Background to the evaluation

This evaluation assesses Directive 2004/82/EC (the ‘API Directive’) adopted in 2004 with a transposition deadline of 5 September 2006 and evaluated for the first time in 2012. Advance Passenger Information (API) is commonly understood as the information of an air passenger collected at check-in or at the time of online check-in. API information includes biographic data of the passenger, ideally captured from the Machine Readable Zone of their travel documents, as well as some information related to their flight.

The Directive aims at improving border controls and combating illegal immigration by the transmission of advance passenger data by carriers to the competent national authorities. It also gives to implementing countries the possibility of using the data for law enforcement purposes.

The Commission launched an evaluation aimed at assessing the implementation of the Directive in terms of its relevance, coherence, effectiveness, efficiency and EU added value. A wide range of stakeholders, including Member States, carriers, industry, the public, EU Institutions and Agencies were consulted as part of the evaluation.

Main findings

Regarding the relevance of the Directive, the Evaluation found that the rationale for collecting API data is still valid 15 years after the entry into force of the Directive. The objectives (i.e. border control management, combating against irregular migration, law enforcement including fighting terrorism) remain highly pertinent to the needs of the relevant stakeholders and the wider societies. In addition, collecting API data is also relevant to facilitate legitimate travel, which is currently not per se an objective of the Directive. The professionalisation and internationalisation of terrorist and criminal groups and their cross-border activities, together with international calls for an increased use of API data, suggest that in the future this instrument will be even more relevant to support implementing countries in facing new challenges also in the light of UN requirements.

However, the lack of harmonisation in the implementation of the Directive is an obstacle to its effectiveness and coherence. As a result of the “minimum requirements” imposed by the Directive, the implementation of API systems and the actual usage of API data show a fragmented picture. In addition, the option left to implementing countries to collect and use API data for law enforcement purposes, without providing a clear definition of this purpose nor laying down a framework for processing data, led to a disjointed implementation at national level. There are also several discrepancies with other EU instruments causing operational challenges in practice and uncertainty for data subjects, and the data protection requirements are not in line with the most recent developments in the field. Furthermore, the API Directive is not fully coherent with the international regulatory framework on passenger information, especially as concerns data fields and transmission standards.

As concerns the efficiency, the perception by national authorities that the overall costs incurred from the implementation of API systems are proportionate and justified is only partially shared by air carriers, given the minimal benefits for them.

As regards the EU added value, the evaluation shows that it is unlikely that without EU intervention the benefits derived from the implementation of API systems would have been achieved on an EU-wide scale. The issues addressed by the Directive would continue to require action at EU level.

At the same time, the evaluation highlights a number of shortcomings related to the API Directive, i.e. the lack of (i) standardisation and harmonisation, (ii) detailed data protection safeguards and (iii) clear alignment with the latest policy and legal developments at EU level. These elements affect the impact of the Directive, create burden on the stakeholders and generate a certain level of legal uncertainty, both for the entities collecting and transmitting the data, for the authorities processing them, and ultimately for the data subjects. They should therefore be properly addressed in the general framework regulating API data as they are unlikely to solve over time.