ECJ: Without a realistic terrorist threat, passenger data is taboo

Jul 15, 2022 Benn-Ibler Rechtsanwälte

The European Court of Justice (ECJ) has ruled: The permission to process and transfer so-called PNR data (Passenger Name Record) for flights crossing an external EU border is to be interpreted very narrowly. Without a current and real terrorist threat to an EU state, data processing is not permitted.

A human rights organisation from Belgium challenged the Belgian transposition law of PNR Directive (EU) 2016/681 on combating terrorism and major crime and brought an action for its annulment before the Belgian Constitutional Court. The organisation argued that the Directive violated the right to respect for private life and to protection of personal data under the EU Charter of Fundamental Rights. The ECJ, before which the case was brought, held that the PNR Directive was in principle valid under the condition of a strict interpretation of the powers contained therein.

Thus, it must be ensured that the processing and storage of passenger data for the purpose of combating terrorist offenses and major crime is limited to what is absolutely necessary in order to ensure compatibility with the EU Charter of Fundamental Rights.

According to the ECJ, the PNR system must a) refer exclusively to the information described in Annex I of the Directive, which is related to the flight and the passenger, and b) must be limited in its application to major crime and terrorist offenses that are objectively related to the transportation of passengers.

For the purpose of a preliminary PNR data check, the nationally organised Passenger Information Unit is allowed to check data of persons who are wanted against databases. Subsequent disclosure of data after the departure or arrival of the person concerned may only be carried out on the basis of objective evidence and new circumstances and is, in principle, subject to judicial review. The ECJ also stated that data may not be stored for longer than the normal period of six months. Any longer storage is only permitted insofar as it concerns data of people for whom there are indications of major crime or terrorism in

EuGH, C-817/19 (21.06.2022)