The ECJ determined that, although interferences with fundamental rights in the agreement can be justified on the grounds of “an objective general interest”, such as public security, “several provisions of the agreement are not limited to what is strictly necessary and do not lay down clear and precise rules”.
The judgment stated that there is no justification for the transfer of sensitive data about air passengers, the use of EU citizens’ PNR data once they have entered Canada must be based on new circumstances defined by rules setting out the conditions for that use, and the continued storage of PNR data of ‘no risk’ passengers (allowed for a maximum of five years in the agreement) is not permissible.
Further provisions in the agreement should include clearer definitions of PNR data to be transferred, a right to individual notification when PNR data is being used and an independent supervisory body to oversee the rules protecting air passengers.
The ruling echoes ECAS’ concerns about the PNR Directive and is likely to have implications for the Directive as well as the EU’s other PNR agreements with the USA and Australia, which allow the retention of PNR data for five years, 15 years and five and a half years, respectively.
Any reformulation of the PNR agreement with Canada, along with the Directive and other PNR agreements, must strike a balance between security measures and the EU’s fundamental rights and values. There must be clear and precise definitions of what constitutes a public security threat, terrorist offence or serious transnational crime, and a package of provisions to guarantee that citizens can take action if they are prevented from exercising their rights on security grounds.
Finally, a thorough impact assessment and stakeholder consultation should be undertaken to review the policy objectives and impact of the PNR in light of the ECJ’s latest judgment.