Government to close air passenger data ‘security gap’

Government to close air passenger data 'security gap'

Jim O'Callaghan

A “security gap” around the use of air passenger information for law enforcement and counter-terrorism purposes is to be closed under legislative amendments proposed by the government.

The government yesterday agreed to introduce amendments to the Criminal Law and Civil Law (Miscellaneous Provisions) Bill 2026 concerning the statutory regime which allows for the processing of passenger name record (PNR) data by the Irish Passenger Information Unit within the Department of Justice, Home Affairs and Migration.

The collection and analysis of PNR data is a widely used law enforcement tool in the EU and elsewhere.

PNR data consists of information provided by passengers, which is collected by and held in the airlines’ reservation and departure control systems for their own commercial purposes.

The 2016 EU PNR Directive established a regime that mandated the collection of PNR data from airlines and processing by national Passenger Information Units, in order to detect suspicious travel patterns and identify criminals and terrorists.

It also provided that national competent authorities such as police forces be entitled to request PNR data being stored by Passenger Information Units, on a case-by-case basis for the purposes of investigating and prosecuting serious crime and terrorism.

Ireland transposed the PNR Directive by way of the European Union (Passenger Name Record Data) Regulations 2018.

These Regulations require that airlines transfer PNR data in respect of extra-EU flights – flights flying in and out of Ireland from and to countries outside the EU – to the Irish Passenger Information Unit for the purposes of combatting terrorism and serious crime.

The EU Directive also provided the option for member states to extend those requirements to airlines in respect of intra-EU flights.

Ireland will avail of this option in the amendments, extending the Irish PNR regime to the collection of PNR data from flights flying in and out of Ireland from and to other EU member states.

Intra-EU flights will be selected based on risk-assessments, or the regime will apply in respect of all intra-EU flights when the state is faced with a genuine and present or foreseeable terrorist threat.

The amendments also ensure Ireland’s PNR regime aligns with a judgment of the Court of Justice of the European Union (CJEU) on the EU PNR Directive, re-enforcing strict controls on PNR data usage.

Justice, home affairs and migration minister Jim O’Callaghan said: “The amendments I have secured Cabinet approval for will strengthen Ireland’s ability to detect suspicious travel patterns and identify criminals and terrorists operating within the EU and travelling to and from Ireland by air.

“Currently PNR data only extends to those flying to and from Ireland from outside the EU. The amendments will bridge that security gap.

“The amendments also ensure Ireland’s PNR regime follows a judgment of the European Court of Justice which laid down safeguards that must be adhered to when processing individuals’ PNR data.

“This includes the Irish Passenger Information Unit only retaining PNR data beyond six months where there is found to be a link connecting such data to serious crime or terrorism.

“An authority independent of the Passenger Information Unit will now approve all PNR disclosure requests which is also a requirement of the judgment.”

The amendments will now be drafted and added to the bill as committee stage amendments in the Dáil.

Join over 12,200 lawyers, north and south, in receiving our FREE daily email newsletter
Share icon
Share this article: