Watch-list matching of passenger data

Last checked: 21 October 2026 · How passenger data works

Watch-list matching is the automated comparison of passenger data, such as API and PNR, against lists of sought persons, flagged documents and sanctioned names ⁴. UN Security Council resolution 2396 (2017) says states shall develop watch lists or databases of known and suspected terrorists ¹. Common sources are the INTERPOL Stolen and Lost Travel Documents database ², national lists such as the US No Fly and Selectee lists ⁶ and the UN Security Council Consolidated List ³. EU law requires a human to review every automated hit ⁴.

UN rule: Resolution 2396 (2017), paragraphs 13 and 16 ¹
INTERPOL SLTD size: About 138 million records ²
SLTD searches in 2023: 3.6 billion, with 232,423 hits ²
UN Consolidated List: 736 individuals and 274 entities, updated 15 October 2026 ³
EU human review: Every positive match reviewed by non-automated means ⁴
US redress: DHS TRIP, online at trip.dhs.gov ⁷

What passenger data is matched against

Paragraph 13 of resolution 2396 says member states shall develop watch lists or databases of known and suspected terrorists, including foreign terrorist fighters ¹. Paragraph 16 calls on states to make regular use of INTERPOL databases to screen travellers at air, land and sea ports of entry ¹.

The INTERPOL Stolen and Lost Travel Documents (SLTD) database holds records of travel and identity documents reported stolen, lost, revoked, invalid or stolen blank ². Only the issuing country can add a record. Officials reach it through I-24/7, INTERPOL's police communication system ². Through I-Checkit, trusted private partners such as airlines can submit travel documents for screening at booking, and hits are relayed to law enforcement ².

The UN Security Council Consolidated List covers all individuals and entities subject to Security Council measures ³. Entries carry names, aliases, dates and places of birth, nationality and passport and identity numbers where known ³.

How the check runs

European Union: the Passenger Information Unit may compare PNR data against relevant databases and against pre-determined criteria ⁴.
United States: under Secure Flight, airlines collect full name, sex, date of birth and any Redress Number and send them to TSA ⁶. TSA checks them against the No Fly and Selectee components of the Terrorist Screening Database ⁶. An airline may not issue a boarding pass until TSA returns a result ⁶.
Kenya: an immigration officer may compare API and PNR data against databases of persons or objects sought or on watch lists, for a specified offence ⁹. If a traveller needs further examination, the officer gives a control agency access to the data ⁹.
United Kingdom: carriers must seek authority to carry passengers through the Government's border system. Refusal grounds include a direct threat to security, an exclusion or deportation order and an invalid travel document ¹⁰.

False matches and human review

Article 6(5) of the EU PNR Directive says any positive match from automated processing must be individually reviewed by non-automated means ⁴. Article 7(6) bars decisions with adverse legal effects based solely on automated processing of PNR data ⁴. Criteria may not be based on race, ethnic origin, religion, political opinions, health or sexual orientation ⁴.

On 21 June 2022 the EU Court of Justice ruled in case C-817/19, Ligue des droits humains ⁵. It noted the fairly substantial number of false positives in 2018 and 2019 ⁵. It said the system's fitness depends on proper checking of positive results by PIU staff ⁵. The databases used must be non-discriminatory and limited to persons or objects sought or under alert ⁵. The Court ruled out self-learning artificial intelligence systems ⁵.

INTERPOL says a person who tries to travel with a document reported lost or stolen faces denied entry or boarding and seizure of the document ².

Redress for travellers

List or system	Where to apply	What the record says
US watch lists and border screening ⁷	DHS Traveler Redress Inquiry Program (DHS TRIP) ⁷	Covers people denied or delayed boarding or entry, or repeatedly sent to secondary screening. A Redress Control Number is issued ⁷
US Secure Flight ⁶	DHS TRIP forms under 49 CFR 1560.205 ⁶	TSA, with the Terrorist Screening Center, reviews the case, corrects errors and replies in writing ⁶
UN ISIL (Da'esh) and Al-Qaida Sanctions List ⁸	Office of the Ombudsperson ⁸	Reviews delisting requests and reports to the Sanctions Committee with a recommendation ⁸
UK Authority to Carry ¹⁰	Home Office contact number and email address, included in the refusal wording ¹⁰	The carrier must tell the person of the refusal using Home Office wording ¹⁰

Retention after a match

Under the EU PNR Directive, data is kept five years after transfer and names, contact details and payment data are masked after six months ⁴. The Court of Justice said keeping all passengers' data for six months is in principle within what is strictly necessary, but a general five-year period for all passengers is not ⁵. After six months, it said, retention must rest on objective evidence of risk, such as a verified positive match ⁵.

Common questions

Do airlines check my passport against INTERPOL?

INTERPOL says airlines that are trusted partners can submit travel documents for SLTD screening through I-Checkit when a customer books a ticket ².

What can I do if I keep being stopped at US airports?

DHS TRIP takes inquiries from people denied or delayed boarding or repeatedly referred to secondary screening. Apply at trip.dhs.gov ⁷.

Can a computer alone stop me from travelling in the EU?

No. The PNR Directive bars decisions with adverse legal effects based solely on automated processing, and every hit must be reviewed by a person ⁴.

How do I get off a UN sanctions list?

People on the ISIL (Da'esh) and Al-Qaida list can apply to the Office of the Ombudsperson, whose mandate runs to 17 June 2027 ⁸.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.

Sources

Passenger Name Record (PNR) data explained
What PNR data is, the 19 EU data elements, who sends and receives it, the legal basis, retention rules and the 2022 EU Court of Justice ruling.
Interactive API and board or no-board decisions
How interactive Advance Passenger Information lets border authorities answer board or no-board at check-in, with US, Canadian and UK examples.
The EU PNR Directive (Directive (EU) 2016/681)
What the EU PNR Directive requires of airlines and Member States, the 19 data elements it covers, retention rules, and what the EU Court of Justice ruled.
UN Security Council Resolution 2396 and ICAO Annex 9
What Resolution 2396 (2017) asks of states on API, PNR, watch lists and biometrics, and how ICAO Annex 9 sets the passenger data standards.
Kenya passenger data record
What passenger data Kenya collects from airlines and travellers, which agency receives it, how long it is kept, and the US$4.95 API/PNR fee.
Risk assessment and traveller targeting
How border agencies check API and PNR data against watch lists and risk rules, what EU law and the Court of Justice allow, and how hits are reviewed.