This document is an excerpt from the EUR-Lex website
Document 22026A01917
Agreement between the European Union and the Kingdom of Norway on the Transfer of Passenger Name Record (PNR) Data for the Prevention, Detection, Investigation and Prosecution of Terrorist Offences and Serious Crime
Agreement between the European Union and the Kingdom of Norway on the Transfer of Passenger Name Record (PNR) Data for the Prevention, Detection, Investigation and Prosecution of Terrorist Offences and Serious Crime
Agreement between the European Union and the Kingdom of Norway on the Transfer of Passenger Name Record (PNR) Data for the Prevention, Detection, Investigation and Prosecution of Terrorist Offences and Serious Crime
ST/11281/2025/INIT
OJ L, 2026/1917, 6.8.2026, ELI: http://data.europa.eu/eli/agree_internation/2026/1917/oj (BG, ES, CS, DA, DE, ET, EL, EN, FR, GA, HR, IT, LV, LT, HU, MT, NL, PL, PT, RO, SK, SL, FI, SV)
Date of entry into force unknown (pending notification) or not yet in force.
ELI: http://data.europa.eu/eli/agree_internation/2026/1917/oj
|
Official Journal |
EN L series |
|
2026/1917 |
6.8.2026 |
AGREEMENT BETWEEN THE EUROPEAN UNION AND THE KINGDOM OF NORWAY ON THE TRANSFER OF PASSENGER NAME RECORD (PNR) DATA FOR THE PREVENTION, DETECTION, INVESTIGATION AND PROSECUTION OF TERRORIST OFFENCES AND SERIOUS CRIME
THE EUROPEAN UNION, hereinafter also referred to as the ‘Union’ or ‘EU’,
and
THE KINGDOM OF NORWAY, hereinafter also referred to as ‘Norway’,
hereinafter jointly referred to as ‘the Parties’,
RECOGNISING that preventing, detecting, investigating, and prosecuting terrorist offences, as well as other serious crime, while preserving human rights and fundamental freedoms, in particular rights to privacy and data protection, are objectives of general interest;
RECOGNISING that information sharing is an essential component of the fight against terrorist offences and other serious crime, and that in this context, the use of Passenger Name Record (PNR) data is a critically important instrument to pursue these goals;
RECOGNISING the importance of sharing PNR data and relevant and appropriate analytical information based on PNR data under this Agreement between the Parties with competent police and judicial authorities of Norway, Member States of the Union (Member States), Europol and Eurojust as a means to foster international police and judicial cooperation;
SEEKING to enhance and encourage the cooperation between the Parties on PNR through the exchange of information and technical cooperation by national experts from the Member States and Schengen Associated Countries' Passenger Information Units (PIUs), in particular on the development of pre-determined criteria and on other aspects of the processing of PNR;
HAVING REGARD to United Nations Security Council Resolutions 2396 (2017) and 2482 (2019), which call upon all States to develop the capability to collect and process PNR data and to the International Civil Aviation Organization Standards and Recommended Practices for the collection, use, processing and protection of PNR data adopted as Amendment 28 to Annex 9 to the Convention on International Civil Aviation (the Chicago Convention);
RECALLING that the Parties have a shared responsibility to ensure internal security within the Schengen area, including by exchanging relevant information, and that this Agreement provides the Parties' competent authorities with an effective tool to achieve that goal in the absence of internal border control within the Schengen area;
RECOGNISING that this Agreement is not intended to apply to advance passenger information (API) that is collected and transmitted by air carriers to Norway for the purpose of border control;
MINDFUL of the Union's commitments pursuant to Article 6 of the Treaty on European Union on respect for fundamental rights, the protection of individuals with regard to the processing of personal data pursuant to Article 16 of the Treaty on the Functioning of the European Union, the principles of proportionality and necessity concerning the right to respect for private and family life, the respect for privacy, and the protection of personal data under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union in line with the relevant case-law of the Court of Justice of the European Union, Article 8 of the European Convention on the Protection of Human Rights and Fundamental Freedoms, Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and its additional Protocol 181;
RECOGNISING that under Norwegian law the transfer of PNR data by air carriers to Norway is mandatory;
RECOGNISING that Directive (EU) 2016/681 of the European Parliament and the Council (1) is the basis for the transfers by air carriers of PNR data to the competent authorities of the Member States. Together with Regulation (EU) 2016/679 of the European Parliament and of the Council (2) and Directive (EU) 2016/680 of the European Parliament and of the Council (3), Directive (EU) 2016/681 ensures a high level of protection of fundamental rights, in particular the rights to privacy and the protection of personal data;
