{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-817-19-62019cj0817", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-817-19-62019cj0817)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-24", "fingerprint": "ewai:eu:210f09", "proof": "sha256:4a1855184dfadd5162efda4bdaed29a651540d1f665284b7ab69e0f789a72008", "jurisdiction": "eu", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "item": { "schema_version": "1.0.0", "id": "eu:c-817-19-62019cj0817", "jurisdiction": "eu", "lang": "en", "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor" }, "sections": [ { "title": "62019CJ0817", "paragraphs": [] }, { "title": "JUDGMENT OF THE COURT (Grand Chamber)", "paragraphs": [] }, { "title": "21 June 2022 (\n *1\n ) (\n i\n )", "paragraphs": [] }, { "title": "Table of contents", "paragraphs": [] }, { "title": "I. Legal context", "paragraphs": [] }, { "title": "A. European Union law", "paragraphs": [] }, { "title": "1. Directive 95/46/EC", "paragraphs": [] }, { "title": "2. The API Directive", "paragraphs": [] }, { "title": "3. Directive 2010/65", "paragraphs": [] }, { "title": "4. The GDPR", "paragraphs": [] }, { "title": "5. Directive 2016/680", "paragraphs": [] }, { "title": "6. The PNR Directive", "paragraphs": [] }, { "title": "7. Framework Decision 2002/475", "paragraphs": [] }, { "title": "B. Belgian law", "paragraphs": [] }, { "title": "1. The Constitution", "paragraphs": [] }, { "title": "2. The Law of 25 December 2016", "paragraphs": [ "para_17" ] }, { "title": "III. Consideration of the questions referred", "paragraphs": [] }, { "title": "A. Question 1", "paragraphs": [] }, { "title": "B. Questions 2 to 4 and Question 6", "paragraphs": [ "para_21" ] }, { "title": "2. Justification for the interferences resulting from the PNR Directive", "paragraphs": [ "para_23", "para_24" ] }, { "title": "(c) Whether the interferences from the PNR Directive are necessary", "paragraphs": [] }, { "title": "(1) Air passenger data covered by the PNR Directive", "paragraphs": [] }, { "title": "(2) The purposes for which PNR data may be processed", "paragraphs": [] }, { "title": "(3) The link between PNR data and the purposes for which those data are processed", "paragraphs": [] }, { "title": "(4) The air passengers and flights concerned", "paragraphs": [] }, { "title": "(5) Advance assessment of PNR data by automated processing", "paragraphs": [] }, { "title": "(i) Comparing PNR data against databases", "paragraphs": [] }, { "title": "(ii) Processing PNR data against pre-determined criteria", "paragraphs": [] }, { "title": "(iii) Safeguards surrounding the automated processing of PNR data", "paragraphs": [] }, { "title": "(6) The disclosure and subsequent assessment of PNR data", "paragraphs": [] }, { "title": "C. Question 5", "paragraphs": [] }, { "title": "D. Question 7", "paragraphs": [] }, { "title": "E. Question 8", "paragraphs": [] }, { "title": "F. Question 9(a)", "paragraphs": [] }, { "title": "G. Question 9(b)", "paragraphs": [] }, { "title": "H. Question 10", "paragraphs": [] }, { "title": "IV. Costs", "paragraphs": [ "para_42", "para_43", "para_44" ] }, { "title": "Ligue des droits humains", "paragraphs": [ "para_46", "para_47", "para_48", "para_49", "para_50", "para_51", "para_52", "para_53", "para_54", "para_55", "para_56", "para_57", "para_58", "para_59", "para_60", "para_61", "para_62", "para_63", "para_64", "para_65", "para_66", "para_67", "para_68", "para_69", "para_70", "para_71", "para_72", "para_73", "para_74", "para_75", "para_76", "para_77", "para_78", "para_79", "para_80", "para_81", "para_82", "para_83", "para_84", "para_85", "para_86", "para_87", "para_88", "para_89", "para_90", "para_91", "para_92", "para_93", "para_94", "para_95", "para_96", "para_97" ] }, { "title": "Judgment", "paragraphs": [] }, { "title": "1", "paragraphs": [] }, { "title": "This reference for a preliminary ruling, in essence, concerns:", "paragraphs": [ "para_101", "para_102", "para_103", "para_104", "para_105", "para_106" ] }, { "title": "2", "paragraphs": [ "para_108" ] }, { "title": "I.   Legal context", "paragraphs": [] }, { "title": "A.   European Union law", "paragraphs": [] }, { "title": "1.\n  \n Directive 95/46/EC", "paragraphs": [] }, { "title": "3", "paragraphs": [ "para_113", "para_114", "para_115", "para_116", "para_117", "para_118" ] }, { "title": "2.\n  \n The API Directive", "paragraphs": [] }, { "title": "4", "paragraphs": [] }, { "title": "Recitals 1, 7, 9 and 12 of the API Directive state:", "paragraphs": [ "para_122", "para_123", "para_124" ] }, { "title": "(7)", "paragraphs": [ "para_126", "para_127" ] }, { "title": "(9)", "paragraphs": [ "para_129", "para_130" ] }, { "title": "(12)", "paragraphs": [ "para_132" ] }, { "title": "5", "paragraphs": [] }, { "title": "Article 1 of the API Directive, entitled ‘Objective’, provides:", "paragraphs": [ "para_135" ] }, { "title": "6", "paragraphs": [] }, { "title": "Article 2 of that directive, entitled ‘Definitions’, states:", "paragraphs": [ "para_138" ] }, { "title": "(a)", "paragraphs": [ "para_140" ] }, { "title": "(b)", "paragraphs": [ "para_142" ] }, { "title": "(c)", "paragraphs": [ "para_144" ] }, { "title": "(d)", "paragraphs": [ "para_146" ] }, { "title": "(e)", "paragraphs": [ "para_148" ] }, { "title": "7", "paragraphs": [ "para_150", "para_151" ] }, { "title": "2.   The information referred to above shall comprise:", "paragraphs": [ "para_153", "para_154", "para_155", "para_156", "para_157", "para_158", "para_159", "para_160", "para_161", "para_162", "para_163", "para_164", "para_165", "para_166", "para_167", "para_168", "para_169", "para_170" ] }, { "title": "8", "paragraphs": [] }, { "title": "Article 6 of the API Directive, entitled ‘Data processing’, provides:", "paragraphs": [ "para_173", "para_174", "para_175", "para_176", "para_177", "para_178" ] }, { "title": "3.\n  \n Directive 2010/65", "paragraphs": [] }, { "title": "9", "paragraphs": [ "para_181" ] }, { "title": "10", "paragraphs": [] }, { "title": "Recital 2 of that directive states:", "paragraphs": [ "para_184" ] }, { "title": "11", "paragraphs": [ "para_186", "para_187", "para_188" ] }, { "title": "12", "paragraphs": [] }, { "title": "Under Article 8 of that directive, entitled ‘Confidentiality’:", "paragraphs": [ "para_191", "para_192" ] }, { "title": "4.\n  \n The GDPR", "paragraphs": [] }, { "title": "13", "paragraphs": [] }, { "title": "Recital 19 of the GDPR states:", "paragraphs": [ "para_196", "para_197" ] }, { "title": "14", "paragraphs": [ "para_199", "para_200" ] }, { "title": "2.   This Regulation does not apply to the processing of personal data:", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_203" ] }, { "title": "(b)", "paragraphs": [ "para_205", "para_206" ] }, { "title": "(d)", "paragraphs": [ "para_208" ] }, { "title": "15", "paragraphs": [] }, { "title": "Article 4 of that regulation, entitled ‘Definitions’, provides:", "paragraphs": [ "para_211" ] }, { "title": "(1)", "paragraphs": [ "para_213" ] }, { "title": "(2)", "paragraphs": [ "para_215", "para_216" ] }, { "title": "16", "paragraphs": [] }, { "title": "Article 23 of the GDPR, entitled ‘Restrictions’, provides:", "paragraphs": [ "para_219" ] }, { "title": "(a)", "paragraphs": [ "para_221" ] }, { "title": "(b)", "paragraphs": [ "para_223" ] }, { "title": "(c)", "paragraphs": [ "para_225" ] }, { "title": "(d)", "paragraphs": [ "para_227", "para_228" ] }, { "title": "(h)", "paragraphs": [ "para_230", "para_231", "para_232" ] }, { "title": "(a)", "paragraphs": [ "para_234" ] }, { "title": "(b)", "paragraphs": [ "para_236" ] }, { "title": "(c)", "paragraphs": [ "para_238" ] }, { "title": "(d)", "paragraphs": [ "para_240" ] }, { "title": "(e)", "paragraphs": [ "para_242" ] }, { "title": "(f)", "paragraphs": [ "para_244" ] }, { "title": "(g)", "paragraphs": [ "para_246" ] }, { "title": "(h)", "paragraphs": [ "para_248" ] }, { "title": "17", "paragraphs": [] }, { "title": "Article 94 of that regulation, entitled ‘Repeal of Directive [95/46]’ provides:", "paragraphs": [ "para_251", "para_252" ] }, { "title": "5.\n  \n Directive 2016/680", "paragraphs": [] }, { "title": "18", "paragraphs": [ "para_255" ] }, { "title": "19", "paragraphs": [] }, { "title": "Recitals 9 to 11 of Directive 2016/680 state:", "paragraphs": [ "para_258", "para_259" ] }, { "title": "(10)", "paragraphs": [ "para_261" ] }, { "title": "(11)", "paragraphs": [ "para_263" ] }, { "title": "20", "paragraphs": [ "para_265", "para_266" ] }, { "title": "21", "paragraphs": [] }, { "title": "Under Article 3 of that directive, entitled ‘Definitions’:", "paragraphs": [ "para_269", "para_270" ] }, { "title": "7. “competent authority” means:", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_273" ] }, { "title": "(b)", "paragraphs": [ "para_275", "para_276" ] }, { "title": "6.\n  \n The PNR Directive", "paragraphs": [] }, { "title": "22", "paragraphs": [] }, { "title": "Recitals 4 to 12, 15, 19, 20, 22, 25, 27, 28, 33, 36 and 37 of the PNR Directive state:", "paragraphs": [ "para_280", "para_281" ] }, { "title": "(5)", "paragraphs": [ "para_283" ] }, { "title": "(6)", "paragraphs": [ "para_285" ] }, { "title": "(7)", "paragraphs": [ "para_287" ] }, { "title": "(8)", "paragraphs": [ "para_289" ] }, { "title": "(9)", "paragraphs": [ "para_291" ] }, { "title": "(10)", "paragraphs": [ "para_293" ] }, { "title": "(11)", "paragraphs": [ "para_295" ] }, { "title": "(12)", "paragraphs": [ "para_297", "para_298" ] }, { "title": "(15)", "paragraphs": [ "para_300", "para_301" ] }, { "title": "(19)", "paragraphs": [ "para_303" ] }, { "title": "(20)", "paragraphs": [ "para_305", "para_306" ] }, { "title": "(22)", "paragraphs": [ "para_308", "para_309" ] }, { "title": "(25)", "paragraphs": [ "para_311", "para_312" ] }, { "title": "(27)", "paragraphs": [ "para_314" ] }, { "title": "(28)", "paragraphs": [ "para_316", "para_317" ] }, { "title": "(33)", "paragraphs": [ "para_319", "para_320" ] }, { "title": "(36)", "paragraphs": [ "para_322" ] }, { "title": "(37)", "paragraphs": [ "para_324" ] }, { "title": "23", "paragraphs": [] }, { "title": "Article 1 of the PNR Directive, entitled ‘Subject matter and scope’, is worded as follows:", "paragraphs": [ "para_327" ] }, { "title": "(a)", "paragraphs": [ "para_329" ] }, { "title": "(b)", "paragraphs": [ "para_331", "para_332" ] }, { "title": "24", "paragraphs": [ "para_334", "para_335", "para_336", "para_337" ] }, { "title": "25", "paragraphs": [] }, { "title": "Under Article 3 of that directive, entitled ‘Definitions’:", "paragraphs": [ "para_340" ] }, { "title": "(1)", "paragraphs": [ "para_342" ] }, { "title": "(2)", "paragraphs": [ "para_344" ] }, { "title": "(3)", "paragraphs": [ "para_346" ] }, { "title": "(4)", "paragraphs": [ "para_348" ] }, { "title": "(5)", "paragraphs": [ "para_350" ] }, { "title": "(6)", "paragraphs": [ "para_352" ] }, { "title": "(7)", "paragraphs": [ "para_354" ] }, { "title": "(8)", "paragraphs": [ "para_356" ] }, { "title": "(9)", "paragraphs": [ "para_358" ] }, { "title": "(10)", "paragraphs": [ "para_360" ] }, { "title": "26", "paragraphs": [ "para_362", "para_363" ] }, { "title": "2.   The PIU shall be responsible for:", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_366" ] }, { "title": "(b)", "paragraphs": [ "para_368", "para_369" ] }, { "title": "27", "paragraphs": [ "para_371", "para_372", "para_373", "para_374" ] }, { "title": "28", "paragraphs": [] }, { "title": "Article 6 of that directive, entitled ‘Processing of PNR data’, provides that:", "paragraphs": [ "para_377" ] }, { "title": "2.   The PIU shall process PNR data only for the following purposes:", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_380" ] }, { "title": "(b)", "paragraphs": [ "para_382" ] }, { "title": "(c)", "paragraphs": [ "para_384", "para_385" ] }, { "title": "(a)", "paragraphs": [ "para_387" ] }, { "title": "(b)", "paragraphs": [ "para_389", "para_390", "para_391", "para_392", "para_393", "para_394", "para_395" ] }, { "title": "29", "paragraphs": [] }, { "title": "Under Article 7 of the PNR Directive, entitled ‘Competent authorities’:", "paragraphs": [ "para_398", "para_399", "para_400", "para_401", "para_402", "para_403" ] }, { "title": "30", "paragraphs": [ "para_405", "para_406", "para_407", "para_408" ] }, { "title": "(a)", "paragraphs": [] }, { "title": "24 to 48 hours before the scheduled flight departure time; and", "paragraphs": [] }, { "title": "(b)", "paragraphs": [ "para_412" ] }, { "title": "31", "paragraphs": [ "para_414", "para_415", "para_416" ] }, { "title": "(a)", "paragraphs": [ "para_418" ] }, { "title": "(b)", "paragraphs": [ "para_420" ] }, { "title": "(c)", "paragraphs": [ "para_422" ] }, { "title": "(d)", "paragraphs": [ "para_424" ] }, { "title": "(e)", "paragraphs": [ "para_426" ] }, { "title": "(f)", "paragraphs": [ "para_428", "para_429" ] }, { "title": "(a)", "paragraphs": [ "para_431" ] }, { "title": "(b)", "paragraphs": [ "para_433" ] }, { "title": "(i)", "paragraphs": [ "para_435" ] }, { "title": "(ii)", "paragraphs": [ "para_437", "para_438", "para_439" ] }, { "title": "32", "paragraphs": [ "para_441", "para_442", "para_443", "para_444", "para_445", "para_446" ] }, { "title": "(a)", "paragraphs": [ "para_448" ] }, { "title": "(b)", "paragraphs": [ "para_450" ] }, { "title": "(c)", "paragraphs": [ "para_452", "para_453" ] }, { "title": "33", "paragraphs": [] }, { "title": "According to Article 15 of that directive, entitled ‘National supervisory authority’:", "paragraphs": [ "para_456", "para_457" ] }, { "title": "3.   Each national supervisory authority shall:", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_460" ] }, { "title": "(b)", "paragraphs": [ "para_462", "para_463" ] }, { "title": "34", "paragraphs": [] }, { "title": "Article 19 of the directive, entitled ‘Review’, provides:", "paragraphs": [ "para_466" ] }, { "title": "2.   In conducting its review, the Commission shall pay special attention to:", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_469" ] }, { "title": "(b)", "paragraphs": [ "para_471" ] }, { "title": "(c)", "paragraphs": [ "para_473" ] }, { "title": "(d)", "paragraphs": [ "para_475" ] }, { "title": "(e)", "paragraphs": [ "para_477", "para_478", "para_479" ] }, { "title": "35", "paragraphs": [ "para_481", "para_482" ] }, { "title": "36", "paragraphs": [ "para_484", "para_485" ] }, { "title": "PNR record locator", "paragraphs": [ "para_487" ] }, { "title": "Date of reservation/issue of ticket", "paragraphs": [ "para_489" ] }, { "title": "Date(s) of intended travel", "paragraphs": [ "para_491" ] }, { "title": "Name(s)", "paragraphs": [ "para_493" ] }, { "title": "Address and contact information (telephone number, email address)", "paragraphs": [ "para_495" ] }, { "title": "All forms of payment information, including billing address", "paragraphs": [ "para_497" ] }, { "title": "Complete travel itinerary for specific PNR", "paragraphs": [ "para_499" ] }, { "title": "Frequent flyer information", "paragraphs": [ "para_501" ] }, { "title": "Travel agency/travel agent", "paragraphs": [ "para_503", "para_504", "para_505" ] }, { "title": "Split/divided PNR information", "paragraphs": [ "para_507", "para_508", "para_509", "para_510", "para_511" ] }, { "title": "Seat number and other seat information", "paragraphs": [ "para_513" ] }, { "title": "Code share information", "paragraphs": [ "para_515" ] }, { "title": "All baggage information", "paragraphs": [ "para_517" ] }, { "title": "Number and other names of travellers on the PNR", "paragraphs": [ "para_519", "para_520", "para_521" ] }, { "title": "All historical changes to the PNR listed in numbers 1 to 18.’", "paragraphs": [] }, { "title": "37", "paragraphs": [ "para_524", "para_525", "para_526", "para_527", "para_528", "para_529", "para_530", "para_531", "para_532", "para_533", "para_534", "para_535", "para_536", "para_537", "para_538", "para_539", "para_540", "para_541", "para_542", "para_543", "para_544", "para_545", "para_546", "para_547", "para_548", "para_549", "para_550", "para_551", "para_552", "para_553", "para_554", "para_555", "para_556", "para_557", "para_558", "para_559", "para_560", "para_561", "para_562", "para_563", "para_564", "para_565", "para_566", "para_567", "para_568", "para_569", "para_570", "para_571", "para_572", "para_573", "para_574", "para_575", "para_576" ] }, { "title": "7.\n  \n Framework Decision 2002/475", "paragraphs": [] }, { "title": "38", "paragraphs": [ "para_579" ] }, { "title": "39", "paragraphs": [ "para_581" ] }, { "title": "B.   Belgian law", "paragraphs": [] }, { "title": "1.\n  \n The Constitution", "paragraphs": [] }, { "title": "40", "paragraphs": [] }, { "title": "Article 22 of the Constitution provides as follows:", "paragraphs": [ "para_586", "para_587" ] }, { "title": "2.\n  \n The Law of 25 December 2016", "paragraphs": [] }, { "title": "41", "paragraphs": [ "para_590", "para_591" ] }, { "title": "42", "paragraphs": [] }, { "title": "Article 3 of that law provides:", "paragraphs": [ "para_594", "para_595" ] }, { "title": "43", "paragraphs": [] }, { "title": "Under Article 4 of that law:", "paragraphs": [ "para_598", "para_599" ] }, { "title": "(8)", "paragraphs": [ "para_601" ] }, { "title": "(9)", "paragraphs": [ "para_603" ] }, { "title": "(10)", "paragraphs": [ "para_605", "para_606" ] }, { "title": "44", "paragraphs": [] }, { "title": "Article 8 of the Law of 25 December 2016 states:", "paragraphs": [ "para_609" ] }, { "title": "(1)", "paragraphs": [ "para_611" ] }, { "title": "(2)", "paragraphs": [ "para_613", "para_614" ] }, { "title": "(4)", "paragraphs": [ "para_616" ] }, { "title": "(5)", "paragraphs": [ "para_618", "para_619" ] }, { "title": "45", "paragraphs": [] }, { "title": "Article 14(1) of that law states:", "paragraphs": [ "para_622", "para_623" ] }, { "title": "(2) members seconded from the following competent services:", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_626" ] }, { "title": "(b)", "paragraphs": [ "para_628" ] }, { "title": "(c)", "paragraphs": [ "para_630", "para_631" ] }, { "title": "46", "paragraphs": [ "para_633", "para_634", "para_635" ] }, { "title": "(1)", "paragraphs": [ "para_637" ] }, { "title": "(2)", "paragraphs": [ "para_639", "para_640", "para_641", "para_642" ] }, { "title": "47", "paragraphs": [ "para_644" ] }, { "title": "48", "paragraphs": [] }, { "title": "Article 28 of that law provides:", "paragraphs": [ "para_647", "para_648" ] }, { "title": "49", "paragraphs": [] }, { "title": "Under Article 29 of that law:", "paragraphs": [ "para_651", "para_652" ] }, { "title": "(1)", "paragraphs": [ "para_654" ] }, { "title": "(2)", "paragraphs": [ "para_656" ] }, { "title": "(3)", "paragraphs": [ "para_658", "para_659", "para_660", "para_661", "para_662" ] }, { "title": "50", "paragraphs": [ "para_664", "para_665" ] }, { "title": "51", "paragraphs": [ "para_667" ] }, { "title": "52", "paragraphs": [ "para_669" ] }, { "title": "53", "paragraphs": [ "para_671" ] }, { "title": "54", "paragraphs": [ "para_673" ] }, { "title": "55", "paragraphs": [ "para_675" ] }, { "title": "56", "paragraphs": [ "para_677" ] }, { "title": "57", "paragraphs": [ "para_679" ] }, { "title": "58", "paragraphs": [ "para_681" ] }, { "title": "59", "paragraphs": [ "para_683" ] }, { "title": "60", "paragraphs": [ "para_685" ] }, { "title": "61", "paragraphs": [ "para_687" ] }, { "title": "62", "paragraphs": [ "para_689", "para_690", "para_691" ] }, { "title": "(2)", "paragraphs": [ "para_693" ] }, { "title": "(3)", "paragraphs": [ "para_695" ] }, { "title": "(4)", "paragraphs": [ "para_697" ] }, { "title": "(5)", "paragraphs": [ "para_699" ] }, { "title": "(6)", "paragraphs": [ "para_701" ] }, { "title": "(7)", "paragraphs": [ "para_703" ] }, { "title": "(8)", "paragraphs": [ "para_705" ] }, { "title": "(9)", "paragraphs": [] }, { "title": "(a)", "paragraphs": [ "para_708" ] }, { "title": "(b)", "paragraphs": [ "para_710" ] }, { "title": "(10)", "paragraphs": [ "para_712" ] }, { "title": "III.   Consideration of the questions referred", "paragraphs": [] }, { "title": "A.   