The Passenger Name Record (PNR): FREQUENTLY ASKED QUESTIONS
European Commission - MEMO/07/294 13/07/2007
Brussels, 13 July 2007
What is PNR and what data does it contain?
The Passenger Name Record (PNR) is the generic name given to the files created by the airlines for each journey any passenger books. They are stored in the airlines' reservation and departure control databases. PNR allows all the different agents within the air industry (from the travel agent and the computer reservation systems (CRS) to the carrier and the handling agents at the airports) to recognise each passenger and have access to all relevant information related to his/her journey: departure and return flights, connecting flights (if any), special services required on board the flight, etc.
The number and nature of fields of information in a PNR system will vary from airline to airline and from passenger to passenger and could expand to approximately 60 fields and sub-fields.
Why has the European Union made an agreement with the USA on sharing the Passenger Names Record (PNR) data of air carriers?
The U.S. Aviation and Transportation Security Act of 19th November 2001 introduced the requirement that airlines operating passenger flights to, from or through the United States provide US authorities, upon request, with electronic access to PNR data contained in their reservation and departure control systems.
The agreement between the European Union and the USA is intended to meet security and data protection requirements through assurances provided by the USA. This provides a Europe-wide solution, legally binding in all Member States, and the necessary legal certainty for all concerned.
When did the EU start talks with the USA?
The European Community and the USA had signed an Agreement on 28 May 2004, but it had to be denounced by the EU as a result of the judgment of the European Court of Justice of 30 May 2006. It was therefore replaced by an interim Agreement between the European Union and the USA of 19 October 2006 which expires on 31 July 2007 and has therefore been replaced by a new long-term Agreement which will be signed in July 2007.
Do we share the US security concerns underlying the PNR system?
Yes. The EU also wants safe transatlantic flights. PNR can provide essential information for the fight against terrorism and other serious crimes.
What exactly has been agreed between the EU and the USA?
The agreement is in three parts: (i) an agreement signed by both parties, (ii) a letter which the USA sends to the EU in which it sets out assurances on the way in which it will handle EU PNR data and (iii) a letter from the EU to the USA acknowledging receipt of the assurances and confirming that, on that basis, it considers the level of protection of PNR data in the U.S. as adequate.
This agreement will be valid for seven years, thus providing for a considerable period of legal certainty.
What PNR data will be shared with the USA?
Air carriers make available the PNR data of all persons who fly to and from the U.S.. The U.S. authorities will use only the 19 PNR elements as defined in the Agreement, and only if the passenger has made available information corresponding to these PNR elements. In practice, the number of PNR about a passenger given to an airline and made available to the US authorities is more limited.
What about sensitive data?
The U.S. Department of Homeland Security (DHS), the agency which receives the data, will filter out and not use sensitive information contained in PNR data, save exceptional cases where life is at risk. Sensitive information means data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or concerning the health or sex life of the individual.
Does the USA require access to PNR data on the types of meal that passengers request or on their medical condition?
This information is collected by airlines in order to provide special services to certain passengers and may therefore be contained in some PNR. However, this is sensitive information (see previous question) and the information is not used to identify potential subjects for border examination.
Can DHS obtain the data contained in PNR by other means?
Much of the information contained in PNR is already included in airline tickets and other travel documents. The missing information can generally be requested by airline staff on departure or US border officials on arrival. We all want to avoid unnecessary delays at airports and modern technology can help collect and transmit information rapidly.
For how long will DHS keep the data?
Seven years from the date of collection in an active database following which, the data will be moved to an inactive status for eight years, to be accessed only in exceptional circumstances and under strict conditions.
Will other US agencies have access to the PNR data that DHS obtains from the airlines?
Only for the purposes of preventing and combating terrorism and other serious crimes. There will be no unconditional direct access to DHS's database. Access will be strictly limited to these purposes and in proportion to the nature of the case for which the data are being sought.
Does U.S. law provide for protection against disclosure of foreigners' PNR data?
Yes, administrative, civil and criminal enforcement measures are available under U.S. law for violations of U.S. privacy rules and unauthorised disclosure of U.S. records.
If an EU citizen believes PNR data accessed and stored by DHS may be inaccurate, what actions may he/she take to obtain redress?
DHS has extended administrative protections to all PNR data regardless of nationality or country of residence. A system is available providing redress for persons seeking information about or correction of PNR.
In addition, U.S. law permits any person access to U.S. records. Requests for access to personally identifiable information contained in PNR may be submitted to the FOIA/PA Unit, Office of Field Operations, U.S. Customs and Border Protection, Room 5.5-C, 1300 Pennsylvania Avenue, NW Washington, DC 20229.
Of course, within the EU everyone has the right to full respect of the rights guaranteed by and in Member States.
To find out more about Vice President Frattini's work please visit his website: http://www.ec.europa.eu/commission_barroso/frattini/index_en.htm