RECOGNISING that Norway, in accordance with its 1999 Agreement with the Council of the European Union (4) concerning its association with the implementation, application and development of the Schengen acquis, has accepted, implemented and applied Directive (EU) 2016/680, given that that Directive constitutes a development of the Schengen acquis. Furthermore, and considering that the application by Norway of Directive (EU) 2016/680 applies to the processing of personal data under legal instruments forming part of the Schengen acquis, it should be clarified that Norway's application of Directive (EU) 2016/680 also includes the processing of personal data by competent authorities under this Agreement;
RECOGNISING that air carriers established or offering their services in the Union are obliged to process personal data in compliance with Regulation (EU) 2016/679, and that that Regulation also applies in the European Economic Area (EEA) as it has been incorporated into the EEA Agreement by Decision 154/2018 of the EEA Joint Committee of 6 July 2018;
RECALLING the right to free movement of persons in the European Economic Area (EEA), as provided for in Articles 1(2), 28 and 31 of the EEA Agreement and that any national system requiring the transfer by air carriers and processing by the competent authorities of PNR data is liable to interfere with the exercise of freedom of movement for persons, and that, therefore, any interference with the exercise of such freedom is justified only where it is based on objective considerations and is proportionate to the legitimate objective pursued,
HAVE AGREED AS FOLLOWS:
CHAPTER I
GENERAL PROVISIONS
Article 1
Objective and scope
1. The objective of this Agreement is to enable the transfer of Passenger Name Record (PNR) data by air carriers from the Union to Norway and to lay down rules and conditions subject to which those PNR data may be processed by Norway.
2. The objective of this Agreement is also to enhance police and judicial cooperation between the Union and Norway in respect of PNR data.
3. The scope of this Agreement covers air carriers operating passenger flights between the Union and Norway as well as air carriers incorporated, or storing data, in the Union and operating flights to or from Norway.
Article 2
Definitions
For the purposes of this Agreement, the following definitions apply:
|
(1) |
‘air carrier’ means an air transport undertaking with a valid operating licence or equivalent permitting it to carry out carriage of passengers by air between the Union and Norway; |
|
(2) |
‘competent authorities’ means the public authorities responsible under Norway's national law for the prevention, detection, investigation or prosecution of terrorist offences or serious crime; |
|
(3) |
‘passenger’ means any person, including persons in transfer or transit and excluding members of the crew, carried or to be carried in an aircraft with the consent of the air carrier, such consent being manifested by that person's registration in the passenger list; |
|
(4) |
‘Passenger Information Unit of Norway’ or ‘Norwegian PIU’ means the authority established or designated as responsible for receiving and processing PNR data by Norway in accordance with Article 6 of this Agreement; |
|
(5) |
‘passenger name record’ or ‘PNR’ means a record of each passenger's travel requirements which contains information necessary to enable reservations to be processed and controlled by the booking and participating air carriers for each journey booked by or on behalf of any person, whether it is contained in reservation systems, departure control systems used to check passengers onto flights, or equivalent systems providing the same functionalities; specifically, as used in this Agreement, PNR data consists of the elements exhaustively listed in the Annex; |
|
(6) |
‘serious crime’ means the offences punishable by a maximum custodial sentence or detention order of at least three years under the national law of Norway which have an objective link, even if only an indirect one, with the carriage of passengers by air; |
|
(7) |
‘terrorist offence’ means:
|
|
(8) |
‘terrorist entity’ means:
|
CHAPTER II
TRANSFER OF PNR DATA
Article 3
Method and frequency of transfer
1. Norway shall ensure that air carriers transfer PNR data to the Norwegian PIU exclusively by transmitting the required PNR data into the database of the requesting authority (‘push’ method), and in accordance with the following procedures to be observed by air carriers:
|
(a) |
by electronic means in compliance with the technical requirements of the Norwegian PIU or, in the case of a technical failure, by any other appropriate means ensuring an appropriate level of data security; |
|
(b) |
by using a mutually accepted messaging format, and in a secure manner using common protocols as required by the Norwegian PIU; |
|
(c) |
either directly or through authorised agents, who act on behalf of and under the responsibility of an air carrier, for the purpose of and under the conditions laid down in this Agreement. |
2. Norway shall not require air carriers to provide elements of PNR data which are not already held, or collected by air carriers for their reservation purposes or in the normal course of their business.
