This move was supported by the German Society for Civil Rights (GFF), which has been fighting the PNR Directive with a series of strategic lawsuits.

Under the PNR Directive, since May 2018, airlines in EU member states have been obliged to pass data on their passengers to government agencies. This PNR data contains several sensitive items. This means the personal data of everyone who takes an international flight in Europe is being centrally stored and analyzed.

Mass surveillance of air passengers

GFF argues that the PNR Directive violates the right to the protection of personal data and the right to respect for private and family life. The Directive requires airlines to automatically transfer their passenger data records to state authorities. These data records contain a large amount of sensitive information, including the date of birth, the names of accompanying persons, the means of payment used to purchase the flight ticket and an unspecified text field which the airlines fill in themselves.

The data is usually stored with police authorities. In Germany, the Federal Criminal Police Office intends to automatically compare the data records with pre-determined “criteria” in the future (for example criteria that describe the flight behavior of known criminals). As a result, any person whose profile happens to appear suspicious will have to expect increased police checks or even arrests. This is because the error rates of the algorithms will be considerable.

Strategic litigation aimed at the highest European court

In 2019, GFF together with epicenter.works took legal action against the PNR Directive before German and Austrian courts. The aim was to bring down the PNR Directive by submitting the case to the highest European court. As it is not possible to appeal against a directive directly before the CJEU, the lawsuits are planned strategically so that the cases are eventually referred to the CJEU. In Germany, GFF is supporting several individuals that are filing complaints against the airline Deutsche Lufthansa AG for transferring passenger data to the German Federal Criminal Police Office.

On 20 January 2020, the District Court of Cologne, Germany, referred the case to the CJEU due to its evident implications for EU law. The plaintiffs bringing charges before the Cologne District Court include Kathalijne Buitenweg, a member of the Dutch parliament, as well as the German net activist Kübra Gümüşay and the lawyer Franziska Nedelmann.

The German case is part of a bigger picture: In another case in Belgium, the Belgian Constitutional Court also submitted the Belgian law implementing the PNR Directive to the ECJ. As of now, several national courts have concluded that the PNR Directive is most probably incompatible with the European Charter of Fundamental Rights. Furthermore, the CJEU has already stopped a similar PNR agreement between the EU and Canada with its Opinion 1/15 of 26 July 2017. With the matter referred to the CJEU from several sides, the mass processing of passenger data in the EU might come to an end.

The basic funding for the project is provided by the Digital Freedom Fund.

You can find further information on the NoPNR campaign at www.nopnr.eu.