Use of airline passenger data must be limited, top EU court says

Passengers queue at Munich Airport, Germany, January 5, 2019. REUTERS/Andreas Gebert

BRUSSELS, June 21 (Reuters) – EU states may only gather the airline passenger data strictly necessary to combat serious crime and terrorism, Europe’s top court said on Tuesday, and banned the use of machine learning to harvest the data.

The Passenger Name Record Directive (PNR), adopted in 2016, allows police and justice officials to access passenger data on flights to and from the EU to combat serious crimes and maintain security in the 27-country bloc.

Rights groups however said data retention even by law enforcement and other authorities is an invasive and unjustified encroachment on fundamental rights to privacy and data protection.

In 2017, Belgium’s Human Rights League (LDH) and other rights groups challenged the PNR at a Belgian court, saying it allows the collection of too much data and could lead to mass surveillance, discrimination and profiling.

The court subsequently sought advice from the Luxembourg-based Court of Justice of the European Union (CJEU).

“The Court considers that respect for fundamental rights requires that the powers provided for by the PNR Directive be limited to what is strictly necessary,” the CJEU said.

Judges said the PNR must be limited to terrorist offences and serious crime having an objective link, even if only an indirect one, with the carriage of passengers by air.

The CJEU said the extension of the PNR to intra-EU flights should only be allowed only if it is strictly necessary and open to review by a court or independent administrative body

“In the absence of a genuine and present or foreseeable terrorist threat to a member state, EU law precludes national legislation providing for the transfer and processing of the PNR data of intra-EU flights and transport operations carried out by other means within the European Union,” judges said.

The CJEU also said artificial intelligence technology in self-learning systems (machine learning) may not be used in collecting airline passenger data.

The case is C-817/19 Ligue des droits humains.

Reporting by Foo Yun Chee; Editing by Jon Boyle

Our Standards: The Thomson Reuters Trust Principles.