Using airline passenger data to fight terrorism and serious crime

Automatic summary, not yet reviewed

1. Airlines and travel booking entities must send passenger reservation data to the Spanish Passenger Information Unit (UIPUIP Passenger Information Unit: the public body that receives, stores and analyzes this data.) for international flights departing from, arriving in or stopping over in Spain. It can also apply to specific domestic flights if the Council of Ministers approves an extraordinary measure due to risk.
2. The data may only be used to prevent, detect, investigate and prosecute terrorism offenses and serious crimes, meaning those punishable by prison sentences of three years or more from a list that includes human trafficking, drug trafficking, cybercrime or kidnapping.
3. The UIP, part of the Center for Intelligence against Terrorism and Organized Crime, collects and analyzes the data. It compares the data with databases and applies predetermined criteria; if an automated evaluation gives a positive result, a specialist must review it manually.
4. Data must be sent between 24 and 48 hours before the flight departs and right after the flight closes. Data is kept for five years, but after six months it is depersonalized, and access to the full data requires approval from a court or the State Secretariat for Security.
5. Only the National Police, the Civil Guard, the National Intelligence Center, Customs Surveillance, the Public Prosecutor's Office and some regional police forces can request the data. Requests must be justified and mass, unfounded requests are never accepted.
6. Failing to send the data or sending it incorrectly is an offense punishable by fines from €3,000 to €300,000, depending on whether it is minor, serious or very serious. The Ministry of the Interior sanctions very serious offenses and the State Secretariat for Security the rest.

Who it affects

• Airlines: Must transmit PNR data for their flights within the set deadlines and formats; otherwise they face fines.
• Travel agencies and tour operators: Must enter into the reservation the data they collect for flights covered by the law.
• Operators of private flights: Must send passenger and crew data to the UIP.
• Passengers on international flights: Their reservation data is collected, analyzed and kept for up to five years, with access and data protection rights.
• Police and investigative authorities: Can request PNR data from the UIP only with justified requests and for specific purposes.

Words worth knowing

Datos PNR (PNR data)

Information from a flight reservation: name, contact details, itinerary, payment, baggage and ID document data, among others.

UIP

Passenger Information Unit: the public body that receives, stores and analyzes this data.

Sistema API (API system)

Data collected by the airline and checked against each passenger's official identity documents.

Despersonalización (depersonalization)

Hiding the data that directly identifies a person (name, address, payment) so it is not visible in normal use of the database.

Ley orgánica (organic law)

A type of Spanish law requiring an absolute majority in Congress because it affects fundamental rights or matters reserved by the Constitution.

It summarizes the law as published in the BOE. It is written by artificial intelligence and may contain mistakes: the official text is what counts. Read the official text · How we make summaries