3. Norway shall ensure that the Norwegian PIU deletes any data element transferred to it by an air carrier pursuant to this Agreement upon receipt of the PNR data, if that data element is not listed in the Annex.
4. Norway shall ensure that the Norwegian PIU requires air carriers to transfer PNR data:
|
(a) |
on a scheduled basis with the earliest point in time being up to 48 hours before the scheduled departure; and |
|
(b) |
a maximum of five times, for a particular flight. |
5. Norway shall permit air carriers to limit the transfer referred to in point (b) of paragraph 4 to updates of the PNR data transferred as referred to in point (a) of that paragraph.
6. Norway shall ensure that the Norwegian PIU informs air carriers of the specified times for the transfers.
7. In specific cases where there is an indication that additional access is necessary to respond to a specific threat related to the purposes set out in Article 5, the Norwegian PIU may require an air carrier to provide PNR data prior to, between or after the scheduled transfers. In exercising this discretion, Norway shall act judiciously and proportionately and shall require the use of the method of transfer referred to in paragraph 1.
Article 4
API-PNR router
1. The Parties may decide that Norway may require air carriers to transfer PNR data to the Norwegian PIU by means of the API-PNR router set up in accordance with Regulation (EU) 2025/13 (5). In such case, Norway shall:
|
(a) |
not require air carriers to transfer PNR data by any other means; |
|
(b) |
be bound by the rules on the functioning and the conditions for the use of the API-PNR router as established by Regulation (EU) 2025/13, by way of derogation from Article 3(1), (4) and (6) of this Agreement. |
2. Norway shall notify the Union of its request to use the API-PNR router. Such request shall be accepted by the Union in writing through diplomatic channels.
3. The Union shall notify Norway in writing through diplomatic channels of any amendment to Regulation (EU) 2025/13 which affects the rules on the functioning and the conditions for the use of the API-PNR router. Within 120 days from the receipt of such notification, Norway may notify the Union of its intention to discontinue the use of that router in writing through diplomatic channels. In this case, the Parties shall enter into consultations as provided for in Article 23(1) and Article 3(1), (4) and (6) shall resume to apply.
CHAPTER III
PNR PROCESSING AND PROTECTION
Article 5
Purposes of PNR processing
Norway shall ensure that PNR data received pursuant to this Agreement are processed strictly for the purpose of preventing, detecting, investigating and prosecuting terrorist offences or serious crime.
Article 6
Modalities of PNR processing
The Norwegian PIU may process PNR data exclusively by means of the following specific modalities of processing:
|
(a) |
carrying out an assessment of passengers prior to their scheduled arrival in or departure from Norway to identify persons who require further examination by the competent authorities, in view of the fact that such persons may be involved in a terrorist offence or serious crime in accordance with the real-time assessment carried out under Article 7; |
|
(b) |
carrying out a search of the database of retained PNR data with a view to responding, on a case-by-case basis, to a duly reasoned request submitted pursuant to Articles 13 and 14 and, where appropriate, disclosing any relevant PNR data or the results of their processing; |
|
(c) |
analysing PNR data for the purpose of updating, testing or creating new criteria to be used in the assessments carried out under Article 7(1)(b), in order to identify any persons who may be involved in a terrorist offence or serious crime. |
Article 7
Real-time assessment
1. When carrying out an assessment referred to in point (a) of Article 6, the Norwegian PIU may:
|
(a) |
compare PNR data only against databases on persons or objects sought or under alert, in accordance with Union, international and national rules applicable to such databases; and |
|
(b) |
process PNR data against pre-determined criteria. |
2. Norway shall ensure that the databases referred to in paragraph 1(a) of this Article are non-discriminatory, reliable, up to date and limited to those used by the competent authorities of Norway in relation to and relevant for the purposes set out in Article 5.
3. Norway shall ensure that any assessment of PNR data as referred to in paragraph 1(b) of this Article is based on non-discriminatory, specific and reliable pre-established models and criteria to enable the Norwegian PIU to arrive at results targeting individuals who might be under a reasonable suspicion of involvement or participation in terrorist offences or serious crime. Norway shall ensure that those criteria are in no circumstances based on a person's race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation.
4. Norway shall ensure that any positive match resulting from the real-time processing of PNR data is individually reviewed by the Norwegian PIU by non-automated means.
Article 8
Special categories of data
1. Any processing of PNR data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, of data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited under this Agreement.
2. To the extent that the PNR data received under this Agreement by the Norwegian PIU include such special categories of personal data, the Norwegian PIU shall delete such data immediately.
Article 9
Data security and integrity
1. Norway shall ensure that PNR data received under this Agreement are processed in a manner that ensures a high level of data security appropriate for the risks represented by the processing and the nature of PNR data received under this Agreement. In particular, the Norwegian PIU shall:
|
(a) |
implement appropriate technical and organisational measures and procedures to ensure such level of security; |
|
(b) |
apply encryption, authorisation, and documentation procedures to the PNR data; |
|
(c) |
limit access to PNR data to authorised staff; and |
|
(d) |
store PNR data in a secure physical environment that is protected with access controls. |
2. Norway shall ensure that any data security breach, in particular leading to accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, or any unlawful forms of processing is subject to effective and dissuasive corrective measures.
3. Norway shall report any breach of data security to the national supervisory authority established pursuant to Article 41 of Directive (EU) 2016/680.
Article 10
Logging and documenting of PNR data processing
1. The Norwegian PIU shall log and document all processing of PNR data. Norway shall use such a log or documentation only to:
|
(a) |
self-monitor and to verify the lawfulness of data processing; |
|
(b) |
ensure proper data integrity or system functionality; |
|
(c) |
ensure the security of data processing; and |
|
(d) |
ensure oversight and accountability of the public administration. |
2. Logs or documentation kept under paragraph 1 shall be communicated upon request to the national supervisory authority which shall use this information only for the oversight of data protection and for ensuring proper data processing as well as data integrity and security.
CHAPTER IV
STORAGE AND DISCLOSURE OF PNR DATA
Article 11
Storage periods
1. Norway shall ensure that PNR data received under this Agreement are stored:
|
(a) |
only as long as there is an objective connection, even an indirect one, between the PNR data stored and at least one of the purposes set out in Article 5; and |
|
(b) |
in any case for periods not exceeding 5 years. |
2. Pursuant to paragraph 1 of this Article, the Norwegian PIU may store PNR data of all air passengers only for an initial period that is to be provided for in its national law. The length of such initial period shall not go beyond what is strictly needed to allow the PIU to carry out the searches referred to in Article 6 point (b), for the purposes of identifying persons who have not already been suspected of involvement in terrorist offences or serious crime on the basis of the real-time assessment carried out under Article 6 point(a).
3. After the initial period referred to in paragraph 2, the Norwegian PIU may store PNR data only in respect of passengers for whom there is objective evidence capable of establishing a risk that relates to terrorist offences or serious crime.
4. Norway shall ensure that the Norwegian PIU reviews on a regular basis the need for continued storage of PNR data pursuant to paragraphs 2 and 3 of this Article.
5. At the expiry of the appropriate storage period, Norway shall ensure that PNR data are irrevocably deleted or rendered anonymous in such a manner that the data subjects concerned are no longer identifiable.
6. By way of derogation from paragraph 1(b), Norway may allow the storage of PNR data required for review, investigation, enforcement action, judicial proceedings, prosecution, or the enforcement of penalties, until the relevant process is concluded.
