On Wednesday 26 July (opinion 1/15), the Court of Justice of the European Union found that in its current state, the draft agreement between the EU and Canada on the transfer of the data in airline passenger files is incompatible with certain requirements under the fundamental rights of the European Union. In so doing, the judges are following the conclusions of the Advocate General.
The draft EU/Canada agreement (PNR agreement) was signed between the two parties on 25 June 2014 (see EUROPE 11109). It provides for a systematic and continuous transfer of PNR data for all airline passengers to a Canadian authority, which may forward them to other authorities to tackle terrorism and cross-border crime. The draft text provides for data to be kept for five years, as well as guarantees for the security and integrity of the data. All PNR data collected may provide specific information about the health, eating habits and full travel itinerary of passengers as well as other private details.
Before approving the text, the European Parliament approached the Court of Justice of the European Union (CJEU) for an a priori opinion, to find out whether the draft agreement was compatible with EU law, particularly from the point of view of the protection of personal data and privacy (see EUROPE 11204).
In its opinion, the court considers that the planned measures laid down in the agreement constitute interference in the fundamental right to privacy (article 7 of the Charter of Fundamental Rights of the EU) and the protection of personal data (article 8 of the same charter), albeit justified by an objective of general interest.
However, the judges note that the provisions under consideration go beyond what is strictly necessary and set out no clear and specific rules. They focused in particular on the sensitive data that can be transferred to Canada under the agreement. In particular, these include the racial or ethnic origin, political opinions or religious beliefs of passengers. In the view of the court, transferring data requires a specific and particularly solid justification on serious grounds other than protecting public security from terrorism and serious cross-border crime, a justification that is missing from the draft text.
The judges consider that although the transfer of PNR data relating to all airline passengers travelling to Canada does not go beyond what is strictly necessary for reasons of public security, the use of these PNR data during the passengers’ stays in the country must be based on new circumstances justifying this use. This in turn calls for rules on the material and procedural concessions of this use, based on specific criteria. Furthermore, the use of the data must be subjected to prior controls carried out by a jurisdiction or independent administrative body. The CJEU finds that retaining the data of passengers for whom a terrorism or cross-border crime risk has not been identified is, moreover, unacceptable.
The Court also notes that other measures in the draft agreement breach the fundamental rights and therefore require a revision. For instance, they consider that the PNR data to be transferred should be clearer and more specific, that the data processing models should be specified, that these should be transmitted to third-party authorities only if there is an agreement in place between the EU and that party or a Commission decision and that the agreement should set out more consistent procedural and material guarantees.
The Court therefore finds that in its current form, the draft agreement is incompatible with the fundamental rights of the EU. This echoes the conclusions of Advocate General Paolo Mengozzi of 8 September 2016 (see EUROPE 11619). As its a priori opinion on a draft external agreement is binding, the draft agreement between the EU and Canada may not be ratified by the EU.
Defenders of rights react favourably. The Commissioner for the Security Union, Julian King, told a press conference that the Commission had taken note of the opinion. The European Commission will now carefully examine the opinion and its possible impacts, he added. He also said that he was prepared to hold discussions with Canada to respond to the court’s concerns. Sophie in't Veld (ALDE, Netherlands), who had militated in the European Parliament to ask the Court for its opinion, welcomed the decision, as did the association (EDRi), which described the judgment as good news for EU citizens. The association Access Now hailed it as a significant victory for fundamental rights to privacy and data protection. (Original version in French by Lucas Tripoteau)