Rwanda passenger data record

The API and PNR law

Law No 006/2024 of 19/01/2024 governing Advance Passenger Information and Passenger Name Record data was published in the Official Gazette special issue of 8 March 2024 ¹. Article 27 says it comes into force on publication ¹. Article 4 makes the Directorate General responsible for processing the data, alone or with another State organ ¹.

Article 1 frames the law around preventing, detecting, investigating and prosecuting terrorism and serious crime ¹. Article 6 requires carriers to push API data before departure from the last port of call and to push PNR data ¹. The operating carrier sends the data on code-shared trips ¹. Article 22 bars processing of data that reveals ethnicity, religion, political opinions, union membership, health or disability, and says such data must be deleted at once ¹.

The law defines a supervisory authority as the organ that oversees compliance with personal data protection ¹. It refers to relevant data protection legislation without naming Law No 058/2021 ¹.

Data fields, timing and fines

Ministerial Order No 001/01 of 10/05/2024 was published in Official Gazette No 20 ter of 13 May 2024 ². It lists travel document, visa and holder details for API, plus seat, baggage and routing data ². It lists 19 PNR elements, including payment information, itinerary, frequent flyer data, travel agency, remarks and the history of changes ².

API goes at check-in closure and at boarding closure ². PNR goes 72 hours, 24 hours and 90 minutes before departure and right after boarding closure ². DGIE may request data on a specific passenger or trip at any time if it identifies a specific threat ². Carriers may appeal a sanction to the Director General within five days ².

How airlines connect

The DGIE implementation guide names the National Passenger Information Unit as the receiving unit ³. API and interactive API use the UN/EDIFACT PAXLST format and responses use CUSRES, with status 0 for OK to board and 1 for do not board ³. The guide names Collins Aerospace/ARINC as the network operator ³. It does not state contract terms, hosting or which party holds the data ³.

The carrier guidance says a carrier may issue a boarding pass if no response arrives within 7 seconds, and must offload a passenger if a do-not-board notice follows before gate close ⁴. Airlines get monthly performance feedback by email ³. Airlines must tell passengers the purpose, the data collected, the recipient and their right to see and correct it ³.

Both pages still cite Article 60 of Ministerial Order No 06/01 of 29/05/2019 for sanctions ^3,4. The implementation guide says it sets a fine of FRW 2,000,000 for an air carrier that does not comply ³. The 2024 Order sets higher amounts ². The DGIE laws page lists both orders ⁵.

Retention and sharing

Article 15 keeps carrier data in readable form for five years from receipt, then in depersonalised form for five more years ¹. Article 16 requires destruction at the end of that period ¹. Article 13 says depersonalisation masks names, contact details, payment information, frequent flyer data and other direct identifiers ¹.

Article 10 allows assessment results to be shared with another country ¹. Article 11 says onward sharing with a third country needs the sending country's prior consent, with exceptions for urgent threats ¹.

Data protection authority

The Data Protection Office says Law No 058/2021 names NCSA as the supervisory authority and that NCSA launched the office on 31 March 2022 ⁶. The office offers an authorisation to store personal data outside Rwanda, with an application form ⁷. We found no published NCSA decision on immigration or passenger data.

Chronology