EUROPEAN COMMISSION
Brussels, 24.7.2026
COM(2026) 383 final
2026/0214(NLE)
Proposal for a
COUNCIL DECISION
on the conclusion of the Agreement between the European Union and the Republic of Korea on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime
EXPLANATORY MEMORANDUM
The present proposal concerns the conclusion of the Agreement with the Republic of Korea on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Agreement’).
1.CONTEXT OF THE PROPOSAL
•Reasons for and objectives of the proposal
Strengthening international cooperation on law enforcement, including on information sharing, is essential to address the threats posed by terrorism and serious transnational crimes. The latest Serious Organised Crime Threat Assessment (SOCTA) report published by Europol 1 illustrates the international dimension of the activities of most serious crime organisations. Additionally, its latest Terrorism Situation and Trend Report (TE-SAT) 2 stresses not only the direct links between transnational travel and the organization of terrorist activities and serious crime, but also the importance of effectively detecting, investigating and prosecuting other serious criminal offences for preventing and detecting terrorist offences.
Passenger name record (PNR) data is information provided by passengers and collected by and held in the air carriers’ reservation and departure control systems for their own commercial purposes. The content of PNR data varies depending on the information given during the booking and check-in process and may include, for example, dates of travel and the complete travel itinerary of the passenger or group of passengers travelling together, contact details like address and phone number, payment information, seat number and baggage information.
The collection and analysis of PNR data can provide the authorities with important elements allowing them to detect suspicious travel patterns and identify associates of criminals and terrorists, in particular those previously unknown to law enforcement authorities. Accordingly, the processing of PNR data has become a widely used law enforcement tool, in the EU and beyond, to detect terrorism and other forms of serious crimes, such as drug-related offences, human trafficking and child sexual exploitation, and to prevent such crime from being committed. It has also proven to constitute an important source of information to support the investigation and prosecution of cases where such illegal activities have been committed 3 .
In 2010, the EU and the Republic of Korea upgraded their broader relationship to a Strategic Partnership, based on shared values and common interests. The EU-Republic of Korea Framework Agreement signed in May 2010 provides the basis for cooperation on major political and global issues. The Republic of Korea is a like-minded and strategic partner of the European Union in the fight against terrorism and other serious crime. Within the United Nations, the G20 and other multilateral fora, the European Union and the Republic of Korea work closely together to improve global security frameworks as well as to enhance the security of their citizens.
On 17 December 2021, the Commission adopted an adequacy decision in relation to the transfer of personal data from the EU to the Republic of Korea between commercial operators 4 , concluding that the Republic of Korea ensures an essentially equivalent level of protection to the one guaranteed under the General Data Protection Regulation (GDPR). 5 In this context, the Commission also assessed the conditions and safeguards under which Korean public authorities, including law enforcement, can access data held by those operators. Although the adequacy assessment under this decision does not cover processing of PNR data as such, it nevertheless provides evidence that the foundations for essential data protection safeguards already exist in the legal framework of the Republic of Korea and should therefore also provide the basis for adducing the necessary corresponding safeguards in a PNR Agreement, in particular, enforceable data subject rights, judicial redress and independent oversight.
According to the legislation of the Republic of Korea, air carriers are required to transmit Passenger Name Record (PNR) data to the single window operated by the Korean Customs Service (KCS). This legislation aims at enhancing the security of the Republic of Korea by obtaining PNR data prior to a passenger’s arrival or departure and therefore significantly enhances the ability to conduct efficient and effective advance travel risk assessment of passengers.
In this context, the Republic of Korea has also shared relevant information both as regards the amount of scheduled flights between the EU and the Republic of Korea (approximately 12.000 in 2024) as well as regards the adherence of its legislation to the ICAO Standards on PNR.
To allow for the transfer of PNR data from the EU to the Republic of Korea to effectively fight terrorism and other forms of serious transnational crime, an international agreement is needed, providing the necessary legal basis at EU level. Such type of future agreement should encompass appropriate data protection safeguards within the meaning of Article 46(2)(a) of the General Data Protection Regulation 6 , including a system of independent oversight. A future agreement should respect fundamental rights and observe the principles recognised by the Charter of Fundamental Rights of the European Union, in particular the right to private and family life recognised in Article 7 of the Charter, the right to the protection of personal data recognised in Article 8 of the Charter and the right to effective remedy and fair trial recognised in Article 47 of the Charter.
