PNR: EU Court rules that draft EU/Canada air passenger data deal is unacceptable

By EDRi · July 26, 2017

Today, on 26 July 2017, the Court of Justice of the European Union (CJEU) confirmed that the EU/Canada deal on collection of air travellers’ data and sharing it breaches European law. This is the third time that the European Court has ruled against arrangements for mandatory storage of personal data.

This is good news for EU citizens, as the risks associated with massive and unnecessary databases of sensitive personal data are unacceptable. Blindly collecting data, hoping it will magically protect our society, is bad for security and bad for fundamental rights.

The law cannot be upheld by breaking the law

said Joe McNamee, Executive Director of European Digital Rights. “Reckless data retention and profiling have no place in a democratic, law-based society. Literally every independent body that has spoken out on the subject supports this analysis. The European Commission and EU Member States must now, at long last, take all necessary steps to abandon all illegal data retention laws and practices.”

On 25 November the European Parliament voted to refer the EU-Canada agreement on collection and storage of airline Passenger Name Records (PNR) to the CJEU. The Court ruled in 2014 that the the EU’s rules on telecoms data collection was illegal and did so again in 2016. Now the CJEU has again ruled that an EU deal on collection and sharing of personal data contravenes EU law. The purpose of PNR data collecting is the profiling of innocent individuals as possible serious criminals, despite the complete absence of evidence that this would be useful, let alone proportionate.

The European Data Protection Supervisor (EDPS), the EU’s Fundamental Rights Agency (FRA), the Article 29 Working Party of national data protection authorities, the European Parliament Research Service (EPRS) and the Meijers Committee of Experts on international migration, refugees and criminal law all explained that PNR data sharing does not respect the criteria of “necessity and proportionality” for a restriction of the fundamental right to privacy. The alleged benefits of the proposal have never been demonstrated, and the argument that it will help to prevent terrorism is not based on credible evidence.

The agreement between the EU and Canada allows for the transfer and processing of PNR data of passengers flying between the EU and Canada. This ruling should now also lead to an end to national laws transposing the EU PNR Directive, adopted in 2016.

The proposed EU/Canada PNR agreement was considered to be the least restrictive of all of the EU’s PNR agreements. To respect the ruling, the EU must now immediately suspend its deals with Australia and the United States.

CJEU: The Court declares that the agreement envisaged between the European Union and Canada on the transfer of Passenger Name Record data may not be concluded in its current form (26.07.2017)
http://www.politico.eu/wp-content/uploads/2017/07/EU-Canada-PNR.pdf

FAQ: Passenger Name Records (PNR)
https://edri.org/faq-pnr/

EU-Canada agreement on PNR referred to the CJEU: What’s next? (03.12.2014)
https://edri.org/eu-canada-agreement-on-pnr-referred-to-the-cjeu-whats-next/

CJEU hearing on the EU Canada PNR agreement: Still shady (06.04.2016)
https://edri.org/cjeu-hearing-on-the-eu-canada-pnr-agreement-still-shady/

The curious tale of the French prime minister, PNR and peculiar patterns (04.10.2016)
https://www.euractiv.com/section/justice-home-affairs/opinion/checked-for-tuesthe-curious-tale-of-the-french-prime-minister-pnr-and-peculiar-patterns/

ECJ: Data retention directive contravenes European law (09.04.2014)
https://edri.org/ecj-data-retention-directive-contravenes-european-law/

European Court confirms: Strict safeguards essential for data retention (19.07.2016)
https://edri.org/european-court-confirms-strict-safeguards-essential-data-retention/