Penalties for failure to transfer Passenger Name Record data | In Principle

According to recent press reports, as many as 210 air carriers that operated air transport on routes to and from Poland in 2018 may be fined for breach of the Passenger Name Record Data Processing Act. In just four months (June–September 2021), the commander-in-chief of the Border Guard instituted some 17,000 proceedings against them seeking to impose administrative penalties, exposing them to fines that could total as high as PLN 640 million. Given that between 2018 and 2020 there were nearly 940,000 passenger-related flight operations (on both domestic and international routes) in Poland, this may represent just the tip of the iceberg.

These proceedings have been initiated and are pending under the Polish PNR Act (Passenger Name Record Data Processing Act of 9 May 2018), which entered into force on 29 May 2018. The PNR Act transposed the PNR Directive (Directive 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime) into Polish law.

The purpose of the directive was to harmonise at the EU level the procedure for obtaining by the member states’ national authorities of PNR data collected by air carriers and processing of PNR data (including transfer between authorities) for the purpose of preventing terrorist offences and serious crime. Indeed, the EU authorities have recognised that due to the threat of organised crime and terrorism, as well as the abolition of borders under the Schengen Agreement, most EU member states were already using these data under national law. The need for implementation of such rules also stems from the conclusion by the EU of international agreements providing for the obligation to transmit PNR data to the authorities of the United States and Australia (and in the future Canada and Japan).

Obligation to transfer PNR data: What, how, when?

Under the PNR Act, all air carriers (and only air carriers) performing international air transport of passengers on routes to and from Poland (PNR flights) must provide the Border Guard with PNR data in their possession regarding each of their planned flights.

The catalogue of PNR data to be transferred is broadly defined in the PNR Act. These include such information as:

• Date of reservation or ticket issue
• Flight date
• Passenger’s name and contact details
• Ticket payment information (including payment card number or cash payment information)
• Seat number on the aircraft
• Luggage information
• Nationality, gender and other data derived from the passenger’s identity document.

On the other hand, this catalogue excludes data revealing a given person’s race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health condition, sex life or sexual orientation.

The PNR data should be transferred by the air carriers themselves (i.e. without a prior request from the Border Guard) within the time limits indicated in the PNR Act, i.e.:

• 48 to 24 hours before the scheduled departure of the PNR flight
• As soon as check-in is completed and all passengers have boarded the aircraft.

It follows that, as a rule, an air carrier should transmit the PNR data twice. Only if it collects the PNR data less than 24 hours before the start of the PNR flight (e.g. in the case of ad hoc carriage) does it need to transmit the data only once, i.e. immediately after completion of check-in.

Additionally, the Border Guard may request the air carrier to transmit PNR data (upon prior request of one of the entitled authorities) regardless of the time limits indicated above. In such a case, the authority may at the same time (but it does not have to) relieve the air carrier of the obligation to transmit the PNR data within the statutory period.

In principle, the air carrier should transfer the PNR data in a defined manner: by electronic communication, using the protocols and data formats specified in the implementing rules of the act.

The PNR Act provides two exceptions to this rule.

An air carrier operating non-scheduled transport of passengers by air may agree in writing with the Border Guard on another method of transfer of the PNR data by electronic means if it does not have the infrastructure to handle the protocols and data formats specified in the implementing provisions.

Also, where due to technical failure it is not possible to transfer the PNR data in the usual way, the air carrier may agree with the Border Guard on an efficient way of transferring the data.

Reporting obligation of air carriers

In addition to PNR data, the air carrier must also provide the Border Guard with information regarding itself and its activity conducted in the territory of Poland, including established flight schedules and flight programmes, as well as the categories of PNR data it collects. This is a reporting obligation of air carriers.

This information needs to be provided once, in writing (paper or electronic document form), as a general rule no later than 14 days before commencement of PNR flights (i.e. de facto before the first such flight after the entry into force of the PNR Act). Thereafter, the air carrier must promptly update information already provided.

Administrative penalties for failure to comply with obligations under the PNR Act

Lump-sum administrative fines may be imposed on air carriers for failure to comply with PNR Act obligations.

These penalties are imposed separately for each PNR flight and for each of the time limits by which the air carrier was required to transfer the PNR data. The maximum penalty that can be imposed on an air carrier in respect of a single PNR flight is PLN 40,000.

Furthermore, for failure to comply with the reporting obligation described above (failure to provide information within the period specified in the act or failure to update it promptly), the air carrier may be assessed a penalty of PLN 5,000.

The penalties may be reduced by 50% if the air carrier remedies the consequences of its breach, i.e. transfers the PNR data within an additional time limit set by the act (depending on the type of breach, up to 6 hours before take-off or until landing time).

An air carrier is not subject to a financial penalty only if its failure to fulfil the obligation is due to:

• Force majeure
• Breakdown of the system used by the Border Guard to collect and process the PNR data
• Breakdown on the part of the air carrier, if the carrier is not at fault and the carrier notifies the Border Guard of the breakdown before the time limit set by the law for providing the PNR data.

The administrative penalty itself is imposed in the form of an administrative decision of the commander-in-chief of the Border Guard, which may be issued within three years after the air carrier committed the breach.

PNR Act: Beginning of problems?

The individual amounts of fines for failure to provide PNR data may not seem exorbitant, but it must be remembered that they relate to a single flight. As practice shows, the period in which these data were not transferred may run to many months, during which a given air carrier may have made dozens or even hundreds of flights involving international carriage of passengers on routes to or from Poland. In such a case, the total penalties may amount to several million zlotys.

At the same time, it should be stressed that the PNR Act provides a fixed and very limited list of prerequisites for excluding the liability of an air carrier, while imposing a rigid set of administrative penalties not amenable to mitigation.

Therefore, the penalties imposed on air carriers for breach of the PNR Act refer to black-and-white situations. In particular, they do not depend on the degree of culpability (which became apparent at the stage of implementation of the statutory solutions, when, due to technical difficulties in linking the air carriers’ reservation systems with the Border Guard system, it was not possible to transfer PNR data), the number of passengers carried, or the financial capacity of the air carrier. Thus the same penalty is imposed on flagship carriers with several hundred passengers on a single PNR flight and on small carriers operating “sky taxi” services.

Consequently, the penalties imposed under the PNR Act may potentially be unduly punitive for specific air carriers, and in some cases may lead to significant deterioration of their financial situation or even bankruptcy.

For this reason, among others, it should be borne in mind that in the course of the proceedings, the authority should take all steps necessary to establish accurately and beyond reasonable doubt whether the carrier in question is in fact subject to a penalty under the PNR Act. It is also advisable for the air carrier to actively participate in these proceedings at every stage by exercising its rights, such as the right to request consideration of evidence or to be informed of the relevant facts of the case. Even if the carrier obtains a decision imposing a penalty for failure to meet its obligations under the PNR Act, the carrier may seek review of the case or lodge a complaint with the administrative court.

Marcin Sobkowicz, adwokat, Aviation practice, Wardyński & Partners