In light of this, on 15 September 2025, the Commission adopted a Recommendation, proposing that the Council authorises the opening of negotiations of an agreement between the European Union and the Republic of Korea on the transfer of Passenger Name Record (PNR) data for preventing, detecting, investigating and prosecuting terrorist offences and serious crime. 7 On 16 December 2025, the Council provided its authorisation to open negotiations and adopted negotiating directives. 8
The purpose of this Agreement is to enable the transfer of PNR data from the Union to the Republic of Korea in recognition of the necessity to use PNR data as an essential tool in the fight against terrorism and other forms of serious crime.
Negotiations with the Republic of Korea began on 17 December 2025. On 4 June 2026, the lead negotiators initialled the agreement text and thus formally concluded negotiations. The Joint Statement pursuant to the EU-Korea Summit held on 10 June 2026 welcomed the conclusion of negotiations and committed to undertake all necessary efforts to ensure its swift entry into force.
The co-legislators have been informed throughout the negotiations process and consulted at all stages of the negotiations, notably through reporting to the Council’s Working Party on Justice and Home Affairs Information Exchange (IXIM) and the European Parliament’s Committee for Civil Liberties, Justice and Home Affairs (LIBE).
•Consistency with existing policy provisions in the policy area
In the European Union, in 2016, the European Parliament and the Council of the European Union adopted Directive (EU) 2016/681 on the use of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘PNR Directive’) 9 . This Directive regulates the transfer and processing of PNR data in the European Union and lays down important safeguards for the protection of fundamental rights, in particular the rights to privacy and the protection of personal data. In June 2022, the Court of Justice of the EU (CJEU) confirmed the validity and compliance of this Directive with the Charter of Fundamental Rights of the EU and the Union Treaties, in its Judgment in case C-817/19 10 .
As regards the EU’s external PNR policy, the Commission first set out the broad lines of such policy in a 2003 Communication 11 on the EU approach towards transfers of PNR data from the EU to third countries, which were reviewed in a Communication adopted in 2010 12 . Three international agreements which cover the transfer and processing of PNR data from the EU are currently in force between the EU and third countries: with Australia 13 , the United States 14 (2012) and the United Kingdom 15 (2020). After negotiations which followed up on Opinion 1/15 of the CJEU of 26 July 2017, 16 a new PNR Agreement with Canada was signed on 4 October 2024 17 . Subsequently, PNR Agreements were also signed with Norway (2025) 18 , Iceland(2025) 19 and Switzerland (2026) 20 .
At international level, an increasing number of third countries have started developing their capabilities to collect PNR data from air carriers. This trend is further prompted by Resolutions adopted by United Nations Security Council (in 2017 and 2019), requiring all States to develop the capability to collect and use PNR data 21 , based on which Standards and Recommended Practices on PNR (SARPs) were adopted by the International Civil Aviation Organization (ICAO) in 2020, by means of Amendment 28 to Annex 9 to the Chicago Convention which became applicable in February 2021. 22
The EU position, as established by Council Decision (EU) 2021/121, welcomes the ICAO SARPs on PNR as laying down ambitious safeguards on data protection and therewith allowing significant progress to be made at international level. At the same time, this Council Decision considered, by means of requiring Member States to register a difference, that the requirements resulting from Union law (including relevant case-law), are more exacting than certain ICAO Standards, and that transfers from the EU to third countries require a legal basis establishing clear and precise rules and safeguards in relation to the use of PNR data by competent authorities of a third country 23 .
In this context, the negotiation and conclusion of this Agreement constitutes part of a broader effort of the Commission to pursue a consistent and effective approach regarding the transfer of PNR data to third countries, as announced in the Security Union Strategy 2020-2025 24 , building on the ICAO SARPs on PNR, and in line with the Union law and case-law. Such an approach was also requested by the Council with its Conclusions of June 2021 25 .
Herewith, the Commission also seeks to respond to calls from air carriers to ensure more legal clarity and foreseeability on PNR transfers to third countries.
2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
•Procedural legal basis
In accordance to Article 218(6) of the Treaty on the Functioning of the European Union (TFEU), where the agreement relates to matters outside of the common foreign and security policy (CFSP), the Commission shall submit a proposal to the Council. The Council shall adopt a decision concluding the agreement.
Pursuant to Article 218(6) TFEU, where the agreement does not relate exclusively to the CFSP, the Council can only take the decision concluding the agreement either after obtaining the consent of the European Parliament (Article 218(6)(a) TFEU), or after consulting it (Article 218(6)(b) TFEU).
