CJEU: Processing of passenger data must be limited to what is necessary

Enlarge image

Travelers at Ostend-Bruges Airport: The use of passenger data has been controversial for years

Photo: KURT DESPLENTER / Belga / IMAGO

According to a ruling by the European Court of Justice (ECJ), the processing of passenger data by the EU states must be limited to what is absolutely necessary for the fight against terrorism.

With the decision, the ECJ answered a Belgian court that had asked questions about the implementation of an EU directive passed in 2016 into Belgian law.

The so-called PNR directive (PNR stands for Passenger Name Record) provides for the systematic processing of passenger data when crossing an external EU border.

This is intended to prevent and detect terrorist offenses and other serious crimes.

The Court made it clear in Tuesday's judgment that processing violates EU law unless there is a real and current or foreseeable terrorist threat (Case C-817/19).

In such a situation, the system should be limited to the transmission and processing of transport data on specific connections and travel patterns or on specific airports, train stations or ports for which there are indications.

It's not just about air travel

The Belgian human rights organization Ligue des droits humains (Human Rights League) had complained about how Belgium was implementing the rules.

Among other things, she sees the right to respect for private life and the protection of personal data as being violated.

According to Belgian law, airline, train, bus, ferry and travel companies are obliged to pass on the data of their passengers who are traveling across national borders to a central office in which, among other things, the police and secret services are represented.

The PNR directive and its implementation in national law is also controversial in other countries, including Germany.

The ECJ also has questions from German courts, which were not decided on Tuesday.

Regarding the questions from Belgium, the Court of Justice has now also announced that the data of all air passengers may not be stored for five years, but normally only for six months.

For a longer period of time, member states should only store data from people who have indications of danger from terrorism or serious crime in connection with flights, it said.

mboe/AFP/dpa