Article 12
Depersonalisation
1. The Norwegian PIU shall depersonalise PNR data at the latest six months after they are received. It shall do so through masking out the following data elements which could serve to identify directly the passenger to whom the PNR data relate:
|
(a) |
name(s), including the names of other passengers on the PNR and number of travelers on the PNR travelling together; |
|
(b) |
address and contact information; |
|
(c) |
all forms of payment information, including billing address, to the extent that it contains any information which could serve to identify directly the passenger to whom the PNR data relate or any other persons; |
|
(d) |
frequent flyer information; |
|
(e) |
general remarks to the extent that they contain any information which could serve to identify directly the passenger to whom the PNR data relate; and |
|
(f) |
any API data that have been collected. |
2. The Norwegian PIU may disclose the data elements referred to in paragraph 1 of this Article only for the purposes of Article 5 and under the conditions of Articles 13 or 14.
Article 13
Disclosure within Norway
1. When responding to a duly reasoned request sent by a competent authority in accordance with Article 6(b), the Norwegian PIU shall disclose, on a case-by-case basis, PNR data or the results of their processing, only where:
|
(a) |
such disclosure is necessary to achieve one of the purposes set out in Article 5; |
|
(b) |
the minimum amount of PNR data necessary is disclosed; |
|
(c) |
the receiving competent authority affords protection equivalent to the safeguards provided for in this Agreement; |
|
(d) |
the disclosure is approved by either a judicial authority or another independent body competent under national law to verify whether the conditions for disclosure are met. |
2. By way of derogation from point (d) of paragraph 1, the Norwegian PIU may disclose PNR data in cases of duly justified urgency without prior review or approval. In such cases, the review referred to in point (b) of paragraph 1 must take place within a short time.
3. Norway shall ensure that the receiving competent authority does not disclose PNR data to another authority unless the disclosure is explicitly authorised by the Norwegian PIU.
Article 14
Disclosure outside Norway and the EU
1. When responding to a duly reasoned request sent by a competent authority of countries other than the Member States in accordance with Article 6(b), the Norwegian PIU shall disclose, on a case-by-case basis, PNR data or the results of their processing, only where:
|
(a) |
such disclosure is necessary to achieve one of the purposes set out in Article 5; |
|
(b) |
the minimum amount of PNR data necessary is disclosed; |
|
(c) |
the country to the authority of which the PNR data are to be disclosed has either concluded an Agreement with the Union that provides for protection of personal data comparable to this Agreement or is subject to a decision of the European Commission pursuant to Union law, finding that said country ensures an adequate level of data protection within the meaning of Union law; |
|
(d) |
the disclosure is approved by either a judicial authority or another independent body competent under national law to verify whether the conditions for disclosure are met. |
2. By way of derogation from paragraph 1(c), the Norwegian PIU may disclose PNR data to another country if it considers that the disclosure is necessary for the prevention or investigation of a serious and imminent threat to public security and if that country provides a written assurance, pursuant to an arrangement, agreement or otherwise, that the information will be protected in line with the safeguards set out in this Agreement.
3. By way of derogation from paragraph 1(d), the Norwegian PIU may disclose PNR data in cases of duly justified urgency without prior review and approval. In such cases, the review referred to in paragraph 1 must take place within a short time.
Article 15
Exchange of PNR-related information
1. The Norwegian PIU shall share with Europol or Eurojust, within the scope of their respective mandates, or with the PIUs of the Member States, PNR data, the results of processing those data, or analytical information based on PNR data, as soon as possible and in specific cases where necessary to prevent, detect, investigate, or prosecute terrorist offences or serious crime. The Norwegian PIU shall share such information either on its own initiative or at the request of Europol or Eurojust, within the scope of their respective mandates, or of the PIUs of the Member States.
2. The PIUs of Member States shall share with the Norwegian PIU PNR data, the results of processing those data, or analytical information based on PNR data, as soon as possible and in specific cases where necessary to prevent, detect, investigate, or prosecute terrorist offences or serious crime. The PIUs of Member States shall share such information on their own initiative or at the request of the Norwegian PIU.
