EU PNR: European Data Protection Supersvisor warns against unjustified and massive collection of passenger data.

 
The EDPS published his Second Opinion on the use of Passenger Name Records (PNR) for the prevention, detection, investigation and prosecution of terrorist offences and serious crime: there is a lack of information to justify the necessity of an EU PNR scheme.

Giovanni Buttarelli, EDPS, said: “Europe is facing serious terrorist threats and we fully recognise the need for appropriate action. As an independent institution, we are not a priori in favour of or against any measure. However, according to the available information, no elements reasonably substantiate the need for the default collection of massive amounts of the personal information of millions of travellers. Necessity and proportionality are essential prerequisites for the legitimacy of any intrusive measure. We encourage the legislators, in assessing the necessity of such a measure, to further explore the effectiveness of new investigative approaches as well as of more selective and less intrusive surveillance measures based on targeted categories of flights, passengers or countries."

The latest EDPS' Opinion notes the role of the legislators in assessing necessity and proportionality and to analyse the impact of the proposed measures on the fundamental rights of individuals to the protection of personal data and to privacy. It is necessary for the EDPS to also carry out such an analysis in his mission to advise the EU institutions on the data protection implications of their policies, particularly when they have a more serious impact on the rights to privacy and data protection.

Since the proposed EU PNR scheme is likely to cover at least all flights to and from the EU, and may also involve intra EU and/or domestic flights, more than 300 million non-suspect passengers would potentially be interested by the EU PNR proposal.

Building on his earlier Opinions on PNR addressing the same issue, the EDPS says that the available information does not justify why the massive, non-targeted and indiscriminate collection of passengers' personal information is necessary and why it is urgently needed.

The EDPS highlights the 2014 ruling of the Court of Justice of the European Union (CJEU) in which it struck down the Data Retention Directive because of the general and indiscriminate collection of the data of the population: ‘the EU legislature has exceeded the limits imposed by compliance with the principle of proportionality in the light of Articles 7, 8 and 52(1) of the Charter".

The EDPS points out that the EU legislator must ensure that it fully complies with the strict requirements laid down by the Court since the Court, applying the Charter, looks with great scepticism upon any measure which, like the Data Retention Directive, would ‘appl[y] to persons for whom there is no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious crime’.

In the wake of recent terrorist incidents, governments in Europe are under pressure to take meaningful action. However, in a democratic society, the EDPS questions the necessity of collecting and storing excessive amounts of the personal information of all passengers in the EU. The legislator is encouraged to further explore if targeting resources and efforts on known suspects would be more effective than profiling all