Law 21/2019 (hereinafter "PNR Data Law" or "Law") which regulates the transfer by air carriers of passenger name and which transposes Directive 2016/681 of the European Parliament and of the Council of 27 April 2016 into national law, was published today, February 25, 2019.

Content of the Law

The PNR Data Law regulates the transfer and treatment by airlines of "PNR Data" or Passenger Name Record Data, as well as the respective exchange of such data with the Member States of the European Union and applies to flights from a Member State of the European Union or a third country or to a Member State of the European Union or to a third country.

This Law states that PNR data collected under these terms can only be processed for the purposes of prevention, detection, investigation and prosecution of terrorist offenses and serious crime.

New developments

Among the new developments of the diploma we highlight the following:

  • Creation of the Passenger Information Office (GIP), which will function as the national passenger information unit. The operation of the GIP is carried out by members of the Republican National Guard, the Public Security Police, the Judiciary Police and the Foreigners and Borders Service (SEF) and the Tax and Customs Authority and may also integrate elements of the Maritime Police
  • Retention and anonymization deadlines are defined and it is defined, among other things, that PNR data provided by air carriers to GIP will as a rule be retained for a period of five years from the date of transfer and that after six months after the transfer all PNR data shall be anonymized
  • In the event of violation of the rules set forth in the PNR Data Law, companies may pay fines of up to 100,000.00 EUR, for each trip, and the application of fines is the responsibility of the Foreigners and Borders Service (SEF)
  • The PNR Data Law defines that the enforcement of this law regarding provisions on the protection of personal data shall be made by the Portuguese Data Protection Authority (CNPD) as the supervisory authority under the terms of Directive 2016/680


Although the date of entry into force of the Law is set to the day after its publication, the effects of this Law are dependent on the entry into force of the legal regime regarding the protection of individuals with regard to the processing of personal data by the competent authorities, which transposes Directive 2016/680 to Portugal and which is currently being discussed at the Portuguese Parliament (Draft Law 125 / XIII).