Question 1", "paragraphs": [] }, { "title": "63", "paragraphs": [ "para_716" ] }, { "title": "64", "paragraphs": [ "para_718" ] }, { "title": "65", "paragraphs": [ "para_720" ] }, { "title": "66", "paragraphs": [ "para_722" ] }, { "title": "67", "paragraphs": [ "para_724" ] }, { "title": "68", "paragraphs": [ "para_726" ] }, { "title": "69", "paragraphs": [ "para_728" ] }, { "title": "70", "paragraphs": [ "para_730" ] }, { "title": "71", "paragraphs": [ "para_732" ] }, { "title": "72", "paragraphs": [ "para_734" ] }, { "title": "73", "paragraphs": [ "para_736" ] }, { "title": "74", "paragraphs": [ "para_738" ] }, { "title": "75", "paragraphs": [ "para_740" ] }, { "title": "76", "paragraphs": [ "para_742" ] }, { "title": "77", "paragraphs": [ "para_744" ] }, { "title": "78", "paragraphs": [ "para_746" ] }, { "title": "79", "paragraphs": [ "para_748" ] }, { "title": "80", "paragraphs": [ "para_750" ] }, { "title": "81", "paragraphs": [ "para_752" ] }, { "title": "82", "paragraphs": [ "para_754" ] }, { "title": "83", "paragraphs": [ "para_756" ] }, { "title": "84", "paragraphs": [ "para_758" ] }, { "title": "B.   Questions 2 to 4 and Question 6", "paragraphs": [] }, { "title": "85", "paragraphs": [ "para_761", "para_762", "para_763", "para_764", "para_765", "para_766", "para_767" ] }, { "title": "86", "paragraphs": [ "para_769" ] }, { "title": "87", "paragraphs": [ "para_771" ] }, { "title": "88", "paragraphs": [ "para_773" ] }, { "title": "89", "paragraphs": [ "para_775" ] }, { "title": "90", "paragraphs": [ "para_777" ] }, { "title": "91", "paragraphs": [ "para_779", "para_780" ] }, { "title": "92", "paragraphs": [ "para_782" ] }, { "title": "93", "paragraphs": [ "para_784" ] }, { "title": "94", "paragraphs": [ "para_786" ] }, { "title": "95", "paragraphs": [ "para_788" ] }, { "title": "96", "paragraphs": [ "para_790" ] }, { "title": "97", "paragraphs": [ "para_792" ] }, { "title": "98", "paragraphs": [ "para_794" ] }, { "title": "99", "paragraphs": [ "para_796" ] }, { "title": "100", "paragraphs": [ "para_798" ] }, { "title": "101", "paragraphs": [ "para_800" ] }, { "title": "102", "paragraphs": [ "para_802" ] }, { "title": "103", "paragraphs": [ "para_804" ] }, { "title": "104", "paragraphs": [ "para_806" ] }, { "title": "105", "paragraphs": [ "para_808" ] }, { "title": "106", "paragraphs": [ "para_810" ] }, { "title": "107", "paragraphs": [ "para_812" ] }, { "title": "108", "paragraphs": [ "para_814" ] }, { "title": "109", "paragraphs": [ "para_816" ] }, { "title": "110", "paragraphs": [ "para_818" ] }, { "title": "111", "paragraphs": [ "para_820" ] }, { "title": "2.\n  \n Justification for the interferences resulting from the PNR Directive", "paragraphs": [] }, { "title": "112", "paragraphs": [ "para_823" ] }, { "title": "113", "paragraphs": [ "para_825" ] }, { "title": "114", "paragraphs": [ "para_827" ] }, { "title": "115", "paragraphs": [ "para_829" ] }, { "title": "116", "paragraphs": [ "para_831" ] }, { "title": "117", "paragraphs": [ "para_833" ] }, { "title": "118", "paragraphs": [ "para_835", "para_836" ] }, { "title": "119", "paragraphs": [ "para_838" ] }, { "title": "120", "paragraphs": [ "para_840", "para_841" ] }, { "title": "121", "paragraphs": [ "para_843" ] }, { "title": "122", "paragraphs": [ "para_845" ] }, { "title": "123", "paragraphs": [ "para_847" ] }, { "title": "124", "paragraphs": [ "para_849" ] }, { "title": "(c)\n  \n Whether the interferences from the PNR Directive are necessary", "paragraphs": [] }, { "title": "125", "paragraphs": [ "para_852" ] }, { "title": "(1)   Air passenger data covered by the PNR Directive", "paragraphs": [] }, { "title": "126", "paragraphs": [ "para_855" ] }, { "title": "127", "paragraphs": [ "para_857" ] }, { "title": "128", "paragraphs": [ "para_859" ] }, { "title": "129", "paragraphs": [ "para_861" ] }, { "title": "130", "paragraphs": [ "para_863" ] }, { "title": "131", "paragraphs": [ "para_865" ] }, { "title": "132", "paragraphs": [ "para_867" ] }, { "title": "133", "paragraphs": [ "para_869" ] }, { "title": "134", "paragraphs": [ "para_871" ] }, { "title": "135", "paragraphs": [ "para_873" ] }, { "title": "136", "paragraphs": [ "para_875" ] }, { "title": "137", "paragraphs": [ "para_877" ] }, { "title": "138", "paragraphs": [ "para_879" ] }, { "title": "139", "paragraphs": [ "para_881" ] }, { "title": "140", "paragraphs": [ "para_883" ] }, { "title": "(2)   The purposes for which PNR data may be processed", "paragraphs": [] }, { "title": "141", "paragraphs": [ "para_886" ] }, { "title": "142", "paragraphs": [ "para_888" ] }, { "title": "143", "paragraphs": [ "para_890" ] }, { "title": "144", "paragraphs": [ "para_892" ] }, { "title": "145", "paragraphs": [ "para_894" ] }, { "title": "146", "paragraphs": [ "para_896" ] }, { "title": "147", "paragraphs": [ "para_898" ] }, { "title": "148", "paragraphs": [ "para_900" ] }, { "title": "149", "paragraphs": [ "para_902" ] }, { "title": "150", "paragraphs": [ "para_904" ] }, { "title": "151", "paragraphs": [ "para_906" ] }, { "title": "152", "paragraphs": [ "para_908" ] }, { "title": "(3)   The link between PNR data and the purposes for which those data are processed", "paragraphs": [] }, { "title": "153", "paragraphs": [ "para_911" ] }, { "title": "154", "paragraphs": [ "para_913" ] }, { "title": "155", "paragraphs": [ "para_915" ] }, { "title": "156", "paragraphs": [ "para_917" ] }, { "title": "157", "paragraphs": [ "para_919" ] }, { "title": "(4)   The air passengers and flights concerned", "paragraphs": [] }, { "title": "158", "paragraphs": [ "para_922" ] }, { "title": "159", "paragraphs": [ "para_924" ] }, { "title": "160", "paragraphs": [ "para_926" ] }, { "title": "161", "paragraphs": [ "para_928" ] }, { "title": "162", "paragraphs": [ "para_930" ] }, { "title": "163", "paragraphs": [ "para_932" ] }, { "title": "164", "paragraphs": [ "para_934" ] }, { "title": "165", "paragraphs": [ "para_936" ] }, { "title": "166", "paragraphs": [ "para_938" ] }, { "title": "167", "paragraphs": [ "para_940" ] }, { "title": "168", "paragraphs": [ "para_942" ] }, { "title": "169", "paragraphs": [ "para_944" ] }, { "title": "170", "paragraphs": [ "para_946" ] }, { "title": "171", "paragraphs": [ "para_948" ] }, { "title": "172", "paragraphs": [ "para_950" ] }, { "title": "173", "paragraphs": [ "para_952" ] }, { "title": "174", "paragraphs": [ "para_954" ] }, { "title": "175", "paragraphs": [ "para_956" ] }, { "title": "(5)   Advance assessment of PNR data by automated processing", "paragraphs": [] }, { "title": "176", "paragraphs": [ "para_959" ] }, { "title": "177", "paragraphs": [ "para_961" ] }, { "title": "178", "paragraphs": [ "para_963" ] }, { "title": "179", "paragraphs": [ "para_965" ] }, { "title": "180", "paragraphs": [ "para_967" ] }, { "title": "181", "paragraphs": [ "para_969" ] }, { "title": "(i)   Comparing PNR data against databases", "paragraphs": [] }, { "title": "182", "paragraphs": [ "para_972" ] }, { "title": "183", "paragraphs": [ "para_974" ] }, { "title": "184", "paragraphs": [ "para_976" ] }, { "title": "185", "paragraphs": [ "para_978" ] }, { "title": "186", "paragraphs": [ "para_980" ] }, { "title": "187", "paragraphs": [ "para_982" ] }, { "title": "188", "paragraphs": [ "para_984" ] }, { "title": "189", "paragraphs": [ "para_986" ] }, { "title": "190", "paragraphs": [ "para_988" ] }, { "title": "191", "paragraphs": [ "para_990" ] }, { "title": "192", "paragraphs": [ "para_992" ] }, { "title": "(ii)   Processing PNR data against pre-determined criteria", "paragraphs": [] }, { "title": "193", "paragraphs": [ "para_995" ] }, { "title": "194", "paragraphs": [ "para_997" ] }, { "title": "195", "paragraphs": [ "para_999" ] }, { "title": "196", "paragraphs": [ "para_1001" ] }, { "title": "197", "paragraphs": [ "para_1003" ] }, { "title": "198", "paragraphs": [ "para_1005" ] }, { "title": "199", "paragraphs": [ "para_1007" ] }, { "title": "200", "paragraphs": [ "para_1009" ] }, { "title": "201", "paragraphs": [ "para_1011" ] }, { "title": "(iii)   Safeguards surrounding the automated processing of PNR data", "paragraphs": [] }, { "title": "202", "paragraphs": [ "para_1014" ] }, { "title": "203", "paragraphs": [ "para_1016" ] }, { "title": "204", "paragraphs": [ "para_1018" ] }, { "title": "205", "paragraphs": [ "para_1020" ] }, { "title": "206", "paragraphs": [ "para_1022" ] }, { "title": "207", "paragraphs": [ "para_1024" ] }, { "title": "208", "paragraphs": [ "para_1026" ] }, { "title": "209", "paragraphs": [ "para_1028" ] }, { "title": "210", "paragraphs": [ "para_1030" ] }, { "title": "211", "paragraphs": [ "para_1032" ] }, { "title": "212", "paragraphs": [ "para_1034" ] }, { "title": "213", "paragraphs": [ "para_1036" ] }, { "title": "(6)   The disclosure and subsequent assessment of PNR data", "paragraphs": [] }, { "title": "214", "paragraphs": [ "para_1039" ] }, { "title": "215", "paragraphs": [ "para_1041" ] }, { "title": "216", "paragraphs": [ "para_1043" ] }, { "title": "217", "paragraphs": [ "para_1045" ] }, { "title": "218", "paragraphs": [ "para_1047" ] }, { "title": "219", "paragraphs": [ "para_1049" ] }, { "title": "220", "paragraphs": [ "para_1051" ] }, { "title": "221", "paragraphs": [ "para_1053" ] }, { "title": "222", "paragraphs": [ "para_1055" ] }, { "title": "223", "paragraphs": [ "para_1057" ] }, { "title": "224", "paragraphs": [ "para_1059" ] }, { "title": "225", "paragraphs": [ "para_1061" ] }, { "title": "226", "paragraphs": [ "para_1063" ] }, { "title": "227", "paragraphs": [ "para_1065" ] }, { "title": "228", "paragraphs": [ "para_1067" ] }, { "title": "C.   Question 5", "paragraphs": [] }, { "title": "229", "paragraphs": [ "para_1070" ] }, { "title": "230", "paragraphs": [ "para_1072" ] }, { "title": "231", "paragraphs": [ "para_1074" ] }, { "title": "232", "paragraphs": [ "para_1076" ] }, { "title": "233", "paragraphs": [ "para_1078" ] }, { "title": "234", "paragraphs": [ "para_1080" ] }, { "title": "235", "paragraphs": [ "para_1082" ] }, { "title": "236", "paragraphs": [ "para_1084" ] }, { "title": "237", "paragraphs": [ "para_1086" ] }, { "title": "D.   Question 7", "paragraphs": [] }, { "title": "238", "paragraphs": [ "para_1089" ] }, { "title": "239", "paragraphs": [ "para_1091" ] }, { "title": "240", "paragraphs": [ "para_1093" ] }, { "title": "241", "paragraphs": [ "para_1095" ] }, { "title": "242", "paragraphs": [ "para_1097" ] }, { "title": "243", "paragraphs": [ "para_1099" ] }, { "title": "244", "paragraphs": [ "para_1101" ] }, { "title": "245", "paragraphs": [ "para_1103" ] }, { "title": "246", "paragraphs": [ "para_1105" ] }, { "title": "247", "paragraphs": [ "para_1107" ] }, { "title": "E.   Question 8", "paragraphs": [] }, { "title": "248", "paragraphs": [ "para_1110" ] }, { "title": "249", "paragraphs": [ "para_1112" ] }, { "title": "250", "paragraphs": [ "para_1114" ] }, { "title": "251", "paragraphs": [ "para_1116" ] }, { "title": "252", "paragraphs": [ "para_1118" ] }, { "title": "253", "paragraphs": [ "para_1120" ] }, { "title": "254", "paragraphs": [ "para_1122" ] }, { "title": "255", "paragraphs": [ "para_1124" ] }, { "title": "256", "paragraphs": [ "para_1126" ] }, { "title": "257", "paragraphs": [ "para_1128" ] }, { "title": "258", "paragraphs": [ "para_1130" ] }, { "title": "259", "paragraphs": [ "para_1132" ] }, { "title": "260", "paragraphs": [ "para_1134" ] }, { "title": "261", "paragraphs": [ "para_1136" ] }, { "title": "262", "paragraphs": [ "para_1138" ] }, { "title": "F.   Question 9(a)", "paragraphs": [] }, { "title": "263", "paragraphs": [ "para_1141" ] }, { "title": "264", "paragraphs": [ "para_1143" ] }, { "title": "265", "paragraphs": [ "para_1145" ] }, { "title": "266", "paragraphs": [ "para_1147" ] }, { "title": "267", "paragraphs": [ "para_1149" ] }, { "title": "268", "paragraphs": [ "para_1151" ] }, { "title": "269", "paragraphs": [ "para_1153" ] }, { "title": "G.   Question 9(b)", "paragraphs": [] }, { "title": "270", "paragraphs": [ "para_1156" ] }, { "title": "271", "paragraphs": [ "para_1158" ] }, { "title": "272", "paragraphs": [ "para_1160" ] }, { "title": "273", "paragraphs": [ "para_1162" ] }, { "title": "274", "paragraphs": [ "para_1164" ] }, { "title": "275", "paragraphs": [ "para_1166" ] }, { "title": "276", "paragraphs": [ "para_1168" ] }, { "title": "277", "paragraphs": [ "para_1170" ] }, { "title": "278", "paragraphs": [ "para_1172" ] }, { "title": "279", "paragraphs": [ "para_1174" ] }, { "title": "280", "paragraphs": [ "para_1176" ] }, { "title": "281", "paragraphs": [ "para_1178" ] }, { "title": "282", "paragraphs": [ "para_1180" ] }, { "title": "283", "paragraphs": [ "para_1182" ] }, { "title": "284", "paragraphs": [ "para_1184" ] }, { "title": "285", "paragraphs": [ "para_1186" ] }, { "title": "286", "paragraphs": [ "para_1188" ] }, { "title": "287", "paragraphs": [ "para_1190" ] }, { "title": "288", "paragraphs": [ "para_1192" ] }, { "title": "289", "paragraphs": [ "para_1194" ] }, { "title": "290", "paragraphs": [ "para_1196" ] }, { "title": "291", "paragraphs": [ "para_1198", "para_1199", "para_1200", "para_1201", "para_1202" ] }, { "title": "H.   Question 10", "paragraphs": [] }, { "title": "292", "paragraphs": [ "para_1205" ] }, { "title": "293", "paragraphs": [ "para_1207" ] }, { "title": "294", "paragraphs": [ "para_1209" ] }, { "title": "295", "paragraphs": [ "para_1211" ] }, { "title": "296", "paragraphs": [ "para_1213" ] }, { "title": "297", "paragraphs": [ "para_1215" ] }, { "title": "298", "paragraphs": [ "para_1217" ] }, { "title": "IV.   Costs", "paragraphs": [] }, { "title": "299", "paragraphs": [ "para_1220" ] }, { "title": "On those grounds, the Court (Grand Chamber) hereby rules:", "paragraphs": [ "para_1222", "para_1223", "para_1224", "para_1225", "para_1226", "para_1227", "para_1228", "para_1229", "para_1230", "para_1231", "para_1232", "para_1233", "para_1234", "para_1235", "para_1236", "para_1237", "para_1238", "para_1239", "para_1240", "para_1241", "para_1242", "para_1243", "para_1244" ] } ], "paragraphs": [ { "text": "62019CJ0817", "paragraph_id": "para_1" }, { "text": "JUDGMENT OF THE COURT (Grand Chamber)", "paragraph_id": "para_2" }, { "text": "21 June 2022 (\n *1\n ) (\n i\n )", "paragraph_id": "para_3" }, { "text": "Table of contents", "paragraph_id": "para_4" }, { "text": "I. Legal context", "paragraph_id": "para_5" }, { "text": "A. European Union law", "paragraph_id": "para_6" }, { "text": "1. Directive 95/46/EC", "paragraph_id": "para_7" }, { "text": "2. The API Directive", "paragraph_id": "para_8" }, { "text": "3. Directive 2010/65", "paragraph_id": "para_9" }, { "text": "4. The GDPR", "paragraph_id": "para_10" }, { "text": "5. Directive 2016/680", "paragraph_id": "para_11" }, { "text": "6. The PNR Directive", "paragraph_id": "para_12" }, { "text": "7. Framework Decision 2002/475", "paragraph_id": "para_13" }, { "text": "B. Belgian law", "paragraph_id": "para_14" }, { "text": "1. The Constitution", "paragraph_id": "para_15" }, { "text": "2. The Law of 25 December 2016", "paragraph_id": "para_16" }, { "text": "II. The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraph_id": "para_17" }, { "text": "III. Consideration of the questions referred", "paragraph_id": "para_18" }, { "text": "A. Question 1", "paragraph_id": "para_19" }, { "text": "B. Questions 2 to 4 and Question 6", "paragraph_id": "para_20" }, { "text": "1. Interferences with the fundamental rights guaranteed in Articles 7 and 8 of the Charter resulting from the PNR Directive", "paragraph_id": "para_21" }, { "text": "2. Justification for the interferences resulting from the PNR Directive", "paragraph_id": "para_22" }, { "text": "(a) Observance of the principle of legality and respect for the essence of the fundamental rights in question", "paragraph_id": "para_23" }, { "text": "(b) Objective of general interest and appropriateness of the processing of PNR data having regard to that objective", "paragraph_id": "para_24" }, { "text": "(c) Whether the interferences from the PNR Directive are necessary", "paragraph_id": "para_25" }, { "text": "(1) Air passenger data covered by the PNR Directive", "paragraph_id": "para_26" }, { "text": "(2) The purposes for which PNR data may be processed", "paragraph_id": "para_27" }, { "text": "(3) The link between PNR data and the purposes for which those data are processed", "paragraph_id": "para_28" }, { "text": "(4) The air passengers and flights concerned", "paragraph_id": "para_29" }, { "text": "(5) Advance assessment of PNR data by automated processing", "paragraph_id": "para_30" }, { "text": "(i) Comparing PNR data against databases", "paragraph_id": "para_31" }, { "text": "(ii) Processing PNR data against pre-determined criteria", "paragraph_id": "para_32" }, { "text": "(iii) Safeguards surrounding the automated processing of PNR data", "paragraph_id": "para_33" }, { "text": "(6) The disclosure and subsequent assessment of PNR data", "paragraph_id": "para_34" }, { "text": "C. Question 5", "paragraph_id": "para_35" }, { "text": "D. Question 7", "paragraph_id": "para_36" }, { "text": "E. Question 8", "paragraph_id": "para_37" }, { "text": "F. Question 9(a)", "paragraph_id": "para_38" }, { "text": "G. Question 9(b)", "paragraph_id": "para_39" }, { "text": "H. Question 10", "paragraph_id": "para_40" }, { "text": "IV. Costs", "paragraph_id": "para_41" }, { "text": "(Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to includ …", "paragraph_id": "para_42" }, { "text": "In Case C‑817/19,", "paragraph_id": "para_43" }, { "text": "REQUEST for a preliminary ruling under Article 267 TFEU from the Cour constitutionnelle (Constitutional Court, Belgium), made by decision of 17 October 2019, received at the Court on 31 October 2019, in the proceedings", "paragraph_id": "para_44" }, { "text": "Ligue des droits humains", "paragraph_id": "para_45" }, { "text": "v", "paragraph_id": "para_46" }, { "text": "Conseil des ministres,", "paragraph_id": "para_47" }, { "text": "THE COURT (Grand Chamber),", "paragraph_id": "para_48" }, { "text": "composed of K. Lenaerts, President, A. Arabadjiev, S. Rodin, I. Jarukaitis and N. Jääskinen, Presidents of Chambers, T. von Danwitz (Rapporteur), M. Safjan, F. Biltgen, P.G. Xuereb, N. Piçarra, L.S. Rossi, A. Kumin and N. Wahl, Judges,", "paragraph_id": "para_49" }, { "text": "Advocate General: G. Pitruzzella,", "paragraph_id": "para_50" }, { "text": "Registrar: M. Krausenböck, Administrator,", "paragraph_id": "para_51" }, { "text": "having regard to the written procedure and further to the hearing on 13 July 2021,", "paragraph_id": "para_52" }, { "text": "after considering the observations submitted on behalf of:", "paragraph_id": "para_53" }, { "text": "–", "paragraph_id": "para_54" }, { "text": "the Ligue des droits humains, by C. Forget, avocate,", "paragraph_id": "para_55" }, { "text": "–", "paragraph_id": "para_56" }, { "text": "the Belgian Government, by P. Cottin, J.-C. Halleux, C. Pochet, M. Van Regemorter, acting as Agents, and by C. Caillet, advocaat, E. Jacubowitz, avocat, G. Ceuppens, V. Dethy and D. Vertongen,", "paragraph_id": "para_57" }, { "text": "–", "paragraph_id": "para_58" }, { "text": "the Czech Government, by T. Machovičová, O. Serdula, M. Smolek and J. Vláčil, acting as Agents,", "paragraph_id": "para_59" }, { "text": "–", "paragraph_id": "para_60" }, { "text": "the Danish Government, by M. Jespersen, J. Nymann-Lindegren, V. Pasternak Jørgensen and M. Søndahl Wolff, acting as Agents,", "paragraph_id": "para_61" }, { "text": "–", "paragraph_id": "para_62" }, { "text": "the German Government, by D. Klebs and J. Möller, acting as Agents,", "paragraph_id": "para_63" }, { "text": "–", "paragraph_id": "para_64" }, { "text": "the Estonian Government, by N. Grünberg, acting as Agent,", "paragraph_id": "para_65" }, { "text": "–", "paragraph_id": "para_66" }, { "text": "Ireland, by M. Browne, A. Joyce, J. Quaney, acting as Agents, and D. Fennelly, Barrister-at-Law,", "paragraph_id": "para_67" }, { "text": "–", "paragraph_id": "para_68" }, { "text": "the Spanish Government, by L. Aguilera Ruiz, acting as Agent,", "paragraph_id": "para_69" }, { "text": "–", "paragraph_id": "para_70" }, { "text": "the French Government, by D. Dubois, E. de Moustier and T. Stéhelin, acting as Agents,", "paragraph_id": "para_71" }, { "text": "–", "paragraph_id": "para_72" }, { "text": "the Cypriot Government, by I. Neofytou, acting as Agent,", "paragraph_id": "para_73" }, { "text": "–", "paragraph_id": "para_74" }, { "text": "the Latvian Government, by E. Bārdiņš, K. Pommere and V. Soņeca, acting as Agents,", "paragraph_id": "para_75" }, { "text": "–", "paragraph_id": "para_76" }, { "text": "the Netherlands Government, by M.K. Bulterman, A. Hanje, J. Langer and C.S. Schillemans, acting as Agents,", "paragraph_id": "para_77" }, { "text": "–", "paragraph_id": "para_78" }, { "text": "the Austrian Government, by G. Kunnert, A. Posch and J. Schmoll, acting as Agents,", "paragraph_id": "para_79" }, { "text": "–", "paragraph_id": "para_80" }, { "text": "the Polish Government, by B. Majczyna, acting as Agent,", "paragraph_id": "para_81" }, { "text": "–", "paragraph_id": "para_82" }, { "text": "the Slovak Government, by B. Ricziová, acting as Agent,", "paragraph_id": "para_83" }, { "text": "–", "paragraph_id": "para_84" }, { "text": "the Finnish Government, by A. Laine and H. Leppo, acting as Agent,", "paragraph_id": "para_85" }, { "text": "–", "paragraph_id": "para_86" }, { "text": "the European Parliament, by O. Hrstková Šolcová and P. López-Carceller, acting as Agents,", "paragraph_id": "para_87" }, { "text": "–", "paragraph_id": "para_88" }, { "text": "the Council of the European Union, by J. Lotarski, N. Rouam, E. Sitbon and C. Zadra, acting as Agents,", "paragraph_id": "para_89" }, { "text": "–", "paragraph_id": "para_90" }, { "text": "the European Commission, by D. Nardi and M. Wasmeier, acting as Agents,", "paragraph_id": "para_91" }, { "text": "–", "paragraph_id": "para_92" }, { "text": "the European Data Protection Supervisor, by P. Angelov, A. Buchta, F. Coudert and C.