Protection of Passenger Information Clarified

Summary#

The final rule titled Regulations Amending the Protection of Passenger Information Regulations (Miscellaneous Program) makes two small wording fixes to the Protection of Passenger Information Regulations. The changes clarify who at the Canada Border Services Agency can access passenger name record data and what protections a foreign authority must promise before receiving that data. The regulations came into force on April 12, 2024 and were published in the Canada Gazette on April 24, 2024.

What it does#

• Rewords the English text of subsection 4(5) to say CBSA officials may access only “passenger name record information,” clarifying the type of data covered.
• Replaces the English text of paragraph 8(c) to make clear that a foreign authority receiving passenger name record information must have agreed to apply protections at least equivalent to those in the Protection of Passenger Information Regulations, or the standards that the authority negotiated with the European Union.
• Confirms the amendments took effect on the day the regulations were registered (April 12, 2024).
• The government says these are technical clarifications and do not create new costs or paperwork for businesses.

Who's affected#

• Canada Border Services Agency staff and the agency’s rules about who can view passenger name record data.
• Commercial carriers and airlines that already give Advance Passenger Information (API) and Passenger Name Record (PNR) data to CBSA — the amendments don’t change their reporting duties but clarify how the data is handled.
• Foreign government authorities that receive PNR data from Canada — the text clarifies the protection standards they must meet.
• Travellers whose booking and travel data are included in PNR systems, because the changes clarify limits on access and data-sharing conditions.

Why it matters#

• The changes remove wording that was seen as unclear. That makes it easier to know what data is covered and who may see it inside the CBSA.
• It also makes the rules for sharing PNR data with foreign governments clearer, by spelling out the minimum protection standards those governments must have.
• For most people and businesses, this is a technical cleanup rather than a new policy—no new reporting duties or costs are expected.