Skip to main content
View expanded cover

Computers, Privacy and Data Protection: an Element of Choice pp 171–199Cite as

EU PNR: European Flight Passengers Under General Suspicion – The Envisaged European Model of Analyzing Flight Passenger Data

Abstract

After 9/11 the United States of America as well as other countries discovered the collection and evaluation of flight passenger data, so called passenger name records (PNR), as a new tool to track terrorists and other criminals. The use of the PNR was meant to help to identify potential terrorists before they reach American territory. Despite being criticized for fundamental rights violations, the EU is on the threshold of imitating the American PNR system. This contribution analyses the current state of play of the proposed EU PNR system by taking into account its scope and its compliance with basic European data protection rules.

Keywords

  • Council Framework Decision
  • European Data Protection
  • German Constitutional
  • Data Retention Directive
  • Admissibility Decision

These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Franziska Boehm is working as a research assistant at the University of Luxembourg where she is also preparing her PhD thesis. E-mail: franziska.boehm@uni.lu; this contribution is based on a presentation held at the CPDP Conference 2010 in Brussels.

This is a preview of subscription content, access via your institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • DOI: 10.1007/978-94-007-0641-5_8
  • Chapter length: 29 pages
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
eBook
USD   149.00
Price excludes VAT (USA)
  • ISBN: 978-94-007-0641-5
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
Softcover Book
USD   199.99
Price excludes VAT (USA)
Hardcover Book
USD   279.99
Price excludes VAT (USA)
Learn about institutional subscriptions

Notes

  1. 1.

    Agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Unites States Department of Homeland Security (DHS), OJ 2007, L-204/18. In the following: EU-US PNR agreement. A similar agreement exists with Canada: Agreement between the European Community and the Government of Canada on the processing of Advanced Passenger Information and Passenger Name Record data, OJ 2006, L-82/15; on the background of this Agreement and its predecessors: Vagelis Papakonstantinou and Paul De Hert, “The PNR Agreement and Transatlantic anti-terrorism Cooperation: No firm human rights framework on either side of the Atlantic,” Common Market Law Review 46, 3 (2009): 885–919; Mario Mendez, “Passenger Name Record Agreement, European Court of Justice,” European Constitutional Law Review 3 (2007): 127–147.

  2. 2.

    Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes, COM (2007) 654 from 6 November 2007.

  3. 3.

    EU-PNR proposal in its latest version, proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  4. 4.

    In each case, reference is made to the specific version the text is referring to.

  5. 5.

    Patrick Pawlak, “Made in USA? The influence of the US on the EU’s data protection regime,” Centre of European Policy Studies, Liberty and Security in Europe, Justice and Home Affairs section, pp. 4-9 (2009), http://www.ceps.be/book/made-usa-influence-us-eu%E2%80%99s-data-protection-regime.

  6. 6.

    For a profound analysis with further references see: Vagelis Papakonstantinou, and Paul De Hert, “The PNR Agreement and Transatlantic anti-terrorism Cooperation: No firm human rights framework on either side of the Atlantic,” Common Market Law Review 46 (3) (2009): 885–919; Mario Mendez, “Passenger Name Record Agreement, European Court of Justice,” European Constitutional Law Review 3 (2007): 127–147.

  7. 7.

    Vagelis Papakonstantinou, and Paul De Hert, “The PNR Agreement and Transatlantic anti-terrorism Cooperation: No firm human rights framework on either side of the Atlantic,” Common Market Law Review 46 (3) (2009): 885–919; Mario Mendez, “Passenger Name Record Agreement, European Court of Justice,” European Constitutional Law Review 3 (2007): 127–147.

  8. 8.

    Compare for instance category 17 of the agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Unites States Department of Homeland Security (DHS), OJ 2007, L-204/18, “general remarks including OSI, SSI and SSR information”, which means “other information”, “sensitive security information” and “special service requests” or category 18 referring to “any collected APIS information” which refers to the Advanced Passenger Information System information which includes further personal information such as passport information, country and city of residence as well as first address in the USA.

  9. 9.

    Examples: date of reservation/issue of ticket, date(s) of intended travel, name(s), available frequent flier and benefit information (i.e. free tickets, upgrades, etc.), other names on PNR, including number of travelers on PNR, all available contact information (including originator information meaning address and telephone number at the final destination), all available payment/billing information linked to the travel transaction, travel itinerary for specific PNR, travel agency/travel agent, code share information, split/divided information, travel status of passenger (including confirmations and check-in status), ticketing information, including ticket number, one-way tickets and Automated Ticket Fare Quote, all baggage information, seat information, including seat number. See also: Edward Hasbrouck, comment on “What’s in a passenger name record (PNR)?,” http://www.hasbrouck.org/articles/PNR.html (accessed February 05, 2010).