-A. Marnier, acting as Agents,", "paragraph_id": "para_93" }, { "text": "–", "paragraph_id": "para_94" }, { "text": "the European Union Agency for Fundamental Rights, by L. López, T. Molnar, M. Nespor and M. O’Flaherty, acting as Agents,", "paragraph_id": "para_95" }, { "text": "after hearing the Opinion of the Advocate General at the sitting on 27 January 2022,", "paragraph_id": "para_96" }, { "text": "gives the following", "paragraph_id": "para_97" }, { "text": "Judgment", "paragraph_id": "para_98" }, { "text": "1", "paragraph_id": "para_99" }, { "text": "This reference for a preliminary ruling, in essence, concerns:", "paragraph_id": "para_100" }, { "text": "–", "paragraph_id": "para_101" }, { "text": "the interpretation of Article 2(2)(d) and Article 23 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC …", "paragraph_id": "para_102" }, { "text": "–", "paragraph_id": "para_103" }, { "text": "the interpretation and validity, in the light of Articles 7 and 8 as well as Article 52(1) of the Charter of Fundamental Rights of the European Union (‘the Charter’), of Article 3(4) and Articles 6 and 12 of, as well as Annex I to, Directive (EU) 2016/681 of the European Parliament and of the Counci …", "paragraph_id": "para_104" }, { "text": "–", "paragraph_id": "para_105" }, { "text": "the interpretation and validity, in the light of Article 3(2) TEU and Article 45 of the Charter, of the API Directive.", "paragraph_id": "para_106" }, { "text": "2", "paragraph_id": "para_107" }, { "text": "The request has been made in proceedings between the Ligue des droits humains and the Conseil des ministres (Council of Ministers, Belgium) concerning the legality of the loi du 25 décembre 2016, relative au traitement des données des passagers (Law of 25 December 2016 on the processing of passenger data).", "paragraph_id": "para_108" }, { "text": "I.   Legal context", "paragraph_id": "para_109" }, { "text": "A.   European Union law", "paragraph_id": "para_110" }, { "text": "1.\n  \n Directive 95/46/EC", "paragraph_id": "para_111" }, { "text": "3", "paragraph_id": "para_112" }, { "text": "Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 281, p. 31 ) was repealed by the GDPR, with effect from 25 May 2018. Article 3(2) of that directive provided:", "paragraph_id": "para_113" }, { "text": "‘This Directive shall not apply to the processing of personal data:", "paragraph_id": "para_114" }, { "text": "–", "paragraph_id": "para_115" }, { "text": "in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,", "paragraph_id": "para_116" }, { "text": "–", "paragraph_id": "para_117" }, { "text": "by a natural person in the course of a purely personal or household activity.’", "paragraph_id": "para_118" }, { "text": "2.\n  \n The API Directive", "paragraph_id": "para_119" }, { "text": "4", "paragraph_id": "para_120" }, { "text": "Recitals 1, 7, 9 and 12 of the API Directive state:", "paragraph_id": "para_121" }, { "text": "‘(1)", "paragraph_id": "para_122" }, { "text": "In order to combat illegal immigration effectively and to improve border control, it is essential that all Member States introduce provisions laying down obligations on air carriers transporting passengers into the territory of the Member States. In addition, in order to ensure the greater effective …", "paragraph_id": "para_123" }, { "text": "…", "paragraph_id": "para_124" }, { "text": "(7)", "paragraph_id": "para_125" }, { "text": "The obligations to be imposed on carriers by virtue of this Directive are complementary to those established pursuant to the provisions of Article 26 of the 1990 Schengen Convention implementing the Schengen Agreement of 14 June 1985, as supplemented by Council Directive 2001/51/EC [of 28 June 2001 …", "paragraph_id": "para_126" }, { "text": "…", "paragraph_id": "para_127" }, { "text": "(9)", "paragraph_id": "para_128" }, { "text": "In order to combat illegal immigration more effectively and in order to ensure the greater effectiveness of this objective, it is essential that, without prejudice to the provisions of Directive [95/46], account be taken at the earliest opportunity of any technological innovation, especially with reference to the integration and use of biometric features in the information to be provided by the carriers.", "paragraph_id": "para_129" }, { "text": "…", "paragraph_id": "para_130" }, { "text": "(12)", "paragraph_id": "para_131" }, { "text": "Directive [95/46] applies with regard to the processing of personal data by the authorities of the Member States. This means, that whereas it would be legitimate to process the passenger data transmitted for the performance of border checks also for the purposes of allowing their use as evidence in …", "paragraph_id": "para_132" }, { "text": "5", "paragraph_id": "para_133" }, { "text": "Article 1 of the API Directive, entitled ‘Objective’, provides:", "paragraph_id": "para_134" }, { "text": "‘This Directive aims at improving border controls and combating illegal immigration by the transmission of advance passenger data by carriers to the competent national authorities.’", "paragraph_id": "para_135" }, { "text": "6", "paragraph_id": "para_136" }, { "text": "Article 2 of that directive, entitled ‘Definitions’, states:", "paragraph_id": "para_137" }, { "text": "‘For the purpose of this Directive:", "paragraph_id": "para_138" }, { "text": "(a)", "paragraph_id": "para_139" }, { "text": "“carrier” means any natural or legal person whose occupation it is to provide passenger transport by air;", "paragraph_id": "para_140" }, { "text": "(b)", "paragraph_id": "para_141" }, { "text": "“external borders” means the external borders of the Member States with third countries;", "paragraph_id": "para_142" }, { "text": "(c)", "paragraph_id": "para_143" }, { "text": "“border control” means a check carried out at a border in response exclusively to an intention to cross that border, regardless of any other consideration;", "paragraph_id": "para_144" }, { "text": "(d)", "paragraph_id": "para_145" }, { "text": "“border crossing point” means any crossing point authorised by the competent authorities for crossing external borders;", "paragraph_id": "para_146" }, { "text": "(e)", "paragraph_id": "para_147" }, { "text": "“personal data”, “processing of personal data” and “personal data filing system” have the meaning as stipulated under Article 2 of Directive [95/46].’", "paragraph_id": "para_148" }, { "text": "7", "paragraph_id": "para_149" }, { "text": "Article 3 of that directive, entitled ‘Data transmission’, provides, in its paragraphs 1 and 2:", "paragraph_id": "para_150" }, { "text": "‘1.   Member States shall take the necessary steps to establish an obligation for carriers to transmit at the request of the authorities responsible for carrying out checks on persons at external borders, by the end of check-in, information concerning the passengers they will carry to an authorised border crossing point through which these persons will enter the territory of a Member State.", "paragraph_id": "para_151" }, { "text": "2.   The information referred to above shall comprise:", "paragraph_id": "para_152" }, { "text": "–", "paragraph_id": "para_153" }, { "text": "the number and type of travel document used,", "paragraph_id": "para_154" }, { "text": "–", "paragraph_id": "para_155" }, { "text": "nationality,", "paragraph_id": "para_156" }, { "text": "–", "paragraph_id": "para_157" }, { "text": "full names,", "paragraph_id": "para_158" }, { "text": "–", "paragraph_id": "para_159" }, { "text": "the date of birth,", "paragraph_id": "para_160" }, { "text": "–", "paragraph_id": "para_161" }, { "text": "the border crossing point of entry into the territory of the Member States,", "paragraph_id": "para_162" }, { "text": "–", "paragraph_id": "para_163" }, { "text": "code of transport,", "paragraph_id": "para_164" }, { "text": "–", "paragraph_id": "para_165" }, { "text": "departure and arrival time of the transportation,", "paragraph_id": "para_166" }, { "text": "–", "paragraph_id": "para_167" }, { "text": "total number of passengers carried on that transport,", "paragraph_id": "para_168" }, { "text": "–", "paragraph_id": "para_169" }, { "text": "the initial point of embarkation.’", "paragraph_id": "para_170" }, { "text": "8", "paragraph_id": "para_171" }, { "text": "Article 6 of the API Directive, entitled ‘Data processing’, provides:", "paragraph_id": "para_172" }, { "text": "‘1.   The personal data referred to in Article 3(1) shall be communicated to the authorities responsible for carrying out checks on persons at external borders through which the passenger will enter the territory of a Member State, for the purpose of facilitating the performance of such checks with the objective of combating illegal immigration more effectively.", "paragraph_id": "para_173" }, { "text": "Member States shall ensure that these data are collected by the carriers and transmitted electronically or, in case of failure, by any other appropriate means to the authorities responsible for carrying out border checks at the authorised border crossing point through which the passenger will enter the territory of a Member State. The authorities responsible for carrying out checks on persons at external borders shall save the data in a temporary file.", "paragraph_id": "para_174" }, { "text": "After passengers have entered, these authorities shall delete the data, within 24 hours after transmission, unless the data are needed later for the purposes of exercising the statutory functions of the authorities responsible for carrying out checks on persons at external borders in accordance with national law and subject to data protection provisions under Directive [95/46].", "paragraph_id": "para_175" }, { "text": "Member States shall take the necessary measures to oblige carriers to delete, within 24 hours of the arrival of the means of transportation pursuant to Article 3(1), the personal data they have collected and transmitted to the border authorities for the purposes of this Directive.", "paragraph_id": "para_176" }, { "text": "In accordance with their national law and subject to data protection provisions under Directive [95/46], Member States may also use the personal data referred to in Article 3(1) for law enforcement purposes.", "paragraph_id": "para_177" }, { "text": "2.   Member States shall take the necessary measures to oblige the carriers to inform the passengers in accordance with the provisions laid down in Directive [95/46]. This shall also comprise the information referred to in Article 10(c) and Article 11(1)(c) of Directive [95/46].’", "paragraph_id": "para_178" }, { "text": "3.\n  \n Directive 2010/65", "paragraph_id": "para_179" }, { "text": "9", "paragraph_id": "para_180" }, { "text": "Directive 2010/65 is to be repealed, pursuant to Article 25 of Regulation (EU) 2019/1239 of the European Parliament and of the Council of 20 June 2019 establishing a European Maritime Single Window environment and repealing Directive 2010/65 ( OJ 2019 L 198, p. 64 ), from 15 August 2025.", "paragraph_id": "para_181" }, { "text": "10", "paragraph_id": "para_182" }, { "text": "Recital 2 of that directive states:", "paragraph_id": "para_183" }, { "text": "‘For the facilitation of maritime transport and in order to reduce the administrative burdens for shipping companies, the reporting formalities required by legal acts of the [European] Union and by Member States need to be simplified and harmonised to the greatest extent possible. …’", "paragraph_id": "para_184" }, { "text": "11", "paragraph_id": "para_185" }, { "text": "Article 1 of that directive, entitled ‘Subject matter and scope’, provides, in its paragraphs 1 and 2:", "paragraph_id": "para_186" }, { "text": "‘1.   The purpose of this Directive is to simplify and harmonise the administrative procedures applied to maritime transport by making the electronic transmission of information standard and by rationalising reporting formalities.", "paragraph_id": "para_187" }, { "text": "2.   This Directive shall apply to the reporting formalities applicable to maritime transport for ships arriving in and ships departing from ports situated in Member States.’", "paragraph_id": "para_188" }, { "text": "12", "paragraph_id": "para_189" }, { "text": "Under Article 8 of that directive, entitled ‘Confidentiality’:", "paragraph_id": "para_190" }, { "text": "‘1.   Member States shall, in accordance with the applicable legal acts of the [European] Union or national legislation, take the necessary measures to ensure the confidentiality of commercial and other confidential information exchanged in accordance with this Directive.", "paragraph_id": "para_191" }, { "text": "2.   Member States shall take particular care to protect commercial data collected under this Directive. In respect of personal data, Member States shall ensure that they comply with Directive [95/46]. The [EU] institutions and bodies shall ensure that they comply with Regulation (EC) No 45/2001 [of …", "paragraph_id": "para_192" }, { "text": "4.\n  \n The GDPR", "paragraph_id": "para_193" }, { "text": "13", "paragraph_id": "para_194" }, { "text": "Recital 19 of the GDPR states:", "paragraph_id": "para_195" }, { "text": "‘The protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of …", "paragraph_id": "para_196" }, { "text": "…’", "paragraph_id": "para_197" }, { "text": "14", "paragraph_id": "para_198" }, { "text": "Article 2 of that regulation, entitled ‘Material scope’, provides in its paragraphs 1 and 2:", "paragraph_id": "para_199" }, { "text": "‘1.   This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.", "paragraph_id": "para_200" }, { "text": "2.   This Regulation does not apply to the processing of personal data:", "paragraph_id": "para_201" }, { "text": "(a)", "paragraph_id": "para_202" }, { "text": "in the course of an activity which falls outside the scope of [EU] law;", "paragraph_id": "para_203" }, { "text": "(b)", "paragraph_id": "para_204" }, { "text": "by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V [TEU];", "paragraph_id": "para_205" }, { "text": "…", "paragraph_id": "para_206" }, { "text": "(d)", "paragraph_id": "para_207" }, { "text": "by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’", "paragraph_id": "para_208" }, { "text": "15", "paragraph_id": "para_209" }, { "text": "Article 4 of that regulation, entitled ‘Definitions’, provides:", "paragraph_id": "para_210" }, { "text": "‘For the purposes of this Regulation:", "paragraph_id": "para_211" }, { "text": "(1)", "paragraph_id": "para_212" }, { "text": "“personal data” means any information relating to an identified or identifiable natural person …;", "paragraph_id": "para_213" }, { "text": "(2)", "paragraph_id": "para_214" }, { "text": "“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;", "paragraph_id": "para_215" }, { "text": "…’", "paragraph_id": "para_216" }, { "text": "16", "paragraph_id": "para_217" }, { "text": "Article 23 of the GDPR, entitled ‘Restrictions’, provides:", "paragraph_id": "para_218" }, { "text": "‘1.   [EU] or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as in Article 5 in so far as its provisions correspond to the rights and …", "paragraph_id": "para_219" }, { "text": "(a)", "paragraph_id": "para_220" }, { "text": "national security;", "paragraph_id": "para_221" }, { "text": "(b)", "paragraph_id": "para_222" }, { "text": "defence;", "paragraph_id": "para_223" }, { "text": "(c)", "paragraph_id": "para_224" }, { "text": "public security;", "paragraph_id": "para_225" }, { "text": "(d)", "paragraph_id": "para_226" }, { "text": "the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;", "paragraph_id": "para_227" }, { "text": "…", "paragraph_id": "para_228" }, { "text": "(h)", "paragraph_id": "para_229" }, { "text": "a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);", "paragraph_id": "para_230" }, { "text": "…", "paragraph_id": "para_231" }, { "text": "2.   In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:", "paragraph_id": "para_232" }, { "text": "(a)", "paragraph_id": "para_233" }, { "text": "the purposes of the processing or categories of processing;", "paragraph_id": "para_234" }, { "text": "(b)", "paragraph_id": "para_235" }, { "text": "the categories of personal data;", "paragraph_id": "para_236" }, { "text": "(c)", "paragraph_id": "para_237" }, { "text": "the scope of the restrictions introduced;", "paragraph_id": "para_238" }, { "text": "(d)", "paragraph_id": "para_239" }, { "text": "the safeguards to prevent abuse or unlawful access or transfer;", "paragraph_id": "para_240" }, { "text": "(e)", "paragraph_id": "para_241" }, { "text": "the specification of the controller or categories of controllers;", "paragraph_id": "para_242" }, { "text": "(f)", "paragraph_id": "para_243" }, { "text": "the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;", "paragraph_id": "para_244" }, { "text": "(g)", "paragraph_id": "para_245" }, { "text": "the risks to the rights and freedoms of data subjects; and", "paragraph_id": "para_246" }, { "text": "(h)", "paragraph_id": "para_247" }, { "text": "the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.’", "paragraph_id": "para_248" }, { "text": "17", "paragraph_id": "para_249" }, { "text": "Article 94 of that regulation, entitled ‘Repeal of Directive [95/46]’ provides:", "paragraph_id": "para_250" }, { "text": "‘1.   Directive [95/46] is repealed with effect from 25 May 2018.", "paragraph_id": "para_251" }, { "text": "2.   References to the repealed Directive shall be construed as references to this Regulation. References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive [95/46] shall be construed as references to the European Data Protection Board established by this Regulation.’", "paragraph_id": "para_252" }, { "text": "5.\n  \n Directive 2016/680", "paragraph_id": "para_253" }, { "text": "18", "paragraph_id": "para_254" }, { "text": "Directive 2016/680, in accordance with Article 59 thereof, repealed and replaced Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters ( OJ 2008 L 350, p. 60 ), from 6 May 2018.", "paragraph_id": "para_255" }, { "text": "19", "paragraph_id": "para_256" }, { "text": "Recitals 9 to 11 of Directive 2016/680 state:", "paragraph_id": "para_257" }, { "text": "‘(9)", "paragraph_id": "para_258" }, { "text": "On that basis, [the GDPR] lays down general rules to protect natural persons in relation to the processing of personal data and to ensure the free movement of personal data within the [European] Union.", "paragraph_id": "para_259" }, { "text": "(10)", "paragraph_id": "para_260" }, { "text": "In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon, the conference acknowledged that specific rules on the protection …", "paragraph_id": "para_261" }, { "text": "(11)", "paragraph_id": "para_262" }, { "text": "It is therefore appropriate for those fields to be addressed by a directive that lays down the specific rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecut …", "paragraph_id": "para_263" }, { "text": "20", "paragraph_id": "para_264" }, { "text": "Article 1 of that directive, entitled ‘Subject matter and objectives’, which corresponds, in essence, to Article 1 of Framework Decision 2008/977, provides, in its paragraph 1:", "paragraph_id": "para_265" }, { "text": "‘This Directive lays down the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’", "paragraph_id": "para_266" }, { "text": "21", "paragraph_id": "para_267" }, { "text": "Under Article 3 of that directive, entitled ‘Definitions’:", "paragraph_id": "para_268" }, { "text": "‘For the purposes of this Directive:", "paragraph_id": "para_269" }, { "text": "…", "paragraph_id": "para_270" }, { "text": "7. “competent authority” means:", "paragraph_id": "para_271" }, { "text": "(a)", "paragraph_id": "para_272" }, { "text": "any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; or", "paragraph_id": "para_273" }, { "text": "(b)", "paragraph_id": "para_274" }, { "text": "any other body or entity entrusted by Member State law to exercise public authority and public powers for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;", "paragraph_id": "para_275" }, { "text": "…’", "paragraph_id": "para_276" }, { "text": "6.