Language selection

Government of Canada / Gouvernement du Canada

Search

Memorandum D-2-7-1: Guidelines for the access to, use, and disclosure of Advance Passenger Information and pre-departure Air Exit information

ISSN 2369-2391

Ottawa,

This document is also available in PDF (135 Kb)

Plain language summary

  • Target audience: CBSA personnel, commercial air carriers, travellers
  • Key content: Administrative guidelines on the access, use, and disclosure of Advance Passenger Information (API) and pre-departure Air Exit (AE) information within the Canada Border Services Agency (CBSA), as well as information regarding access and correction requests for this data.
  • Keywords: API, Air Exit, prescribed information, data access, data use, data disclosure

Updates made to this D-memo

This memorandum has been revised to solely reflect information pertaining to API, the Interactive API (IAPI) process, and pre-departure AE information. Please refer to Memorandum D2-7-2: Guidelines for the access to, use, and disclosure of passenger name record data.

Guidelines

1. API and pre-departure Air Exit information is basic traveller information that includes inbound and outbound flight details for each passenger arriving and departing Canada.

2. For inbound flights, the CBSA requires all commercial air carriers to provide the prescribed API under subsection 107.1 of the Customs Act, as described in the Passenger Information (Customs) Regulations (PICR), and under the Immigration and Refugee Protection Act (IRPA) paragraph 148(1)(d), as described in section 269 of the Immigration and Refugee Protection Regulations (IRPR).

The required API for each traveller includes the following:

  • their name, date of birth, citizenship or nationality, and gender
  • type and number of each passport or other travel document that identifies them, and the name of the country or entity that issued it
  • their reservation record locator number, if any
  • a unique passenger reference number assigned to them for board/no-board purposes by the carrier or, in the case of a crew member, notification of their status as a crew member

The required API about the flight includes:

  • the date and time of take-off from the last point of embarkation before arriving in Canada, and the location of that last point of embarkation
  • the date and time of arrival at the first point of disembarkation in Canada, and the location of that first point of disembarkation
  • the flight code identifying the commercial air carrier and the flight number

3. Pursuant to paragraph 269(3)(a) and (b) of the IRPR and paragraph 7(1) of the PICR, commercial air carriers are required to provide the prescribed API to the CBSA at the following intervals:

  • for passengers, no later than the time of check-in
  • for crew members, not later than one hour before the time of departure to Canada

4. For outbound flights, the CBSA requires all commercial air carriers to provide the prescribed pre-departure Air Exit information under subsection 93(1) of the Customs Act, as described in the EIR.

The required pre-departure Air Exit information for each traveller includes the following:

  • the surname, first name and middle names, the date of birth, the citizenship or nationality and the sex of the person
  • the type of travel document that identifies the person, the name of the country or organization that issued the travel document and the travel document number
  • any unique passenger reference assigned to the person by the prescribed person

The required pre-departure Air Exit information about the flight includes:

  • the flight code that identifies the commercial carrier and the flight number of the conveyance
  • the last place inside Canada from which the conveyance departed, regardless of whether persons boarded it at that place, and the date and time of that departure

5. Pursuant to paragraphs 11(1) and 11(2) of the EIR, commercial air carriers are required to provide the prescribed Air Exit information to the CBSA for flights departing Canada at the following intervals:

  • 72 hours before scheduled time of departure and until check-in, a subset of traveller information (if the information becomes known)
  • at check-in, if the information relates to a person, other than a crew member expected to be on board the conveyance
  • one hour before the conveyance's scheduled time of departure if the information relates to a crew member expected to be on board the conveyance

6. For both inbound and outbound flights, air carriers are required to provide a close-out message no later than 30 minutes after the time of departure. The close-out message includes the unique passenger reference of each person on board the aircraft, as well as the flight details.

Operational use of API and Pre-departure Air Exit Information

7. API and pre-departure Air Exit information may only be used by the CBSA for purposes authorized under the Customs Act or the Immigration and Refugee Protection Act.

8. Per subsection 107(3) of the Customs Act, where necessary, an official of the CBSA may use API and pre-departure Air Exit information:

  • for the purposes of administering or enforcing this Act, the Customs Tariff, the Excise Act, 2001, the Special Imports Measures Act or Part 2 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act or for any purpose set out in subsection (4), (5) or (7)
  • for the purposes of exercising the powers or performing the duties and functions of the Minister of Public Safety and Emergency Preparedness under the IRPA, including establishing a person's identity or determining their inadmissibility
  • for the purposes of any Act or instrument made under it, or any part of such an Act or instrument, that the Governor in Council or Parliament authorizes the Minister, the Agency, the President or an employee of the Agency to enforce

9. Per subsection 149(a) of the IRPA, where necessary, an official of the CBSA may use API and pre-departure Air Exit information for the purposes of exercising the powers or performing the duties and functions of the Minister of Public Safety under that Act, or to identify a person for whom a warrant of arrest has been issued in Canada.

10. For clarity, this includes use for pre-arrival and pre-departure risk assessment purposes.

11. The Interactive Advance Passenger Information process uses API received at check-in to validate that all passengers hold a prescribed travel document (for example, Visa or electronic travel authorization (eTA)) to enter Canada, or are exempt from that requirement. The CBSA electronically sends a "board" or "no-board" message to commercial carriers before the passenger boards the flight to Canada.