  10. 10.

    See data categories 7, 8 and 10 of the agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Unites States Department of Homeland Security (DHS), OJ 2007, L-204/18.

  11. 11.

    Compare the list of data categories entailed in the annex of the proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes, COM (2007) 654 from 6 November 2007 with the list of data categories of the agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Unites States Department of Homeland Security (DHS), OJ 2007, L-204/18.

  12. 12.

    Patrick Pawlak, “Made in USA? The influence of the US on the EU’s data protection regime,” Centre of European Policy Studies, Liberty and Security in Europe, Justice and Home Affairs section, p. 9 (2009), http://www.ceps.be/book/made-usa-influence-us-eu%E2%80%99s-data-protection-regime.

  13. 13.

    Patrick Pawlak, “Made in USA? The influence of the US on the EU’s data protection regime,” Centre of European Policy Studies, Liberty and Security in Europe, Justice and Home Affairs section, pp. 6–7 (2009), http://www.ceps.be/book/made-usa-influence-us-eu%E2%80%99s-data-protection-regime, compare in this context articles 1, 9, 11 as well as the list of stored items in the annex of the Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes, COM (2007) 654 from 6 November 2007 with points I, III, IV and VII Agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Unites States Department of Homeland Security (DHS), OJ 2007, L-204/18.

  14. 14.

    Article 1 of the Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes, COM (2007) 654 from 6 November 2007.

  15. 15.

    Compare in particular the modification of article 1 of the Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes, COM (2007) 654 from 6 November 2007 with the EU-PNR proposal in its latest Council version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  16. 16.

    Article 3 EU-PNR proposal in its latest Council version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  17. 17.

    Article 9 EU-PNR proposal in its latest Council version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  18. 18.

    Article 2 (b) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  19. 19.

    See Recital (7) and article 17 of the EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  20. 20.

    See statistics: Eurocontrol:

    http://www.eurocontrol.int/corporate/public/faq/about_us_faq.html#qa12 (August, 25, 2010).

  21. 21.

    European Data Protection Supervisor, Opinion on the draft proposal for a Council Framework Decision on the use of Passenger Name records (PNR) for law enforcement purposes, OJ 2008, C-110/01, in the following EDPS opinion; European Parliament, Resolution of 20 November 2008 on the proposal for a Council Framework Decision on the use of Passenger Name records (PNR) for law enforcement purposes, B6-0615/2008, in the following EP resolution; Opinion of the European Union Agency for Fundamental Rights on the Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes, 28 October 2008, in the following FRA’s opinion.

  22. 22.

    EDPS opinion, point 8.

  23. 23.

    Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ 1995, L-281/31.

  24. 24.

    For instance: Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector, OJ 1998, L-24/1.

  25. 25.

    Article 3 (2) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ 1995, L-281/31. This statement was clarified by the ECJ in the famous PNR case: joined cases C-317/04 and C-318/04, Parliament v. Council, [2006], ECR I-4721.

  26. 26.

    Mainly by article 8 ECHR, the Convention No. 108 of the Council of Europe for the protection of individuals with regard to automatic processing of personal data from 28 January 1981, the additional protocol to the Convention for the protection of individuals with regard to automatic processing of personal data regarding supervisory authorities and transborder data flows from 2004 and Recommendation R (87) 15 of the Committee of Ministers to the Member States regulating the use of personal data in the police sector, adopted 17 September 1987; compare for a profound analysis: Siemen, Birte (2006). Datenschutz als europäisches Grundrecht. Berlin: Duncker & Humblot.

  27. 27.

    Convention No. 108 of the Council of Europe for the protection of individuals with regard to automatic processing of personal data from 28 January 1981.

  28. 28.

    In particular the additional protocol to Convention for the protection of individuals with regard to automatic processing of personal data regarding supervisory authorities and transborder data flows, which entered into force in 2004.

  29. 29.

    Recommendation R (87) 15 of the Committee of Ministers to the Member States regulating the use of personal data in the police sector, adopted 17 September 1987.

  30. 30.

    Recital (10b) and article 11 (1a) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  31. 31.

    Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data in the framework of police and judicial cooperation in criminal matters, OJ 2008, L-350/60.

  32. 32.

    In addition to the Council of Europe instruments, the EU-PNR proposal also refers to the DPFD, compare Recital (10b) and article 11 (1a) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  33. 33.

    Article 16 TFEU clarifies that “everyone has the right to the protection of personal data concerning them”.

  34. 34.

    Article 6 (3) TFEU.

  35. 35.

    Article 6 (2) and (3) TEU.

  36. 36.

    Compare for a profound analysis: Siemen, Birte (2006). Datenschutz als europäisches Grundrecht. Berlin: Duncker & Humblot.