\n  \n The PNR Directive", "paragraph_id": "para_277" }, { "text": "22", "paragraph_id": "para_278" }, { "text": "Recitals 4 to 12, 15, 19, 20, 22, 25, 27, 28, 33, 36 and 37 of the PNR Directive state:", "paragraph_id": "para_279" }, { "text": "‘(4)", "paragraph_id": "para_280" }, { "text": "[The API Directive] regulates the transfer of advance passenger information (API) data by air carriers to the competent national authorities for the purpose of improving border controls and combating illegal immigration.", "paragraph_id": "para_281" }, { "text": "(5)", "paragraph_id": "para_282" }, { "text": "The objectives of this Directive are, inter alia, to ensure security, to protect the life and safety of persons, and to create a legal framework for the protection of PNR data with regard to their processing by competent authorities.", "paragraph_id": "para_283" }, { "text": "(6)", "paragraph_id": "para_284" }, { "text": "Effective use of PNR data, for example by comparing PNR data against various databases on persons and objects sought, is necessary to prevent, detect, investigate and prosecute terrorist offences and serious crime and thus enhance internal security, to gather evidence and, where relevant, to find associates of criminals and unravel criminal networks.", "paragraph_id": "para_285" }, { "text": "(7)", "paragraph_id": "para_286" }, { "text": "Assessment of PNR data allows identification of persons who were unsuspected of involvement in terrorist offences or serious crime prior to such an assessment and who should be subject to further examination by the competent authorities. By using PNR data it is possible to address the threat of terr …", "paragraph_id": "para_287" }, { "text": "(8)", "paragraph_id": "para_288" }, { "text": "Air carriers already collect and process their passengers’ PNR data for their own commercial purposes. This Directive should not impose any obligation on air carriers to collect or retain any additional data from passengers or any obligation on passengers to provide any data in addition to that already being provided to air carriers.", "paragraph_id": "para_289" }, { "text": "(9)", "paragraph_id": "para_290" }, { "text": "Some air carriers retain as part of the PNR data the API data they collect, while others do not. The use of PNR data together with API data has added value in assisting Member States in verifying the identity of an individual, thus reinforcing the law enforcement value of that result and minimising …", "paragraph_id": "para_291" }, { "text": "(10)", "paragraph_id": "para_292" }, { "text": "To prevent, detect, investigate and prosecute terrorist offences and serious crime, it is essential that all Member States introduce provisions laying down obligations on air carriers operating extra-EU flights to transfer PNR data they collect, including API data. Member States should also have the possibility to extend this obligation to air carriers operating intra-EU flights. Those provisions should be without prejudice to [the API Directive].", "paragraph_id": "para_293" }, { "text": "(11)", "paragraph_id": "para_294" }, { "text": "The processing of personal data should be proportionate to the specific security goals pursued by this Directive.", "paragraph_id": "para_295" }, { "text": "(12)", "paragraph_id": "para_296" }, { "text": "The definition of terrorist offences applied in this Directive should be the same as in Council Framework Decision 2002/475/JHA [of 13 June 2002 on combating terrorism ( OJ 2002 L 164, p. 3 )]. The definition of serious crime should encompass the categories of offence listed in Annex II to this Directive.", "paragraph_id": "para_297" }, { "text": "…", "paragraph_id": "para_298" }, { "text": "(15)", "paragraph_id": "para_299" }, { "text": "A list of the PNR data to be obtained by a [passenger information unit (PIU)] should be drawn up with the objective of reflecting the legitimate requirements of public authorities to prevent, detect, investigate and prosecute terrorist offences or serious crime, thereby improving internal security w …", "paragraph_id": "para_300" }, { "text": "…", "paragraph_id": "para_301" }, { "text": "(19)", "paragraph_id": "para_302" }, { "text": "Each Member State should be responsible for assessing the potential threats related to terrorist offences and serious crime.", "paragraph_id": "para_303" }, { "text": "(20)", "paragraph_id": "para_304" }, { "text": "Taking fully into consideration the right to the protection of personal data and the right to non-discrimination, no decision that produces an adverse legal effect on a person or significantly affects that person should be taken only by reason of the automated processing of PNR data. Moreover, in re …", "paragraph_id": "para_305" }, { "text": "…", "paragraph_id": "para_306" }, { "text": "(22)", "paragraph_id": "para_307" }, { "text": "Taking fully into consideration the principles outlined in recent relevant case-law of the Court of Justice of the European Union, the application of this Directive should ensure full respect for fundamental rights, for the right to privacy and for the principle of proportionality. It should also ge …", "paragraph_id": "para_308" }, { "text": "…", "paragraph_id": "para_309" }, { "text": "(25)", "paragraph_id": "para_310" }, { "text": "The period during which PNR data are to be retained should be as long as is necessary for and proportionate to the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime. Because of the nature of the data and their uses, it is necessary that the PNR dat …", "paragraph_id": "para_311" }, { "text": "…", "paragraph_id": "para_312" }, { "text": "(27)", "paragraph_id": "para_313" }, { "text": "The processing of PNR data in each Member State by the PIU and by competent authorities should be subject to a standard of protection of personal data under national law in line with Framework Decision [2008/977] and the specific data protection requirements laid down in this Directive. References to Framework Decision [2008/977] should be understood as references to legislation currently in force as well as to legislation that will replace it.", "paragraph_id": "para_314" }, { "text": "(28)", "paragraph_id": "para_315" }, { "text": "Taking into consideration the right to the protection of personal data, the rights of data subjects concerning the processing of their PNR data, such as the rights of access, rectification, erasure and restriction and the rights to compensation and judicial redress, should be in line both with Framework Decision [2008/977] and with the high level of protection provided by the Charter and the ECHR.", "paragraph_id": "para_316" }, { "text": "…", "paragraph_id": "para_317" }, { "text": "(33)", "paragraph_id": "para_318" }, { "text": "This Directive does not affect the possibility for Member States to provide, under their national law, for a system of collecting and processing PNR data from non-carrier economic operators, such as travel agencies and tour operators which provide travel-related services – including the booking of f …", "paragraph_id": "para_319" }, { "text": "…", "paragraph_id": "para_320" }, { "text": "(36)", "paragraph_id": "para_321" }, { "text": "This Directive respects the fundamental rights and the principles of the Charter, in particular the right to the protection of personal data, the right to privacy and the right to non-discrimination as protected by Articles 8, 7 and 21 thereof; it should therefore be implemented accordingly. This Di …", "paragraph_id": "para_322" }, { "text": "(37)", "paragraph_id": "para_323" }, { "text": "The scope of this Directive is as limited as possible since: it provides for the retention of PNR data in the PIUs for a period of time not exceeding five years, after which the data should be deleted; it provides for the data to be depersonalised through masking out of data elements after an initia …", "paragraph_id": "para_324" }, { "text": "23", "paragraph_id": "para_325" }, { "text": "Article 1 of the PNR Directive, entitled ‘Subject matter and scope’, is worded as follows:", "paragraph_id": "para_326" }, { "text": "‘1.   This Directive provides for:", "paragraph_id": "para_327" }, { "text": "(a)", "paragraph_id": "para_328" }, { "text": "the transfer by air carriers of passenger name record (PNR) data of passengers of extra-EU flights,", "paragraph_id": "para_329" }, { "text": "(b)", "paragraph_id": "para_330" }, { "text": "the processing of the data referred to in point (a), including its collection, use and retention by Member States and its exchange between Member States.", "paragraph_id": "para_331" }, { "text": "2.   PNR data collected in accordance with this Directive may be processed only for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, as provided for in points (a), (b) and (c) of Article 6(2).’", "paragraph_id": "para_332" }, { "text": "24", "paragraph_id": "para_333" }, { "text": "In accordance with Article 2 of that directive, entitled ‘Application of this Directive to intra-EU flights’:", "paragraph_id": "para_334" }, { "text": "‘1.   If a Member State decides to apply this Directive to intra-EU flights, it shall notify the Commission in writing. A Member State may give or revoke such a notification at any time. The Commission shall publish that notification and any revocation of it in the Official Journal of the European Union .", "paragraph_id": "para_335" }, { "text": "2.   Where a notification referred to in paragraph 1 is given, all the provisions of this Directive shall apply to intra-EU flights as if they were extra-EU flights and to PNR data from intra-EU flights as if they were PNR data from extra-EU flights.", "paragraph_id": "para_336" }, { "text": "3.   A Member State may decide to apply this Directive only to selected intra-EU flights. In making such a decision, the Member State shall select the flights it considers necessary in order to pursue the objectives of this Directive. The Member State may decide to change the selection of intra-EU flights at any time.’", "paragraph_id": "para_337" }, { "text": "25", "paragraph_id": "para_338" }, { "text": "Under Article 3 of that directive, entitled ‘Definitions’:", "paragraph_id": "para_339" }, { "text": "‘For the purposes of this Directive the following definitions apply:", "paragraph_id": "para_340" }, { "text": "(1)", "paragraph_id": "para_341" }, { "text": "“air carrier” means an air transport undertaking with a valid operating licence or equivalent permitting it to carry out carriage of passengers by air;", "paragraph_id": "para_342" }, { "text": "(2)", "paragraph_id": "para_343" }, { "text": "“extra-EU flight” means any scheduled or non-scheduled flight by an air carrier flying from a third country and planned to land on the territory of a Member State or flying from the territory of a Member State and planned to land in a third country, including in both cases flights with any stop-overs in the territory of Member States or third countries;", "paragraph_id": "para_344" }, { "text": "(3)", "paragraph_id": "para_345" }, { "text": "“intra-EU flight” means any scheduled or non-scheduled flight by an air carrier flying from the territory of a Member State and planned to land on the territory of one or more of the other Member States, without any stop-overs in the territory of a third country;", "paragraph_id": "para_346" }, { "text": "(4)", "paragraph_id": "para_347" }, { "text": "“passenger” means any person, including persons in transfer or transit and excluding members of the crew, carried or to be carried in an aircraft with the consent of the air carrier, such consent being manifested by that person’s registration in the passengers list;", "paragraph_id": "para_348" }, { "text": "(5)", "paragraph_id": "para_349" }, { "text": "“passenger name record” or “PNR” means a record of each passenger’s travel requirements which contains information necessary to enable reservations to be processed and controlled by the booking and participating air carriers for each journey booked by or on behalf of any person, whether it is contained in reservation systems, departure control systems used to check passengers onto flights, or equivalent systems providing the same functionalities;", "paragraph_id": "para_350" }, { "text": "(6)", "paragraph_id": "para_351" }, { "text": "“reservation system” means the air carrier’s internal system, in which PNR data are collected for the handling of reservations;", "paragraph_id": "para_352" }, { "text": "(7)", "paragraph_id": "para_353" }, { "text": "“push method” means the method whereby air carriers transfer PNR data listed in Annex I into the database of the authority requesting them;", "paragraph_id": "para_354" }, { "text": "(8)", "paragraph_id": "para_355" }, { "text": "“terrorist offences” means the offences under national law referred to in Articles 1 to 4 of Framework Decision [2002/475];", "paragraph_id": "para_356" }, { "text": "(9)", "paragraph_id": "para_357" }, { "text": "“serious crime” means the offences listed in Annex II that are punishable by a custodial sentence or a detention order for a maximum period of at least three years under the national law of a Member State;", "paragraph_id": "para_358" }, { "text": "(10)", "paragraph_id": "para_359" }, { "text": "“to depersonalise through masking out of data elements” means to render those data elements which could serve to identify directly the data subject invisible to a user.’", "paragraph_id": "para_360" }, { "text": "26", "paragraph_id": "para_361" }, { "text": "Article 4 of the PNR Directive, entitled ‘Passenger information unit’, provides in paragraphs 1 to 3:", "paragraph_id": "para_362" }, { "text": "‘1.   Each Member State shall establish or designate an authority competent for the prevention, detection, investigation or prosecution of terrorist offences and of serious crime or a branch of such an authority, to act as its passenger information unit (“PIU”).", "paragraph_id": "para_363" }, { "text": "2.   The PIU shall be responsible for:", "paragraph_id": "para_364" }, { "text": "(a)", "paragraph_id": "para_365" }, { "text": "collecting PNR data from air carriers, storing and processing those data and transferring those data or the result of processing them to the competent authorities referred to in Article 7;", "paragraph_id": "para_366" }, { "text": "(b)", "paragraph_id": "para_367" }, { "text": "exchanging both PNR data and the result of processing those data with the PIUs of other Member States and with Europol in accordance with Articles 9 and 10.", "paragraph_id": "para_368" }, { "text": "3.   Staff members of a PIU may be seconded from competent authorities. Member States shall provide the PIUs with adequate resources for them to fulfil their tasks.’", "paragraph_id": "para_369" }, { "text": "27", "paragraph_id": "para_370" }, { "text": "Article 5 of that directive, entitled ‘Data protection officer in the PIU’ is worded as follows:", "paragraph_id": "para_371" }, { "text": "‘1.   The PIU shall appoint a data protection officer responsible for monitoring the processing of PNR data and implementing relevant safeguards.", "paragraph_id": "para_372" }, { "text": "2.   Member States shall provide data protection officers with the means to perform their duties and tasks in accordance with this Article effectively and independently.", "paragraph_id": "para_373" }, { "text": "3.   Member States shall ensure that a data subject has the right to contact the data protection officer, as a single point of contact, on all issues relating to the processing of that data subject’s PNR data.’", "paragraph_id": "para_374" }, { "text": "28", "paragraph_id": "para_375" }, { "text": "Article 6 of that directive, entitled ‘Processing of PNR data’, provides that:", "paragraph_id": "para_376" }, { "text": "‘1.   The PNR data transferred by the air carriers shall be collected by the PIU of the relevant Member State as provided for in Article 8. Where the PNR data transferred by air carriers include data other than those listed in Annex I, the PIU shall delete such data immediately and permanently upon receipt.", "paragraph_id": "para_377" }, { "text": "2.   The PIU shall process PNR data only for the following purposes:", "paragraph_id": "para_378" }, { "text": "(a)", "paragraph_id": "para_379" }, { "text": "carrying out an assessment of passengers prior to their scheduled arrival in or departure from the Member State to identify persons who require further examination by the competent authorities referred to in Article 7, and, where relevant, by Europol in accordance with Article 10, in view of the fact that such persons may be involved in a terrorist offence or serious crime;", "paragraph_id": "para_380" }, { "text": "(b)", "paragraph_id": "para_381" }, { "text": "responding, on a case-by-case basis, to a duly reasoned request based on sufficient grounds from the competent authorities to provide and process PNR data in specific cases for the purposes of preventing, detecting, investigating and prosecuting terrorist offences or serious crime, and to provide the competent authorities or, where appropriate, Europol with the results of such processing; and", "paragraph_id": "para_382" }, { "text": "(c)", "paragraph_id": "para_383" }, { "text": "analysing PNR data for the purpose of updating or creating new criteria to be used in the assessments carried out under point (b) of paragraph 3 in order to identify any persons who may be involved in a terrorist offence or serious crime.", "paragraph_id": "para_384" }, { "text": "3.   When carrying out the assessment referred to in point (a) of paragraph 2, the PIU may:", "paragraph_id": "para_385" }, { "text": "(a)", "paragraph_id": "para_386" }, { "text": "compare PNR data against databases relevant for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, including databases on persons or objects sought or under alert, in accordance with [EU], international and national rules applicable to such databases; or", "paragraph_id": "para_387" }, { "text": "(b)", "paragraph_id": "para_388" }, { "text": "process PNR data against pre-determined criteria.", "paragraph_id": "para_389" }, { "text": "4.   Any assessment of passengers prior to their scheduled arrival in or departure from the Member State carried out under point (b) of paragraph 3 against pre-determined criteria shall be carried out in a non-discriminatory manner. Those pre-determined criteria must be targeted, proportionate and s …", "paragraph_id": "para_390" }, { "text": "5.   Member States shall ensure that any positive match resulting from the automated processing of PNR data conducted under point (a) of paragraph 2 is individually reviewed by non-automated means to verify whether the competent authority referred to in Article 7 needs to take action under national law.", "paragraph_id": "para_391" }, { "text": "6.   The PIU of a Member State shall transmit the PNR data of persons identified in accordance with point (a) of paragraph 2 or the result of processing those data for further examination to the competent authorities referred to in Article 7 of the same Member State. Such transfers shall only be made on a case-by-case basis and, in the event of automated processing of PNR data, after individual review by non-automated means.", "paragraph_id": "para_392" }, { "text": "7.   Member States shall ensure that the data protection officer has access to all data processed by the PIU. If the data protection officer considers that processing of any data has not been lawful, the data protection officer may refer the matter to the national supervisory authority.", "paragraph_id": "para_393" }, { "text": "…", "paragraph_id": "para_394" }, { "text": "9.   