3. The Parties shall ensure that the information referred to in paragraphs 1 and 2 is shared in accordance with applicable rules on law enforcement cooperation or information sharing between Norway and Europol or Eurojust, or the relevant Member State. In particular, the exchange of information with Europol under this Article shall take place through a secure communication channel established for the exchange of information.
CHAPTER V
DATA PROTECTION
Article 16
Rights and obligations under Directive (EU) 2016/680
1. Norway shall ensure that, in respect of the processing of personal data by competent authorities for the purposes of this Agreement, it applies rights and obligations the same as those provided for in Directive (EU) 2016/680, including any amendments to that Directive that have been accepted and implemented by Norway in accordance with the Agreement concluded by the Council of the European Union and Iceland and Norway concerning the latters' association with the implementation, application and development of the Schengen acquis.
2. The processing of personal data by the Norwegian PIU shall be overseen by an independent supervisory authority established in accordance with the implementation and application by Norway of Directive (EU) 2016/680, including any amendments thereto that have been accepted and implemented by Norway in accordance with the Agreement concluded by the Council of the European Union and Iceland and Norway concerning the latters' association with the implementation, application and development of the Schengen acquis.
3. This Article is without prejudice to the application of any more specific provisions in this Agreement relating to the processing of PNR data.
Article 17
Transparency and information
1. Norway shall ensure that the Norwegian PIU makes the following information available on its website:
|
(a) |
a list of the legislation authorising the transfer of PNR data by air carriers; |
|
(b) |
the reason for the collection and storage of PNR data; |
|
(c) |
the manner of processing and protecting the PNR data; |
|
(d) |
the manner and extent to which the PNR data may be disclosed to other competent authorities; and |
|
(e) |
contact information for inquiries. |
2. Norway shall work with interested third parties, such as the aviation and air travel industry, to promote transparency at the time of booking regarding the reasons for the collection and processing of PNR data, and regarding how to request access, rectification and redress.
3. If PNR data retained in accordance with Article 11 has been disclosed in accordance with Article 13 or Article 14, Norway shall inform, taking into account reasonable efforts, the passengers concerned by means of the modalities set out pursuant to Article 13(2)(d) of Directive (EU) 2016/680, and within a reasonable time once such notification is no longer liable to jeopardise the investigations by the public authorities concerned to the extent the relevant contact information of the passengers is available or can be retrieved.
CHAPTER VI
FINAL PROVISIONS
Article 18
Notifications
1. Norway shall notify the Union through diplomatic channels in writing of the details of the following authorities:
|
(a) |
the Norwegian PIU referred to in Article 2(4); |
|
(b) |
the national supervisory authority referred to in Article 9(3). |
2. Norway shall notify without delay any changes to the information referred to in paragraph 1.
3. The Union shall make the information referred to in paragraphs 1 and 2 available to the public.
Article 19
Entry into force
1. This Agreement shall be approved by the Parties in accordance with their own procedures.
2. This Agreement shall enter into force on the first day of the month following the date of the receipt of the written notification by which Norway has notified the Union of the authorities referred to in Article 18(1) or the written notifications by which the Parties have notified each other through diplomatic channels that the procedures referred to in paragraph 1 of this Article have been completed, whichever is the later.
Article 20
Dispute resolution and suspension
1. The Parties shall resolve any dispute regarding the interpretation, application or implementation of this Agreement through consultations with a view to reaching a mutually acceptable resolution, including providing an opportunity for either Party to comply within a reasonable time.
2. Either Party may suspend in whole or in part the application of this Agreement by notification in writing to the other Party through diplomatic channels. Such written notification shall not be made until after the Parties have engaged in a reasonable period of consultation. The suspension shall come into effect two months from the date of such notification, unless the Parties jointly decide otherwise.
3. The Party that has suspended the application of this Agreement shall immediately inform the other Party of the date on which the application of this Agreement will resume, once it considers that the reasons for the suspension no longer apply. The suspending Party shall notify the other Party in writing.
4. Norway shall continue to apply the terms of this Agreement to all PNR data received before any suspension of this Agreement.
Article 21
Termination
1. This Agreement may be terminated at any time by either of the Parties by written notification through diplomatic channels. The termination shall take effect three months after the date of receipt of the written notification.