  37. 37.

    Compare for instance: ECtHR, Leander v. Sweden, Application no. 9248/81 from 26 March 1987; ECtHR, Amann v. Switzerland, Application no. 27798/95 from 16 February 2000; ECtHR, Rotaru against Romania, Application no. 28341/95 from 4 May 2000; ECtHR, Panteleyenko v. Ukraine, Application no. 11901/02 from 29 June 2006; ECtHR, S. and Marper v the United Kingdom, Application nos. 30562/04 and 30566/04 from 4 December 2008; ECtHR Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision from 29 June 2006; ECtHR, C.G. and others v. Bulgaria, Application no. 1365/07 from 24 April 2008; ECtHR, Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria, Application no. 62540/00 from 28 June 2007; ECtHR, Malone v. the United Kingdom, Application no. 8691/79 from 2 August 1984; ECtHR, Valenzuela v. Spain, Application no. 27671/95 from 30 July 1998.

  38. 38.

    ECtHR, Z. v Finland, Application no. 22009/93, from 25 February 1997, para 95; ECtHR, Peck v. United Kingdom, Application no. 44647/98 from 28 January 2003, para 78; ECtHR, L.L. v France Application no. 7508/02 from 10 October 2006, para 43; ECtHR, Biriuk v Lithuania, Application no. 23373/03 from 25 November 2008, para 39; ECtHR, I v Finland Application no. 20511/03 from 17 July 2008, para 38; ECtHR, S. and Marper v the United Kingdom, Application nos. 30562/04 and 30566/04 from 4 December 2008, para 103; ECtHR, C.C. v. Spain, Application no. 1425/06 from 6 October 2009, para 31.

  39. 39.

    ECtHR, Amann v. Switzerland, Application no. 27798/95 from 16 February 2000, paras 65–67.

  40. 40.

    ECtHR, Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision from 29 June 2006, para 79.

  41. 41.

    ECtHR, Sunday Times v. the United Kingdom, Application no. 6538/74, para 49 from 26 April 1979; ECtHR, Liberty and others v. the United Kingdom, Application no. 58234/00 from 1 July 2008, para 68; ECtHR Silver v. the United Kingdom, Application no. 5947/72 and others from 25 March 1983, paras 85–88.

  42. 42.

    ECtHR, Segerstedt-Wiberg and others v. Sweden, Application no. 62332/00 from 6 June 2006, paras 88–92; ECtHR, Liberty and others v. the United Kingdom, Application no. 58234/00 from 1 July 2008, para 68; ECtHR, Rotaru v. Romania, Application no. 28341/954 from 4 May 2000, para 57; ECtHR, Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision from 29 June 2006, paras 116 and 127.

  43. 43.

    ECtHR, S. and Marper v. the United Kingdom, Application nos. 30562/04 and 30566/04 from 4 December 2008, para 119; ECtHR, Segerstedt-Wiberg and others v. Sweden, Application no. 62332/00 from 6 June 2006, paras 89–92.

  44. 44.

    ECtHR, Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision, para 116 from 29 June 2006; ECtHR, Rotaru v. Romania, Application no. 28341/954, para 57 from 4 May 2000; see also: ECtHR, Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria, Application no. 62540/00 from 28 June 2007.

  45. 45.

    ECtHR, Rotaru against Romania, Application no. 28341/95 from 4 May 2000, paras 55–63; ECtHR, Segerstedt-Wilberg and others v. Sweden, Application no. 62332/00 from 6 June 2006, para 121.

  46. 46.

    ECtHR, Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision from 29 June 2006, para 135: “since there is in principle little scope for recourse to the courts by the individual concerned unless the latter is advised of the measures taken without his or her knowledge and thus able to challenge their legality retrospectively”.

  47. 47.

    ECtHR, Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision, para 135 from 29 June 2006.

  48. 48.

    ECtHR, Valenzuela v. Spain, Application no. 27671/95 from 30 July 1998, para 46 et seq.

  49. 49.

    See a case with regard to governmental data mining: ECtHR, Rotaru against Romania, Application no. 28341/95 from 4 May 2000, para 50.

  50. 50.

    Compare article 1 EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  51. 51.

    ECtHR, Kennedy v. the United Kingdom, Application no. 26839/05 from 18 May 2010, para 159.

  52. 52.

    ECtHR, Kennedy v. the United Kingdom, Application no. 26839/05 from 18 May 2010, para 159.

  53. 53.

    Emphasis added.

  54. 54.

    ECtHR, Kennedy v. the United Kingdom, Application no. 26839/05 from 18 May 2010, para 159.

  55. 55.

    Article 2 (h) and (i) and Recital (3) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  56. 56.