Given the substantive legal basis, the Council is to adopt the decision concluding the agreement after obtaining the consent of the European Parliament.
Therefore, the procedural legal basis for the proposed decision on concluding the agreement is Article 218(6), second subparagraph, point (a) TFEU.
•Substantive legal basis
The proposal has two main aims and components, one relating to the necessity of ensuring public security by means of the transfer of PNR data to the Republic of Korea and the other concerning the protection of privacy and other fundamental rights and freedoms of individuals. Thus, the substantive legal basis is Article 16(2) and Article 87(2)(a) of the Treaty on the Functioning of the European Union.
•Proportionality
The Union’s objectives with regard to this proposal as set out above can only be achieved by establishing a valid legal basis at Union level to ensure that appropriate protection of fundamental rights is granted to personal data transfers from the Union. The provisions of the agreement are limited to what is necessary to achieve its main objectives and strike a fair balance between the legitimate objective to maintain public security and the right of everyone to enjoy the protection of their personal data and private life.
•Choice of the instrument
This proposal for a Council decision is submitted in accordance with paragraph 6 of Article 218 TFEU, which envisages the adoption by the Council of a decision concluding the agreement. There exists no other legal instrument that could be used in order to achieve the objective expressed in this proposal.
The appropriate safeguards required for the specific processing of PNR data received by the Republic of Korea from air carriers on flights operated by air carriers between the Union and the Republic of Korea must be established by means of a valid legal basis under EU law. The present Agreement constitutes such legal basis enabling PNR data transfers.
• Fundamental rights
The exchange of PNR data and its processing by the authorities of a third country constitutes an interference with the fundamental rights to privacy and data protection. However, such interference is justified, also because the Agreement pursues legitimate objectives i.e. to prevent, detect, investigate and prosecute serious crime and terrorism. The Agreement includes appropriate data protection safeguards to the personal data transferred and processed, in line with EU law, notably Articles 7, 8, 47 and 52 of the Charter of Fundamental Rights of the EU.
3.BUDGETARY IMPLICATIONS
There are no budgetary implications for the Union budget.
4.OTHER ELEMENTS
•Detailed explanation of the specific provisions of the proposal
The Agreement, in full alignment with the Charter of Fundamental Rights of the EU, the relevant caselaw of the Court of Justice of the EU and the negotiating directives, provides a legal basis, conditions and safeguards for the transfer to and processing by the Republic of Korea of PNR data received from air carriers from the Union:
Article 1 sets out the scope and objectives the Agreement.
Article 2 includes key definitions of the Agreement, inter alia of the ‘Korean Competent Authority’ as the designated authority responsible for processing PNR data and of the terms ‘serious crime’ and ‘terrorism’, in line with how these concepts have been defined in other relevant EU law instruments.
Article 3 regulates the method and frequency of PNR data transfers by airlines to the Korean Competent Authority with a view to ensuring that PNR data transfers are kept to the minimum necessary and are proportionate to the purpose specified in the Agreement.
Article 4 sets out the purpose limitation – i.e. prevention, detection, investigation and prosecution of terrorist offences and serious crime – in an exhaustive manner for all PNR processing covered by the Agreement.
Article 5 sets out the three specific modalities for the processing of PNR data received under the Agreement by the Korean Competent Authority.
Article 6 provides additional safeguards for carrying out ‘real-time assessment’ and limits automated processing of PNR data.
Article 7 provides for a prohibition to process special categories of PNR data in line with how this concept has been defined in the EU data protection acquis.
Article 8 provides for a high level of security of PNR data received under the Agreement and ensures notifications of data security breaches to the designated Korean overseeing authority.
Article 9 provides for the keeping of logs and documentation of all PNR processing.
Article 10 sets out the maximum retention period of five years, combined with a requirement to delete the data after passengers’ date of departure, unless a risk assessment indicates that there is a connection based on objective elements from which it may be inferred that the PNR data might make an effective contribution to address the purposes of the Agreement, in addition to the requirement for the Republic of Korea to review its assessment every two years and notify the Union of the results of this assessment.
Article 11 requires the Korean Competent Authority to depersonalise PNR data at the latest after six months.
Article 12 includes rules and conditions for the disclosure of PNR data within the Republic of Korea, e.g. by limiting such disclosures to authorities with functions related to the purposes of the Agreement and by requiring prior approval by a judicial authority or another independent body for such disclosures.
