Luxembourg, 21 June 2022
105/2022 : 21 June 2022 – Judgment of the Court of Justice in Case C-817/19
Ligue des droits humains
The Court considers that respect for fundamental rights requires that the powers provided for by the PNR Directive be limited to what is strictly necessary
—
In the absence of a genuine and present or foreseeable terrorist threat to a Member State, EU law precludes national legislation providing for the transfer and processing of the PNR data of intra-EU flights and transport operations carried out by other means within the European Union.
The PNR Directive requires the systematic processing of a significant amount of PNR (Passenger Name Record) data relating to air passengers on extra-EU flights entering and leaving the European Union, for the purposes of combating terrorist offences and serious crime. In addition, Article 2 of that directive provides Member States with the possibility to apply the directive to intra-EU flights also.
The Ligue des droits humains (LDH) is a not-for-profit association which filed an action for annulment with the Cour constitutionnelle (Constitutional Court, Belgium) in July 2017 against the Law of 25 December 2016 which transposed into domestic law the PNR Directive, the API Directive and also Directive 2010/65.
According to LDH, that law infringes the right to respect for private life and the right to the protection of personal data guaranteed under Belgian and EU law. It criticises, first, the very broad nature of the PNR data and, secondly, the general nature of the collection, transfer and processing of those data. In its view, the law also infringes the free movement of persons in that it indirectly re-establishes border controls by extending the PNR system to intra-EU flights, as well as to transport by other means within the European Union.
In October 2019, the Belgian Constitutional Court referred ten questions to the Court of Justice for a preliminary ruling on, among other things, the validity of the PNR Directive and the compatibility of the Law of 25 December 2016 with EU law.
In its judgment delivered today, the Court held, first, that since the interpretation given by the Court to the provisions of the PNR Directive in the light of the fundamental rights guaranteed by Articles 7, 8 and 21 and Article 52(1) of the Charter of Fundamental Rights of the European Union (‘the Charter’) ensures that that directive is consistent with those articles, the examination of the questions referred has revealed nothing capable of affecting the validity of the said directive.
It should be noted as a preliminary point that an EU act must be interpreted, as far as possible, in such a way as not to affect its validity and in conformity with primary law as a whole and, in particular, with the provisions of the Charter. Member States must therefore ensure that they do not rely on an interpretation of that act that would be in conflict with the fundamental rights protected by the EU legal order or with the other general principles recognised by EU law. The Court states that many of the recitals and provisions of the PNR Directive require such an interpretation, stressing the importance that the EU legislature, by referring to the high level of data protection, gives to the full respect for fundamental rights enshrined in the Charter.
The Court states that the PNR Directive entails undeniably serious interferences with the rights guaranteed in Articles 7 and 8 of the Charter, in so far, inter alia, as it seeks to introduce a surveillance regime that is continuous, untargeted and systematic, including the automated assessment of the personal data of everyone using air transport services. It notes that the question whether the Member States may justify that interference must be assessed by measuring its seriousness and by verifying that the importance of the objective of general interest pursued is proportionate to that seriousness.
The Court concludes that the transfer, processing and retention of PNR data provided for by that directive may be regarded as being limited to what is strictly necessary for the purposes of combating terrorist offences and serious crime, provided that the powers provided for by that directive are interpreted restrictively.
In that regard, today’s judgment states, inter alia, that:
- The system established by the PNR Directive must cover only clearly identifiable and circumscribed information contained in the headings of Annex I thereto, relating to the flight operated and to the passenger concerned, which implies that, for certain headings of that annex, only the information specifically referred to is covered.
- The application of the system established by the PNR Directive must be limited to terrorist offences and serious crime having an objective link, even if only an indirect one, with the carriage of passengers by air. As regards those crimes, the application of that system cannot be extended to offences which, although meeting the criterion laid down in that directive relating to the threshold of severity and being referred to in Annex II thereto, amount to ordinary crime in view of the particular features of the domestic criminal justice system.
- The possible extension of the application of the PNR Directive to selected or all intra-EU flights, which a Member State may decide by exercising the power provided for in that directive, should be limited to what is strictly necessary. To that end, it must be open to effective review, either by a court or by an independent administrative body whose decision is binding. In that regard, the Court states that:
- in the sole situation where the Member State establishes that there are sufficiently solid grounds for considering that it is confronted with a terrorist threat which is shown to be genuine and present or foreseeable, the application of that directive to all intra-EU flights from or to the said Member State, for a period which is limited to what is strictly necessary but may be extended, does not go beyond what is strictly necessary;
- in the absence of such a terrorist threat, the application of the directive cannot be extended to all intra-EU flights, but must be limited to intra-EU flights relating, inter alia, to certain routes or travel patterns or to certain airports for which there are, at the discretion of the Member State concerned, indications that would justify that application. The strictly necessary nature of that application to the selected intra EU flights must be regularly reviewed in accordance with changes in the circumstances that justified their selection.