    Articles 1–4 Council Framework Decision on Combating Terrorism, OJ 2002 L-164/03, article 2 (2) of the Council Framework Decision on the European Arrest Warrant and the surrender procedures between Member States, OJ 2002, L-190/1 and article 2 Council Framework Decision of 24 October 2008 on the Fight Against Organised Crime, OJ 2008, L-300/42.

  57. 57.

    ECtHR, Kennedy v. the United Kingdom, Application no. 26839/05 from 18 May 2010, para 159.

  58. 58.

    See arguments of the German Constitutional Court delivered in a judgment in context of a governmental profiling case: Bundesverfassungsgericht, 1 BvR 518/02, para 117.

  59. 59.

    Compare for instance: ECtHR, Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision from 29 June 2006, paras 121–122.

  60. 60.

    ECtHR, Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision from 29 June 2006, paras 80 et seq.

  61. 61.

    EDPS opinion, points 27-29.

  62. 62.

    Vagelis Papakonstantinou and Paul De Hert, “The PNR Agreement and Transatlantic anti-terrorism Cooperation: No firm human rights framework on either side of the Atlantic,” Common Market Law Review 46, 3 (2009): 917.

  63. 63.

    Compare for instance: ECtHR, K.U. v. Finland, Application no. 2871/02 from 2 December 2008, para 26; ECtHR, Copland v. the United Kingdom, Application no. 62617/00 from 3 April 2007, para 38.

  64. 64.

    In addition to the EU-US PNR Agreement, the EU-PNR proposal is closely related to Directive 2004/82/EC at EU level. While the Directive regulates the transfer of advanced passenger information (API) from air carriers to border control authorities of the Member States, the EU-PNR proposal attempts to harmonize the legal provisions of the Member States regarding the duties of air carriers to transfer their PNR to law enforcement authorities of the Member States for crime prevention purposes. Whereas the API Directive obliges air carriers to transmit on prior request of border control authorities information relating to the passengers they will carry, the EU-PNR proposal provides for a general obligation for air carriers to transfer their passenger data to law enforcement authorities without the request requirement. Moreover, in contrast to API, which principally contains passport information, PNR information includes more data categories, mainly based on the information the passenger provides him- or herself during an airline ticket reservation. For an overview on the similarity and the provisions of API Directive 2004/82 see: Evelien Brouwer, “Towards a European PNR system? Questions on the added value and the protection of fundamental rights,” study requested by the European Parliament’s Committee on civil liberties, justice and home affairs (LIBE) (2009), pp. 2–3.

  65. 65.

    ECtHR, Segerstedt-Wiberg and others v. Sweden, Application no. 62332/00 from 6 June 2006, paras 88–92; ECtHR, Liberty and others v. the United Kingdom, Application no. 58234/00 from 1 July 2008, para 68; ECtHR, Rotaru v. Romania, Application no. 28341/954 from 4 May 2000, para 57; ECtHR, Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision from 29 June 2006, paras 116 and 127.

  66. 66.

    Recital (9) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  67. 67.

    Accompanying document to the proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes from 12 November 2007 – summary of the impact assessment, 2007/0237 (CNS), 14922/07, p. 3, para 2.

  68. 68.

    Accompanying document to the proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes from 12 November 2007 – summary of the impact assessment, 2007/0237 (CNS), 14922/07, p. 3, para 2.

  69. 69.

    Article 3 (3) (c) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  70. 70.

    Accompanying document to the proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes from 12 November 2007 – summary of the impact assessment, 2007/0237 (CNS), 14922/07, p. 3, para 2.

  71. 71.

    Accompanying document to the proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes from 12 November 2007 – summary of the impact assessment, 2007/0237 (CNS), 14922/07, p. 3, para 2.

  72. 72.

    Compare: EDPS opinion, point 18 and FRA’s opinion point 12.

  73. 73.

    EDPS opinion, points 18–25.

  74. 74.

    Annual report of the European Organisation for the Safety of Air Navigation, Eurocontrol, http://www.eurocontrol.int/epr/public/standard_page/AnnualReport.html, p. 27.

  75. 75.

    Compare article 1 EU-PNR which refers to the scope of the EU-PNR proposal and article 5 (1) EU-PNR proposal referring to the obligations of air carriers which are obliged to “make available the PNR data of all passengers of the flight” to the PIUs of the Member States, EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  76. 76.

    ECtHR, Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision from 29 June 2006, para 129.

  77. 77.

    ECtHR, Weber and Saravia, Application no. 54934/00 Admissibility Decision from 29 June 2006, para 127.

  78. 78.

    Judgment on governmental profiling of the German Constitutional Court, Bundesverfassungsgericht, 1 BvR 518/02, para 117.

  79. 79.

