According to a ruling by the European Court of Justice, the processing of passenger data by the EU states must be limited to what is absolutely necessary for the fight against terrorism. In addition, the European Supreme Court made it clear in Tuesday’s judgment that the processing of data on flights within the EU violates EU law, provided there is no risk of terrorism (Case C-817/19).
E-mobility, transport policy and future mobility: the briefing on transport and smart mobility. For decision makers
The so-called PNR directive (Passenger Name Record) of the European Union provides for the systematic processing of large numbers of passenger data when crossing an external EU border. This is intended to prevent and detect terrorist offenses and other serious crimes. The stored data includes, for example, address, luggage details, telephone number and the names of fellow passengers.
In the specific case, a Belgian human rights organization had complained about how Belgium implemented EU law. The PNR law there obliges airlines, train, bus, ferry and travel companies to pass on the data of their passengers who are traveling across national borders to a central office in which, among other things, the police and secret services are represented. That’s too much for the organization.
The judgment in the Belgian case must now be made by a national court. According to the judgment of the ECJ, however, the Belgian rules may violate EU law.
The same should apply to the German implementation of the EU directive, since Germany has extended the rules to all intra-European flights. The Administrative Court of Wiesbaden and the District Court of Cologne submitted questions to the CJEU about the PNR Directive in 2020. Here, too, the ECJ should clarify, among other things, whether the directive is compatible with fundamental rights to respect for private and family life and the protection of personal data.
With a view to the Belgian case, the ECJ first of all states that the directive is consistent with the relevant parts of the European Charter of Fundamental Rights. At the same time, the Court emphasizes that the rules unquestionably constitute a serious interference with, for example, the right to respect for private and family life and the protection of personal data.
According to the ECJ, the powers under the directive must be interpreted narrowly. Then the transmission, processing and storage of the data in question could be considered limited to what is absolutely necessary in the fight against terrorism and serious crime.
This means that the system put in place by the PNR Directive may only cover the information specified in the Annex to the Directive. Also, the system must be limited to terrorist offenses and serious crime with an objective link to the carriage of passengers. Criminal offenses that are mentioned in the directive but fall under common crime in the respective EU country should not be included.
