Skip to content
DRAFT REPORT (COM(2022)0729 – C90428/2022 – 2022/0424(COD))

On the proposal for a regulation of the European Parliament and of the Council on the collection and transfer of advance passenger information (API) for enhancing and facilitating external border controls, amending Regulation (EU) 2019/817 and Regulation (EU) 2018/1726, and repealing Council Directive 2004/82/EC

LIBE-PR-750252

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: JanChristoph Oetjen

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 4 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

This draft report sets out the European Parliament's position on a proposed regulation for collecting and transferring advance passenger information (API) to enhance external border controls. It amends the Commission proposal to exempt general aviation, exclude transit passengers, require encrypted data transfer, and shorten data retention to 24 hours. The report also adds safeguards: non-discrimination, legal remedies, audits by supervisory authorities, and financial penalties up to EUR 10 million for systematic non-compliance. It establishes an API Contact Group and requires the Commission to assess impact on travel experience.

Committee position. The rapporteur proposes amendments to the Commission proposal to exempt general aviation and transit passengers, require encryption, shorten data retention to 24 hours, add fundamental rights safeguards, and introduce financial penalties.

Key points

  1. The regulation applies to commercial air carriers on scheduled or non-scheduled flights into the Union; general aviation is exempted.
  2. Air carriers must collect API data only for passengers, not crew, and only the listed data items; baggage information is limited to number and weight of checked bags.
  3. Air carriers must enable passengers to provide API data during online check-in and at the airport at no cost to the passenger.
  4. API data must be transferred encrypted to the router at check-in and after flight closure; for code-shared flights, the operating carrier is responsible.
  5. Air carriers and border authorities must store API data for 24 hours from departure, then delete it permanently.
  6. The router must verify data formats and notify carriers of non-compliance; it must delete data immediately after transmission, or after 12 hours if transmission is technically impossible.
  7. Processing must not discriminate; affected persons have the right to an effective legal remedy; best interests of the child are primary.
  8. Independent supervisory authorities and the EDPS must carry out audits of processing operations; costs are borne by Member States and the Union budget respectively.
  9. Member States must impose financial penalties up to EUR 10 million for systematic or persistent non-compliance by air carriers.
  10. Statistics from the router must be anonymized and cannot be used for risk analysis, profiling, or predictive risk assessment.
  11. An API Contact Group is established to facilitate cooperation among Member States, EU institutions, and stakeholders.
  12. The Commission must assess the regulation's impact on travel experience and ensure budget adequacy for the router.

Who is affected

  • Air carriers: must collect and transfer API data for passengers, enable free data provision, and face penalties for non-compliance.
  • Passengers: must provide API data but can do so online or at airport at no cost; their data is protected by non-discrimination and legal remedies.
  • General aviation operators: exempted from the regulation.
  • Transit passengers: not subject to API data transfer if their journey starts and ends outside participating Member States.
  • Competent border authorities and eu-LISA: receive and process API data with strict storage limits and audit requirements.

Figures and deadlines

  • 24 hours: storage period for API data by air carriers and border authorities from flight departure.
  • 12 hours: time after which router must delete data if transmission is technically impossible.
  • EUR 10 million: maximum financial penalty for systematic non-compliance.
  • Every four years: frequency of audits by national supervisory authorities.
  • Every year: frequency of audits by the European Data Protection Supervisor.

Legal basis: Articles 77(2)(b) and (d) and 79(2)(c) of the Treaty on the Functioning of the European Union