The European Data Protection Board (EDPB) during its latest plenary adopted a statement on the recent judgment C-817/19 of the Court of Justice of the European Union (CJEU) on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, under the PNR Directive 2016/681.
While the CJEU found that the validity of the PNR Directive was not affected, it ruled that, in order to ensure compliance with the EU Charter of Fundamental Rights (the Charter), the PNR Directive needs to be interpreted as including important limitations to the processing of personal data.
In EDPB’s opinion the interpretation the CJEU puts forward significantly narrows the ways in which EU Member States may process PNR data. The EDPB considers it likely that the current processing of PNR data in many, if not most Member States, does not fully comply with the PNR Directive as interpreted by the CJEU. PNR systems across the EU may thus continue to interfere disproportionately with the fundamental rights of data subjects every day.