The European Commission last week proposed rules governing the use of Advance Passenger Information in a bid to strengthen border security.

As commissioner for home affairs Ylva Johansson explained during a press conference, travel in and out of the [1]Schengen zone – the 26 European countries between which passengers are free to travel without visas – involves the obligation to give border authorities Personal Name Records (PNR). That's just the minimal information passengers provide airlines when booking tickets.

Airlines, she said, less formally share [2]Advance Passenger Information [PDF] – flight details and passenger passport data collected by airlines upon check-in. It's provided to border authorities as a passenger manifest list.

[3]

"With this proposal, we will make it mandatory to share the Advanced Passenger Information for all flights that go in and out of Schengen but also for intra-Schengen flights that are the same as those that are required for the PNR," [4]explained Johansson. "This will significantly help to prepare the readiness for the border guards – what kind of people they will expect – but also of course to track significant criminal individuals."

[5]

[6]

According to Johansson, PNR sharing alone is insufficient to catch criminals because they often book multiple tickets on airlines at the same time to make it difficult for authorities to know where they're actually traveling. With the addition of obligatory, standardized API data, authorities should be better able to determine who is traveling where and when.

[7]Microsoft to Europe: We're setting an EU 'data boundary' from 2023

[8]EU takes another step towards US data-sharing agreement

[9]Europe's USB-C deadline: Lightning must be struck from iPhone by December, 2024

[10]Using personal info for ads without consent puts Meta in EU's gunsights

Johansson said that the proposed rules – [11]which won't be applied until 2028 – will be enforced using a central "router," managed by an EU agency called [12]eu-LISA . That agency will receive data from departure points and send it to arrival points without storing it.

"The transmission of API data through the router will reduce costs on the air industry and would ensure that border guards have [fast and seamless] access … to API data they need to perform in the context of advanced border checks," the [13]proposal [PDF] explains. "This approach will drastically reduce the number of connections to establish and maintain from a member states perspective. Conversely, this will reduce the complexity for air carriers to maintain connections with competent border authorities and introduce economies of scale."

eu-LISA will have to comply with EU data protection obligations and will be considered a personal data processor under EU law. Air carriers and relevant authorities will monitor themselves to make sure they're compliant with the law.

[14]

The router isn't expected to be developed until 2026, at which point two years have been allotted for adjustment and testing. The projected cost is €45 million ($47.6M) for development and €9 million ($9.5M) for operation from 2029 onward. It's anticipated that member states will have to spend €27 million ($28.6M) to make existing systems compatible, plus €5 million ($5.3M) per year in operational expenses from 2028 onwards.

(Member states contribute €8 million ($8.4M) per year to the present system under the current [15]Multiannual Financial Framework .)

The revised data sharing requirement – part of the [16]EU Security Union Strategy – is intended to harmonize rules on the collection of API data. Previously PNR records were governed by a separate legal framework – the 2016 PNR Directive.

[17]

The rule change is also intended to ensure that data collected is accurate, complete, and high quality – air carriers will be required to use automated data collection methods, so manual data entry problems can be avoided.

People traveling into, out of, and within the EU – over one billion passengers annually – will be affected. ®

Get our [18]Tech Resources



[1] https://www.schengenvisainfo.com/schengen-visa-countries-list/

[2] https://www.icao.int/Security/FAL/Documents/2010%20API%20Guidelines%20Final%20Version.ICAO.2011%20full%20x2.pdf

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y6GVzqcykDgCNYUUGwFPmwAAAEw&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://youtu.be/VLNCFO3cHg8?t=51

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y6GVzqcykDgCNYUUGwFPmwAAAEw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y6GVzqcykDgCNYUUGwFPmwAAAEw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://www.theregister.com/2022/12/15/microsoft_launches_eu_data_boundary/

[8] https://www.theregister.com/2022/12/14/eu_us_data_sharing_agreement/

[9] https://www.theregister.com/2022/12/08/eu_usbc_law_is_official/

[10] https://www.theregister.com/2022/12/08/meta_eu_personal_info/

[11] https://ec.europa.eu/commission/presscorner/detail/en/IP_22_7644

[12] https://www.eulisa.europa.eu/

[13] https://home-affairs.ec.europa.eu/system/files/2022-12/Proposal%20for%20a%20regulation%20on%20the%20collection%20and%20transfer%20of%20API%20for%20enhancing%20and%20facilitating%20external%20border%20controls_en.pdf

[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y6GVzqcykDgCNYUUGwFPmwAAAEw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[15] https://www.consilium.europa.eu/en/policies/the-eu-budget/long-term-eu-budget-2021-2027/

[16] https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1596452256370&uri=CELEX%3A52020DC0605

[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y6GVzqcykDgCNYUUGwFPmwAAAEw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[18] https://whitepapers.theregister.com/