CJEU to decide on processing of passenger data under PNR Directive
On 20 January 2020, the District Court of Cologne, Germany, submitted to the Court of Justice of the European Union (CJEU) the question whether the European Passenger Name Record (PNR) Directive violates fundamental rights. EDRi member Gesellschaft für Freiheitsrechte (GFF, Society for Civil Rights) initiated the proceedings against the directive, which allows for authorities to analyse and store personal data of all people who take an international flight in Europe.
GFF considers the PNR Directive to violate the right to the protection of personal data and the right to respect for private and family life. The PNR Directive (Directive 2016/681) requires airlines to automatically transfer their passengers’ data records to state authorities. These data records contain a large amount of sensitive information, including the date of birth, the names of accompanying persons, the means of payment used to purchase the flight ticket and an unspecified text field which the airline fills in independently.
The data is usually stored with police authorities. In Germany, the Federal Criminal Police Office intends to automatically compare the data records with pre-determined “criteria” in the future, for example criteria that describe the flight behavior of known criminals. As a result, any person whose profile happens to appear suspicious will have to expect increased police checks or even arrests. This is because the error rates of the algorithms will be considerable.
Strategic litigation aimed at the highest European court
In 2019, GFF together with EDRi member epicenter.works took legal action against the PNR Directive before German and Austrian courts and authorities. Since it is not possible to appeal against the Directive directly before the CJEU, the lawsuits were chosen with a strategic view to having the complaint submitted to the highest European court.
In Germany, GFF supports several individuals filing complaints against the airline Deutsche Lufthansa AG transferring their data to the German Federal Criminal Police Office. The plaintiffs bringing charges before the Cologne District Court include Kathalijne Buitenweg, a member of the Dutch parliament, as well as the German net activist Kübra Gümüşay, and the lawyer Franziska Nedelmann.
As expected, the Cologne District Court has now referred the case to the CJEU due to its evident implications of EU law. In our view, the PNR Directive is incompatible with the European Charter of Fundamental Rights, and the CJEU has already stopped a similar PNR agreement between the EU and Canada with its Opinion 1/15 of 26 July 2017. With the matter referred to the CJEU, the mass processing of passenger data in the EU might come to an end.
The basic funding for the project is provided by the Digital Freedom Fund.
Gesellschaft für Freiheitsrechte (GFF, Society for Civil Rights)
https://freiheitsrechte.org/english/
PNR campaign site: No PNR
https://www.nopnr.eu
Passenger surveillance brought before courts in Germany and Austria (22.05.2019)
https://edri.org/passenger-surveillance-brought-before-courts-in-germany-and-austria/
EU Directive 2016/681 (PNR Directive)
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016L0681&from=DE
(Contribution by EDRi member Gesellschaft für Freiheitsrechte, Germany)