    ECtHR, Weber and Saravia, Application no. 54934/00 Admissibility Decision from 29 June 2006, paras 125–129.

  80. 80.

    Compare commentary in footnote 56 of EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009 referring to the different positions regarding the data retention period provided for in article 9 of the EU-PNR proposal.

  81. 81.

    Recital (9) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  82. 82.

    Article 9 EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  83. 83.

    Compare commentary in footnote 56 of EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009 referring to the different positions regarding the data retention period provided for in article 9 of the EU-PNR proposal.

  84. 84.

    S. and Marper v. the United Kingdom, Application nos. 30562/04 and 30566/04 from 4 December 2008, para 119; Segerstedt-Wiberg and others v. Sweden Application no. 62332/00 from 6 June 2006, paras 89–92.

  85. 85.

    Article 9 (3) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  86. 86.

    Recital (9a) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  87. 87.

    ECtHR, S. and Marper v. the United Kingdom, Application nos. 30562/04 and 30566/04 from 4 December 2008.

  88. 88.

    ECtHR, S. and Marper v. the United Kingdom, Application nos. 30562/04 and 30566/04 from 4 December 2008, para 119.

  89. 89.

    ECtHR, S. and Marper v. the United Kingdom, Application nos. 30562/04 and 30566/04 from 4 December 2008, para 119.

  90. 90.

    ECtHR, S. and Marper v. the United Kingdom, Application nos. 30562/04 and 30566/04 from 4 December 2008, para 120.

  91. 91.

    Article 3 (a) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  92. 92.

    EDPS opinion, point 19 and FRA’s opinion point 12. To the general concerns raised by data mining including further references, see: Paul De Hert and Rocco Bellanova, “Data protection from a transatlantic perspective: The EU and US move towards an international data protection agreement?,” study requested by the European Parliament’s Committee on civil liberties, justice and home affairs (LIBE) (2008), pp. 25–26 and 37–38.

  93. 93.

    EDPS opinion, point 22.

  94. 94.

    Compare wording in article 18 (2) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  95. 95.

    Judgment on governmental profiling of the German Constitutional Court, Bundesverfassungsgericht, 1 BvR 518/02.

  96. 96.

    Census decision of the German Constitutional Court, Bundesverfassungsgericht, Volkszählungsurteil, BVerfGE 65, 1, para 177.

  97. 97.

    Article 3 (a) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  98. 98.

    ECtHR, Rotaru against Romania, Application no. 28341/95 from 4 May 2000, paras 55–63; ECtHR, Segerstedt-Wiberg and others v. Sweden, Application no. 62332/00from 6 June 2006, para 121.

  99. 99.

    Article 11 et seq. EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  100. 100.

    Evelien Brouwer, “Towards a European PNR system? Questions on the added value and the protection of fundamental rights,” study requested by the European Parliament’s Committee on civil liberties, justice and home affairs (LIBE) (2009), p. 26.

  101. 101.

    Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision, para 135 from 29 June 2006.

  102. 102.

    Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision, para 135 from 29 June 2006.

  103. 103.

    Spiros Simitis, “Der EuGH und die Vorratsdatenspeicherung oder die verfehlte Kehrtwende bei der Kompetenzregelung,” Neue Juristische Wochenzeitschrift 25 (2009): 1782–1786.

  104. 104.

    Council Directive 2004/82/EC of 29 April 2004 on the obligation of air carriers to communicate passenger data, OJ 2004, L-261/24, compare footnote 64.

  105. 105.

    Joined cases C-317/04 and C-318/04, Parliament v. Council, [2006], ECR I-4721 and case C-301/06 Ireland v. Parliament and Council [2009] ECR I-593. To the similiarity of the cases, see: Spiros Simitis, “Der EuGH und die Vorratsdatenspeicherung oder die verfehlte Kehrtwende bei der Kompetenzregelung,” Neue Juristische Wochenzeitschrift 25 (2009): 1782–1786.

  106. 106.

    Joined cases C-317/04 and C-318/04, Parliament v. Council, [2006], ECR I-4721.

  107. 107.

    For a more detailed analysis and the consequences of this case, compare: Vagelis Papakonstantinou, and Paul De Hert, “The PNR Agreement and Transatlantic anti-terrorism Cooperation: No firm human rights framework on either side of the Atlantic,” Common Market Law Review 46, 3 (2009): 885–919 and Mario Mendez, “Passenger Name Record Agreement, European Court of Justice,” European Constitutional Law Review 3 (2007): 127–147.

  108. 108.

    Joined cases C-317/04 and C-318/04, Parliament v. Council, [2006], ECR I-4721, para 56.

  109. 109.