2. If either Party gives notice of termination under this Article, the Parties shall decide what measures are needed to ensure that any cooperation initiated under this Agreement is concluded in an appropriate manner.
3. Norway shall continue to apply the terms of this Agreement to all PNR data received before any termination of this Agreement.
Article 22
Amendments
1. This Agreement may be amended at any time by mutual consent between the Parties. The amendments to this Agreement shall enter into force in accordance with Article 19.
2. The Annex to this Agreement may be updated, by mutual consent between the Parties expressed by written notification exchanged through diplomatic channels. Such updates shall enter into force on the date referred to in Article 19(2).
Article 23
Consultation and evaluation
1. The Parties shall enter into consultation with respect to issues related to the monitoring of the implementation of this Agreement. They shall advise each other of any measure that may affect this Agreement.
2. The Parties shall carry out a joint evaluation of the implementation of this Agreement if requested by either Party and jointly decided. In conducting such an evaluation, the Parties shall pay special attention to the necessity and proportionality of processing PNR data for each of the purposes set out in Article 5. The Parties shall decide in advance on the modalities of such evaluations.
Article 24
Territorial application
1. This Agreement shall apply to the territory of the Union in accordance with the Treaty on European Union and the Treaty on the Functioning of the European Union and to the territory of Norway.
2. By the date of entry into force of this Agreement, the Union shall notify Norway of the Member States to the territories of which this Agreement applies. It may subsequently, at any time, notify any changes thereto.
This Agreement shall be drawn up in duplicate in the Bulgarian, Croatian, Czech, Danish, Dutch, English, Estonian, Finnish, French, German, Greek, Hungarian, Irish, Italian, Latvian, Lithuanian, Maltese, Polish, Portuguese, Romanian, Slovak, Slovenian, Spanish, Swedish and Norwegian languages, each text being equally authentic. In the event of any divergence between the texts of this Agreement, the English text shall prevail.
IN WITNESS WHEREOF, the undersigned Plenipotentiaries, duly authorised to this effect, have signed this Agreement.
(1) Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (OJ EU L 119, 4.5.2016, p. 132, ELI: http://data.europa.eu/eli/dir/2016/681/oj).
(2) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj).
(3) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ EU L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).
(4) Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters' association with the implementation, application and development of the Schengen acquis (OJ EU L 176, 10.7.1999, p. 36, ELI: http://data.europa.eu/eli/agree_internation/1999/439(1)/oj).
(5) Regulation (EU) 2025/13 of the European Parliament and of the Council of 19 December 2024 on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending Regulation (EU) 2019/818 (OJ EU L, 2025/13, 8.1.2025, ELI: http://data.europa.eu/eli/reg/2025/13/oj).
ANNEX
PASSENGER NAME RECORD DATA ELEMENTS REFERRED TO IN ARTICLE 2(5)
1.
PNR record locator
2.
Date of reservation/issue of ticket
3.
Date(s) of intended travel
4.
Name(s)
5.
Address and contact information, namely telephone number and email address relating to the passengers
6.
Information relating to the payment methods for, and billing of, the air ticket
7.
Complete travel itinerary for specific PNR
8.
Frequent flyer data relating to the passenger(s) (status and frequent flyer number)
9.
Travel agency/travel agent
10.
Travel status of passenger, including confirmations, check-in status, no-show or go-show information
11.
Split/divided PNR information
12.
Information relating to unaccompanied minors under 18 years: name, gender, age, language(s) spoken, name and contact details of guardian on departure and relationship to the minor, name and contact details of guardian on arrival and relationship to the minor, name of departure and arrival agent
13.
Ticketing field information, including ticket number, date of ticket issuance and one-way tickets, automated ticket fare quote fields
14.
Seat number and other seat information
15.
Code share information
16.
All baggage information
17.
Number and other names of travellers on the PNR
18.
Any advance passenger information (API) data elements as far as already collected by carriers
19.
All historical changes to the PNR listed in points 1 to 18
ELI: http://data.europa.eu/eli/agree_internation/2026/1917/oj
ISSN 1977-0677 (electronic edition)