Skip to content
REPORT (COM(2022)0731 – C90427/2022 – 2022/0425(COD))

On the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending Regulation (EU) 2019/818

A-9-2023-0411

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Assita Kanko

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 4 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the proposed regulation on collecting and transferring advance passenger information (API) for law enforcement sets rules for air carriers, a central router, and Passenger Information Units (PIUs). It requires API data collection on extra-EU and selected intra-EU flights, with automated means where possible, and mandates transfer via the router, which filters and transmits data to PIUs. It sets data categories, limits collection to alphanumeric data from travel documents, and prohibits biometric data collection and profiling. It establishes deletion rules, security measures, audits, and penalties for non-compliance, and requires the Commission to evaluate the regulation's impact.

Committee position. The Committee on Civil Liberties, Justice and Home Affairs proposes amendments to the Commission proposal, including mandatory use of the router for PNR data, stricter data protection, and penalties for non-compliance.

Key points

  1. Air carriers must collect API data on extra-EU and selected intra-EU flights, using automated means to read machine-readable travel documents, with manual collection as fallback.
  2. API data is limited to specified passenger data (name, date of birth, travel document details) and flight information (flight number, border crossing point, times).
  3. Collection must not involve checking travel documents at boarding or require passengers to carry them, and must not collect biometric data.
  4. Air carriers must transfer API data to the router at check-in and after flight closure, using encrypted transfers and receiving acknowledgements.
  5. The router transmits API data to PIUs of relevant member states; for intra-EU flights, only for those selected by member states based on a threat assessment.
  6. API data must be deleted from the router immediately after transmission, or after 12 hours if transmission fails, and for non-selected intra-EU flights.
  7. PIUs are sole competent authorities to receive and process API data; they cannot use it for profiling.
  8. eu-LISA designs, develops, and manages the router, ensures security and encryption, and provides training and support.
  9. Passengers must be informed about data collection at booking and check-in, and offline check-in alternatives must be available.
  10. Member states must set penalties for infringements, with financial penalties up to 2% of global turnover for systematic or persistent failures.
  11. The Commission must evaluate the regulation every four years, assessing impact on travel experience and aviation sector competitiveness.

Who is affected

  • Air carriers operating flights covered by the regulation must collect and transfer API data, with obligations for data security and deletion.
  • Passenger Information Units (PIUs) in member states receive and process API data for law enforcement, with restrictions on use.
  • Passengers on extra-EU and selected intra-EU flights have their API data collected and transferred, with rights to information and offline check-in.
  • eu-LISA is responsible for developing and managing the router, ensuring security, and providing support.

Figures and deadlines

  • Financial penalties up to 2% of an air carrier's global turnover of the preceding business year for systematic or persistent failures.
  • API data stored on router for maximum 12 hours if transmission fails, then deleted.
  • Logs kept for one year from creation, then deleted.
  • Audits of PIUs at least once every four years; audits of eu-LISA at least once every year.
  • Regulation applies from two years after router starts operations.

Legal basis: Articles 82(1)(d) and 87(2)(a) of the Treaty on the Functioning of the European Union