How to request your passenger data

What records exist

In the EU, each member state has a Passenger Information Unit (PIU) that collects PNR from air carriers, stores and processes it ¹. The PIU keeps PNR for five years and masks names, contact details and payment information after six months ¹.

Canada's Travel History Report lists entries, exits or both, with name, date of birth, citizenship, gender, date and port of entry, and document numbers such as a passport number ⁹. The UK Subject Access Request Unit covers records held by UK Visas and Immigration, Border Force and citizenship ³.

EU member states: asking the PIU

Article 13 of the EU PNR Directive gives every passenger rights of access, rectification, erasure and restriction, plus compensation and judicial redress ¹. Each PIU must appoint a data protection officer. A passenger has the right to contact that officer as a single point of contact on all issues about their PNR ¹.

Article 13 refers to Framework Decision 2008/977/JHA. Directive (EU) 2016/680 repealed that decision with effect from 6 May 2018, and references to it are read as references to the 2016 directive ². Under Article 14 of that directive, you can ask whether data about you is processed and get access to it ².

Where access is refused or restricted, Article 17 lets you exercise your rights through the national supervisory authority ². The authority then tells you that it carried out the checks or a review, and that you can seek a judicial remedy ².

United Kingdom

The Home Office Subject Access Request Unit (SARU) handles requests for records held by UK Visas and Immigration and Border Force ³. Requests are free and go through the online form at visas-immigration.service.gov.uk/product/saru. People with no UK address email [email protected] ³. SARU replies within one month of receiving all supporting documents and can extend complex cases ³. You choose one of three options ³.

• Basic: digital records held since 2000, such as immigration history and landing cards ³.
• Specific: up to 5 single documents you name ³.
• Detailed: an electronic summary plus the paper file records you specify ³.
• Send a colour copy of photo ID and a signed letter of authority dated within the last 6 months. Documents that do not arrive within 7 days lead to automatic rejection ³.

United States: FOIA and DHS TRIP

Article 11 of the EU-US PNR agreement lets any person, whatever their nationality, country of origin or residence, request their PNR from DHS under the Freedom of Information Act ⁸. U.S. Customs and Border Protection asks requesters to use the DHS FOIA portal. Mailed requests go to 90 K ST NE MS 1181, Washington DC 20229 ⁷.

DHS TRIP is a single point of contact for people denied or delayed at boarding, denied or delayed entry or exit at a US port of entry, or repeatedly sent to secondary screening ⁶. You apply at trip.dhs.gov and receive a Redress Control Number to track the case and to give when booking flights ⁶. Article 13 of the EU-US agreement names DHS TRIP as the administrative redress route and allows review of final DHS action in US federal court ⁸.

Canada

The Canada Border Services Agency (CBSA) issues a Travel History Report on request under the Privacy Act ⁹. You apply through the Access to Information and Privacy online request service at atip-aiprp.tbs-sct.gc.ca. Your own report is free and processing can take up to 30 days ⁹.

State whether you want entry data, exit data or both. CBSA includes exit information only when asked. Someone acting for you needs form BSF745 signed by you ⁹.

Kenya

Kenya's Office of the Data Protection Commissioner (ODPC) lists the right to access personal data held by a data controller or processor, the right to correct or delete false or misleading data, and the right to object to processing ¹⁰. A parent, guardian or person duly authorised by you can exercise these rights for you ¹⁰. The ODPC rights page does not set out a request procedure or a deadline for controllers ¹⁰. The ODPC home page links to an online complaint portal at cie.odpc.go.ke ⁴.

What can be withheld

EU law lets member states restrict access where this is a necessary and proportionate measure, for example to avoid obstructing investigations or to protect public or national security ². The controller must tell you in writing of a refusal and its reasons. Reasons can be held back where giving them would undermine the restriction ².

In the UK, the immigration exemption lets the Home Office withhold data from an access request where disclosure would be likely to prejudice effective immigration control ⁵. The ICO says only the Secretary of State can use it, case by case, where necessary and proportionate ⁵.

In the US, DHS may limit PNR access for reasons such as privacy, national security or law enforcement sensitivity. Any refusal must be in writing with its legal basis and redress options ⁸.