Violating fundamental rights won’t fly
Brussels, Belgium – Today the Court of Justice of the European Union (CJEU) issued its opinion in a case challenging the EU-Canada Passenger Name Records (PNR) agreement. The court found that the data sharing arrangement is incompatible with EU law and the European Union cannot therefore sign it. The ruling is a significant victory for the fundamental rights to privacy and data protection.
“The court’s confirmation that the EU-Canada PNR agreement is illegal in its current form is a turning point in the fight against unlawful border surveillance,” said Estelle Massé, Senior Policy Analyst at Access Now. “Civil society has long argued that the blanket surveillance mandated by PNR agreements and the EU PNR Directive are in violation of fundamental rights. The Commission must urgently reform these measures”.
PNR, or Passenger Name Records, contain information about a passenger’s flight details, including itinerary, contact details, forms of payment, accompanying guests, and more. All this information is stored in airlines’ databases for commercial purposes. PNR data is regarded as potentially useful for the vaguely defined purposes of the “prevention, detection, investigation or prosecution of terrorist offences or serious transnational crime”. For at least the past 10 years, governments have been seeking access to the information through far-reaching, disproportionate agreements that establish excessive data retention mandates.
The EU Parliament brought the EU-Canada PNR case before the CJEU in November 2014 so the court could assess whether the agreement is compatible with rights guaranteed under EU treaties and the Charter. The court decision follows the opinion of the Advocate General Mengozzi delivered in September 2016. The first PNR agreement with Canada was concluded in 2006, and was being re-negotiated when the parliament decided to send it for review by the court.
Currently, the EU has PNR arrangements not only with Canada, but also with:
– United States, to allow retention of PNR data for up to 15 years;
– Australia, with a retention period of up to 5 and a half years; and
– The EU has also recently adopted its own internal PNR framework which allows for a maximum retention period of five years.
“This decision demonstrates the need to closely evaluate the necessity and proportionality of proposed EU legislation. This is not the first time that EU Commission-proposed measures turn out to be in violation of fundamental rights, despite its role as ‘guardian’ of the treaties”, added Massé. “Globally, governments must stop treating all travellers as suspects and reform broad and indiscriminate border surveillance measures”.
Access Now will release an analysis of today’s decision in the coming weeks.
For more information on PNR and border surveillance, please see: