1.   The purpose of this Agreement is to ensure security and to protect the life and safety of the public.

2.   For this purpose, this Agreement sets forth the responsibilities of the Parties with respect to the conditions under which PNR may be transferred, processed and used, and protected.

1.   PNR, as set forth in the Guidelines of the International Civil Aviation Organisation, shall mean the record created by air carriers or their authorised agents for each journey booked by or on behalf of any passenger and contained in carriers’ reservation systems, departure control systems, or equivalent systems providing similar functionality (collectively referred to in this Agreement as ‘reservation systems’). Specifically, as used in this Agreement, PNR consists of the data types set forth in the Annex to this Agreement (‘Annex’).

2.   This Agreement shall apply to carriers operating passenger flights between the European Union and the United States.

3.   This Agreement shall also apply to carriers incorporated or storing data in the European Union and operating passenger flights to or from the United States.

1.   The United States collects, uses and processes PNR for the purposes of preventing, detecting, investigating, and prosecuting:

2.   PNR may be used and processed on a case-by-case basis where necessary in view of a serious threat and for the protection of vital interests of any individual or if ordered by a court.

3.   PNR may be used and processed by DHS to identify persons who would be subject to closer questioning or examination upon arrival to or departure from the United States or who may require further examination.

4.   Paragraphs 1, 2, and 3 shall be without prejudice to domestic law enforcement, judicial powers, or proceedings, where other violations of law or indications thereof are detected in the course of the use and processing of PNR.

1.   DHS shall ensure that appropriate technical measures and organisational arrangements are implemented to protect personal data and personal information contained in PNR against accidental, unlawful or unauthorised destruction, loss, disclosure, alteration, access, processing or use.

2.   DHS shall make appropriate use of technology to ensure data protection, security, confidentiality and integrity. In particular, DHS shall ensure that:

3.   In the event of a privacy incident (including unauthorised access or disclosure), DHS shall take reasonable measures to notify affected individuals as appropriate, to mitigate the risk of harm of unauthorised disclosures of personal data and information, and to institute remedial measures as may be technically practicable.

4.   Within the scope of this Agreement, DHS shall inform without undue delay the relevant European authorities about cases of significant privacy incidents involving PNR of EU citizens or residents resulting from accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, or any unlawful forms of processing or use.

5.   The United States confirms that effective administrative, civil, and criminal enforcement measures are available under US law for privacy incidents. DHS may take disciplinary action against persons responsible for any such privacy incident, as appropriate, to include denial of system access, formal reprimands, suspension, demotion, or removal from duty.

6.   All access to PNR, as well as its processing and use, shall be logged or documented by DHS. Logs or documentation shall be used only for oversight, auditing, and system maintenance purposes or as otherwise required by law.

1.   To the extent that PNR of a passenger as collected includes sensitive data (i.e. personal data and information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or data concerning the health or sex life of the individual), DHS shall employ automated systems to filter and mask out sensitive data from PNR. In addition, DHS shall not further process or use such data, except in accordance with paragraphs 3 and 4.

2.   DHS shall provide to the European Commission within 90 days of the entry into force of this Agreement a list of codes and terms identifying sensitive data that shall be filtered out.

3.   Access to, as well as processing and use of, sensitive data shall be permitted in exceptional circumstances where the life of an individual could be imperilled or seriously impaired. Such data may be exclusively accessed using restrictive processes on a case-by-case basis with the approval of a DHS senior manager.

4.   Sensitive data shall be permanently deleted not later than 30 days from the last receipt of PNR containing such data by DHS. However, sensitive data may be retained for the time specified in US law for the purpose of a specific investigation, prosecution or enforcement action.

1.   DHS retains PNR in an active database for up to five years. After the initial six months of this period, PNR shall be depersonalised and masked in accordance with paragraph 2 of this Article. Access to this active database shall, unless otherwise permitted by this Agreement, be restricted to a limited number of specifically authorised officials.

