UN Security Council Resolution 2396 and ICAO Annex 9
- Resolution 2396 adopted
- 21 December 2017, 8148th meeting 1
- Vote
- Unanimous 2
- API duty
- States shall require airlines to provide API 1
- PNR duty
- States shall develop the capability to collect, process and analyse PNR 1
- Annex 9 edition
- Sixteenth edition (Amendment 29), applicable 18 November 2022 4
What Resolution 2396 decides
The resolution was adopted unanimously 2. It deals with foreign terrorist fighters. Four of its operative paragraphs open with "Decides that Member States shall" 1.
- Paragraph 11, API: states shall require airlines operating in their territories to provide API to national authorities, in line with the ICAO standard effective 23 October 2017. The aim is to detect foreign terrorist fighters and people on the lists of the 1267/1989/2253 sanctions committee 1.
- Paragraph 12, PNR: states shall develop the capability to collect, process and analyse PNR data and make it available to competent national authorities. The paragraph urges ICAO to work with its members to establish a standard for the collection of PNR data 1.
- Paragraph 13, watch lists: states shall develop watch lists or databases of known and suspected terrorists for law enforcement, border, customs, military and intelligence agencies 1.
- Paragraph 15, biometrics: states shall develop and implement systems to collect biometric data, such as fingerprints, photographs and facial recognition 1.
Human rights wording and capacity
Paragraphs 11 and 12 require "full respect for human rights and fundamental freedoms." Paragraph 15 says biometric systems must comply with "domestic law and international human rights law" 2. The operative paragraphs quoted in the UN press release do not use the words data protection or privacy 2.
Paragraph 14 encourages ICAO and the Counter-Terrorism Committee Executive Directorate to work together to identify where states need technical assistance 1. The press release says the Council recognised that PNR and biometric collection can be resource-intensive and take time to make operational 2.
ICAO Annex 9 and the PNR standards
Annex 9 to the Chicago Convention contains ICAO's Standards and Recommended Practices on facilitation. It covers border formalities for passengers and cargo, including customs and immigration, and rests on articles of the Convention including Articles 13, 22, 23 and 29 5.
The ICAO Council adopted Amendment 28 on 23 June 2020. It took effect on 30 October 2020 and applies from 28 February 2021 3,4. Amendment 28 replaced Standards 9.22 to 9.22.1 and Recommended Practice 9.23 with new provisions numbered 9.23 to 9.38 3.
Amendment 29 created the sixteenth edition of Annex 9. The ICAO Council adopted it on 9 March 2022 and it applies from 18 November 2022. It added a new Chapter 10 on health-related provisions 4.
| Provision | What it requires |
|---|---|
| Standard 9.23 3 | States develop PNR capability and set the rules in national law 3 |
| Standard 9.25 3 | Data security and rights of access, correction and redress 3 |
| Standard 9.27 3 | Automated processing on objective, precise and reliable criteria, with no significant adverse decision based solely on automation 3 |
| Standard 9.28 3 | One or more authorities to oversee PNR data protection independently 3 |
| Standard 9.29 3 | No processing of sensitive data except in exceptional, immediate cases 3 |
| Standard 9.30 and Recommended Practice 9.32 3 | Retention only as long as needed, then masking, with five years suggested as the maximum 3 |
How the EU responded
On 12 January 2021, the European Commission proposed the EU position on Amendment 28. It said Member States should notify a difference under Article 38 of the Chicago Convention, limited to Standard 9.34 on PNR transfers between states. It did not propose a disapproval under Article 90, and said the new standards advance data protection at international level 3.
Support for states and country examples
The UN Countering Terrorist Travel Programme was launched on 7 May 2019. It supports resolutions 2178 (2014), 2396 (2017) and 2482 (2019) and works with CTED, UNODC, ICAO, UNOICT, INTERPOL and IOM 6.
- The Gambia: on 6 September 2022, Minister of Interior Seyaka Sonko signed a memorandum of understanding with UNOCT on the goTravel software and the collection of API and PNR data. The press release cites resolution 2396 and ICAO standards 7.
- Philippines: on 20 March 2025, UNOCT announced that goTravel was in full production in the Philippines, citing resolutions 2178, 2396 and 2482 8.
- European Union: the Commission proposed a difference to ICAO Standard 9.34 for EU Member States 3.
Common questions
What does Resolution 2396 say about API?
Paragraph 11 decides that states shall require airlines operating in their territories to provide API to national authorities, in line with the ICAO standard 1.
When did the ICAO PNR standards start to apply?
Amendment 28 to Annex 9 applies from 28 February 2021 4. The ICAO Council adopted it on 23 June 2020 3.
What does Annex 9 say about how long PNR data is kept?
Standard 9.30 requires retention only for a necessary and proportionate period, followed by masking. Recommended Practice 9.32 suggests a maximum of five years 3.
Does Resolution 2396 cover biometrics?
Yes. Paragraph 15 decides that states shall develop and implement systems to collect biometric data 1.
Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email [email protected] with the official link.
Sources
- UN Security Council: Resolution 2396 (2017), S/RES/2396 (21 December 2017)
- UN Meetings Coverage: Security Council press release SC/13138 on resolution 2396 (December 2017)
- Council of the EU: Commission proposal COM(2021) 16 on the EU position on Amendment 28 to ICAO Annex 9 (12 January 2021)
- ICAO Middle East Office: Annex 9 recent developments, FAL webinar presentation (2022)
- ICAO: Annex 9, Facilitation (page checked 21 October 2026)
- UN Office of Counter-Terrorism: Countering Terrorist Travel Programme (page checked 21 October 2026)
- UN Office of Counter-Terrorism: press release on the CT Travel Programme MoU signing with The Gambia (6 September 2022)
- UN Office of Counter-Terrorism: press release on the launch of goTravel in the Philippines (20 March 2025)
Related
- Advance Passenger Information (API) explained
What API data is, which fields airlines send, who receives it, the legal basis, how long it is kept, and examples from four jurisdictions.
- Passenger Name Record (PNR) data explained
What PNR data is, the 19 EU data elements, who sends and receives it, the legal basis, retention rules and the 2022 EU Court of Justice ruling.
- Biometric data at borders
Which fingerprints and facial images border agencies collect from travellers, the legal basis, who holds the records and how long they are kept.
- The EU PNR Directive (Directive (EU) 2016/681)
What the EU PNR Directive requires of airlines and Member States, the 19 data elements it covers, retention rules, and what the EU Court of Justice ruled.
- The Gambia: passenger data rules and border system records
Data protection law status, the Securiport airport contract, National Audit Office findings and official and company responses in The Gambia.
- Watch-list matching of passenger data
How API and PNR data are compared with INTERPOL, national and UN lists, what happens after a hit, how false matches are handled and how to seek redress.