- For the purposes of the advance assessment of PNR data, the objective of which is to identify persons who require further examination before their arrival or departure and which is initially carried out by means of automated processing, the passenger information unit (PIU) may compare those data only against the databases on persons or objects sought or under alert. Those databases must be non discriminatory and must be used by the competent authorities in the context of their mission to combat terrorist offences and serious crime having an objective link, even if only an indirect one, with the carriage of passengers by air. As regards, moreover, the advance assessment in the light of the pre-determined criteria, the PIU may not use artificial intelligence technology in self-learning systems (‘machine learning’), capable of modifying without human intervention or review the assessment process and, in particular, the assessment criteria on which the result of the application of that process is based as well as the weighting of those criteria. Those criteria must be defined in such a way that their application targets, specifically, individuals who might be reasonably suspected of involvement in terrorist offences or serious crime and to take into consideration both ‘incriminating’ as well as ‘exonerating’ evidence, and, in so doing, must not give rise to direct or indirect discrimination.
- Given the margin of error inherent in such automated processing of PNR data and the fairly substantial number of ‘false positives’ obtained as a result of their application in 2018 and 2019, the appropriateness of the system established by the PNR Directive to achieve the objectives pursued depends essentially on the proper functioning of the verification of the positive results obtained under those processing operations carried out by the PIU, as a second step, by non-automated means. In that regard, Member States must lay down clear and precise rules capable of providing guidance and support for the analysis carried out by the PIU agents in charge of that individual review for the purposes of ensuring full respect for the fundamental rights enshrined in Articles 7, 8 and 21 of the Charter and, in particular, guarantee a uniform administrative practice within the PIU that observes the principle of non-discrimination. In particular, they must ensure that the PIU establishes objective review criteria enabling its agents to verify, on the one hand, whether and to what extent a positive match (‘hit’) concerns effectively an individual who may be involved in the terrorist offences or serious crime, as well as, on the other hand, the non-discriminatory nature of the automated processing operations. In that context, the Court also stresses that the competent authorities must ensure that the person concerned can understand the operation of the pre-determined assessment criteria and programs applying those criteria, so that it is possible for that person to decide with full knowledge of the relevant facts whether or not to exercise his or her right to judicial redress. Similarly, in the context of such an action, the court responsible for reviewing the legality of the decision adopted by the competent authorities as well as, except in the case of threats to State security, the persons concerned themselves must have had an opportunity to examine both all the grounds and the evidence on the basis of which the decision was taken, including the pre-determined assessment criteria and the operation of the programs applying those criteria.
− The subsequent disclosure and assessment of PNR data after the arrival or departure of the person concerned may be carried out only on the basis of new circumstances and objective evidence capable of giving rise to a reasonable suspicion of that person’s involvement in serious crime having an objective link, even if only an indirect one, with the carriage of passengers by air, or from which it can be inferred that those data could, in a given case, contribute effectively to combating terrorist offences with such a link. Disclosure of PNR data for the purposes of such subsequent assessment must, as a general rule, except in the event of duly justified urgency, be subject to a prior review carried out either by a court or by an independent administrative authority, upon a reasoned request from the competent authorities, regardless of whether that request was introduced before or after the expiry of a period of six months following the transfer of those data to the PIU.
Secondly, the Court considers that the PNR Directive, read in the light of the Charter, precludes national legislation which authorises the processing of PNR data collected in accordance with that directive to be processed for purposes other than those expressly referred to in Article 1(2) of the said directive.
Thirdly, as regards the retention period for PNR data, the Court held that Article 12 of the PNR Directive, read in the light of Articles 7 and 8 as well as Article 52(1) of the Charter, precludes national legislation which provides for a general retention period of five years for such data, applicable indiscriminately to all air passengers.
According to the Court, after expiry of the initial retention period of six months, the retention of PNR data does not appear to be limited to what is strictly necessary in respect of those air passengers for whom neither the advance assessment nor any verification carried out during the initial six-month retention period nor any other circumstance have revealed the existence of objective evidence – such as the fact that the PNR data of the passengers concerned gave rise to a verified positive match during the advance assessment – that would be capable of establishing a risk that relates to terrorist offences or serious crime having an objective link, even if only an indirect one, with those passengers’ air travel.
On the other hand, it considers that, during the initial six-month period, the retention of the PNR data of all air passengers subject to the system established by that directive does not appear, as a matter of principle, to go beyond what is strictly necessary.
Fourthly, the Court holds that EU law precludes national legislation which, in the absence of a genuine and present or foreseeable terrorist threat to which the Member State concerned is confronted, provides for a system for the transfer, by air carriers and tour operators, as well as for the processing, by the competent authorities, of the PNR data of all intra-EU flights and transport operations carried out by other means within the European Union and departing from, going to or transiting through that Member State, for the purposes of combating terrorist offences and serious crime. In such a situation, the application of the system established by the PNR Directive must be limited to the transfer and processing of the PNR data of flights and/or transport operations relating, inter alia, to certain routes or travel patterns or to certain airports, stations or seaports for which there are indications that would justify that application.
Furthermore, the Court states that EU law precludes national legislation providing for such a system for the transfer and processing of those data for the purposes of improving border controls and combating illegal immigration.
NOTE: A reference for a preliminary ruling allows the courts and tribunals of the Member States, in disputes which have been brought before them, to refer questions to the Court of Justice about the interpretation of European Union law or the validity of a European Union act. The Court of Justice does not decide the dispute itself. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.
Source – EU Court of Justice: 105/2022 : 21 June 2022 – Judgment of the Court of Justice in Case C-817/19