The European Parliament approved the conclusion of the agreement between the European Union and Norway on the transfer of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. It followed the Commission's proposal. This text has now been adopted by Parliament; it must still be formally approved by the governments of the Member States before it can enter into force.
Passenger name record (PNR) data is the information that airlines collect at the time of booking: name, itinerary, contact details, method of payment, baggage. For several years, the European Union has used this data to combat terrorism and serious crime. An agreement with Norway allowed this data to be transferred between the EU and that country. The European Commission negotiated this agreement and asked Parliament to approve it. Parliament made its decision on 29 April 2026.
Approval of the agreementParliament gives its approval to the conclusion of the agreement between the European Union and Norway on the transfer of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.
Transmission of the positionThe President of Parliament is instructed to transmit Parliament's position to the Council, to the Commission, and to the governments and parliaments of the Member States and of the Kingdom of Norway.
No change to the contentThe resolution of approval contains no change to the content of the agreement. Parliament did not add any additional conditions or thresholds to the PNR data transfer mechanism.
The vote was held by electronic roll call: 532 votes in favour, 72 against and 26 abstentions.
In practice, booking data for flights between the European Union and Norway may continue to be transferred and used by the Norwegian authorities to combat terrorism and serious crime. The passengers concerned will not see any immediate change in their procedures, but their data will remain subject to these transfers. The agreement governs these exchanges and aims to guarantee a level of protection for personal data. The text must still receive the formal approval of the governments of the Member States before becoming final.
The European Parliament gave its green light, on 29 April 2026, to the EU-Norway agreement on the transfer of passenger name record (PNR) data. By 532 votes for, 72 against and 26 abstentions, it followed the Commission without amending the text. A vote of confidence in a security tool, but also a blank cheque to a mechanism that deserves to be monitored.
The PNR agreement with Norway allows the Norwegian authorities to access booking data for flights originating in or destined for the Union. These data (name, itinerary, contact details, method of payment, baggage) are used to detect and prosecute terrorist offences and serious forms of crime. For citizens, this means that their data will continue to be transferred, with no immediate change in their procedures. For airlines, this implies maintaining the existing transmission systems.
Parliament could have demanded additional safeguards, review clauses or precise limits on the retention period. It did not do so. By approving the agreement without amendment, it trusts the Commission and the Council to ensure that data protection safeguards are sufficient. Yet every transfer of personal data creates a risk of abuse or error. An independent oversight mechanism and regular reports would have been useful guardrails. Parliament preferred simplicity to prudence.
That said, the agreement is part of a long-standing cooperation between the EU and Norway on security. Norway is a reliable partner, a member of the Schengen area, and PNR data are a recognised tool for combating terrorism. The broad vote shows that political groups, from the EPP to the S&D, including Renew and ECR, share this analysis. The 72 votes against and 26 abstentions probably come from the Greens/EFA and The Left, which express reservations about data protection. But the majority considered that security came first.
Parliament did not take advantage of this procedure to renegotiate the agreement. It could have asked that transfers be limited to flights that are genuinely suspect, or that Norway commit to independent judicial oversight. It did not do so. This is understandable: the agreement had already been negotiated and time is short on security matters. But Parliament could at least have demanded an annual report on the use of the data, or a suspension clause in the event of a breach. None of this was added.
A more liberal and more responsible approach would have consisted in strictly limiting collection to the data necessary, setting a short retention period and entrusting oversight to an independent authority. This would have reduced the cost to freedoms without weakening security. Parliament chose the path of trust. It is now up to the governments of the member states to verify that this trust is justified.
Approving an agreement without touching it means accepting that others decide on the safeguards in our place.
The European Parliament gave its green light, on 29 April 2026, to the EU-Norway agreement on the transfer of passenger name record (PNR) data. By 532 votes for, 72 against and 26 abstentions, it followed the Commission without amending the text. A vote of confidence in a security tool, but also a blank cheque to a mechanism that deserves to be monitored.
The PNR agreement with Norway allows the Norwegian authorities to access booking data for flights originating in or destined for the Union. These data (name, itinerary, contact details, method of payment, baggage) are used to detect and prosecute terrorist offences and serious forms of crime. For citizens, this means that their data will continue to be transferred, with no immediate change in their procedures. For airlines, this implies maintaining the existing transmission systems.
Parliament could have demanded additional safeguards, review clauses or precise limits on the retention period. It did not do so. By approving the agreement without amendment, it trusts the Commission and the Council to ensure that data protection safeguards are sufficient. Yet every transfer of personal data creates a risk of abuse or error. An independent oversight mechanism and regular reports would have been useful guardrails. Parliament preferred simplicity to prudence.
That said, the agreement is part of a long-standing cooperation between the EU and Norway on security. Norway is a reliable partner, a member of the Schengen area, and PNR data are a recognised tool for combating terrorism. The broad vote shows that political groups, from the EPP to the S&D, including Renew and ECR, share this analysis. The 72 votes against and 26 abstentions probably come from the Greens/EFA and The Left, which express reservations about data protection. But the majority considered that security came first.
Parliament did not take advantage of this procedure to renegotiate the agreement. It could have asked that transfers be limited to flights that are genuinely suspect, or that Norway commit to independent judicial oversight. It did not do so. This is understandable: the agreement had already been negotiated and time is short on security matters. But Parliament could at least have demanded an annual report on the use of the data, or a suspension clause in the event of a breach. None of this was added.
A more liberal and more responsible approach would have consisted in strictly limiting collection to the data necessary, setting a short retention period and entrusting oversight to an independent authority. This would have reduced the cost to freedoms without weakening security. Parliament chose the path of trust. It is now up to the governments of the member states to verify that this trust is justified.
Approving an agreement without touching it means accepting that others decide on the safeguards in our place.