The consequences of the assessments of passengers referred to in point (a) of paragraph 2 of this Article shall not jeopardise the right of entry of persons enjoying the [EU] right of free movement into the territory of the Member State concerned as laid down in Directive 2004/38/EC of the Euro …", "paragraph_id": "para_395" }, { "text": "29", "paragraph_id": "para_396" }, { "text": "Under Article 7 of the PNR Directive, entitled ‘Competent authorities’:", "paragraph_id": "para_397" }, { "text": "‘1.   Each Member State shall adopt a list of the competent authorities entitled to request or receive PNR data or the result of processing those data from the PIU in order to examine that information further or to take appropriate action for the purposes of preventing, detecting, investigating and prosecuting terrorist offences or serious crime.", "paragraph_id": "para_398" }, { "text": "2.   The authorities referred to in paragraph 1 shall be authorities competent for the prevention, detection, investigation or prosecution of terrorist offences or serious crime.", "paragraph_id": "para_399" }, { "text": "…", "paragraph_id": "para_400" }, { "text": "4.   The PNR data and the result of processing those data received by the PIU may be further processed by the competent authorities of the Member States only for the specific purposes of preventing, detecting, investigating or prosecuting terrorist offences or serious crime.", "paragraph_id": "para_401" }, { "text": "5.   Paragraph 4 shall be without prejudice to national law enforcement or judicial powers where other offences, or indications thereof, are detected in the course of enforcement action further to such processing.", "paragraph_id": "para_402" }, { "text": "6.   The competent authorities shall not take any decision that produces an adverse legal effect on a person or significantly affects a person only by reason of the automated processing of PNR data. Such decisions shall not be taken on the basis of a person’s race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation.’", "paragraph_id": "para_403" }, { "text": "30", "paragraph_id": "para_404" }, { "text": "Article 8 of that directive, entitled ‘Obligations on air carriers regarding transfers of data’, provides in its paragraphs 1 to 3:", "paragraph_id": "para_405" }, { "text": "‘1.   Member States shall adopt the necessary measures to ensure that air carriers transfer, by the “push method”, the PNR data listed in Annex I, to the extent that they have already collected such data in the normal course of their business, to the database of the PIU of the Member State on the te …", "paragraph_id": "para_406" }, { "text": "2.   In the event that the air carriers have collected any [API] data listed under item 18 of Annex I but do not retain those data by the same technical means as for other PNR data, Member States shall adopt the necessary measures to ensure that air carriers also transfer, by the “push method”, those data to the PIU of the Member States referred to in paragraph 1. In the event of such a transfer, all the provisions of this Directive shall apply in relation to those API data.", "paragraph_id": "para_407" }, { "text": "3.   Air carriers shall transfer PNR data by electronic means using the common protocols and supported data formats to be adopted in accordance with the examination procedure referred to in Article 17(2) or, in the event of technical failure, by any other appropriate means ensuring an appropriate level of data security:", "paragraph_id": "para_408" }, { "text": "(a)", "paragraph_id": "para_409" }, { "text": "24 to 48 hours before the scheduled flight departure time; and", "paragraph_id": "para_410" }, { "text": "(b)", "paragraph_id": "para_411" }, { "text": "immediately after flight closure, that is once the passengers have boarded the aircraft in preparation for departure and it is no longer possible for passengers to board or leave.’", "paragraph_id": "para_412" }, { "text": "31", "paragraph_id": "para_413" }, { "text": "Article 12 of that directive, entitled ‘Period of data retention and depersonalisation’, provides:", "paragraph_id": "para_414" }, { "text": "‘1.   Member States shall ensure that the PNR data provided by the air carriers to the PIU are retained in a database at the PIU for a period of five years after their transfer to the PIU of the Member State on whose territory the flight is landing or departing.", "paragraph_id": "para_415" }, { "text": "2.   Upon expiry of a period of six months after the transfer of the PNR data referred to in paragraph 1, all PNR data shall be depersonalised through masking out of the following data elements which could serve to identify directly the passenger to whom the PNR data relate:", "paragraph_id": "para_416" }, { "text": "(a)", "paragraph_id": "para_417" }, { "text": "name(s), including the names of other passengers on the PNR and number of travellers on the PNR travelling together;", "paragraph_id": "para_418" }, { "text": "(b)", "paragraph_id": "para_419" }, { "text": "address and contact information;", "paragraph_id": "para_420" }, { "text": "(c)", "paragraph_id": "para_421" }, { "text": "all forms of payment information, including billing address, to the extent that it contains any information which could serve to identify directly the passenger to whom the PNR relate or any other persons;", "paragraph_id": "para_422" }, { "text": "(d)", "paragraph_id": "para_423" }, { "text": "frequent flyer information;", "paragraph_id": "para_424" }, { "text": "(e)", "paragraph_id": "para_425" }, { "text": "general remarks to the extent that they contain any information which could serve to identify directly the passenger to whom the PNR relate; and", "paragraph_id": "para_426" }, { "text": "(f)", "paragraph_id": "para_427" }, { "text": "any API data that have been collected.", "paragraph_id": "para_428" }, { "text": "3.   Upon expiry of the period of six months referred to in paragraph 2, disclosure of the full PNR data shall be permitted only where it is:", "paragraph_id": "para_429" }, { "text": "(a)", "paragraph_id": "para_430" }, { "text": "reasonably believed that it is necessary for the purposes referred to in point (b) of Article 6(2) and", "paragraph_id": "para_431" }, { "text": "(b)", "paragraph_id": "para_432" }, { "text": "approved by:", "paragraph_id": "para_433" }, { "text": "(i)", "paragraph_id": "para_434" }, { "text": "a judicial authority; or", "paragraph_id": "para_435" }, { "text": "(ii)", "paragraph_id": "para_436" }, { "text": "another national authority competent under national law to verify whether the conditions for disclosure are met, subject to informing the data protection officer of the PIU and to an ex post review by that data protection officer.", "paragraph_id": "para_437" }, { "text": "4.   Member States shall ensure that the PNR data are deleted permanently upon expiry of the period referred to in paragraph 1. This obligation shall be without prejudice to cases where specific PNR data have been transferred to a competent authority and are used in the context of specific cases for …", "paragraph_id": "para_438" }, { "text": "5.   The result of the processing referred to in point (a) of Article 6(2) shall be kept by the PIU only as long as necessary to inform the competent authorities and, in accordance with Article 9(1), to inform the PIUs of other Member States of a positive match. Where the result of automated process …", "paragraph_id": "para_439" }, { "text": "32", "paragraph_id": "para_440" }, { "text": "Article 13 of the PNR Directive, entitled ‘Protection of personal data’, provides in paragraphs 1 to 5:", "paragraph_id": "para_441" }, { "text": "‘1.   Each Member State shall provide that, in respect of all processing of personal data pursuant to this Directive, every passenger shall have the same right to protection of their personal data, rights of access, rectification, erasure and restriction and rights to compensation and judicial redress as laid down in [EU] and national law and in implementation of Articles 17, 18, 19 and 20 of Framework Decision [2008/977]. Those Articles shall therefore apply.", "paragraph_id": "para_442" }, { "text": "2.   Each Member State shall provide that the provisions adopted under national law in implementation of Articles 21 and 22 of Framework Decision [2008/977] regarding confidentiality of processing and data security shall also apply to all processing of personal data pursuant to this Directive.", "paragraph_id": "para_443" }, { "text": "3.   This Directive is without prejudice to the applicability of Directive [95/46] to the processing of personal data by air carriers, in particular their obligations to take appropriate technical and organisational measures to protect the security and confidentiality of personal data.", "paragraph_id": "para_444" }, { "text": "4.   Member States shall prohibit the processing of PNR data revealing a person’s race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation. In the event that PNR data revealing such information are received by the PIU, they shall be deleted immediately.", "paragraph_id": "para_445" }, { "text": "5.   Member States shall ensure that the PIUs maintain documentation relating to all processing systems and procedures under their responsibility. That documentation shall contain at least:", "paragraph_id": "para_446" }, { "text": "(a)", "paragraph_id": "para_447" }, { "text": "the name and contact details of the organisation and personnel in the PIU entrusted with the processing of the PNR data and the different levels of access authorisation;", "paragraph_id": "para_448" }, { "text": "(b)", "paragraph_id": "para_449" }, { "text": "the requests made by competent authorities and PIUs of other Member States;", "paragraph_id": "para_450" }, { "text": "(c)", "paragraph_id": "para_451" }, { "text": "all requests for and transfers of PNR data to a third country.", "paragraph_id": "para_452" }, { "text": "The PIU shall make all documentation available, upon request, to the national supervisory authority.’", "paragraph_id": "para_453" }, { "text": "33", "paragraph_id": "para_454" }, { "text": "According to Article 15 of that directive, entitled ‘National supervisory authority’:", "paragraph_id": "para_455" }, { "text": "‘1.   Each Member State shall provide that the national supervisory authority referred to in Article 25 of Framework Decision [2008/977] is responsible for advising on and monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive. Article 25 of Framework Decision [2008/977] shall apply.", "paragraph_id": "para_456" }, { "text": "2.   Those national supervisory authorities shall conduct activities under paragraph 1 with a view to protecting fundamental rights in relation to the processing of personal data.", "paragraph_id": "para_457" }, { "text": "3.   Each national supervisory authority shall:", "paragraph_id": "para_458" }, { "text": "(a)", "paragraph_id": "para_459" }, { "text": "deal with complaints lodged by any data subject, investigate the matter and inform the data subjects of the progress and the outcome of their complaints within a reasonable time period;", "paragraph_id": "para_460" }, { "text": "(b)", "paragraph_id": "para_461" }, { "text": "verify the lawfulness of the data processing, conduct investigations, inspection and audits in accordance with national law, either on its own initiative or on the basis of a complaint referred to in point (a).", "paragraph_id": "para_462" }, { "text": "4.   Each national supervisory authority shall, upon request, advise any data subject on the exercise of the rights laid down in provisions adopted pursuant to this Directive.’", "paragraph_id": "para_463" }, { "text": "34", "paragraph_id": "para_464" }, { "text": "Article 19 of the directive, entitled ‘Review’, provides:", "paragraph_id": "para_465" }, { "text": "‘1.   On the basis of information provided by the Member States, including the statistical information referred to in Article 20(2), the Commission shall by 25 May 2020 conduct a review of all the elements of this Directive and submit and present a report to the European Parliament and to the Council [of the European Union].", "paragraph_id": "para_466" }, { "text": "2.   In conducting its review, the Commission shall pay special attention to:", "paragraph_id": "para_467" }, { "text": "(a)", "paragraph_id": "para_468" }, { "text": "compliance with the applicable standards of protection of personal data,", "paragraph_id": "para_469" }, { "text": "(b)", "paragraph_id": "para_470" }, { "text": "the necessity and proportionality of collecting and processing PNR data for each of the purposes set out in this Directive,", "paragraph_id": "para_471" }, { "text": "(c)", "paragraph_id": "para_472" }, { "text": "the length of the data retention period,", "paragraph_id": "para_473" }, { "text": "(d)", "paragraph_id": "para_474" }, { "text": "the effectiveness of exchange of information between the Member States, and", "paragraph_id": "para_475" }, { "text": "(e)", "paragraph_id": "para_476" }, { "text": "the quality of the assessments including with regard to the statistical information gathered pursuant to Article 20.", "paragraph_id": "para_477" }, { "text": "3.   The report referred to in paragraph 1 shall also include a review of the necessity, proportionality, and effectiveness of including within the scope of this Directive the mandatory collection and transfer of PNR data relating to all or selected intra-EU flights. The Commission shall take into a …", "paragraph_id": "para_478" }, { "text": "4.   If appropriate, in light of the review conducted pursuant to this Article, the Commission shall make a legislative proposal to the European Parliament and to the Council with a view to amending this Directive.’", "paragraph_id": "para_479" }, { "text": "35", "paragraph_id": "para_480" }, { "text": "Article 21 of that directive, entitled ‘Relationship to other instruments’, provides, in paragraph 2:", "paragraph_id": "para_481" }, { "text": "‘This Directive is without prejudice to the applicability of Directive [95/46] to the processing of personal data by air carriers.’", "paragraph_id": "para_482" }, { "text": "36", "paragraph_id": "para_483" }, { "text": "Annex I to the PNR Directive, entitled ‘Passenger name record data as far as collected by air carriers’, provides:", "paragraph_id": "para_484" }, { "text": "‘1.", "paragraph_id": "para_485" }, { "text": "PNR record locator", "paragraph_id": "para_486" }, { "text": "2.", "paragraph_id": "para_487" }, { "text": "Date of reservation/issue of ticket", "paragraph_id": "para_488" }, { "text": "3.", "paragraph_id": "para_489" }, { "text": "Date(s) of intended travel", "paragraph_id": "para_490" }, { "text": "4.", "paragraph_id": "para_491" }, { "text": "Name(s)", "paragraph_id": "para_492" }, { "text": "5.", "paragraph_id": "para_493" }, { "text": "Address and contact information (telephone number, email address)", "paragraph_id": "para_494" }, { "text": "6.", "paragraph_id": "para_495" }, { "text": "All forms of payment information, including billing address", "paragraph_id": "para_496" }, { "text": "7.", "paragraph_id": "para_497" }, { "text": "Complete travel itinerary for specific PNR", "paragraph_id": "para_498" }, { "text": "8.", "paragraph_id": "para_499" }, { "text": "Frequent flyer information", "paragraph_id": "para_500" }, { "text": "9.", "paragraph_id": "para_501" }, { "text": "Travel agency/travel agent", "paragraph_id": "para_502" }, { "text": "10.", "paragraph_id": "para_503" }, { "text": "Travel status of passenger, including confirmations, check-in status, no-show or go-show information", "paragraph_id": "para_504" }, { "text": "11.", "paragraph_id": "para_505" }, { "text": "Split/divided PNR information", "paragraph_id": "para_506" }, { "text": "12.", "paragraph_id": "para_507" }, { "text": "General remarks (including all available information on unaccompanied minors under 18 years, such as name and gender of the minor, age, language(s) spoken, name and contact details of guardian on departure and relationship to the minor, name and contact details of guardian on arrival and relationship to the minor, departure and arrival agent)", "paragraph_id": "para_508" }, { "text": "13.", "paragraph_id": "para_509" }, { "text": "Ticketing field information, including ticket number, date of ticket issuance and one-way tickets, automated ticket fare quote fields", "paragraph_id": "para_510" }, { "text": "14.", "paragraph_id": "para_511" }, { "text": "Seat number and other seat information", "paragraph_id": "para_512" }, { "text": "15.", "paragraph_id": "para_513" }, { "text": "Code share information", "paragraph_id": "para_514" }, { "text": "16.", "paragraph_id": "para_515" }, { "text": "All baggage information", "paragraph_id": "para_516" }, { "text": "17.", "paragraph_id": "para_517" }, { "text": "Number and other names of travellers on the PNR", "paragraph_id": "para_518" }, { "text": "18.", "paragraph_id": "para_519" }, { "text": "Any advance passenger information (API) data collected (including the type, number, country of issuance and expiry date of any identity document, nationality, family name, given name, gender, date of birth, airline, flight number, departure date, arrival date, departure port, arrival port, departure time and arrival time)", "paragraph_id": "para_520" }, { "text": "19.", "paragraph_id": "para_521" }, { "text": "All historical changes to the PNR listed in numbers 1 to 18.’", "paragraph_id": "para_522" }, { "text": "37", "paragraph_id": "para_523" }, { "text": "Annex II to that directive, entitled ‘List of offences referred to in point (9) of Article 3’, is worded as follows:", "paragraph_id": "para_524" }, { "text": "‘1.", "paragraph_id": "para_525" }, { "text": "participation in a criminal organisation,", "paragraph_id": "para_526" }, { "text": "2.", "paragraph_id": "para_527" }, { "text": "trafficking in human beings,", "paragraph_id": "para_528" }, { "text": "3.", "paragraph_id": "para_529" }, { "text": "sexual exploitation of children and child pornography,", "paragraph_id": "para_530" }, { "text": "4.", "paragraph_id": "para_531" }, { "text": "illicit trafficking in narcotic drugs and psychotropic substances,", "paragraph_id": "para_532" }, { "text": "5.", "paragraph_id": "para_533" }, { "text": "illicit trafficking in weapons, munitions and explosives,", "paragraph_id": "para_534" }, { "text": "6.", "paragraph_id": "para_535" }, { "text": "corruption,", "paragraph_id": "para_536" }, { "text": "7.", "paragraph_id": "para_537" }, { "text": "fraud, including that against the financial interests of the Union,", "paragraph_id": "para_538" }, { "text": "8.", "paragraph_id": "para_539" }, { "text": "laundering of the proceeds of crime and counterfeiting of currency, including the euro,", "paragraph_id": "para_540" }, { "text": "9.", "paragraph_id": "para_541" }, { "text": "computer-related crime/cybercrime,", "paragraph_id": "para_542" }, { "text": "10.", "paragraph_id": "para_543" }, { "text": "environmental crime, including illicit trafficking in endangered animal species and in endangered plant species and varieties,", "paragraph_id": "para_544" }, { "text": "11.", "paragraph_id": "para_545" }, { "text": "facilitation of unauthorised entry and residence,", "paragraph_id": "para_546" }, { "text": "12.", "paragraph_id": "para_547" }, { "text": "murder, grievous bodily injury,", "paragraph_id": "para_548" }, { "text": "13.", "paragraph_id": "para_549" }, { "text": "illicit trade in human organs and tissue,", "paragraph_id": "para_550" }, { "text": "14.", "paragraph_id": "para_551" }, { "text": "kidnapping, illegal restraint and hostage-taking,", "paragraph_id": "para_552" }, { "text": "15.", "paragraph_id": "para_553" }, { "text": "organised and armed robbery,", "paragraph_id": "para_554" }, { "text": "16.", "paragraph_id": "para_555" }, { "text": "illicit trafficking in cultural goods, including antiques and works of art,", "paragraph_id": "para_556" }, { "text": "17.", "paragraph_id": "para_557" }, { "text": "counterfeiting and piracy of products,", "paragraph_id": "para_558" }, { "text": "18.", "paragraph_id": "para_559" }, { "text": "forgery of administrative documents and trafficking therein,", "paragraph_id": "para_560" }, { "text": "19.", "paragraph_id": "para_561" }, { "text": "illicit trafficking in hormonal substances and other growth promoters,", "paragraph_id": "para_562" }, { "text": "20.", "paragraph_id": "para_563" }, { "text": "illicit trafficking in nuclear or radioactive materials,", "paragraph_id": "para_564" }, { "text": "21.", "paragraph_id": "para_565" }, { "text": "rape,", "paragraph_id": "para_566" }, { "text": "22.", "paragraph_id": "para_567" }, { "text": "crimes within the jurisdiction of the International Criminal Court,", "paragraph_id": "para_568" }, { "text": "23.", "paragraph_id": "para_569" }, { "text": "unlawful seizure of aircraft/ships,", "paragraph_id": "para_570" }, { "text": "24.", "paragraph_id": "para_571" }, { "text": "sabotage,", "paragraph_id": "para_572" }, { "text": "25.", "paragraph_id": "para_573" }, { "text": "trafficking in stolen vehicles,", "paragraph_id": "para_574" }, { "text": "26.", "paragraph_id": "para_575" }, { "text": "industrial espionage.’", "paragraph_id": "para_576" }, { "text": "7.\n  \n Framework Decision 2002/475", "paragraph_id": "para_577" }, { "text": "38", "paragraph_id": "para_578" }, { "text": "Article 1 of Framework Decision 2002/475 defined the concept of ‘terrorist offence’ by listing intentional acts referred to in points (a) to (i) of that article, committed with the aim of ‘seriously intimidating a population’, ‘unduly compelling a Government or international organisation to perform …", "paragraph_id": "para_579" }, { "text": "39", "paragraph_id": "para_580" }, { "text": "Framework Decision 2002/475 was repealed by Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Framework Decision 2002/475 and amending Council Decision 2005/671/JHA ( OJ 2017 L 88, p. 6 ), Articles 3 to 14 of which include similar definitions.", "paragraph_id": "para_581" }, { "text": "B.   Belgian law", "paragraph_id": "para_582" }, { "text": "1.\n  \n The Constitution", "paragraph_id": "para_583" }, { "text": "40", "paragraph_id": "para_584" }, { "text": "Article 22 of the Constitution provides as follows:", "paragraph_id": "para_585" }, { "text": "‘Everyone is entitled to respect for private and family life except in the cases and under the circumstances laid down by law.", "paragraph_id": "para_586" }, { "text": "The laws, decrees and rules referred to in Article 134 guarantee the protection of this right.’", "paragraph_id": "para_587" }, { "text": "2.\n  \n The Law of 25 December 2016", "paragraph_id": "para_588" }, { "text": "41", "paragraph_id": "para_589" }, { "text": "Article 2 of the loi du 25 décembre 2016, relative au traitement des données des passagers (Law of 25 December 2016 on the processing of passenger data, Moniteur belge of 25 January 2017, p. 12905; ‘the Law of 25 December 2016’) is worded as follows:", "paragraph_id": "para_590" }, { "text": "‘The present law and the royal decrees which shall be adopted in implementation of the present law transpose [the API Directive] and [the PNR Directive]. The present law and the royal decree concerning the maritime sector partially transpose Directive [2010/65].’", "paragraph_id": "para_591" }, { "text": "42", "paragraph_id": "para_592" }, { "text": "Article 3 of that law provides:", "paragraph_id": "para_593" }, { "text": "‘1.   This law lays down the obligations of carriers and tour operators regarding the transfer of data relating to passengers travelling to or from or transiting through Belgian territory.", "paragraph_id": "para_594" }, { "text": "2.   The King shall prescribe, by decree deliberated in the Council of Ministers, in respect of each sector of the transport industry and in respect of tour operators, the passenger data to be transferred and how they are to be transferred, after an opinion has been given by the Commission de la protection de la vie privée [(Commission for the protection of privacy)].’", "paragraph_id": "para_595" }, { "text": "43", "paragraph_id": "para_596" }, { "text": "Under Article 4 of that law:", "paragraph_id": "para_597" }, { "text": "‘For the purposes of this law and its implementing decrees, the following definitions shall apply:", "paragraph_id": "para_598" }, { "text": "…", "paragraph_id": "para_599" }, { "text": "(8)", "paragraph_id": "para_600" }, { "text": "“the competent services”: the services under Article 14(1)(2);", "paragraph_id": "para_601" }, { "text": "(9)", "paragraph_id": "para_602" }, { "text": "“PNR”: a record of each passenger’s travel requirements which contains the information referred to in Article 9, which is necessary to enable reservations to be processed and controlled by the booking and participating carriers and tour operators for each journey booked by or on behalf of any person, whether it is contained in reservation systems, departure control systems used to check passengers onto flights, or equivalent systems providing the same functionalities;", "paragraph_id": "para_603" }, { "text": "(10)", "paragraph_id": "para_604" }, { "text": "“passenger”: any person, including persons in transfer or transit and excluding members of the crew, carried or to be carried by the carrier with its consent, such consent being manifested by that person’s registration in the passengers list;", "paragraph_id": "para_605" }, { "text": "…’", "paragraph_id": "para_606" }, { "text": "44", "paragraph_id": "para_607" }, { "text": "Article 8 of the Law of 25 December 2016 states:", "paragraph_id": "para_608" }, { "text": "‘1.   Passenger data shall be processed for the purposes of:", "paragraph_id": "para_609" }, { "text": "(1)", "paragraph_id": "para_610" }, { "text": "detection and prosecution (including the execution of penalties or measures depriving the person concerned of his or her liberty) of the offences referred to Article 90 ter (2), …(7), …(8), …(11), …(14), …(17), (18), (19) and Article 90 ter (3) of the Code d’instruction criminelle [(Criminal Procedure Code)];", "paragraph_id": "para_611" }, { "text": "(2)", "paragraph_id": "para_612" }, { "text": "detection and prosecution (including the execution of penalties or measures depriving the person of his or her liberty) of the offences referred to in Article 196, in so far as concerns the offences of forgery of authentic and public documents, Article 198, 199, 199 bis , 207, 213, 375 and 505 of the Code pénal [(Criminal Code)];", "paragraph_id": "para_613" }, { "text": "…", "paragraph_id": "para_614" }, { "text": "(4)", "paragraph_id": "para_615" }, { "text": "monitoring the activities referred to in Article 7(1) and (3/l) and Article 11(1)(1) to (3) and (5) of the loi du 30 novembre 1998 organique des services de renseignement et de sécurité [(Organic law of 30 November 1998 on the intelligence and security services)];", "paragraph_id": "para_616" }, { "text": "(5)", "paragraph_id": "para_617" }, { "text": "detection and prosecution of the offences referred to in Article 220(2) of the loi générale sur les douanes et accises du 18 juillet 1977 [(General customs and excise law of 18 July 1977)] and the third paragraph of Article 45 of the loi du 22 décembre 2009 relative au régime général d’accise [(Law of 22 December 2009 on the general excise regime)] …", "paragraph_id": "para_618" }, { "text": "2.   Subject to the conditions in Chapter 11, passenger data shall also be processed with a view to improving external border controls on individuals, and with a view to combating illegal immigration.’", "paragraph_id": "para_619" }, { "text": "45", "paragraph_id": "para_620" }, { "text": "Article 14(1) of that law states:", "paragraph_id": "para_621" }, { "text": "‘The PIU shall be made up of:", "paragraph_id": "para_622" }, { "text": "…", "paragraph_id": "para_623" }, { "text": "(2) members seconded from the following competent services:", "paragraph_id": "para_624" }, { "text": "(a)", "paragraph_id": "para_625" }, { "text": "the police services covered by the loi du 7 décembre 1998 organisant un service de police intégré, structuré à deux niveaux [(Law of 7 December 1998 organising an integrated police service, with a two-tier structure)];", "paragraph_id": "para_626" }, { "text": "(b)", "paragraph_id": "para_627" }, { "text": "the Sûreté de l’État [(State security services)] covered by the [Organic law of 30 November 1998 on the intelligence and security services];", "paragraph_id": "para_628" }, { "text": "(c)", "paragraph_id": "para_629" }, { "text": "the Service général de Renseignement et de Sécurité [(General intelligence and security services)] covered by the [Organic law of 30 November 1998 on the intelligence and security services];", "paragraph_id": "para_630" }, { "text": "…’", "paragraph_id": "para_631" }, { "text": "46", "paragraph_id": "para_632" }, { "text": "Article 24 of the said law, in Section 1 thereof, entitled ‘Processing of passenger data in connection with the advance assessment of passengers’, of Chapter 10 of that law, on data processing, is worded as follows:", "paragraph_id": "para_633" }, { "text": "‘1.   Passenger data shall be processed with a view to carrying out an assessment of passengers prior to their scheduled arrival in, departure from, or transit through Belgian territory, in order to identify persons who require further examination.", "paragraph_id": "para_634" }, { "text": "2.   For the purposes referred to in Article 8(1)(1), (4) and (5), or relating to the threats referred to in Article 8(1)(a), (b), (c), (d), (f) and (g) and Article 11(2) of the [Organic law of 30 November 1998 on the intelligence and security services], the advance assessment of passengers shall be based on a positive match resulting from comparing passenger data against:", "paragraph_id": "para_635" }, { "text": "(1)", "paragraph_id": "para_636" }, { "text": "the databases managed by the competent services or which are directly available or accessible to those services in the course of their functions or against the lists of individuals drawn up by the competent services in the course of their functions.", "paragraph_id": "para_637" }, { "text": "(2)", "paragraph_id": "para_638" }, { "text": "the assessment criteria pre-determined by the PIU, as referred to in Article 25.", "paragraph_id": "para_639" }, { "text": "3.   For the purposes referred to in Article 8(1)(3), the advance assessment of passengers shall be based on a positive match resulting from comparing passenger data against the databases referred to in Article 8(2)(1).", "paragraph_id": "para_640" }, { "text": "4.   Positive matches shall be validated by the PIU within 24 hours of receipt of the automated notification of the positive match.", "paragraph_id": "para_641" }, { "text": "5.   From the moment of that validation, the competent service which originally identified the positive match shall take further action without delay.’", "paragraph_id": "para_642" }, { "text": "47", "paragraph_id": "para_643" }, { "text": "Chapter 11 of the Law of 25 December 2016, entitled ‘Processing of passenger data with a view to improving border controls and combating illegal immigration’, comprises Articles 28 to 31 thereof.", "paragraph_id": "para_644" }, { "text": "48", "paragraph_id": "para_645" }, { "text": "Article 28 of that law provides:", "paragraph_id": "para_646" }, { "text": "‘1.   This Chapter applies to the processing of passenger data by the police services responsible for carrying out border checks and by the Office des étrangers [(Immigration Office)], carried out with a view to improving the checks on persons at external borders and with a view to combating illegal immigration.", "paragraph_id": "para_647" }, { "text": "2.   It applies without prejudice to the obligations incumbent on the police services responsible for carrying out border checks and on the [Immigration Office] to transfer personal data or information in accordance with legal or statutory provisions.’", "paragraph_id": "para_648" }, { "text": "49", "paragraph_id": "para_649" }, { "text": "Under Article 29 of that law:", "paragraph_id": "para_650" }, { "text": "‘1.   For the purposes of Article 28(1) passenger data are transferred to the police services responsible for carrying out border checks and to the [Immigration Office] to enable them to perform their statutory duties, within the limits provided for in this article.", "paragraph_id": "para_651" }, { "text": "2.   Only the passenger data referred to in Article 9(1)(18) concerning the following passenger categories shall be transferred:", "paragraph_id": "para_652" }, { "text": "(1)", "paragraph_id": "para_653" }, { "text": "passengers who intend to enter or have entered Belgian territory at an external border;", "paragraph_id": "para_654" }, { "text": "(2)", "paragraph_id": "para_655" }, { "text": "passengers who intend to leave or have left Belgian territory at an external border;", "paragraph_id": "para_656" }, { "text": "(3)", "paragraph_id": "para_657" }, { "text": "passengers who intend to pass through, are located in, or have passed through an international transit area situated on Belgian territory.", "paragraph_id": "para_658" }, { "text": "3.   The passenger data referred to in paragraph (2) shall be transferred to the police services responsible for carrying out checks at Belgium’s external border immediately after they have been entered in the passenger database. The said services shall save those data in a temporary file and delete them within 24 hours of the transfer.", "paragraph_id": "para_659" }, { "text": "4.   When it needs them to perform its statutory duties, the passenger data referred to in paragraph (2) shall be transferred to the [Immigration Office] immediately after they have been entered in the passenger database. The Office shall save those data in a temporary file and delete them within 24 hours of the transfer.", "paragraph_id": "para_660" }, { "text": "After that period has passed, if the [Immigration Office] requires access to the passenger data referred to in paragraph (2) for the purposes of performing its statutory duties, it shall send a duly reasoned request to the PIU.", "paragraph_id": "para_661" }, { "text": "…’", "paragraph_id": "para_662" }, { "text": "50", "paragraph_id": "para_663" }, { "text": "The Law of 25 December 2016 became applicable to airlines, carriers operating international passenger service (HST carriers) and travel intermediaries in a contract with those carriers (HST ticket distributors), and bus carriers, respectively, by the arrêté royal du 1 juillet 2017 relatif à l’exécut …", "paragraph_id": "para_664" }, { "text": "II.   The dispute in the main proceedings and the questions referred for a preliminary ruling", "paragraph_id": "para_665" }, { "text": "51", "paragraph_id": "para_666" }, { "text": "By application of 24 July 2017, the Ligue des droits humains brought an action before the Cour constitutionnelle (Constitutional Court, Belgium) seeking annulment in full or in part of the Law of 25 December 2016.", "paragraph_id": "para_667" }, { "text": "52", "paragraph_id": "para_668" }, { "text": "The referring court states that that law transposes, into domestic law, the PNR Directive and the API Directive as well as, in part, Directive 2010/65. According to the referring court, it follows from the travaux préparatoires that that law seeks to ‘create a legal framework requiring international …", "paragraph_id": "para_669" }, { "text": "53", "paragraph_id": "para_670" }, { "text": "In support of its action, the Ligue des droits humains raises two pleas, the first, alleging breach of Article 22 of the Constitution, read in conjunction with Article 23 of the GDPR, Articles 7, 8 as well as Article 52(1) of the Charter as well as Article 8 ECHR, and the second, alleging, in the alternative, breach of Article 22 of the Charter, read in conjunction with Article 3(2) TEU and Article 45 of the Charter.", "paragraph_id": "para_671" }, { "text": "54", "paragraph_id": "para_672" }, { "text": "By its first plea, the Ligue des droits humains submits, in essence, that that law entails an interference with the rights to respect for private life and the protection of personal data, which does not comply with Article 52(1) of the Charter and, inter alia, the principle of proportionality. The s …", "paragraph_id": "para_673" }, { "text": "55", "paragraph_id": "para_674" }, { "text": "By its second plea, concerning Article 3(1), Article 8(2) and Articles 28 to 31 of the Law of 25 December 2016, the Ligue des droits humains submits that, by extending the system provided for by the PNR Directive to intra-EU transport operations, those provisions have the effect of indirectly restor …", "paragraph_id": "para_675" }, { "text": "56", "paragraph_id": "para_676" }, { "text": "The Council of Ministers disputes those arguments. It considers, in particular, that the first plea is inadmissible in so far as it concerns the GDPR, which is not applicable to the Law of 25 December 2016. Furthermore, the processing of data provided for by that law, in accordance with the PNR Dire …", "paragraph_id": "para_677" }, { "text": "57", "paragraph_id": "para_678" }, { "text": "As regards the first plea, the referring court asks, first of all, whether the protection provided for by the GDPR applies to the processing of data established by the Law of 25 December 2016, which is intended to implement, primarily, the PNR Directive. Next, that court notes, with reference to the …", "paragraph_id": "para_679" }, { "text": "58", "paragraph_id": "para_680" }, { "text": "The referring court also observes that PNR data, in accordance with the provisions of the PNR Directive, are systematically subject to advance assessment involving cross-checks with databases or pre-determined criteria with a view to finding matches. The Consultative Committee of Convention No 108 o …", "paragraph_id": "para_681" }, { "text": "59", "paragraph_id": "para_682" }, { "text": "As regards the five-year retention period and access to the data provided for in Article 12 of the PNR Directive, the referring court notes that the Commission for the protection of privacy (Belgium), in its avis d’initiative n o  01/2010 du 13 janvier 2010 relatif au projet de loi portant assentime …", "paragraph_id": "para_683" }, { "text": "60", "paragraph_id": "para_684" }, { "text": "In those circumstances, having regard to the case-law resulting in particular from Opinion 1/15 (EU-Canada PNR Agreement) ) of 26 July 2017 ( EU:C:2017:592 ), the referring court asks whether the system for the collection, transfer, processing and retention of PNR data established by the PNR Directi …", "paragraph_id": "para_685" }, { "text": "61", "paragraph_id": "para_686" }, { "text": "As regards the second plea, the referring court states that Article 3(1) of that law lays down the obligations of carriers and tour operators regarding the transfer of data relating to passengers ‘travelling to or from or transiting through Belgian territory’. That court adds, with regard to the sco …", "paragraph_id": "para_687" }, { "text": "62", "paragraph_id": "para_688" }, { "text": "It is in those circumstances that the Cour constitutionnelle (Constitutional Court) decided to stay proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:", "paragraph_id": "para_689" }, { "text": "‘(1)", "paragraph_id": "para_690" }, { "text": "Is Article 23 of [the GDPR], read in conjunction with Article 2(2)(d) of that regulation, to be interpreted as applying to national legislation such as the [Law of 25 December 2016], which transposes [the PNR Directive] as well as [the API Directive] and Directive [2010/65]?", "paragraph_id": "para_691" }, { "text": "(2)", "paragraph_id": "para_692" }, { "text": "Is Annex I to [the PNR Directive] compatible with Articles 7, 8 and 52(1) of [the Charter], given that the data it refers to are very wide in scope – particularly the data referred to in paragraph 18 of Annex I to [that directive], which go beyond the data referred to in Article 3(2) of [the API Directive] – and also given that, taken together, they may reveal sensitive information, and thus go beyond what is “strictly necessary”?", "paragraph_id": "para_693" }, { "text": "(3)", "paragraph_id": "para_694" }, { "text": "Are paragraphs 12 and 18 of Annex I to [the PNR Directive] compatible with Articles 7, 8 and 52(1) of [the Charter], given that, having regard to the word “including”, the data referred to in those paragraphs are given by way of example and not exhaustively, such that the requirement for precision and clarity in rules which interfere with the