No PNR: No mass surveillance in the sky
We are taking legal action against the mass processing of air passenger data.
On 20 January 2020, the District Court of Cologne, Germany, referred the question of whether the PNR Directive violates the fundamental rights of the Charter of Fundamental Rights of the European Union to the European Court of Justice (ECJ). Following the court's request, we submitted a statement to the ECJ explaining why we believe the Directive to be contrary to fundamental rights.
Already in May 2020, the Wiesbaden Administrative Court similarly referred two of our cases to the ECJ.
The European PNR Directive (Directive 2016/681) requires airlines to automatically transfer their passengers’ data to government passenger data centers, called Passenger Information Units. Data records are centrally stored and can be accessed by numerous authorities. The data records are then automatically processed and compared to both established international databases (such as Europol, Interpol etc.) and so-called “patterns”, specifically created based on known flight patterns of past perpetrators.
Thus, every European passenger, approximately 170 million yearly in Germany alone, is subjected to mass surveillance without any factual basis of suspicion whatsoever. Any individual, whether previously suspected of a crime or not, can hence be subjected to stigmatizing investigations, merely for coincidentally having similar flight patterns to past offenders.
This randomized way of identifying new suspects amongst the mass of innocent passengers constitutes a new form of dragnet search. Due to the measure’s dubious reliability, many passengers will be affected by false results of opaque automatic data evaluation programs and as a consequence fall victim to stigmatizing police measures. Moreover, it is equally possible to transmit the data to both other EU member countries and non-EU member countries. This amounts to mass surveillance of passengers in air traffic.
According to the GFF, PNR violates, among others, the right to private and family life (Art. 7) and the right to the protection of personal data (Art. 8) guaranteed in the Charter of Fundamental Rights of the EU. Already in July 2017, the ECJ ruled in an opinion that a similar form of PNR data retention, as provided for in an EU agreement with Canada, was contrary to fundamental rights.
The GFF and its plaintiffs have taken two routes to the ECJ. On the one hand, we are taking administrative action against the Federal Criminal Police Office (BKA) and demand the non-processing and deletion of the passenger data. On the other hand, we are supporting plaintiffs who are defending themselves against the transfer of their data by the airlines to the BKA. Some of them have professions that require a special level of confidentiality. Among others, the journalist and activist Kübra Gümüşay, the data protection commissioner of Schleswig-Holstein Marit Hansen and the data protection activist Alexander Sander are bringing lawsuits with us.
The lawyer Prof. Dr. Remo Klinger is representing us in court. In the meantime, our proceedings before the ECJ have been paused because a parallel case from Belgium is being given priority, as the Belgian law goes even further than the German law.
GFF is a Berlin-based NGO and conducts strategic litigation for fundamental and human rights. Epicenter.works is a data protection and civil rights NGO based in Vienna with a focus on data retention.
We thank the Digital Freedom Fund for supporting this project.