    The Court added: “While the view may rightly be taken that PNR data are initially collected by airlines in the course of an activity which falls within the scope of Community law, namely sale of an aeroplane ticket which provides entitlement to a supply of services, the data processing which is taken into account […] is, however, quite different in nature”, as a result, the PNR transfers did not concern “data processing necessary for a supply of services, but data processing regarded as necessary for safeguarding public security and for law-enforcement purposes”, see: Joined cases C-317/04 and C-318/04, Parliament v. Council, [2006], ECR I-4721, para 57.

  110. 110.

    Joined cases C-317/04 and C-318/04, Parliament v. Council, [2006], ECR I-4721, paras 33–50.

  111. 111.

    Spiros Simitis, “Der EuGH und die Vorratsdatenspeicherung oder die verfehlte Kehrtwende bei der Kompetenzregelung,” Neue Juristische Wochenzeitschrift 25 (2009): 1782–1786, in particular 1782.

  112. 112.

    Case C-301/06 Ireland v. Parliament and Council [2009] ECR I-593. Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, OJ 2006, L-105/54.

  113. 113.

    Article 1 (1) and (2) Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, OJ 2006, L-105/54.

  114. 114.

    Case C-301/06 Ireland v. Parliament and Council [2009] ECR I-593, para 63.

  115. 115.

    Spiros Simitis, “Der EuGH und die Vorratsdatenspeicherung oder die verfehlte Kehrtwende bei der Kompetenzregelung,” Neue Juristische Wochenzeitschrift 25 (2009): 1782–1786, in particular 1783.

  116. 116.

    Case C-301/06 Ireland v. Parliament and Council [2009] ECR I-593, para 83.

  117. 117.

    Case C-301/06 Ireland v. Parliament and Council [2009] ECR I-593, para 84.

  118. 118.

    Case C-301/06 Ireland v. Parliament and Council [2009] ECR I-593, para 84.

  119. 119.

    Spiros Simitis, “Der EuGH und die Vorratsdatenspeicherung oder die verfehlte Kehrtwende bei der Kompetenzregelung,” Neue Juristische Wochenzeitschrift 25 (2009): 1782–1786, in particular 1784.

  120. 120.

    A third pillar basis would have for instance hindered a subsequent judicial control in front of the European Courts.

  121. 121.

    Bundesverfassungsgericht, 2 March 2010, 1 BvR 256/08 and Curtea Constitutionala, 8 October 2009 number 1258, Romanian Official Monitor no. 789 of 23 November 2009. For more details, see: Katja de Vries, Rocco Bellanova and Paul de Hert, “Proportionality overrides Unlimited Surveillance, The German Constitutional Court Judgment on Data Retention,” Centre of European Policy Studies, Liberty and Security in Europe, (2010), http://www.ceps.eu/book/proportionality-overrides-unlimited-surveillance and Bogdan Manolea, “Implementation of EU Data Retention Directive Unconstitutional,” Computer Law Review International 2 (2010): 49–51.

  122. 122.

    Former articles 29, 30 (1) (b) and 34 (2) (b) TEU; now 67, 87 (2) (a) TFEU. Article 34 (2) (b) TEU was repealed, compare EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  123. 123.

    Recital (6) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  124. 124.

    Recitals (10a) and (10b) and article 11 (1) EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  125. 125.

    Ibid.

  126. 126.

    Compare remarks of the EDPS in this context, EDPS opinion, points 54–66.

  127. 127.

    Compare articles 11d and 11e EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009, which state that Member States should decide whether the rights of the individuals should be exercised via the national DPA’s or directly asserted against the PIU.

  128. 128.

    This solution was strongly opposed by Denmark and France, see footnote 61 relating to article 11 EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

  129. 129.

    Steve Peers, comment on “The Third Pillar acquis after the Treaty of Lisbon enters into force,” comment posted on December 1, 2009, http://www.statewatch.org/analyses/86-third-pillar-acquis-post-lisbon.pdf.

References

  • Accompanying document to the proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes from 12 November 2007 – impact assessment, 2007/0237 (CNS), 14922/07.

    Google Scholar 

  • Additional protocol to the Convention for the protection of individuals with regard to automatic processing of personal data regarding supervisory authorities and transborder data flows from 2004.

    Google Scholar 

  • Agreement between the European Community and the Government of Canada on the processing of Advanced Passenger Information and Passenger Name Record data, OJ 2006, L-82/15.

    Google Scholar 

  • Agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Unites States Department of Homeland Security (DHS), OJ 2007, L-204/18.

    Google Scholar 

  • Annual report 2009 of the European Organisation for the Safety of Air Navigation, Eurocontrol, http://www.eurocontrol.int/epr/public/standard_page/AnnualReport.html (accessed August 25, 2010).

