On 26 July the CJEU delivered its’ opinion that a draft international agreement between Canada and the EU concerning the transfer of Passenger Name Record (PNR) data is incompatible with the EU Charter of Fundamental Rights.
By way of background the EU and Canada negotiated an agreement in 2014 on the transfer and processing of PNR data which was signed in 2014. The Council of the European Union requested the European Parliament’s approval of the agreement and the European Parliament referred the matter to the CJEU for consideration. By a vote of 383 to 271 the Parliament voted to refer the matter to the CJEU for consideration. In particular the CJEU was asked to consider whether the agreement was compatible with the right to respect for private life and the protection of personal data. The Court found that the agreement in its current form breached both the right to privacy and protection of personal data.
The objective of the agreement was to regulate the transfer and use of PNR data of all air passengers arriving into Canada. The agreement would amongst other things permit a Canadian authority to use and retain PNR data, and possibly transfer such data to other authorities and to other non-member countries, for the purpose of combating terrorism and forms of serious transnational crime. The draft agreement permitted the retention of data for a period of five years and laid out criteria in relation to data security and integrity of sensitive data, including access to and correction and erasure of data. The CJEU found that taken as a whole the PNR data had the potential to reveal a complete travel itinerary of an individual, travel habits, relationships existing between two or more individuals, and information on the financial situation of air passengers, their dietary habits and state of health.
Having found that the draft agreement infringed fundamental rights protected by the EU Charter the Court then had to determine whether such infringements were proportionate and justified by the pursuit of an objective of general interest i.e. to ensure public security in the context of the fight against terrorist offences and serious transnational crime. The CJEU found that several provisions of the agreement were not limited to what was strictly necessary to ensure the achievement of that general objective and failed to lay down clear and precise rules for its achievement. In particular the CJEU found that where a passenger had been cleared to enter Canada the use of their PNR data while in country must be based on new circumstances justifying that use. The CJEU found that as a general rule, except in cases of validly established urgency, be subject to a prior review carried out by a court or by an independent administrative body, the decision of that court or body being made following a reasoned request by the competent authorities submitted, inter alia, within the framework of procedures for the prevention, detection or prosecution of crime.
The CJEU went on to find that the continued retention of PNR data after a passenger departed Canada was not strictly necessary to the overall objective of combating terrorism and serious transnational crime. The CJEU contrasted this to a situation where there were objective evidence from which a risk may be inferred relevant to the objective of combating terrorism and transnational crime. In such circumstance the retention of data up to a period of five years might be justifiable but such a distinction was not included in the current draft of the agreement. The CJEU found that the envisaged agreement could not be concluded in its current form.
A copy of the opinion is available here.
Further commentary on the decision is available here.