The National Travel Data Agency (ANDV) is an interministerial service, nationally competent, attached to the Ministry of the Interior and under the authority of the general director of the French national police (DGPN).

The ANDV is in charge of the design, the implementation and the improvement of collection and exploitation systems for travel data (reservation, check-in and boarding data of the passengers) in air, sea and land transports, departing from France or arriving in France. The agency is also responsible for the collection of the data, checks its quality and reliability, and as such assumes the function of Passengers Information Unit (PIU), as provided by the European directive 2016/681.

Each EU member state is required to establish a Passenger Information Unit (PIU), in accordance with EU Directive 2016/681.

A PIU is in charge of:

• Collecting, retaining and processing data as well as transferring the data or results of the processing to the competent national authorities;
• Exchanging PNR data and the results of data processing with other member States and Europol.

A PIU therefore ensures the interface between air passengers’ data and the operational services of the EU member States.

The French PIU was created by the decree of the 22nd December 2014, repealed by the decree of the 29th April 2022. Since the 1st of July 2022, its missions are carried out by the National Travel Data Agency (ANDV).

The CNIL has been consulted about the processing of API and PNR data and has given a favourable opinion.

The processing of API and PNR data has been implemented in compliance with the French Law n°78-17 of the 6th January 1978 related to data processing, data files and individual liberties.

Competent authorities may only submit a request to the ANDV for the protection of the fundamental interests of the nation, the prevention and detection of terrorist offences and serious crime, as well as investigation and prosecution on such matters. API and PNR data can only be processed in the following cases:

• To carry out assessments of the passengers before their arrival, based on predefined risk criteria, and relevant databases in terms of law enforcement;
• For specific investigations or prosecutions;
• For the elaboration of risk assessment criteria.

Competent authorities do not have a direct access to the API-PNR France system and to the data it contains. Indeed, the nominally and specifically authorised services and agents can only submit a request to the ANDV, which checks its legal conformity in order to validate or refuse it.

Article L.232-7-1 of the Internal Security Code provides that the API-PNR France system does not collect nor process any data known as “sensitive”, as defined in Article 8 of the Law of the 6th January 1978, i.e. “data which may reveal, directly or indirectly, the racial or ethnic origins, political, philosophical or religious opinions, trade-union membership, or related to the health or the sex life of a moral person”.

Currently, air transport data is collected and processed in the API-PNR system. However, the decree establishing the ANDV provides that the agency is responsible for implementing and improving the systems for collecting and processing data, as well as collecting travel data for air, sea, rail and road transport.

Passengers must be informed by air carriers of the collection of their data in the API-PNR system. They shall find the following mention in the electronic media, interfaces and forms used for the reservation of their trip:

“Pursuant to Article L.232-7 of the Internal Security Code, we inform you that air carriers are required to transmit their passengers’ reservation, check-in and boarding data (PNR/ API) to the French administration, according to the processing procedures and the purposes provided by Decree N°2014-1095 of the 26 September 2014, modified by Decree N°2018-714 of the 3 August 2018”.

The ANDV regularly checks that air carriers comply with this obligation.

Passengers can access their personal data collected in the API-PNR system by contacting the National Travel Data Agency (ANDV) via the following email address: andv-voyageur@interieur.gouv.fr.

Passengers do have a rectification right on their personal data collected in the API-PNR system. This right can be exercised by contacting the National Travel Data Agency (ANDV) via the following email address: andv-voyageur@interieur.gouv.fr.

Pursuant to Article L.232-4 of the Internal Security Code, air carriers are required to provide the French administration with information on passengers on flights to and from French territory, under the conditions and limits set by French and European regulations.

Companies that are not connected to the API-PNR France system are invited to contact the ANDV at the following address: relations-compagnies@uip.pnr.gouv.fr.