  • Brouwer, E. “Towards a European PNR system? Questions on the added value and the protection of fundamental rights,” study requested by the European Parliament’s Committee on civil liberties, justice and home affairs (LIBE) (2009).

    Google Scholar 

  • Bundesverfassungsgericht, 1 BvR 518/02, Judgment on governmental profiling of the German Constitutional Court.

    Google Scholar 

  • Bundesverfassungsgericht, 2 March 2010, 1 BvR 256/08, judgment related to the implementation of the Data Retention Directive.

    Google Scholar 

  • Bundesverfassungsgericht, Volkszählungsurteil, BVerfGE 65, 1, Census decision of the German Constitutional Court.

    Google Scholar 

  • Case C-301/06 Ireland v. Parliament and Council [2009] ECR I-593.

    Google Scholar 

  • Convention No. 108 of the Council of Europe for the protection of individuals with regard to automatic processing of personal data from 28 January 1981.

    Google Scholar 

  • Council Directive 2004/82/EC of 29 April 2004 on the obligation of air carriers to communicate passenger data, OJ 2004, L-261/24.

    Google Scholar 

  • Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data in the framework of police and judicial cooperation in criminal matters, OJ 2008, L-350/60.

    Google Scholar 

  • Council Framework Decision on Combating Terrorism, OJ 2002 L-164/03.

    Google Scholar 

  • Council Framework Decision on the European Arrest Warrant and the surrender procedures between Member States, OJ 2002, L-190/1.

    Google Scholar 

  • Curtea Constitutionala, 8 October 2009 number 1258, Romanian Official Monitor no. 789 of 23 November 2009, judgment related to the implementation of the Data Retention Directive.

    Google Scholar 

  • De Hert, P., and R. Bellanova. “Data protection from a transatlantic perspective: The EU and US move towards an international data protection agreement?” study requested by the European Parliament’s Committee on civil liberties, justice and home affairs (LIBE) (2008).

    Google Scholar 

  • De Vries, K., R. Bellanova, and P. de Hert“Proportionality overrides Unlimited Surveillance, The German Constitutional Court Judgment on Data Retention”, Centre of European Policy Studies, Liberty and Security in Europe, (2010), http://www.ceps.eu/book/proportionality-overrides-unlimited-surveillance (accessed August 25, 2010).

  • Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC, OJ 2006, L-105/54.

    Google Scholar 

  • Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ 1995, L-281/31.

    Google Scholar 

  • Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector, OJ 1998, L-24/1.

    Google Scholar 

  • ECtHR, Amann v. Switzerland, Application no. 27798/95 from 16 February 2000.

    Google Scholar 

  • ECtHR, Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria, Application no. 62540/00 from 28 June 2007.

    Google Scholar 

  • ECtHR, Biriuk v Lithuania, Application no. 23373/03 from 25 November 2008.

    Google Scholar 

  • ECtHR, C.C. v. Spain, Application no. 1425/06 from 6 October 2009.

    Google Scholar 

  • ECtHR, C.G. and others v. Bulgaria, Application no. 1365/07 from 24 April 2008.

    Google Scholar 

  • ECtHR, Copland v. the United Kingdom, Application no. 62617/00 from 3 April 2007.

    Google Scholar 

  • ECtHR, I. v Finland Application no. 20511/03 from 17 July 2008.

    Google Scholar 

  • ECtHR, K.U. v. Finland, Application no. 2871/02 from 2 December 2008.

    Google Scholar 

  • ECtHR, Kennedy v. the United Kingdom, Application no. 26839/05 from 18 May 2010.

    Google Scholar 

  • ECtHR, L.L. v France Application no. 7508/02 from 10 October 2006.

    Google Scholar 

  • ECtHR, Leander v. Sweden, Application no. 9248/81 from 26 March 1987.

    Google Scholar 

  • ECtHR, Liberty and others v. the United Kingdom, Application no. 58234/00 from 1 July 2008.

    Google Scholar 

  • ECtHR, Malone v. the United Kingdom, Application no. 8691/79 from 2 August 1984.

    Google Scholar 

  • ECtHR, Panteleyenko v. Ukraine, Application no. 11901/02 from 29 June 2006.

    Google Scholar 

  • ECtHR, Peck v. United Kingdom, Application no. 44647/98 from 28 January 2003.

    Google Scholar 

  • ECtHR, Rotaru against Romania, Application no. 28341/95 from 4 May 2000.

    Google Scholar 

  • ECtHR, S. and Marper v the United Kingdom, Application nos. 30562/04 and 30566/04 from 4 December 2008.

    Google Scholar 

  • ECtHR, Segerstedt-Wiberg and others v. Sweden, Application no. 62332/00 from 6 June 2006.

