Respect for fundamental rights requires that the powers provided for in thePassenger Name Record Directive (2016/681) governing the use of air passenger data (see EUROPE 11532/2) be limited to what is strictly necessary, the Court of Justice of the European Union ruled on Tuesday 21 June (Case C-817/19).
In Belgium, citing respect for private life and protection of personal data, the Ligue des droits humains brought an action before the Belgian Constitutional Court against the national measures transposing: - the PNR Directive; - the API Directive (2004/82) obliging carriers to communicate passenger data; - the Directive (2010/65) on reporting formalities for ships arriving in and/or departing from ports of the Member States.
In its judgment, based on the opinion of the Advocate General (see EUROPE 12878/22), the Court validates the conformity of the PNR Directive in the light of the rights guaranteed by the EU Charter of Fundamental Rights.
Nevertheless, it recognises that this Directive involves serious interference with these rights, insofar as it aims to establish continuous, untargeted and systematic surveillance of persons entering or leaving the EU by air. Such a situation is justified if it is limited to what is strictly necessary and solely for the purpose of combating terrorism and serious crime (Article 1(2)).
The European Court sets the following limits to the application of EU law: - the system established by the PNR Directive should only cover the 19 clearly identifiable data listed in Annex I; - the application of the system established by the PNR Directive should be limited to terrorist offences and only to those serious forms of crime which have an objective, or at least indirect, link with the air transport of passengers; - the possible extension of the application of the PNR Directive to all or part of intra-EU flights should be limited to what is strictly necessary and be subject to independent judicial review.
On this last point, the Court clarifies that the application of EU law to all intra-EU flights from or to a Member State is only possible when that country is facing an actual, present or foreseeable terrorist threat. In the absence of such a terrorist threat, the application of the Directive will be limited to certain intra-EU air routes, travel patterns or airports where the situation justifies such application. Furthermore, the strict necessity of this application should be regularly reviewed.
The Court goes on to detail how PNR data should be processed and evaluated. In particular, the unit in charge of this task can only compare this data with the databases of persons or objects wanted or for which an alert has been issued. Artificial intelligence technologies in the context of machine learning systems are prohibited, the Court stresses, so as not to alter the evaluation criteria.
Furthermore, noting the error rate inherent in the automated processing of PNR data (‘false positives’) observed in 2018 and 2019, it adds that Member States must provide clear and precise rules to guide and supervise the verification of positives by non-automated means, in accordance with fundamental rights. A person affected by a positive match (‘hit’) will need to understand the pre-established assessment criteria in order to be able to exercise a possible judicial remedy.
With regard to the retention period for PNR data, the Court ruled that EU law precludes national legislation that provides for a general data retention period of 5 years, applicable to all air passengers without distinction. Indeed, beyond an initial period of 6 months during which the retention of any PNR data is allowed, retaining PNR data of persons not linked to terrorism or serious crime goes beyond what is strictly necessary.
See the judgment: https://aeur.eu/f/28a (Original version in French by Mathieu Bion)