2.   To achieve depersonalisation, personally identifiable information contained in the following PNR data types shall be masked out:

3.   After this active period, PNR shall be transferred to a dormant database for a period of up to ten years. This dormant database shall be subject to additional controls, including a more restricted number of authorised personnel, as well as a higher level of supervisory approval required before access. In this dormant database, PNR shall not be repersonalised except in connection with law enforcement operations and then only in connection with an identifiable case, threat or risk. As regards the purposes as set out in Article 4(1)(b), PNR in this dormant database may only be repersonalised for a period of up to five years.

4.   Following the dormant period, data retained must be rendered fully anonymised by deleting all data types which could serve to identify the passenger to whom PNR relate without the possibility of repersonalisation.

5.   Data that are related to a specific case or investigation may be retained in an active PNR database until the case or investigation is archived. This paragraph is without prejudice to data retention requirements for individual investigation or prosecution files.

6.   The Parties agree that, within the framework of the evaluation as provided for in Article 23(1), the necessity of a 10-year dormant period of retention will be considered.

1.   DHS shall provide information to the travelling public regarding its use and processing of PNR through:

2.   DHS shall publish and provide to the EU for possible publication its procedures and modalities regarding access, correction or rectification, and redress procedures.

3.   The Parties shall work with the aviation industry to encourage greater visibility to passengers at the time of booking on the purpose of the collection, processing and use of PNR by DHS, and on how to request access, correction and redress.

1.   In accordance with the provisions of the Freedom of Information Act, any individual, regardless of nationality, country of origin, or place of residence is entitled to request his or her PNR from DHS. DHS shall timely provide such PNR subject to the provisions of paragraphs 2 and 3 of this Article.

2.   Disclosure of information contained in PNR may be subject to reasonable legal limitations, applicable under US law, including any such limitations as may be necessary to safeguard privacy-protected, national security, and law enforcement sensitive information.

3.   Any refusal or restriction of access shall be set forth in writing and provided to the requesting individual on a timely basis. Such notification shall include the legal basis on which information was withheld and shall inform the individual of the options available under US law for seeking redress.

4.   DHS shall not disclose PNR to the public, except to the individual whose PNR has been processed and used or his or her representative, or as required by US law.

1.   Any individual regardless of nationality, country of origin, or place of residence may seek the correction or rectification, including the possibility of erasure or blocking, of his or her PNR by DHS pursuant to the processes described in this Agreement.

2.   DHS shall inform, without undue delay, the requesting individual in writing of its decision whether to correct or rectify the PNR at issue.

3.   Any refusal or restriction of correction or rectification shall be set forth in writing and provided to the requesting individual on a timely basis. Such notification shall include the legal basis of such refusal or restriction and shall inform the individual of the options available under US law for seeking redress.

1.   Any individual regardless of nationality, country of origin, or place of residence whose personal data and personal information has been processed and used in a manner inconsistent with this Agreement may seek effective administrative and judicial redress in accordance with US law.

2.   Any individual is entitled to seek to administratively challenge DHS decisions related to the use and processing of PNR.

3.   Under the provisions of the Administrative Procedure Act and other applicable law, any individual is entitled to petition for judicial review in US federal court of any final agency action by DHS. Further, any individual is entitled to petition for judicial review in accordance with applicable law and relevant provisions of:

4.   In particular, DHS provides all individuals an administrative means (currently the DHS Traveller Redress Inquiry Program (DHS TRIP)) to resolve travel-related inquiries including those related to the use of PNR. DHS TRIP provides a redress process for individuals who believe they have been delayed or prohibited from boarding a commercial aircraft because they were wrongly identified as a threat. Pursuant to the Administrative Procedure Act and Title 49, United States Code, Section 46110, any such aggrieved individual is entitled to petition for judicial review in US federal court from any final agency action by DHS relating to such concerns.

1.   Compliance with the privacy safeguards in this Agreement shall be subject to independent review and oversight by Department Privacy Officers, such as the DHS Chief Privacy Officer, who:

They shall, in particular, ensure that complaints relating to non-compliance with this Agreement are received, investigated, responded to, and appropriately redressed. These complaints may be brought by any individual, regardless of nationality, country of origin, or place of residence.

