Since May 2018, airlines have had to transfer passenger data to member states’ national police authorities. PNR data contains several sensitive items, including date of birth and dietary habits. The data is stored centrally and compared to “patterns” that are specifically created based on the flight patterns of previous offenders. This amounts to the mass surveillance of passengers. The NoPNR campaign intends to stop the PNR directive through strategic litigation.
Mass surveillance without grounds for suspicion
The PNR data of every passenger travelling in Europe is compared against existing patterns, even when they are not suspected of any crimes. This allows law enforcement agencies to identify new suspects. Unfortunately, totally innocent people can be affected by the false results from opaque automatic data evaluation programs and be investigated by the police.
The authorities that are responsible for storing and processing PNR data are usually police authorities, like the Federal Criminal Police Offices in both Germany and Austria. However, other authorities can access the data as well, with domestic police authorities, intelligence services and security agencies being able to manually access the databases. Moreover, the data may be exchanged with other EU countries and, in certain cases, even with third countries.
PNR data is stored for six months using real names, and then for another four and a half years under pseudonyms. These pseudonyms can be removed, however, under certain circumstances. It is only after five years that, as long as there have been no in-depth police measures, the data is finally deleted.
Retaining PNR data violates European fundamental rights
In a 2017 legal opinion, the ECJ found that the transfer of PNR data as planned in a draft international treaty between the EU and Canada would breach citizens' fundamental rights. The PNR Directive also violates the Charter of Fundamental Rights of the EU, especially the right to respect for private and family life (Article 7), as well as the right to the protection of personal data (Article 8).
In our case, it is not possible to appeal directly to the ECJ. GFF and epicenter.works have thus taken legal action against the national implementation of the PNR Directive before German and Austrian courts, both civil and administrative. They expect the national courts to refer the question of the PNR Directive to the ECJ, and only the ECJ can overturn the PNR Directive and thus stop the retention of PNR data in all EU member states.
We thank the Digital Freedom Fund for providing the basic funding for the project.
