Activist countries

Judges clip EU countries’ wings over travel data collection – POLITICO

European Union countries can no longer force airlines to hand over reams of passenger data – at least for flights within the 27-member bloc, according to an EU Supreme Court ruling on Tuesday.

The Court of Justice of the EU (CJEU) has ruled that requiring airlines to transfer passenger data to national authorities interferes with the right to privacy. The judges stopped short of nullifying the data collection framework entirely.

The ruling on the Passenger Name Record, or PNR, directive represents a bittersweet outcome for privacy campaigners who for years campaigned against the framework, which was put in place following the September 11 attacks and subsequent terrorist incidents in Madrid and London.

“Given the impact of the EU PNR directive on fundamental rights – as confirmed by the court – the law should have been invalidated,” said Estelle Massé, privacy officer for the NGO Access Now digital rights.

The decision states that EU countries can only impose data transfers for intra-EU travel if there is a “real and present or foreseeable terrorist threat”.

The Luxembourg judges added that the PNR directive “caused undeniably serious interference” with EU privacy and data protection rights, but did not strike down the regulation entirely.

The CJEU ruling comes after campaign group League for Human Rights filed a lawsuit in 2017 accusing Belgium’s transposition of the PNR directive of breaching EU privacy rights.

“The Court concludes that the transfer, processing and storage of PNR data provided for by this directive can be considered to be limited to what is strictly necessary for the purposes of the fight against terrorist offenses and serious forms of crime, provided that that the powers provided for in this directive are interpreted restrictively,” said a press release on the decision.

But the ruling left the door open for national capitals to interpret the criteria it established and uphold airline obligations, at least in part.

France, for example, has previously legitimized other surveillance measures by suggesting that its threat of being hit by terrorism is near-constant. It is not inconceivable that EU states would use similar reasoning to keep their PNR regimes intact. “Never underestimate the creativity of governments in circumventing CJEU requirements,” said Chloé Berthélémy of digital rights firm EDRi.

The decision, however, offers privacy activists red meat elsewhere.

Countries can no longer retain data for five years, for example, unless it is linked to a suspect. Otherwise, the data must be deleted after six months.

It has also put a damper on countries extending PNR obligations beyond air travel, as many countries want to do for passengers using coaches, boats and trains.

By explicitly targeting its general ban on transfers of PNR data for “intra-EU flights and transport operations carried out by other means within the European Union”, the Court seems to have preempted efforts to extend the scope from the cadre to the entire bloc of 27 members.

“This [ruling] could torpedo some governments’ ambitions to extend PNR systems to buses and trains because it’s not worth it,” said Berthélémy.

This article is part of POLITICO Pro

The one-stop solution for policy professionals fusing the depth of POLITICO journalism with the power of technology

Exclusive and never-before-seen scoops and ideas

Personalized Policy Intelligence Platform

A high-level public affairs network