Opinion on the Broader and Core Issues Arising in the PNR Case Currently Before the CJEU (Case C-817/19)

Abstract

This opinion was written at the request of the Fundamental Rights Europe Experts (FREE) Group while the case on the PNR Directive (Case C-817/19) was still pending before the Court of Justice of the EU. In it, I tried to place the PNR Directive and the processing of personal data that is intended, or allowed and envisaged, under the directive in their wider contexts (section 2, below) and adduce the relevant legal standards that are to be applied to the processing (as elaborated in the case-law of the CJEU in particular) (section 3).

In section 4, I analyse the PNR Directive in some detail, with reference to various aspects of the directive (aims, legal bases, competent authorities, “PNR-relevant offences”, categories of data and categories of data subjects, etc.), before focussing on the various forms of data matching that are carried out, or to be carried out, under the directive (see section 4, sub-section 4.9) and on the access to the data and the dissemination and subsequent use of the data (sub-sections 4.10 and 4.11). I also discuss the consequences of a “match” in the various kinds of data matching (sub-section 4.12).

In section 5, I note the inexcusable lack of serious data on the use of the PNR data and on the implications of this use (sub-section 5.1), before making an attempt at an assessment of the PNR Directive and the processing of personal data under it, in particular in terms of the suitability, effectiveness and proportionality of the processing in relation to the stated aim of the directive: the prevention, detection, investigation and prosecution of terrorist offences and serious crime (section 5.2). In section 5, sub-section 5.3, I set out my overall conclusions.

A number of attachments expand on certain relevant matters.

An Executive Summary is provided separately, together with a one-page “at a glance” overview of my findings and conclusions.

Two sub-sections have also been issued as separate papers (also on SSRN), with minor edits. These relate to The Limitations and Flaws in AI-based Technologies and to The Lack of Data on the Effectiveness of Mass Surveillance.

Available at https://ssrn.com/abstract=4437106

Keywords: data protection, EU, data retention, PNR

JEL Classification: K19, K29, K39