data the PIU processes. The officer may refer unlawful processing to the national supervisory authority 1. The Commission report said data protection officers help approve and review pre-determined criteria 6.

In Germany, 83 patterns were active on 13 October 2025: 53 from the Federal Police, 27 from Customs and 3 from the Federal Criminal Police Office 5. Of 4,805 requests to search stored data in 2024, 4,247 were found admissible and approved by a judge 5. The Court of Justice said later access of this kind needs prior review by a court or independent body, except in duly justified urgency 2.

In the US, the ATS notice says some records are exempt from parts of the Privacy Act. PNR is not exempt from access and amendment 3.

Common questions

Do border agencies give each traveller a risk score?

Not in all systems. DHS says ATS does not assign scores to travellers identified by targeting scenarios 4. EU law describes matching against databases and pre-determined criteria 1.

Can an algorithm alone stop me at the border in the EU?

No. EU law bars decisions with an adverse legal effect taken only by reason of automated processing of PNR data, and every match must be reviewed by a person 1.

Can EU passenger units use machine learning?

Not for the advance assessment. The Court of Justice ruled on 21 June 2022 that self-learning systems may not be used 2.

How long does the US keep PNR used for targeting?

Up to five years in an active database, depersonalised after six months, then up to ten years in a dormant database 3.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.

Sources

  1. EUR-Lex: Directive (EU) 2016/681 on the use of passenger name record data (27 April 2016)
  2. Court of Justice of the EU: press release 105/22, judgment in Case C-817/19 Ligue des droits humains (21 June 2022)
  3. Federal Register: DHS/CBP-006 Automated Targeting System, system of records notice (22 May 2012)
  4. DHS: Privacy Impact Assessment Update for the Automated Targeting System, DHS/CBP/PIA-006(e) (13 January 2017, with later addenda)
  5. Deutscher Bundestag: Drucksache 21/2365, federal government answer on passenger data storage (22 October 2025)
  6. EUR-Lex: Commission report COM(2020) 305 on the review of Directive (EU) 2016/681 (24 July 2020)
  7. DHS: Automated Targeting System privacy impact assessment and SORN page (checked 21 October 2026)
  8. Court of Justice of the EU: press release 84/17 on Opinion 1/15, EU-Canada PNR agreement (26 July 2017)

Related