Regarding the model of implementation of the function of collecting information about passengers of all types of transport, including API/PNR
Authors: Kysil Liudmyla , Shevchuk Yaroslav 
Published: December 2024

Introduction. The war waged by the Russian Federation against Ukraine brought to the fore the issue of proper legal protection, among other things, countering terrorism. Article 1 of the Law of Ukraine «On Combating Terrorism» was supplemented by the Law of Ukraine dated March 21, 2023 with the legislative definition of «advance passenger information/passenger name record» (API) and «passenger registration records»(PNR). This approach of the domestic legislator corresponds to the international experience in the specified area, according to which preliminary information about passengers and passenger registration records are used by the governments of foreign countries to identify passengers who may pose a risk to the national security of the country, before they reach the checkpoint through the state border, is a powerful a tool for security, intelligence and law enforcement agencies of the state in their activities to fight terrorism, transnational organized crime.

The aim of the article is based on the analysis of international regulatory and legal acts and domestic legislation in the field of countering international terrorism, prevention, detection, investigation of criminal oﬀenses committed with terrorist intent, other serious and especially serious crimes, as well as prevention of the movement of persons who may constitute threat to the national security of Ukraine, to propose a domestic model of the implementation of the function of collecting information about passengers of all types of transport, including API/PNR, in order to form a unified state approach.

Results. The UN Security Council, adopting Resolutions No. 2170 (2014), No. 2178 (2014), No. 2309 (2016), No. 2396 (2017) and No. 2482 (2019), relating to the fight against international terrorism, obliges required Member States to: require airlines operating on their territory to provide the relevant national authorities with advance passenger information in order to detect cases of entry, exit or transit through the territory of the country on board civil aviation aircraft of persons with high risk; to take measures aimed at preventing the entry (transit) through its territory of persons with regard to whom there is information about their intention to commit a terrorist act or carry out terrorist activities; strengthen international cooperation in the field of combating international terrorism. In the EU, the collection of information about passengers is regulated by special EU Directives: 2004/82/EC on the obligations of carriers to report passenger data (API) and 2016/681/EC on the use of passenger registration records (PNR). In particular, according to EU Directive 2016/681, the European Union obliges its member states and calls on candidate countries to collect passenger data in accordance with the API and PNR Directives.

Directive 2016/681 also established a single mandatory approach to the formation of national PNR data processing systems for all EU member states:
• development and adoption of national legislation that would be maximally consistent with the provisions of Directive 2016/681, which would create a legal basis for the collection, processing and transmission of PNR data;
• establish or appoint an authorized body for the prevention, detection, investigation and prosecution of terrorist and serious crimes, which will function as the National Passenger Information Processing Authority (PIU);
• integration of national PIUs with the relevant unit of EUROPOL;
• national competent authorities should not have continuous direct access to passenger data, but should instead cooperate with the PIU;
• the time of transmission of PNR messages to the PIU should be: the first — 48 — 24 hours before the scheduled departure, the second — at the actual time of departure (completion of boarding);
• transmission and processing of PNR data also involves transmission and processing of ARI data;
• data transmission standards and formats must comply with accepted international standards;
• the data must be stored for 5 years, but already after 6 months from the moment of entry into the relevant PIU information system, they must be depersonalized, and access to them must be granted only with the permission of the court.

As of December 2020, the above requirements have already been implemented in all EU member states.
How are the above-mentioned provisions of international legal acts implemented by the domestic legislator? If we refer to the Law of Ukraine dated September 20, 2022

«On the Ratification of the Additional Protocol to the Convention of the Council of Europe on the Prevention of Terrorism», it clearly states that, in accordance with Article 7 of the Additional Protocol to the Convention of the Council of Europe on the Prevention of Terrorism, the contact point responsible for the exchange of information about persons who travel abroad with a terrorist purpose is the Security Service of Ukraine. The Anti-Terrorist Center operates under the Security Service of Ukraine to organize and conduct anti-terrorist operations and coordinate the activities of entities fighting terrorism or involved in anti-terrorist operations.

The legislator entrusts the ATC under the SBU with, among other things, the following functions: participation in the preparation of drafts of international treaties of Ukraine, preparation and submission in the established order of proposals for improving the legislation of Ukraine in the field of combating terrorism, financing of actions by entities fighting terrorism, anti-terrorist operations, implementation of measures to prevent, detect and stop terrorist activities; forming and maintaining a list of terrorist organizations and groups; national coordination of the implementation of UN Security Council resolutions on combating international terrorism; interaction with special services, law enforcement agencies of foreign countries and international organizations on issues of combating terrorism and exchange of available information about passengers of international flights.

Results. Taking into account international experience, guided by the requirements of the principle of the rule of law and the principle of legality, based on the analysis of the current legislation of Ukraine, it can be concluded that the most optimal model of the implementation of the function of collecting information about passengers of all types of transport for the purpose of countering international terrorism, prevention, detection, investigation of criminal oﬀenses , committed with terrorist intent, other serious and especially serious crimes, as well as preventing the movement of persons who may pose a threat to the national security of Ukraine, including API/PNR, it depends on the ATC at the SBU. Therefore, the national authorized body for processing information about passengers should become the ATC under the SBU.

Key words: passenger information (API), passenger registration records (PNR), combating international terrorism, SBU, ATC under the SBU, DPS Administration of Ukraine, model for implementing the function of collecting information about passengers.