Article 13 includes rules and conditions for the disclosure of PNR data outside the Republic of Korea and the EU, e.g. by limiting such disclosures to third countries with which the EU has concluded a comparable agreement or for which the EU has adopted a relevant adequacy decision and by requiring prior approval by a judicial authority or another independent body for such disclosures.
Article 14 fosters police and judicial cooperation through the exchange of PNR data or the results of processing of PNR data between the Korean Competent Authority and the PIUs of Member States of the Union, as well as between the Korean Competent Authority, on the one hand, and Europol and Eurojust within their respective competences, on the other hand.
Article 15 requires the Republic of Korea to appoint an authority required to oversee PNR processing in Korea.
Article 16 includes transparency and information obligations, including a requirement to notify individuals of the disclosure of their PNR data.
Article 17 provides that individuals may access (only) their own PNR data.
Article 18 provides that individuals’ right to correction, redress and information must be ensured.
Article 19 provides that individuals must be given effective administrative and judicial redress.
Article 20 provides for the obligations by the Republic of Korea to notify the Union with relevant information about the authorities involved in PNR processing, and for the Union to make such information available to the public.
Article 21 provides for the entry into force of the Agreement.
Article 22 provides for dispute settlement and suspension mechanisms.
Article 23 provides for the possibility for either Party to terminate the Agreement at any time.
Article 24 provides for amendments of the Agreement.
Article 25 provides for consultation and evaluation of the implementation of the Agreement.
Article 24 contains a clause regarding the territorial application of the Agreement.
•Text of the Agreement and notifications
The text of the Agreement is submitted to the Council together with this proposal.
In accordance with the Treaties, it is for the Commission to proceed, on behalf of the Union, to make the notification provided for in Article 21(2) of the Agreement, in order to express the consent of the Union to be bound by the Agreement.
2026/0214 (NLE)
Proposal for a
COUNCIL DECISION
on the conclusion of the Agreement between the European Union and the Republic of Korea on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Articles 16(2), and Article 87(2), point (a) in conjunction with Article 218(6), second subparagraph, point (a),
Having regard to the proposal from the European Commission,
Having regard to the consent of the European Parliament,
Whereas:
(1)In accordance with Council Decision [XXX] of […] 26 , the Agreement between the European Union and the Republic of Korea on the transfer of Passenger Name Record (PNR) data to prevent, detect, investigate and prosecute terrorist offences and serious crime (‘the Agreement’) was signed on […], subject to its conclusion at a later date.
(2)The Agreement enables the transfer of PNR data by air carriers from the Union to the Republic of Korea in full respect of the rights provided in the Charter of Fundamental Rights of the Union, in particular the right to private and family life recognised in Article 7 of the Charter, and the right to the protection of personal data recognised in Article 8 of the Charter. In particular, the Agreement includes appropriate safeguards for the protection of personal data transferred under the Agreement.
(3)The Agreement fosters police and judicial cooperation between the competent authorities of the Republic of Korea and those of the Member States of the Union as well as Europol and Eurojust to contribute to the fight against terrorism and serious crime.
(4)The Agreement should enable the transfer of PNR data from the Union to the Republic of Korea in recognition of the necessity to use PNR data as an essential tool in the fight against terrorism and other forms of serious crime.
(5)The conclusion of this Agreement constitutes part of a broader effort of the Commission to pursue a consistent and effective approach regarding the transfer of PNR data to third countries, as announced in the Security Union Strategy 2020-2025 27 , building on the the International Civil Aviation Organization’s Standards and Recommended Practices (SARPs) on PNR, and in line with the Union law and case-law. Such an approach was also requested by the Council with its Conclusions of June 2021 28 .
(6)[In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Decision and is not bound by it or subject to its application.] OR [In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Ireland has notified [, by letter of …,] its wish to take part in the adoption and application of this Decision.].
(7)In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application.
(8)The European Data Protection Supervisor was consulted in accordance with Article 42 of Regulation (EU) 2018/1725 and delivered its Opinion [xxx] on [xx.xx.xxxx].
(9)The Agreement should be approved,
HAS ADOPTED THIS DECISION:
Article 1
The Agreement between the European Union and the Republic of Korea on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime is hereby approved 29 .
Article 2
This Decision shall enter into force on the date of its adoption 30 .
Done at Brussels,
For the Council
The President