European Court delivers Opinion on the EU-Canada PNR Agreement
Details
The Court of Justice of the European Union (CJEU) has declared the proposed EU-Canada Passenger Name Record (PNR) Agreement to be incompatible with the EU Charter of Fundamental Rights.
The EU Canada PNR Agreement aims to regulate the transfer and processing of passenger name record data to Canada for the purposes of combatting terrorism and serious transnational crime, replacing the EU’s existing agreement with Canada, signed in 2006. Although the agreement was signed in 2014, it requires the European Parliament’s consent before it can come into force. The European Parliament had referred it to the CJEU for its view on whether the agreement had sufficient safeguards to protect EU citizens’ privacy and personal data. In a press release issued yesterday, it was the CJEU’s overall view that ‘although the systematic transfer, retention and use of all passenger data are, in essence, permissible, several provisions of the draft agreement do not meet requirements stemming from the fundamental rights of the European Union’.
Advocate general Paolo Mengozzi had already come to a similar conclusion in September 2016, citing concerns about the extent to which data could be used and the length of time it could be stored.
The requirements set out in the EU Charter of Fundamental Rights include a clearer objective justification (a validly established urgency) to use PNR data of passengers during their stay in Canada and certainty in relation to retaining that PNR data. Such retention should only be for as long as is necessary to deal with certain threats instead of the blanket five year retention period of PNR data for all visitors to Canada proposed by the PNR Agreement. The CJEU also calls for individuals to receive notification in the event that their PNR data is used during their stay, for restrictions on Canada sharing that PNR data with other third countries (provided there is an agreement in place between the EU and that third country) and for better oversight by an independent supervisory body.
The CJEU’s Opinion is technically not binding on the European Parliament or on the Commission, who have also issued a statement. However, without further amendments, bringing it into effect under EU law will inevitably lead to constitutional challenges in the CJEU.
PNR and, more generally, data protection and privacy continue to dominate as we prepare for the PNR Directive and the General Data Protection Regulation (GDPR) in May 2018. For any queries about the GDPR’s impact on the aviation businesses please contact our aviation team.
