On 24 July 2026, the European Commission published a proposal for a Council decision to conclude the EU–Republic of Korea Agreement on transferring Passenger Name Record (PNR) data for preventing, detecting, investigating and prosecuting terrorist offences and serious crime. The agreement, negotiated between 17 December 2025 and 4 June 2026 and initialled on 4 June, would designate the Korean Customs Service (KCS) as the competent authority to receive PNR data from air carriers on flights between the EU and South Korea.
a maximum retention period of five years, with depersonalisation after six months; limits on automated processing; and requirements for prior approval by a judicial or independent body before disclosures within Korea. Transfers outside Korea or the EU would only be allowed to countries with an EU-comparable agreement or adequacy decision. Individuals would have rights to access, correction, redress, and effective administrative and judicial remedies. Korea must appoint an independent oversight authority, and the EU will make relevant information public. The Commission notes no budgetary implications for the EU budget.
The Council must now decide whether to conclude the agreement. The proposal builds on the EU's existing PNR framework, which includes agreements with the United States, Canada, and Australia, and follows the European Parliament's call for robust data protection standards in such transfers. The agreement aims to balance security cooperation with privacy rights, impacting air carriers that must transmit PNR data, passengers whose data is processed, and data protection authorities in both jurisdictions. The Council's decision is expected in the coming months, with the European Parliament likely to scrutinise the safeguards before giving its consent.