Passenger Information Units

What a PIU does

Under Article 4(2) of Directive (EU) 2016/681, the PIU collects PNR data from air carriers, stores and processes it, and passes data or results to competent authorities. It exchanges information with other PIUs and with Europol ¹. The European Commission describes PIUs as comparing PNR data against law enforcement databases and pre-set criteria ².

Article 6(2) gives the PIU three ways to process data ¹.

• Assess passengers before scheduled arrival or departure, to identify people who need further examination ¹.
• Respond, case by case, to a duly reasoned request from a competent authority ¹.
• Analyse PNR data to update or create new assessment criteria ¹.
• Any positive match from automated processing must be reviewed individually by non-automated means ¹.

How a PIU is set up in the EU

A Member State may make its PIU a branch of a competent authority. Staff may be seconded from competent authorities, and the PIU must have adequate resources. Two or more Member States may designate one shared PIU located in one of them. Each Member State must notify the Commission of its PIU within one month of setting it up ¹.

Each Member State must adopt a list of the competent authorities that may request or receive PNR data or results from the PIU. These must be authorities that prevent, detect, investigate or prosecute terrorist offences or serious crime ¹. Europol may request data case by case through the Europol National Unit, and exchanges run through the SIENA network ¹.

Regulation (EU) 2025/13 of 19 December 2024 adds API data. Air carriers send encrypted API data to a central router, which passes it to PIUs without changing its content. The PIU is a separate controller for that data ⁴.

Limits set by the Court of Justice

On 21 June 2022, the Court of Justice ruled in Case C-817/19, Ligue des droits humains. The case challenged the Belgian law of 25 December 2016 and was referred by Belgium's Constitutional Court ⁵.

• The PIU may compare data only against databases on persons or objects sought or under alert ⁵.
• The PIU may not use artificial intelligence in self-learning systems to assess passengers ⁵.
• Each hit must be checked by a person, using clear and objective review criteria ⁵.
• Disclosure of data after arrival or departure needs prior review by a court or an independent administrative body, except in duly justified urgency ⁵.
• PNR processing within the EU may not be used to improve border controls or combat illegal immigration ⁵.

Oversight and reviews

Article 5 requires each PIU to appoint a data protection officer to monitor PNR processing. Article 15 makes the national supervisory authority responsible for advising on and monitoring the Directive, handling complaints and checking lawfulness ¹. ICAO Standard 9.28 in Annex 9 asks states to designate one or more authorities to oversee PNR data protection independently ⁶.

The Commission's review report of 24 July 2020 said the vast majority of Member States had fully operational PIUs. It found that data protection officers could check the lawfulness of processing independently ⁷. The report gave no exact count of operational PIUs ⁷.

Examples inside and outside the EU

• Belgium: the law of 25 December 2016 transposed the PNR Directive into Belgian law and was the subject of the 2022 Court of Justice ruling ⁵.
• Philippines: on 20 March 2025, UNOCT said goTravel was in full production in the Philippines, with the Department of Justice and the Bureau of Immigration leading the work. The press release does not name a PIU ⁸.
• UN programme states: the CT Travel Programme supports a PIU as a single window that checks data from air, sea and land travel against national and international watch lists, including INTERPOL's ³. The goTravel brochure says PIUs collect, share, analyse and disseminate data ⁹.