Access to PAXIS

12. API and pre-departure Air Exit information are stored in the Passenger Information System (PAXIS). Pursuant to Treasury Board policy and the CBSA's Directive for Access Control in Information Systems, access to PAXIS is restricted according to the "need-to-know" and "least privilege" principles. This means that users will only be granted access to PAXIS where it is required in order for the user to perform their assigned duties, and that the user will be assigned a profile with the minimum access permissions required to fulfill said duties.

13. Some PAXIS user profiles provide access to API and/or pre-departure Air Exit information only. These profiles are assigned to a varied set of users to perform assigned duties largely in support of the IAPI process and Entry/Exit programs.

14. PAXIS access requests are submitted through the IT Self-service Portal. All access requests must be approved by the user's immediate superintendent, supervisor, chief or manager. A secondary review and approval is given by the API-Entry/Exit Program team before the profile is assigned. For a list of the relevant PAXIS profiles and the associated permissions, please refer to the Appendix.

15. Each query and review of passenger data elements in PAXIS is recorded for audit purposes.

Timeframes to access data in PAXIS

16. Per subsections 269(9) and (10) of the Immigration and Refugee Protection Regulations, API data about a traveller is retained in PAXIS for 3.5 years after the CBSA receives the data, unless the data is required as part of an ongoing investigation, in which case it may be retained until the investigation is concluded, or up to a maximum of six years.

17. Additional data retained in PAXIS as part of the IAPI process and Entry/Exit Program, specifically pre-departure Air Exit information, board/no-board messages and flight update notification messages are also retained for 3.5 years.

Note: Air Exit information is also used for travel history purposes. Once the close-out message is received, Air Exit information is copied out of PAXIS and into the Entry/Exit Information System (EXIS) and retained for up to 15 years.

Disclosure of API and pre-departure Air Exit information

18. API and pre-departure Air Exit information may be disclosed under section 8 of the Privacy Act or section 150.1 of the Immigration and Refugee Protection Act, for personal and/or immigration related cases, or under section 107 of the Customs Act, for customs related cases.

19. For additional guidance on section 107 of the Customs Act and section 8 of the Privacy Act, contact CBSA officials at the Information Sharing and Collaborative Arrangements Unit directly at info_sharing-echange_info@cbsa-asfc.gc.ca.

Rights of access, correction, and complaint

20. Upon request, the CBSA will provide any individual, regardless of citizenship or presence in Canada, access to their API and pre-departure Air Exit information held by the CBSA, including board/no-board information. Individuals may make a request by completing the form BSF153: Traveller's API/PNR Information Request and Pre-departure Air Exit.

21. The CBSA will consider any individual's request to correct any error contained in their API or pre-departure Air Exit information. The Agency will either make the applicable correction, or attach a notation to the information indicating a request for correction was refused, and respond to the individual with an explanation of the legal or factual reasons why the request was refused.

22. If a correction is made to the individual's data, or a notation is added, that information will be shared with any authorities that received the data via a disclosure request.

23. If you made a request under the Privacy Act, all individuals living in and outside of Canada may submit a complaint to the Officer of the Privacy Commissioner of Canada – File a formal privacy complaint.

Additional information

24. Misuse of API and pre-departure Air Exit information in contravention of CBSA regulations, policies, directives, or standards may be subject to security screening review for cause as well as disciplinary action, up to and including termination of employment. Additionally, a person knowingly disclosing, providing access to or using customs information in a manner not authorized by the Customs Act is guilty of an indictable offence or an offence punishable on summary conviction under subsection 160(1) of that Act or potentially charged with criminal code violations, such as Breach of Trust, under section 122 of the Criminal Code.

25. The CBSA is committed to remaining in compliance with the International Civil Aviation Organization's (ICAO) Annex 9 – Facilitation border controls and procedures of the Standards and Recommended Practices (SARPs) on Facilitation. The SARPs provide an international benchmark for which the CBSA, Government of Canada, and other Governments and their customs and/or immigration authorities can meet to ensure that the API and AE data (Outbound API) received from commercial air carriers are processed and retained according to international standards.

Appendix: PAXIS profiles

Access only to API or Air Exit information.

Liaison Officer
(#2341)
May be given to officers employed by the International Network Section, in support of the IAPI program.
Transporter Obligations
(#2342)
May be given to officers employed by the Transporter Obligations program.
Headquarters (HQ) Program Support IAPI
(#2343)
May be given to officers who are employed within areas at HQ that support the IAPI program.
IAPI Only – Special
(#2344)
May be given to officers who are authorized to access IAPI information for a specific purpose and timeframe.
Outbound Only – Special
(#2381)
May be given to officers who are authorized to access outbound information for a specific purpose and timeframe.

Note: There are other PAXIS roles with API and Air Exit access that also provide access to PNR. Refer to Memorandum D2-7-2: Guidelines for the access to, use, and disclosure of passenger name record data for a list of those roles.

References

Consult these resources for further information.

Applicable legislation and regulations

Related D-memo

Memorandum D2-7-2: Guidelines for the access to, use, and disclosure of passenger name record data

Superseded D-memo

D1-16-3 dated

Issuing office

Policy and Program Development Division
Travellers Policy and Programs Directorate
Travellers Branch

Contact us

Contact border information services

Page details

Date modified: