Skip to content
REPORT (COM(2022)0729 – C90428/2022 – 2022/0424(COD))

On the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls, amending Regulation (EU) 2019/817 and Regulation (EU) 2018/1726, and repealing Council Directive 2004/82/EC

A-9-2023-0409

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: JanChristoph Oetjen

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 4 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the proposed regulation on collecting and transferring advance passenger information (API) for external border checks. It sets rules for air carriers, a central router, data protection, and penalties. The text requires air carriers to collect API data using automated means where possible, transfer it encrypted to a router managed by eu-LISA, and store it for 24 hours. It also sets rules for data protection, audits, and penalties.

Committee position. The Committee on Civil Liberties, Justice and Home Affairs proposes amendments to the Commission proposal, including encryption, shorter data retention, and safeguards against profiling.

Key points

  1. Air carriers must collect API data for all commercial flights into the Union, using automated means to read travel documents where possible, and manually otherwise.
  2. API data must be transferred to the router at check-in and after flight closure, encrypted, and in accordance with common protocols.
  3. The router, managed by eu-LISA, serves only to transmit data; it must not store data except temporarily for transmission, and must delete it immediately after.
  4. Competent border authorities and air carriers must store API data for 24 hours from departure, then delete it permanently, unless needed for business.
  5. Processing of API data for profiling is prohibited, and data must not be used for discrimination; fundamental rights are protected.
  6. Passengers must be informed about data collection at booking and check-in, and an offline check-in alternative must be available.
  7. Penalties for non-compliance are set by member states, with a maximum of 2% of global turnover for systematic failures.
  8. Statistics on router use must be published quarterly, without identifying individuals, and use for risk analysis or profiling is banned.
  9. The Commission must evaluate the regulation's impact on travel experience and aviation competitiveness every four years.

Who is affected

  • Air carriers operating commercial flights into the EU must collect and transfer API data, with exemptions for general aviation.
  • Passengers on those flights will have their data collected and transferred; they must be informed and can check in offline.
  • Competent border authorities of member states receive API data through the router and must store it for 24 hours.
  • eu-LISA manages the router and provides training and support.

Figures and deadlines

  • 24 hours: storage period for API data by air carriers and border authorities.
  • 2% of global turnover: maximum financial penalty for systematic non-compliance.
  • 12 hours: deletion of data if router cannot transmit.

Legal basis: Articles 77(2)(b) and (d) and 79(2)(c) of the Treaty on the Functioning of the European Union