No PNR: No mass surveillance in the sky

According to the European PNR Directive, airlines are obliged to forward data on domestic and foreign passengers on international flights to national police authorities. There they are stored centrally, filtered by algorithms and can be requested by numerous authorities. This means mass surveillance of international air traffic.

Passenger name records, or PNR, are data sets containing around 20 categories of data such as name, date of birth, details of accompanying persons and payment information. One data record is created for each passenger per flight. In combination with information about the flight, this provides a detailed picture of the journey and the person traveling. The retention of passenger data was introduced in the EU with Directive 2016/681 (PNR Directive), which the member states had to transpose into national law by May 2018.

In Germany, passenger data has since been forwarded to the Federal Criminal Police Office (BKA), where it is compared with databases, e.g. on wanted persons. The BKA is also allowed to apply "patterns" to the data records, which are used to identify suspicious persons who have not yet been suspected. Other police authorities, secret services and the Office for the Protection of the Constitution can also access the passenger data, which can also be exchanged with EU countries and even third countries.

POTENTIALLY DISCRIMINATORY MASS SURVEILLANCE

This retention of passenger data is another form of mass surveillance without cause. According to the Federal Office of Administration, around 170 million passengers are expected to fly in Germany alone every year. The automated decision-making systems used to create profiles ("patterns") are non-transparent and potentially discriminatory - namely when supposedly "neutral" points of reference lead to people being classified as suspicious on the basis of their origin, religion or other characteristics.

Furthermore, it is not certain that such mass surveillance will work at all. There is a well-founded concern that people will be wrongly suspected en masse in the search for alleged future terrorists. One EU member state, for example, already considers it suspicious if someone travels a long distance with too little luggage.

SUCCESSFUL ACTIONS BEFORE THE ADMINISTRATIVE COURTS

The GFF and its plaintiffs have taken two routes to the ECJ: Firstly, we have taken administrative action against the Federal Criminal Police Office and demanded that the passenger data not be processed and deleted, and we have also taken civil action with other plaintiffs.

Together with Emilio de Capitani (former official of the EU Parliament) and Malte Spitz (Secretary General of the GFF), we brought an action under administrative law.

In response to our complaints, the Cologne District Court referred the question of whether the PNR Directive violates the fundamental rights of the Charter of Fundamental Rights of the European Union to the European Court of Justice (ECJ) on January 20, 2020. At the court's request, we explained to the ECJ in a statement on this referral procedure why we believe the Directive violates fundamental rights.

Following our complaints, the Wiesbaden Administrative Court also referred two of our cases to the ECJ in May 2020. In June, however, the ECJ responded to a request for a preliminary ruling from Belgium and strengthened fundamental rights. We were finally able to invoke this groundbreaking decision before the Wiesbaden Administrative Court and were vindicated: the Wiesbaden Administrative Court upheld our complaints, thereby confirming EU law. The Federal Government appealed in both proceedings.

AFTER ECJ RULING: BKA HAS SIGNIFICANTLY REDUCED SURVEILLANCE

The appeal proceedings in the case of Emilio de Capitani have now been declared closed, as the BKA has implemented the requirements of the ECJ ruling: Passenger Name Record processing for the vast majority of EU flights recorded to date has been deactivated as of February 14, 2023. The reason for this is that, following an initial risk assessment, the requirements of the ECJ ruling have not been met. In addition, the BKA has made further adjustments as a result of the ECJ ruling. In the individual review of hits, it is now ensured that there is at least an indirect objective connection with air traffic. Following the mass deletion of passenger data records in January 2023, passenger data will in future be automatically deleted after the permissible storage period stipulated by the ECJ has expired. In addition, the Wiesbaden District Court will in future decide on requests for retroactive searches as part of a preliminary judicial review.

CIVIL CLAIMS DISMISSED

We have supported several plaintiffs under civil law who have defended themselves against the transfer of their data by the airlines to the BKA. Some of them work in professions that require a particular degree of confidentiality. For example, the journalist and activist Kübra Gümüşay, the lawyer Franziska Nedelmann and the data protection activist Alexander Sander joined us in our lawsuit. Our civil claims were dismissed: According to the Cologne District Court, airlines may assume that the transmitted data will be handled properly.

PASSENGER DATA RETENTION VIOLATES EU LAW

In the opinion of the GFF, passenger data retention violates, among other things, the right to private and family life (Art. 7) and the right to the protection of personal data (Art. 8) guaranteed in the Charter of Fundamental Rights of the EU.

Back in July 2017, the European Court of Justice ruled in an opinion that a similar form of passenger data retention, as provided for in an agreement between the EU and Canada, violated fundamental rights. Now, following the request for a preliminary ruling from Belgium, fundamental rights from the European Charter of Fundamental Rights have once again been strengthened.

Lawyer Prof. Dr. Remo Klinger represented us in court. In the meantime, our proceedings before the ECJ have been declared closed because the ECJ ruled on an earlier reference for a preliminary ruling from Belgium concerning a more far-reaching regulation.

We are grateful to the Digital Freedom Fund for supporting this project.