2.   In addition, application of this Agreement by the United States shall be subject to independent review and oversight by one or more of the following entities:

Such oversight may be manifested in the findings and recommendations of public reports, public hearings, and analyses.

1.   For the purposes of this Agreement, carriers shall be required to transfer PNR to DHS using the ‘push’ method, in furtherance of the need for accuracy, timeliness and completeness of PNR.

2.   Carriers shall be required to transfer PNR to DHS by secure electronic means in compliance with the technical requirements of DHS.

3.   Carriers shall be required to transfer PNR to DHS in accordance with paragraphs 1 and 2, initially at 96 hours before the scheduled flight departure and additionally either in real time or for a fixed number of routine and scheduled transfers as specified by DHS.

4.   In any case, the Parties agree that all carriers shall be required to acquire the technical ability to use the ‘push’ method not later than 24 months following entry into force of this Agreement.

5.   DHS may, where necessary, on a case-by-case basis, require a carrier to provide PNR between or after the regular transfers described in paragraph 3. Wherever carriers are unable, for technical reasons, to respond timely to requests under this Article in accordance with DHS standards, or, in exceptional circumstances in order to respond to a specific, urgent, and serious threat, DHS may require carriers to otherwise provide access.

1.   DHS may share PNR only pursuant to a careful assessment of the following safeguards:

2.   When transferring analytical information obtained from PNR under this Agreement, the safeguards set forth in paragraph 1 of this Article shall be respected.

1.   The United States may transfer PNR to competent government authorities of third countries only under terms consistent with this Agreement and only upon ascertaining that the recipient’s intended use is consistent with those terms.

2.   Apart from emergency circumstances, any such transfer of data shall occur pursuant to express understandings that incorporate data privacy protections comparable to those applied to PNR by DHS as set out in this Agreement.

3.   PNR shall be shared only in support of those cases under examination or investigation.

4.   Where DHS is aware that PNR of a citizen or a resident of an EU Member State is transferred, the competent authorities of the concerned Member State shall be informed of the matter at the earliest appropriate opportunity.

5.   When transferring analytical information obtained from PNR under this Agreement, the safeguards set forth in paragraphs 1 to 4 shall be respected.

1.   Consistent with existing law enforcement or other information-sharing agreements or arrangements between the United States and any EU Member State or Europol and Eurojust, DHS shall provide to competent police, other specialised law enforcement or judicial authorities of the EU Member States and Europol and Eurojust within the remit of their respective mandates, as soon as practicable, relevant, and appropriate, analytical information obtained from PNR in those cases under examination or investigation to prevent, detect, investigate, or prosecute within the European Union terrorist offences and related crimes or transnational crime as described in Article 4(1)(b).

2.   A police or judicial authority of an EU Member State, or Europol or Eurojust, may request, within its mandate, access to PNR or relevant analytical information obtained from PNR that are necessary in a specific case to prevent, detect, investigate, or prosecute within the European Union terrorist offences and related crimes or transnational crime as described in Article 4(1)(b). DHS shall, subject to the agreements and arrangements noted in paragraph 1 of this Article, provide such information.

3.   Pursuant to paragraphs 1 and 2 of this Article, DHS shall share PNR only following a careful assessment of the following safeguards:

4.   When transferring analytical information obtained from PNR under this Agreement, the safeguards set forth in paragraphs 1 to 3 of this Article shall be respected.

1.   The Parties shall actively promote the cooperation of carriers within their respective jurisdictions with any PNR system operating or as may be adopted in the other’s jurisdiction, consistent with this Agreement.

2.   Given that the establishment of an EU PNR system could have a material effect on the Parties’ obligations under this Agreement, if and when an EU PNR system is adopted, the Parties shall consult to determine whether this Agreement would need to be adjusted accordingly to ensure full reciprocity. Such consultations shall in particular examine whether any future EU PNR system would apply less stringent data protection standards than those provided for in this Agreement, and whether, therefore, this Agreement should be amended.

1.   This Agreement shall not create or confer, under US law, any right or benefit on any person or entity, private or public. Each Party shall ensure that the provisions of this Agreement are properly implemented.

2.   Nothing in this Agreement shall derogate from existing obligations of the United States and EU Member States, including under the Agreement on Mutual Legal Assistance between the European Union and the United States of 25 June 2003 and the related bilateral mutual legal assistance instruments between the United States and EU Member States.

1.   The Parties shall jointly review the implementation of this Agreement one year after its entry into force and regularly thereafter as jointly agreed. Further, the Parties shall jointly evaluate this Agreement four years after its entry into force.

2.   The Parties shall jointly determine in advance the modalities and terms of the joint review and shall communicate to each other the composition of their respective teams. For the purpose of the joint review, the European Union shall be represented by the European Commission, and the United States shall be represented by DHS. The teams may include appropriate experts on data protection and law enforcement. Subject to applicable laws, participants in the joint review shall be required to have appropriate security clearances and to respect the confidentiality of the discussions. For the purpose of the joint review, DHS shall ensure appropriate access to relevant documentation, systems, and personnel.

3.   Following the joint review, the European Commission shall present a report to the European Parliament and the Council of the European Union. The United States shall be given an opportunity to provide written comments which shall be attached to the report.

1.   Any dispute arising from the implementation of this Agreement, and any matters related thereto, shall give rise to consultations between the Parties, with a view to reaching a mutually agreeable resolution, including providing an opportunity for either Party to cure within a reasonable time.

2.   In the event that consultations do not result in a resolution of the dispute, either Party may suspend the application of this Agreement by written notification through diplomatic channels, with any such suspension to take effect 90 days from the date of such notification, unless the Parties otherwise agree to a different effective date.

3.   Notwithstanding any suspension of this Agreement, all PNR obtained by DHS pursuant to this Agreement prior to its suspension shall continue to be processed and used in accordance with the safeguards of this Agreement.

1.   Either Party may terminate this Agreement at any time by written notification through diplomatic channels.

2.   Termination shall take effect 120 days from the date of such notification, unless the Parties otherwise agree to a different effective date.

3.   Prior to any termination of this Agreement, the Parties shall consult each other in a manner which allows sufficient time for reaching a mutually agreeable resolution.

4.   Notwithstanding any termination of this Agreement, all PNR obtained by DHS pursuant to this Agreement prior to its termination shall continue to be processed and used in accordance with the safeguards of this Agreement.

1.   Subject to Article 25, this Agreement shall remain in force for a period of seven years from the date of its entry into force.

2.   Upon the expiry of the period set forth in paragraph 1 of this Article, as well as any subsequent period of renewal under this paragraph, the Agreement shall be renewed for a subsequent period of seven years unless one of the Parties notifies the other in writing through diplomatic channels, at least twelve months in advance, of its intention not to renew the Agreement.

3.   Notwithstanding the expiration of this Agreement, all PNR obtained by DHS under the terms of this Agreement shall continue to be processed and used in accordance with the safeguards of this Agreement. Similarly, all PNR obtained by DHS under the terms of the Agreement between the United States of America and the European Union on the processing and transfer of passenger name record (PNR) data by air carriers to the United States Department of Homeland Security (DHS), signed at Brussels and Washington, 23 and 26 July 2007, shall continue to be processed and used in accordance with the safeguards of that Agreement.

1.   This Agreement shall enter into force on the first day of the month after the date on which the Parties have exchanged notifications indicating that they have completed their internal procedures for this purpose.

2.   This Agreement, as of the date of its entry into force, shall supersede the 23 and 26 July 2007 Agreement.

3.   This Agreement will only apply to the territory of Denmark, the United Kingdom or Ireland, if the European Commission notifies the United States in writing that Denmark, the United Kingdom or Ireland has chosen to be bound by this Agreement.

4.   If the European Commission notifies the United States before the entry into force of this Agreement that it will apply to the territory of Denmark, the United Kingdom or Ireland, this Agreement shall apply to the territory of the relevant State on the same day as for the other EU Member States bound by this Agreement.

5.   If the European Commission notifies the United States before the entry into force of this Agreement that it will apply to the territory of Denmark, the United Kingdom or Ireland, this Agreement shall apply to the territory of the relevant State on the first day following receipt of the notification by the United States.