right to respect for private life and the right to protection of personal data is not satisfied?", "paragraph_id": "para_695" }, { "text": "(4)", "paragraph_id": "para_696" }, { "text": "Are Article 3(4) of [the PNR Directive] and Annex I to that directive compatible with Articles 7, 8 and 52(1) of [the Charter], given that the system of generalised collection, transfer and processing of passenger data established by those provisions relates to any person using the mode of transport concerned, regardless of whether there is any objective ground for considering that that person may present a risk to public security?", "paragraph_id": "para_697" }, { "text": "(5)", "paragraph_id": "para_698" }, { "text": "Is Article 6 of [the PNR Directive], read in conjunction with Articles 7, 8 and 52(1) of [the Charter], to be interpreted as precluding national legislation such as the contested law, which includes, among the purposes for which PNR data are processed, [monitoring] activities within the remit of the …", "paragraph_id": "para_699" }, { "text": "(6)", "paragraph_id": "para_700" }, { "text": "Is Article 6 of [the PNR Directive] compatible with Articles 7, 8 and 52(1) of [the Charter], given that the advance assessment for which it provides, which is made by comparing passenger data against databases and pre-determined criteria, applies to such data in a systematic and generalised manner, regardless of whether there is any objective ground for considering that the passengers concerned may present a risk to public security?", "paragraph_id": "para_701" }, { "text": "(7)", "paragraph_id": "para_702" }, { "text": "Can the expression “another national authority competent under national law” in Article 12(3) of [the PNR Directive] be interpreted as including the PIU created by the Law of 25 December 2016, which would then have power to authorise access to PNR data after six months had passed, for the purposes of ad hoc searches?", "paragraph_id": "para_703" }, { "text": "(8)", "paragraph_id": "para_704" }, { "text": "Is Article 12 of [the PNR Directive], read in conjunction with Articles 7, 8 and 52(1) of [the Charter], to be interpreted as precluding national legislation such as the contested law which provides for a general data retention period of five years, without making any distinction in terms of whether the advance assessment indicated that the passengers might present a risk to public security?", "paragraph_id": "para_705" }, { "text": "(9)", "paragraph_id": "para_706" }, { "text": "(a)", "paragraph_id": "para_707" }, { "text": "Is [the API Directive] compatible with Article 3(2) [TEU] and Article 45 of [the Charter], given that the obligations for which it provides apply to flights within the European Union?", "paragraph_id": "para_708" }, { "text": "(b)", "paragraph_id": "para_709" }, { "text": "Is [the API Directive], read in conjunction with Article 3(2) [TEU] and Article 45 of [the Charter], to be interpreted as precluding national legislation such as the contested law which, for the purposes of combating illegal immigration and improving border controls, authorises a system of collectio …", "paragraph_id": "para_710" }, { "text": "(10)", "paragraph_id": "para_711" }, { "text": "If, on the basis of the answers to the preceding questions, the Cour constitutionnelle (Constitutional Court) concludes that the contested law, which transposes, inter alia, [the PNR Directive], fails to fulfil one or more of the obligations arising under the provisions referred to in those question …", "paragraph_id": "para_712" }, { "text": "III.   Consideration of the questions referred", "paragraph_id": "para_713" }, { "text": "A.   Question 1", "paragraph_id": "para_714" }, { "text": "63", "paragraph_id": "para_715" }, { "text": "By its Question 1, the referring court asks, in essence, whether Article 2(2)(d) and Article 23 of the GDPR must be interpreted as meaning that that regulation applies to the processing of personal data envisaged by national legislation intended to transpose, into domestic law, the provisions of the PNR Directive, those of the API Directive and also those of Directive 2010/65, in particular, the transfer, the retention and the processing of PNR data.", "paragraph_id": "para_716" }, { "text": "64", "paragraph_id": "para_717" }, { "text": "As is apparent from Article 2(1) of the GDPR, that regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of such data which form part of a filing system or are intended to form part of a filing system. The concep …", "paragraph_id": "para_718" }, { "text": "65", "paragraph_id": "para_719" }, { "text": "The Belgian Government submits however that the transfer of PNR data by economic operators to the PIU, for the purposes of the prevention and detection of criminal offences, as provided for in Article 1(1)(a) and (2) and Article 8 of the PNR Directive, which constitutes ‘processing’ of personal data …", "paragraph_id": "para_720" }, { "text": "66", "paragraph_id": "para_721" }, { "text": "In that regard, it is true that, as previously held by the Court, the first indent of Article 3(2) of Directive 95/46, which was repealed and replaced by the GDPR with effect from 25 May 2018, generally excluded from its scope ‘processing operations concerning public security, defence [and] State se …", "paragraph_id": "para_722" }, { "text": "67", "paragraph_id": "para_723" }, { "text": "However, Article 2(2)(d) of the GDPR draws such a distinction, since, as noted by the Advocate General in points 41 and 46 of his Opinion, it is clearly apparent from the wording of that provision that two conditions need to be met for data processing to fall within the scope of the exception it lay …", "paragraph_id": "para_724" }, { "text": "68", "paragraph_id": "para_725" }, { "text": "As the Court has also held, it is apparent from Article 23(1)(d) and (h) of the GDPR that the processing of personal data carried out by individuals for the purposes set out in Article 2(2)(d) of that regulation falls within the scope of thereof (see, to that effect, judgment of 6 October 2020, La Quadrature du Net and Others, C‑511/18, C‑512/18 and C‑520/18 , EU:C:2020:791 , paragraph  102 ).", "paragraph_id": "para_726" }, { "text": "69", "paragraph_id": "para_727" }, { "text": "It follows that the case-law stemming from the judgment of 30 May 2006, Parliament v Council and Commission ( C‑317/04 and C‑318/04 , EU:C:2006:346 ), relied on by the Belgian Government, is not applicable to the exception to the scope of the GDPR set out in Article 2(2)(d) thereof.", "paragraph_id": "para_728" }, { "text": "70", "paragraph_id": "para_729" }, { "text": "In addition, that exception, like the other exceptions to the scope of the GDPR laid down in Article 2(2) of that regulation, must be interpreted strictly.", "paragraph_id": "para_730" }, { "text": "71", "paragraph_id": "para_731" }, { "text": "As is apparent from recital 19 of the GDPR, the reason for that exception is that the processing of personal data by authorities competent for the purposes, inter alia, of the prevention and detection of criminal offences, including the safeguarding against and the prevention of threats to public se …", "paragraph_id": "para_732" }, { "text": "72", "paragraph_id": "para_733" }, { "text": "As is stated, moreover, in recitals 9 to 11 of Directive 2016/680, the latter lays down the specific rules relating to the protection of natural persons with regard to such processing operations, respecting the specific nature of those activities in the fields of judicial cooperation in criminal mat …", "paragraph_id": "para_734" }, { "text": "73", "paragraph_id": "para_735" }, { "text": "As regards the first condition set out in paragraph 67 above, and, specifically, the purposes for which the personal data are to be processed under the PNR Directive, it is appropriate to recall that, in accordance with Article 1(2) of that directive, PNR data may be processed only for the purposes …", "paragraph_id": "para_736" }, { "text": "74", "paragraph_id": "para_737" }, { "text": "By contrast, that is not the case with regard to the processing operations covered by the API Directive and Directive 2010/65, the purposes of which are other than those in Article 2(2)(d) of the GDPR and Article 1(1) of Directive 2016/680.", "paragraph_id": "para_738" }, { "text": "75", "paragraph_id": "para_739" }, { "text": "Indeed, the API Directive aims at improving border controls and combating illegal immigration, as is apparent from recitals 1, 7 and 9 as well as Article 1 thereof, by the transmission of advance passenger data by carriers to the competent national authorities. Moreover, several recitals and provisi …", "paragraph_id": "para_740" }, { "text": "76", "paragraph_id": "para_741" }, { "text": "As to Directive 2010/65, it follows from recital 2 and Article 1(1) thereof that the purpose of that directive is to simplify and harmonise the administrative procedures applied to maritime transport by making the electronic transmission of information standard and by rationalising reporting formali …", "paragraph_id": "para_742" }, { "text": "77", "paragraph_id": "para_743" }, { "text": "It follows that the data processing operations envisaged by national legislation transposing, into domestic law, the provisions of the API Directive and of Directive 2010/65 are within the scope of the GDPR. By contrast, data processing operations envisaged by national legislation that transpose, in …", "paragraph_id": "para_744" }, { "text": "78", "paragraph_id": "para_745" }, { "text": "As regards that second condition, the Court has held that, in so far as Directive 2016/680 defines, in Article 3(7) thereof, the concept of ‘competent authority’, such a definition must be applied, by analogy, to Article 2(2)(d) of the GDPR (see, to that effect, judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19 , EU:C:2021:504 , paragraph  69 ).", "paragraph_id": "para_746" }, { "text": "79", "paragraph_id": "para_747" }, { "text": "Pursuant to Articles 4 and 7 of the PNR Directive, each Member State must, respectively, designate, as its PIU, an authority competent for the prevention, detection, investigation or prosecution of terrorist offences and of serious crime and adopt a list of the competent authorities entitled to requ …", "paragraph_id": "para_748" }, { "text": "80", "paragraph_id": "para_749" }, { "text": "It follows therefrom that the processing of PNR data by the PIU and the said competent authorities for such purposes satisfy both conditions referred to in paragraph 67 above, with the result that those operations are covered by the provisions of the PNR Directive itself as well as those of Directive 2016/680 and not those of the GDPR, as confirmed, moreover, by recital 27 of the PNR Directive.", "paragraph_id": "para_750" }, { "text": "81", "paragraph_id": "para_751" }, { "text": "By contrast, since economic operators such as air carriers, although they have a legal obligation to transfer PNR data, are neither in charge of exercising public authority nor entrusted with public powers by that directive, they cannot be regarded as being competent authorities within the meaning o …", "paragraph_id": "para_752" }, { "text": "82", "paragraph_id": "para_753" }, { "text": "The referring, lastly, raises the question of the impact, if any, of the adoption of national legislation intended to transpose the provisions of the PNR Directive, those of the API Directive and also those of Directive 2010/65, such as the Law of 25 December 2016. In that regard, it should be borne …", "paragraph_id": "para_754" }, { "text": "83", "paragraph_id": "para_755" }, { "text": "Thus, when a data processing operation carried out on the basis of that legislation is covered by the API Directive and/or Directive 2010/65, the GDPR applies to that operation. The same is true of a data processing operation carried out on that same basis and, in terms of its purpose and in additio …", "paragraph_id": "para_756" }, { "text": "84", "paragraph_id": "para_757" }, { "text": "In the light of the foregoing, the answer to Question 1 is that Article 2(2)(d) and Article 23 of the GDPR must be interpreted as meaning that that regulation applies to the processing of personal data envisaged by national legislation intended to transpose, into domestic law, the provisions of the …", "paragraph_id": "para_758" }, { "text": "B.   Questions 2 to 4 and Question 6", "paragraph_id": "para_759" }, { "text": "85", "paragraph_id": "para_760" }, { "text": "By its Questions 2 to 4 and Question 6, which it is appropriate to consider together, the referring court asks the Court, in essence, whether the PNR Directive is valid in the light of Articles 7 and 8 as well as Article 52(1) of the Charter. Those questions concern, inter alia:", "paragraph_id": "para_761" }, { "text": "–", "paragraph_id": "para_762" }, { "text": "Annex I to that directive and the data listed in that annex, in particular those referred to in paragraphs 12 and 18 thereof, concerning the requirements for clarity and precision (Questions 2 and 3);", "paragraph_id": "para_763" }, { "text": "–", "paragraph_id": "para_764" }, { "text": "Article 3(4) of the said directive and Annex I thereto, in that the system of generalised collection, transfer and processing of PNR data established by those provisions may apply to any person on a flight covered by the provisions of that directive (Question 4), and", "paragraph_id": "para_765" }, { "text": "–", "paragraph_id": "para_766" }, { "text": "Article 6 of the PNR Directive in that it provides for advance assessment, by comparing PNR data against databases and/or processing them against pre-determined criteria, which applies to such data in a systematic and generalised manner, regardless of whether there is any objective ground for considering that the passengers concerned may present a risk to public security (Question 6).", "paragraph_id": "para_767" }, { "text": "86", "paragraph_id": "para_768" }, { "text": "It should be noted as a preliminary point that, in accordance with a general principle of interpretation, an EU act must be interpreted, as far as possible, in such a way as not to affect its validity and in conformity with primary law as a whole and, in particular, with the provisions of the Charte …", "paragraph_id": "para_769" }, { "text": "87", "paragraph_id": "para_770" }, { "text": "In addition, it is settled case-law that, when a directive allows the Member States discretion to define transposition measures adapted to the various situations possible, they must, when implementing those measures, not only interpret their national law in a manner consistent with the directive in …", "paragraph_id": "para_771" }, { "text": "88", "paragraph_id": "para_772" }, { "text": "As regards the PNR Directive, it should be noted that recitals 15, 20, 22, 25, 36 and 37 thereof stress the importance that the EU legislature, by referring to the high level of data protection, gives to the full respect for fundamental rights enshrined in Articles 7, 8 and 21 of the Charter as well as the principle of proportionality, with the result that, as stated in recital 36, that directive ‘should … be implemented accordingly’.", "paragraph_id": "para_773" }, { "text": "89", "paragraph_id": "para_774" }, { "text": "In particular, recital 22 of the PNR Directive points out that, ‘[by] taking fully into consideration the principles outlined in recent relevant case-law of the [Court], the application of th[at] Directive should ensure full respect for fundamental rights, for the right to privacy and for the princi …", "paragraph_id": "para_775" }, { "text": "90", "paragraph_id": "para_776" }, { "text": "Moreover, under Article 19(2) of the PNR Directive, the Commission, when reviewing the directive, must pay special attention to ‘compliance with the applicable standards of protection of personal data’, ‘the necessity and proportionality of collecting and processing PNR data for each of the purposes set out in this Directive’ and ‘the length of the data retention period’.", "paragraph_id": "para_777" }, { "text": "91", "paragraph_id": "para_778" }, { "text": "It is therefore appropriate to determine whether the PNR Directive, in accordance with, in particular, the requirements set out in its recitals and its provisions referred to in paragraphs 88 to 90 above, may be interpreted in a way that ensures full respect for the fundamental rights guaranteed in Articles 7 and 8 of the Charter as well as the principle of proportionality enshrined in Article 52(1) thereof.", "paragraph_id": "para_779" }, { "text": "1.\n  \n Interferences with the fundamental rights guaranteed in Articles 7 and 8 of the Charter resulting from the PNR Directive", "paragraph_id": "para_780" }, { "text": "92", "paragraph_id": "para_781" }, { "text": "Article 7 of the Charter guarantees everyone the right to respect for his or her private and family life, home and communications, while Article 8(1) of the Charter expressly confers on everyone the right to the protection of personal data concerning him or her.", "paragraph_id": "para_782" }, { "text": "93", "paragraph_id": "para_783" }, { "text": "As is apparent from Article 3(5) of the PNR Directive and the list in Annex I thereto, the PNR data covered by that directive include, inter alia, besides the name(s) of the air passenger(s), information necessary to the reservation, such as the dates of intended travel and the travel itinerary, inf …", "paragraph_id": "para_784" }, { "text": "94", "paragraph_id": "para_785" }, { "text": "Since the PNR data therefore include information on identified individuals, namely the air passengers concerned, the various forms of processing to which those data may be subject affect the fundamental right to respect for private life, guaranteed in Article 7 of the Charter (see, to that effect, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592 , paragraphs  121 and  122 and the case-law cited).", "paragraph_id": "para_786" }, { "text": "95", "paragraph_id": "para_787" }, { "text": "Furthermore, the processing of PNR data such as that covered by the PNR Directive also falls within the scope of Article 8 of the Charter because it constitutes the processing of personal data within the meaning of that article and, accordingly, must necessarily satisfy the data protection requirements laid down in that article (see, to that effect, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592 , paragraph  123 and the case-law cited).", "paragraph_id": "para_788" }, { "text": "96", "paragraph_id": "para_789" }, { "text": "It is settled case-law that the communication of personal data to a third party, such as a public authority, constitutes an interference with the fundamental rights enshrined Articles 7 and 8 of the Charter, whatever the subsequent use of the information communicated. The same is true of the retenti …", "paragraph_id": "para_790" }, { "text": "97", "paragraph_id": "para_791" }, { "text": "Thus, both the transfer of PNR data by air carriers to the PIU of the Member State concerned, provided for in Article 1(1)(a) of the PNR Directive, read in conjunction with Article 8 thereof, and the framework of conditions governing the retention of those data, their use and any further transfer to …", "paragraph_id": "para_792" }, { "text": "98", "paragraph_id": "para_793" }, { "text": "As regards the seriousness of those interferences, it should be noted, first, that according to Article 1(1)(a), read in conjunction with Article 8 thereof, the PNR Directive provides for the systematic and continuous transfer to the PIUs of PNR data relating to any air passenger on an extra-EU flig …", "paragraph_id": "para_794" }, { "text": "99", "paragraph_id": "para_795" }, { "text": "Secondly, Article 2 of the PNR Directive provides, in paragraph 1 thereof, that Member States may decide to apply the directive to intra-EU flights within the meaning of Article 3(3) thereof, and specifies, in paragraph 2 thereof, that in that case all the provisions of the said directive ‘shall apply to intra-EU flights as if they were extra-EU flights and to PNR data from intra-EU flights as if they were PNR data from extra-EU flights’.", "paragraph_id": "para_796" }, { "text": "100", "paragraph_id": "para_797" }, { "text": "Thirdly, even if some of the PNR data listed on Annex I to the PNR Directive, as summarised in paragraph 93 above, taken