European Union. Surveillance / law enforcement access. Directive (EU) 2016/681
EU PNR DirectivePNR Directive (EU) 2016/681 on the use of passenger name record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime
Partly verified
Medium confidence.Dates from the Directive text (Articles 18 and 22). Directive 2016/681 remains in force as far as this research could confirm; the Court of Justice ruled on it in Case C-817/19 (2022), which was not checked here. The flight scope was not checked in the text, so it is not stated; the SaaS comment is an assessment.
§1Summary
- Synopsis
Directive (EU) 2016/681 requires air carriers to transfer passenger name record data to a Passenger Information Unit set up or designated in each Member State, for use against terrorist offences and serious crime. Member States keep the data in the unit for five years after transfer, and the Directive requires certain data elements to be masked out after six months.
- Key themes
- Unique features
Passenger Information Units process the data; a data protection officer is appointed in each unit.
- SaaS relevance
Mainly affects air carriers and the travel-sector software that handles booking data.
§2Obligations
- Breach notification
- None
- DPO
- Yes (each Passenger Information Unit has a data protection officer)
- Cross-border transfers
- Rules for transfers to third countries
- Maximum penalty
- Set by Member States
§3Dates
- Key dates
- Adopted
- In force
- Adopted 27 April 2016; published 4 May 2016; in force 24 May 2016; Member States to apply by 25 May 2018
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- English text eur-lex.europa.eu
- Authority
- National Passenger Information Units; national supervisory authorities
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Dates from the Directive text (Articles 18 and 22). Directive 2016/681 remains in force as far as this research could confirm; the Court of Justice ruled on it in Case C-817/19 (2022), which was not checked here. The flight scope was not checked in the text, so it is not stated; the SaaS comment is an assessment.