On Thursday 13 March, the European Data Protection Board (EDPB) adopted an opinion enabling the Member States to implement a 2022 ruling by the Court of Justice of the EU on the European directive on ‘passenger name records’ (PNR) and to adapt the transpositions already made to this directive, which was adopted in 2016.
The Court validated the directive in June 2022 (see EUROPE 12976/24), but gave a more restrictive reading to certain provisions.
In its opinion, the EDPB makes recommendations on the way in which European countries should select the flights from which PNR data is collected, and on the length of time PNR data should be kept, which should not exceed an initial period of six months.
“After the initial period of six months, individual PNR datasets may be processed only if there are objective factors relating to those datasets which make it possible to establish a link with the purposes pursued by the processing under the PNR Directive, and only for as long as this is necessary and proportionate,” writes the Committee.
On intra-EU flights, the principle of strict necessity applies notwithstanding the application of the directive to some or all intra-EU flights, which requires an assessment of the timing and scope of the directive, including for actual and current or foreseeable terrorist threats. Regular and ad hoc review procedures should be built into the system.
Link to opinion: https://aeur.eu/f/fyf (Original version in French by Solenn Paulic)