Airlines flying to and from the EU would be obliged to transmit 19 pieces of personal data on each of their passengers – including names, travel dates, full itinerary, billing data and baggage information – to designated risk analysis units in the first member state where the plane is to land.
Intra-European flights would not be covered by this obligation.
The so-called 'Passenger Information Units' (PIUs) would then be in charge of assessing travellers' terrorist risk and identifying those who should be subjected to further enquiries upon their arrival or departure from the country.
All information would be kept for five years and then for a further eight years in a "dormant" database, where it could only be accessed in "exceptional circumstances in response to a specific and actual threat related to the prevention or combat of terrorist offences and organised crime".
For reasons of privacy, the proposal excludes the sharing of "sensitive" PNR data, such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and data concerning the health or sex life of the individual. Any such information that is passed on would have to be deleted immediately, it states.
The Commission underlined that air carriers already have an obligation, under a 2004 directive, to communicate 'Advance Passenger Information' (API) – official biographical data stemming from passports – to the competent authorities of the member states in order to fight illegal immigration, and that the new plan would not put any extra burden on airlines.



