Today, on 26 July 2017, the Court of Justice of the European Union (CJEU) confirmed that the EU/Canada deal on collection of air travellers’ data and sharing it breaches European law. This is the third time that the European Court has ruled against arrangements for mandatory storage of personal data.
This is good news for EU citizens, as the risks associated with massive and unnecessary databases of sensitive personal data are unacceptable. Blindly collecting data, hoping it will magically protect our society, is bad for security and bad for fundamental rights.
The law cannot be upheld by breaking the law
said Joe McNamee, Executive Director of European Digital Rights. “Reckless data retention and profiling have no place in a democratic, law-based society. Literally every independent body that has spoken out on the subject supports this analysis. The European Commission and EU Member States must now, at long last, take all necessary steps to abandon all illegal data retention laws and practices.”
The European Data Protection Supervisor (EDPS), the EU’s Fundamental Rights Agency (FRA), the Article 29 Working Party of national data protection authorities, the European Parliament Research Service (EPRS) and the Meijers Committee of Experts on international migration, refugees and criminal law all explained that PNR data sharing does not respect the criteria of “necessity and proportionality” for a restriction of the fundamental right to privacy. The alleged benefits of the proposal have never been demonstrated, and the argument that it will help to prevent terrorism is not based on credible evidence.
The agreement between the EU and Canada allows for the transfer and processing of PNR data of passengers flying between the EU and Canada. This ruling should now also lead to an end to national laws transposing the EU PNR Directive, adopted in 2016.
The proposed EU/Canada PNR agreement was considered to be the least restrictive of all of the EU’s PNR agreements. To respect the ruling, the EU must now immediately suspend its deals with Australia and the United States.
FAQ: Passenger Name Records (PNR)
EU-Canada agreement on PNR referred to the CJEU: What’s next? (03.12.2014)
CJEU hearing on the EU Canada PNR agreement: Still shady (06.04.2016)
The curious tale of the French prime minister, PNR and peculiar patterns (04.10.2016)
ECJ: Data retention directive contravenes European law (09.04.2014)
European Court confirms: Strict safeguards essential for data retention (19.07.2016)