COMMISSION STAFF WORKING DOCUMENT EXECUTIVE SUMMARY OF THE EVALUATION of Council Directive 2004/82/EC on the obligation of carriers to communicate passenger data (API Directive)
Date: 2020-09-08
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: air transport, application of EU law, border control, carriage of passengers, data protection, disclosure of information, fight against crime, migration control, personal data, terrorism

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 8.9.2020  SWD(2020) 175 final  COMMISSION STAFF WORKING DOCUMENT  EXECUTIVE SUMMARY OF THE EVALUATION  of Council Directive 2004/82/EC on the obligation of carriers to communicate passenger data (API Directive)  {SWD(2020) 174 final}  
 
 
Background to the evaluation 

This evaluation assesses Directive 2004/82/EC (the ‘API Directive’) adopted in 2004 with a 
transposition deadline of 5 September 2006 and evaluated for the first time in 2012. Advance 
Passenger Information (API) is commonly understood as the information of an air passenger 
collected at  check-in  or at  the time of online check-in.  API information includes biographic 
data  of  the  passenger,  ideally  captured  from  the  Machine  Readable  Zone  of  their  travel 
documents, as well as some information related to their flight. 

The  Directive  aims  at  improving  border  controls  and  combating  illegal  immigration  by  the 
transmission  of  advance  passenger  data  by  carriers  to  the  competent  national  authorities.  It 
also  gives  to  implementing  countries  the  possibility  of  using  the  data  for  law  enforcement 
purposes.  

The  Commission  launched  an  evaluation  aimed  at  assessing  the  implementation  of  the 
Directive  in  terms  of  its  relevance,  coherence,  effectiveness,  efficiency  and  EU  added 
value. A wide range of stakeholders, including Member States, carriers, industry, the public, 
EU Institutions and Agencies were consulted as part of the evaluation. 

Main findings 

Regarding  the  relevance  of  the  Directive,  the  Evaluation  found  that  the  rationale  for 
collecting  API  data  is  still  valid  15  years  after  the  entry  into  force  of  the  Directive.  The 
objectives  (i.e.  border  control  management,  combating  against  irregular  migration,  law 
enforcement including fighting terrorism) remain highly pertinent to the needs of the relevant 
stakeholders  and  the  wider  societies.  In  addition,  collecting  API  data  is  also  relevant  to 
facilitate  legitimate  travel,  which  is  currently  not  per  se  an  objective  of  the  Directive.  The 
professionalisation  and  internationalisation  of  terrorist  and  criminal  groups  and  their  cross-
border  activities,  together  with  international  calls  for  an  increased  use  of  API  data,  suggest 
that  in  the  future  this  instrument  will  be  even  more  relevant  to  support  implementing 
countries in facing new challenges also in the light of UN requirements1.  

However, the lack of harmonisation in the implementation of the Directive is an obstacle to 
its effectiveness and coherence. As a result of the “minimum requirements” imposed by the 
Directive,  the  implementation  of  API  systems  and  the  actual  usage  of  API  data  show  a 
fragmented picture.  In addition,  the option left  to implementing countries to  collect  and use 
API data for law enforcement purposes, without providing a clear definition of this purpose 
nor  laying  down  a  framework  for  processing  data,  led  to  a  disjointed  implementation  at 
national  level.  There  are  also  several  discrepancies  with  other  EU  instruments  causing 
operational  challenges  in  practice  and  uncertainty  for  data  subjects,  and  the  data  protection 

1 UN Security Council Resolutions 2178(2014), 2309(2016), 2396(2017) and 2482 (2019) 

1 

 
 
                                                           
requirements are not in line with the most recent developments in the field. Furthermore, the 
API Directive is not fully coherent with the international regulatory framework on passenger 
information, especially as concerns data fields and transmission standards.  

As  concerns  the  efficiency,  the  perception  by  national  authorities  that  the  overall  costs 
incurred  from  the  implementation  of  API  systems  are  proportionate  and  justified  is  only 
partially shared by air carriers, given the minimal benefits for them.  

As  regards  the  EU  added  value,  the  evaluation  shows  that  it  is  unlikely  that  without  EU 
intervention the benefits derived from the implementation of API  systems  would have been 
achieved  on  an  EU-wide  scale.  The  issues  addressed  by  the  Directive  would  continue  to 
require action at EU level.  

At  the  same  time,  the  evaluation  highlights  a  number  of  shortcomings  related  to  the  API 
Directive,  i.e.  the  lack  of  (i)  standardisation  and  harmonisation,  (ii)  detailed  data  protection 
safeguards and (iii) clear alignment with the latest policy and legal developments at EU level. 
These  elements  affect  the  impact  of  the  Directive,  create  burden  on  the  stakeholders  and 
generate a certain  level  of legal  uncertainty, both  for the entities collecting and transmitting 
the data, for the authorities processing them, and ultimately for the data subjects. They should 
therefore  be  properly  addressed  in  the  general  framework  regulating  API  data  as  they  are 
unlikely to solve over time. 

2