US passenger data rules: APIS, Secure Flight and ATS
- APIS rule
- 19 CFR 122.49a, manifests sent to CBP's APIS 1
- APIS deadline
- No later than 30 minutes before the aircraft is secured (batch), or by securing (interactive) 1
- Secure Flight rule
- 49 CFR Part 1560, run by TSA 2
- APIS retention
- No more than 12 months in APIS, per the 13 March 2015 notice 3
- PNR in ATS
- 5 years active, then up to 10 years dormant 4
- Secure Flight retention
- 7 days (no match), 7 years (potential match), 99 years (confirmed match) 5
APIS: manifests sent to CBP
Under 19 CFR 122.49a, carriers on flights to the United States must send an electronic passenger manifest to the Advance Passenger Information System (APIS) or another system CBP approves 1.
Batch transmissions are due no later than 30 minutes before the aircraft is secured. Interactive transmissions for individual passengers are due no later than the securing of the aircraft 1.
- Identity: full name, date of birth, gender, citizenship and country of residence 1
- Travel document: type, passport number, issuing country and expiry date, and alien registration number where it applies 1
- Trip: US address, PNR locator if available, airline code, flight number, ports and date of arrival 1
Secure Flight: data sent to TSA
49 CFR Part 1560 lets TSA run Secure Flight, which compares passenger and non-traveller information against federal watch lists 2. Secure Flight Passenger Data covers full name, date of birth, sex, Redress Number or Known Traveler Number, passport information and itinerary details 2.
Operators must collect name, sex and date of birth no later than 72 hours before scheduled departure, or at booking for later reservations. They must transmit the data before the flight's scheduled departure 2. Covered flights include certain foreign carrier flights into, out of or over the continental United States 2.
ATS: risk assessment and PNR
CBP's Automated Targeting System compares traveller data against rules and other records. Its system of records notice, DHS/CBP-006, was published on 22 May 2012 4. DHS lists a later publication of that notice on 6 May 2021, and a privacy impact assessment from January 2017 with an addendum in May 2020 6.
GAO described the passenger component as the Automated Targeting System-Passenger (ATS-P) in a May 2007 report 8. In that report GAO found that CBP's public notices did not fully explain how passenger data is combined and used, and recommended that DHS complete the needed notices and assessments 8. DHS and CBP said their disclosures met the law. GAO disagreed 8.
Retention periods
Access to dormant PNR needs approval from a senior DHS official. Records tied to an active law enforcement matter stay available for the life of that matter 4.
| System | Retention | Source |
|---|---|---|
| APIS | No more than 12 months from collection. Copies held in other systems follow those systems' rules 3 | DHS/CBP-005, 13 March 2015 3 |
| ATS official records | No more than 15 years 4 | DHS/CBP-006, 22 May 2012 4 |
| PNR in ATS | Up to 5 years active, depersonalized after 6 months, then up to 10 years dormant 4 | DHS/CBP-006, 22 May 2012 4 |
| Secure Flight, no match | Destroyed within 7 days after travel 5 | DHS/TSA-019, 19 November 2012 5 |
| Secure Flight, potential match | 7 years after travel 5 | DHS/TSA-019, 19 November 2012 5 |
| Secure Flight, confirmed match | 99 years 5 | DHS/TSA-019, 19 November 2012 5 |
Oversight and audit findings
On 9 September 2014, GAO reported that screening staff made errors carrying out Secure Flight determinations between May 2012 and February 2014, and that TSA had no measure for system matching errors 7. DHS concurred with all three recommendations. GAO lists them as closed and implemented 7.
In June 2006 the DHS Office of Inspector General (OIG-06-43) reviewed how CBP intercepts suspected terrorists at ports of entry. It found that most name-match referrals were repeat screenings of people already cleared, and made five recommendations 9.
Common questions
Who receives APIS data in the United States?
U.S. Customs and Border Protection receives manifests through APIS or another system it approves 1.
How long does TSA keep Secure Flight data?
Records with no watch list match are destroyed within 7 days after travel. Potential matches are kept 7 years and confirmed matches 99 years 5.
How long does CBP keep passenger name records?
Up to 5 years in an active database and up to 10 more years in a dormant database, per the May 2012 ATS notice 4.
Has an auditor reviewed Secure Flight?
Yes. GAO-14-531 of 9 September 2014 made three recommendations, which DHS accepted 7.
Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.
Sources
- eCFR: 19 CFR 122.49a, electronic manifest requirement for passengers onboard commercial aircraft arriving in the United States (current)
- eCFR: 49 CFR Part 1560, Secure Flight Program (current)
- Federal Register: DHS/CBP-005 Advance Passenger Information System, system of records notice (13 March 2015)
- Federal Register: DHS/CBP-006 Automated Targeting System, system of records notice (22 May 2012)
- Federal Register: DHS/TSA-019 Secure Flight Records, system of records notice (19 November 2012)
- DHS: Automated Targeting System privacy impact assessment and SORN page
- GAO: GAO-14-531 Secure Flight, TSA Should Take Additional Steps to Determine Program Effectiveness (9 September 2014)
- GAO: GAO-07-346 Aviation Security, international passenger prescreening (16 May 2007)
- DHS OIG: OIG-06-43 Review of CBP Actions Taken to Intercept Suspected Terrorists at U.S. Ports of Entry (June 2006)
Related
- Advance Passenger Information (API) explained
What API data is, which fields airlines send, who receives it, the legal basis, how long it is kept, and examples from four jurisdictions.
- Passenger Name Record (PNR) data explained
What PNR data is, the 19 EU data elements, who sends and receives it, the legal basis, retention rules and the 2022 EU Court of Justice ruling.
- Watch-list matching of passenger data
How API and PNR data are compared with INTERPOL, national and UN lists, what happens after a hit, how false matches are handled and how to seek redress.
- Passenger data retention
How long governments keep PNR, API and biometric records about air travellers, what must be masked or deleted, and what the EU Court of Justice ruled.
- Who oversees passenger data
The bodies that check how governments use API and PNR data: data protection authorities, data protection officers, courts and UN standards.
- Risk assessment and traveller targeting
How border agencies check API and PNR data against watch lists and risk rules, what EU law and the Court of Justice allow, and how hits are reviewed.