Who oversees passenger data

Last checked: 21 October 2026 · Rules and oversight

Passenger data oversight is the set of checks on how governments collect, use and keep API and PNR data. In the EU, each Passenger Information Unit has a data protection officer and a national supervisory authority that handles complaints and audits ¹. The EU Court of Justice requires a court or independent body to review access to PNR data after six months ². In Kenya and Ghana, national data protection regulators apply ^3,4 ^6,7.

Data fields overseen: API identity and flight data and PNR booking data ^1,5
Main overseers: Data protection authorities, data protection officers, courts ^1,2
EU legal basis: Directive (EU) 2016/681, Articles 5 and 15 ¹
Key court ruling: Case C-817/19 Ligue des droits humains, 21 June 2022 ²
Date checked: 21 October 2026 ^4,6 ⁹

What oversight means for passenger data

Airlines send API and PNR data to a government unit, which compares it against watch lists and risk criteria ^1,5. Oversight is the work of checking that this processing follows the law. It covers complaints from travellers, inspections, audits and prior approval before officials see full records ^1,2.

UN Security Council Resolution 2396 (2017) requires states to collect API and build the capability to process PNR data, with full respect for human rights and fundamental freedoms ⁸. The UN Countering Terrorist Travel Programme says it was designed in line with human rights principles and UN policies ⁹.

The EU model

Directive (EU) 2016/681 of 27 April 2016 sets three layers of oversight ¹. Each Passenger Information Unit must appoint a data protection officer to monitor PNR processing and apply safeguards ¹. After six months, disclosure of full PNR data needs approval from a judicial authority or another competent national authority ¹. Under Article 15, the national supervisory authority advises on and monitors the Directive's application, deals with complaints, verifies lawfulness and carries out inspections and audits ¹.

On 21 June 2022 the EU Court of Justice ruled in case C-817/19 that disclosure after the first six months must be subject to prior review by a court or an independent administrative authority, except in duly justified urgency ². The Court said the PIU may not use self-learning artificial intelligence systems, and it ruled out a general five-year retention period for all passengers ².

Layer	Role	Source
Data protection officer	Monitors PNR processing inside the PIU ¹	Directive Article 5 ¹
Judicial or competent authority	Approves full disclosure after six months ¹	Directive Article 12 ¹
National supervisory authority	Complaints, investigations, inspections, audits ¹	Directive Article 15 ¹
Court or independent body	Prior review of access after six months ²	Case C-817/19 ²

Kenya

Kenya's 2024 immigration regulations let immigration officers process API and PNR data under the Data Protection Act, 2019, and give control agencies access subject to the same Act ⁵. The Act commenced on 25 November 2019 ³. The Office of the Data Protection Commissioner takes its mandate from that Act ⁴.

The regulations place the depersonalisation and re-identification decisions with the Director of Immigration Services ⁵. Data must be masked six months after receipt and may be kept up to five years for a specified offence case ⁵.

Ghana

Ghana's Data Protection Commission is an independent statutory body under the Data Protection Act, 2012 (Act 843) ⁶. Data controllers and processors must register with it ⁶. A Ghana Civil Aviation Authority presentation from June 2024 states that the Commission provides independent oversight of the API/PNR system, including complaints, investigations and resolution of related issues ⁷.

How a traveller can use oversight

In the EU, contact the PIU's data protection officer or lodge a complaint with the national supervisory authority ¹
In Kenya, the Office of the Data Protection Commissioner is the regulator under the Data Protection Act, 2019 ^3,4
In Ghana, contact the Data Protection Commission ⁶

Common questions

Who checks how the EU uses PNR data?

A data protection officer in each PIU and a national supervisory authority, with prior review of later access by a court or independent body ^1,2.

What did the EU Court of Justice decide on PNR?

On 21 June 2022 in case C-817/19 it limited retention, required prior review of access after six months and barred self-learning systems ².

Does Kenya's data protection law apply to passenger data?

Yes. The immigration regulations make processing and sharing subject to the Data Protection Act, 2019 ⁵.

Who oversees Ghana's API/PNR system?

The GCAA says the Data Protection Commission provides independent oversight ⁷.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.

Sources

Passenger data retention
How long governments keep PNR, API and biometric records about air travellers, what must be masked or deleted, and what the EU Court of Justice ruled.
Access logging and audit trails
What access logs for passenger data must record, how long logs are kept, who may read them, and what an audit found when controls failed.
The EU PNR Directive (Directive (EU) 2016/681)
What the EU PNR Directive requires of airlines and Member States, the 19 data elements it covers, retention rules, and what the EU Court of Justice ruled.
Passenger Information Units
What a Passenger Information Unit does with API and PNR data, the EU rules that govern it, the limits set by the EU Court of Justice, and examples.
Kenya passenger data record
What passenger data Kenya collects from airlines and travellers, which agency receives it, how long it is kept, and the US$4.95 API/PNR fee.
How to request your passenger data
Official routes to ask for your API, PNR and border records in the EU, UK, US, Canada and Kenya, and what an authority may withhold.