    Google Scholar 

  • ECtHR, Silver v. the United Kingdom, Application no. 5947/72 and others, from 25 March 1983.

    Google Scholar 

  • ECtHR, Sunday Times v. the United Kingdom, Application no. 6538/74.

    Google Scholar 

  • ECtHR, Valenzuela v. Spain, Application no. 27671/95 from 30 July 1998.

    Google Scholar 

  • ECtHR, Weber and Saravia v. Germany, Application no. 54934/00 Admissibility Decision from 29 June 2006.

    Google Scholar 

  • ECtHR, Z. v Finland, Application no. 22009/93, from 25 February 1997.

    Google Scholar 

  • Edward Hasbrouck Blog, http://www.hasbrouck.org/ (accessed August 25, 2010).

  • EU-PNR proposal in its latest version, Council doc. 5618/2/09, interinstitutional file 2007/0237 (CNS) from 29 June 2009.

    Google Scholar 

  • European Data Protection Supervisor, Opinion on the draft proposal for a Council Framework Decision on the use of Passenger Name records (PNR) for law enforcement purposes, OJ 2008, C-110/01.

    Google Scholar 

  • European Parliament, Resolution of 20 November 2008 on the proposal for a Council Framework Decision on the use of Passenger Name records (PNR) for law enforcement purposes, B6-0615/2008.

    Google Scholar 

  • Joined cases C-317/04 and C-318/04, Parliament v. Council, [2006], ECR I-4721.

    Google Scholar 

  • Manolea, B. “Implementation of EU Data Retention Directive Unconstitutional.” Computer Law Review International 2 (2010): 49–51.

    Google Scholar 

  • Mendez, M. “Passenger Name Record Agreement, European Court of Justice.” European Constitutional Law Review 3 (2007): 127–147.

    CrossRef  Google Scholar 

  • Opinion of the European Union Agency for Fundamental Rights on the Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes, 28 October 2008.

    Google Scholar 

  • Papakonstantinou, V., and P. De Hert. “The PNR Agreement and Transatlantic anti-terrorism Cooperation: No firm human rights framework on either side of the Atlantic.” Common Market Law Review 46, 3 (2009): 885–919.

    Google Scholar 

  • Pawlak, P. “Made in USA? The influence of the US on the EU’s data protection regime,” Centre of European Policy Studies, Liberty and Security in Europe, Justice and Home Affairs section, (2009), http://www.ceps.be/book/made-usa-influence-us-eu%E2%80%99s-data-protection-regime (accessed August 25, 2010).

  • Peers, S. “The Third Pillar acquis after the Treaty of Lisbon enters into force” comment posted on December 1, 2009, http://www.statewatch.org/analyses/86-third-pillar-acquis-post-lisbon.pdf (accessed August 25, 2010).

  • Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes from 6 November 2007, COM (2007) 654.

    Google Scholar 

  • Recommendation R (87) 15 of the Committee of Ministers to the Member States regulating the use of personal data in the police sector, adopted 17 September 1987.

    Google Scholar 

  • Siemen, B. Datenschutz als europäisches Grundrecht. Berlin: Duncker & Humblot, 2006.

    Google Scholar 

  • Simitis, S. “Der EuGH und die Vorratsdatenspeicherung oder die verfehlte Kehrtwende bei der Kompetenzregelung.” Neue Juristische Wochenzeitschrift 25 (2009): 1782–1786.

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. University of Luxembourg, Luxembourg, Luxembourg

    Franziska Boehm

Authors
  1. Franziska Boehm
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Franziska Boehm .

Editor information

Editors and Affiliations

  1. Law, Science, Technology & Society, (LSTS), Vrije Universiteit Brussels, Pleinlaan 2, Bruxelles, 1050, Belgium

    Serge Gutwirth

  2. Research Centre for Information, Technology & Law, University of Namur, Rempart de la Vierge 5, Namur, 5000, Belgium

    Yves Poullet

  3. Center for Law, Science, Technology, and Society Studies (LSTS), Vrije Universiteit Brussel, Pleinlaan 2, Brussels, 1050, Belgium

    Paul De Hert

  4. , TILT, Tilburg University, Warandelaan 2, Tilburg, 5037 AB, Netherlands

    Ronald Leenes

Rights and permissions

Reprints and Permissions

Copyright information

© 2011 Springer Science+Business Media B.V.

About this chapter

Cite this chapter

Boehm, F. (2011). EU PNR: European Flight Passengers Under General Suspicion – The Envisaged European Model of Analyzing Flight Passenger Data. In: Gutwirth, S., Poullet, Y., De Hert, P., Leenes, R. (eds) Computers, Privacy and Data Protection: an Element of Choice. Springer, Dordrecht. https://doi.org/10.1007/978-94-007-0641-5_8

Download citation