in isolation, do not appear to be liable to reveal precise information about the private life of the persons concerned, the fact remains that, taken as a whole, the data may, inte …", "paragraph_id": "para_798" }, { "text": "101", "paragraph_id": "para_799" }, { "text": "Fourthly, under Article 6(2)(a) and (b) of the PNR Directive, the data transferred by air carriers are intended for advance assessment, prior to the passengers’ scheduled arrival or departure, as well as subsequent assessment.", "paragraph_id": "para_800" }, { "text": "102", "paragraph_id": "para_801" }, { "text": "As regards advance assessment, it is apparent from Article 6(2)(a) and (3) of the PNR Directive that that assessment is carried out by the PIUs of the Member States, systematically and by automated means, that is to say continuously and regardless of whether there is any indication that there is a r …", "paragraph_id": "para_802" }, { "text": "103", "paragraph_id": "para_803" }, { "text": "Against this background, it should be borne in mind that the Court has already held that the extent of the interference which automated analyses of PNR data entail in respect of the rights enshrined in Articles 7 and 8 of the Charter essentially depends on the pre-determined models and criteria and on the databases on which that type of data processing is based (Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592 , paragraph  172 ).", "paragraph_id": "para_804" }, { "text": "104", "paragraph_id": "para_805" }, { "text": "As noted by the Advocate General in point 78 of his Opinion, the processing operation provided for in Article 6(3)(a) of the PNR Directive, namely the comparison of PNR data against ‘relevant databases’, may provide additional information on the private lives of air passengers and may allow very precise conclusions to be drawn in that regard.", "paragraph_id": "para_806" }, { "text": "105", "paragraph_id": "para_807" }, { "text": "As to the processing of PNR data against ‘pre-determined criteria’ provided for in Article 6(3)(b) of the PNR Directive, it is true that Article 6(4) of that directive requires that any assessment of passengers by those means must be carried out in a non-discriminatory manner and, in particular, should not be based on a series of characteristics referred to in the last sentence of that paragraph 4. In addition, the criteria used must be targeted, proportionate and specific.", "paragraph_id": "para_808" }, { "text": "106", "paragraph_id": "para_809" }, { "text": "That being said, the Court has already held that, since automated analyses of PNR data are carried out on the basis of unverified personal data and are based on pre-determined models and criteria, they necessarily present some margin of error (see, by analogy, Opinion 1/15 (EU-Canada PNR Agreement) …", "paragraph_id": "para_810" }, { "text": "107", "paragraph_id": "para_811" }, { "text": "As regards the subsequent assessment of PNR data provided for in Article 6(2)(b) of the PNR Directive, it is apparent from that provision that, during the period of six months after the transfer of the PNR data, referred to in Article 12(2) of that directive, the PIU is required, upon request from the competent authorities, to provide them with the PNR data and process those data in specific cases, for the purposes of combating terrorist offences and serious crime.", "paragraph_id": "para_812" }, { "text": "108", "paragraph_id": "para_813" }, { "text": "In addition, even if, upon expiry of that period of six months, PNR data are depersonalised through masking out of certain data elements, the PIU may be required, pursuant to Article 12(3) of the PNR Directive, to disclose, following such a request, full PNR data in a form which permits the identifi …", "paragraph_id": "para_814" }, { "text": "109", "paragraph_id": "para_815" }, { "text": "Fifthly, by providing, in Article 12(1) thereof, without providing further details in that regard, that PNR data are to be retained in a database for a period of five years following their transfer to the PIU of the Member State on the territory of which the flight is landing or departing, the PNR D …", "paragraph_id": "para_816" }, { "text": "110", "paragraph_id": "para_817" }, { "text": "Given how common use of air transport services is, the effect of a retention period that long is that a very large part of the population of the European Union is liable to have its PNR data retained, repeatedly, under the system established by the PNR Directive and, accordingly, be accessible for a …", "paragraph_id": "para_818" }, { "text": "111", "paragraph_id": "para_819" }, { "text": "In the light of all of the foregoing, it is appropriate to find that the PNR Directive entails undeniably serious interferences with the rights guaranteed in Articles 7 and 8 of the Charter, in so far, inter alia, as it seeks to introduce a surveillance regime that is continuous, untargeted and systematic, including the automated assessment of the personal data of everyone using air transport services.", "paragraph_id": "para_820" }, { "text": "2.\n  \n Justification for the interferences resulting from the PNR Directive", "paragraph_id": "para_821" }, { "text": "112", "paragraph_id": "para_822" }, { "text": "It must be borne in mind that the fundamental rights enshrined in Articles 7 and 8 of the Charter are not absolute rights, but must be considered in relation to their function in society (Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592 , paragraph  136 and the case-law cited, and judgment of 6 October 2020, Privacy International, C‑623/17 , EU:C:2020:790 , paragraph  63 and the case-law cited).", "paragraph_id": "para_823" }, { "text": "113", "paragraph_id": "para_824" }, { "text": "Under the first sentence of Article 52(1) of the Charter, any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and respect the essence of those rights and freedoms. Under the second sentence of Article 52(1) of the Charter, subject to the pr …", "paragraph_id": "para_825" }, { "text": "114", "paragraph_id": "para_826" }, { "text": "It should be added that the requirement that any limitation on the exercise of fundamental rights must be provided for by law implies that the act which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned, bearing in mind, …", "paragraph_id": "para_827" }, { "text": "115", "paragraph_id": "para_828" }, { "text": "As regards observance of the principle of proportionality, the protection of the fundamental right to respect for private life at EU level requires, in accordance with settled case-law of the Court, that derogations from and limitations on the protection of personal data should apply only in so far …", "paragraph_id": "para_829" }, { "text": "116", "paragraph_id": "para_830" }, { "text": "More specifically, the question whether the Member States may justify a limitation on the rights guaranteed in Articles 7 and 8 of the Charter must be assessed by measuring the seriousness of the interference which such a limitation entails and by verifying that the importance of the objective of ge …", "paragraph_id": "para_831" }, { "text": "117", "paragraph_id": "para_832" }, { "text": "In order to satisfy the proportionality requirement, the legislation in question entailing the interference must lay down clear and precise rules governing the scope and application of the measures provided for and imposing minimum safeguards, so that the persons whose data have been transferred hav …", "paragraph_id": "para_833" }, { "text": "118", "paragraph_id": "para_834" }, { "text": "Thus, legislation that provides for the retention of personal data must continue to satisfy objective criteria that establish a connection between the data to be retained and the objective pursued (see, to that effect, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592 , paragraph …", "paragraph_id": "para_835" }, { "text": "(a)\n  \n Observance of the principle of legality and respect for the essence of the fundamental rights in question", "paragraph_id": "para_836" }, { "text": "119", "paragraph_id": "para_837" }, { "text": "Provision is made in an EU legislative act for the limitation of the exercise of the fundamental rights guaranteed in Articles 7 and 8 of the Charter stemming from the system established by the PNR Directive. As to the question whether, in accordance with the case-law referred to in paragraph 114 ab …", "paragraph_id": "para_838" }, { "text": "120", "paragraph_id": "para_839" }, { "text": "As regards respect for the essence of the fundamental rights enshrined in Articles 7 and 8 of the Charter, it is true that PNR data may, in some circumstances, reveal very specific information on the private life of a person. However, in so far as, on the one hand, the nature of that information is …", "paragraph_id": "para_840" }, { "text": "(b)\n  \n Objective of general interest and appropriateness of the processing of PNR data having regard to that objective", "paragraph_id": "para_841" }, { "text": "121", "paragraph_id": "para_842" }, { "text": "As to the question whether the system established by the PNR Directive pursues an objective of general interest, it is apparent from recitals 5, 6 and 15 of that directive that the objectives thereof are to ensure the internal security of the European Union and thus protect the life and safety of pe …", "paragraph_id": "para_843" }, { "text": "122", "paragraph_id": "para_844" }, { "text": "To that end, Article 1(2) of the PNR Directive provides that PNR data collected in accordance with that directive may be subject to the processing operations referred to in Article 6(2)(a) to (c) thereof only for the purposes of preventing, detecting, investigating and prosecuting terrorist offences …", "paragraph_id": "para_845" }, { "text": "123", "paragraph_id": "para_846" }, { "text": "As to the whether the system established by the PNR Directive is appropriate for the purpose of attaining the objectives pursued, it should be noted that while the possibility of ‘false negatives’ and the fairly substantial number of ‘false positives’ resulting, as noted in paragraph 106 above, from …", "paragraph_id": "para_847" }, { "text": "124", "paragraph_id": "para_848" }, { "text": "In addition, having regard to the margin of error inherent in the automated processing of PNR data and, in particular, the fairly substantial number of ‘false positives’, the appropriateness of the system established by the PNR Directive essentially depends on the proper functioning of the subsequen …", "paragraph_id": "para_849" }, { "text": "(c)\n  \n Whether the interferences from the PNR Directive are necessary", "paragraph_id": "para_850" }, { "text": "125", "paragraph_id": "para_851" }, { "text": "According to the case-law recalled in paragraphs 115 to 118 above, it must be determined whether the interferences resulting from the PNR Directive are limited to what is strictly necessary and, inter alia, whether that directive lays down clear and precise rules governing the scope and application …", "paragraph_id": "para_852" }, { "text": "(1)   Air passenger data covered by the PNR Directive", "paragraph_id": "para_853" }, { "text": "126", "paragraph_id": "para_854" }, { "text": "It is necessary to assess whether the data headings in Annex I to the PNR Directive define in a clear and precise manner the PNR data which air carriers are required to provide to the PIU.", "paragraph_id": "para_855" }, { "text": "127", "paragraph_id": "para_856" }, { "text": "As a preliminary point, it must be recalled that, as is apparent from recital 15 of the PNR Directive, the EU legislature intended for the list of the PNR data to be obtained by a PIU to be drawn up ‘with the objective of reflecting the legitimate requirements of public authorities to prevent, detec …", "paragraph_id": "para_857" }, { "text": "128", "paragraph_id": "para_858" }, { "text": "Consequently, PNR data collected and provided in accordance with Annex I to the PNR Directive must relate directly to the flight operated and the passenger concerned and must be limited in such a way as to, on the one hand, meet solely the legitimate requirements of public authorities to prevent, detect, investigate and prosecute terrorist offences or serious crime and, on the other, exclude sensitive data.", "paragraph_id": "para_859" }, { "text": "129", "paragraph_id": "para_860" }, { "text": "Headings 1 to 4, 7, 9, 11, 15, 17 and 19 of Annex I to the PNR Directive meet those requirements as well as those of clarity and precision, in that they concern clearly identifiable and circumscribed information directly related to the flight operated and the passenger concerned. As noted by the Advocate General in point 165 of his Opinion, the same is true of headings 10, 13, 14 and 16, despite their ‘open-ended’ wording.", "paragraph_id": "para_861" }, { "text": "130", "paragraph_id": "para_862" }, { "text": "However, clarifications are needed for the purposes of interpreting headings 5, 6, 8, 12 and 18.", "paragraph_id": "para_863" }, { "text": "131", "paragraph_id": "para_864" }, { "text": "Heading 5, entitled ‘address and contact information (telephone number, email address)’, does not expressly specify whether the said address and contact information refer to the air passenger alone or also cover third parties who made the flight reservation for the air passenger, third parties throu …", "paragraph_id": "para_865" }, { "text": "132", "paragraph_id": "para_866" }, { "text": "As to heading 6, which relates to ‘all forms of payment information, including billing address’, that heading, in order to meet the requirements of clarity and precision, must be interpreted as covering solely information relating to the payment methods for, and billing of, the air ticket, to the exclusion of any other information not directly relating to the flight (see, by analogy, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592 , paragraph  159 ).", "paragraph_id": "para_867" }, { "text": "133", "paragraph_id": "para_868" }, { "text": "Heading 8, which relates to ‘frequent flyer information’, must be interpreted, as noted by the Advocate General in point 164 of his Opinion, as referring exclusively to data relating to the status of the passenger concerned in the context of a customer loyalty programme of a given airline or a given …", "paragraph_id": "para_869" }, { "text": "134", "paragraph_id": "para_870" }, { "text": "Heading 12 concerns ‘general remarks (including all available information on unaccompanied minors under 18 years, such as name and gender of the minor, age, language(s) spoken, name and contact details of guardian on departure and relationship to the minor, name and contact details of guardian on arrival and relationship to the minor, departure and arrival agent)’.", "paragraph_id": "para_871" }, { "text": "135", "paragraph_id": "para_872" }, { "text": "In that regard, it must be noted from the outset that whereas the phrase ‘general remarks’ does not meet the requirements of clarity and precision in that it does not set, as such, any limitation on the nature and scope of the information that may be collected and provided to a PIU under heading 12 (see, to that effect, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592 , paragraph  160 ), the list in brackets does.", "paragraph_id": "para_873" }, { "text": "136", "paragraph_id": "para_874" }, { "text": "Consequently, in order to interpret heading 12, in accordance with the case-law recalled in paragraph 86 above, in a manner that complies with the requirements of clarity and precision and, more generally, with Articles 7 and 8 as well as Article 52(1) of the Charter, it is appropriate to consider t …", "paragraph_id": "para_875" }, { "text": "137", "paragraph_id": "para_876" }, { "text": "Lastly, heading 18 refers to ‘any advance passenger information (API) data collected (including the type, number, country of issuance and expiry date of any identity document, nationality, family name, given name, gender, date of birth, airline, flight number, departure date, arrival date, departure port, arrival port, departure time and arrival time)’.", "paragraph_id": "para_877" }, { "text": "138", "paragraph_id": "para_878" }, { "text": "As noted, in essence, by the Advocate General, in points 156 to 160 of his Opinion, it is apparent from that heading 18, read in the light of recitals 4 and 9 of the PNR Directive, that the information to which it refers is exhaustively the API data listed in the said heading as well as in Article 3(2) of the API Directive.", "paragraph_id": "para_879" }, { "text": "139", "paragraph_id": "para_880" }, { "text": "Thus heading 18, in so far as it is construed as covering only the information expressly referred to in that heading and in Article 3(2) of the API Directive, may be regarded as meeting the requirements of clarity and precision (see, by analogy, Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592 , paragraph  161 ).", "paragraph_id": "para_881" }, { "text": "140", "paragraph_id": "para_882" }, { "text": "Accordingly, it must be held that, interpreted in accordance with the considerations set out inter alia in paragraphs 130 to 139 above, Annex I to the PNR Directive is of a sufficiently clear and precise nature overall, thus defining the scope of the interferences with the fundamental rights enshrined in Articles 7 and 8 of the Charter.", "paragraph_id": "para_883" }, { "text": "(2)   The purposes for which PNR data may be processed", "paragraph_id": "para_884" }, { "text": "141", "paragraph_id": "para_885" }, { "text": "As is apparent from Article 1(2) of the PNR Directive, the PNR data collected in accordance with that directive are to be processed for the purposes of combating ‘terrorist offences’ and ‘serious crime’.", "paragraph_id": "para_886" }, { "text": "142", "paragraph_id": "para_887" }, { "text": "As to whether the PNR Directive provides, in that context, for clear and precise rules that limit the application of the system established by that directive to what is strictly necessary for those purposes, it should be borne in mind, first, that the phrase ‘terrorist offences’ is defined in Article 3(8) of the said directive by reference to the ‘offences under national law referred to in Articles 1 to 4 of Framework Decision [2002/475]’.", "paragraph_id": "para_888" }, { "text": "143", "paragraph_id": "para_889" }, { "text": "In addition to the fact that that framework decision, in Articles 1 to 3 thereof, defined in a clear and precise manner ‘terrorist offences’, ‘offences related to a terrorist group’ and ‘offences related to terrorist activities’, which Member States had to ensure were made punishable as criminal offences under that framework decision, Directive 2017/541, in Articles 3 to 14 thereof, also defines those same offences in a clear and precise manner.", "paragraph_id": "para_890" }, { "text": "144", "paragraph_id": "para_891" }, { "text": "Secondly, Article 3(9) of the PNR Directive defines ‘serious crime’ by reference to the ‘offences listed in Annex II [to that directive] that are punishable by a custodial sentence or a detention order for a maximum period of at least three years under the national law of a Member State’.", "paragraph_id": "para_892" }, { "text": "145", "paragraph_id": "para_893" }, { "text": "However, first of all, that annex lists exhaustively the different categories of offences that might be covered by the notion of ‘serious crime’ referred to in Article 3(9) of the PNR Directive.", "paragraph_id": "para_894" }, { "text": "146", "paragraph_id": "para_895" }, { "text": "Next, having regard to the particular features, at the time that directive was adopted, of the criminal justice systems of the Member States in the absence of harmonisation of the offences thus referred to, it was possible for the EU legislature merely to refer to categories of offences without defi …", "paragraph_id": "para_896" }, { "text": "147", "paragraph_id": "para_897" }, { "text": "It is true that paragraphs 7, 8, 10 and 16 of Annex II relate to categories of offences that are very general (fraud, laundering of the proceeds of crime and counterfeiting of currency, environmental crime, illicit trafficking in cultural goods) while nonetheless referring to specific offences falli …", "paragraph_id": "para_898" }, { "text": "148", "paragraph_id": "para_899" }, { "text": "Lastly, it is important also to bear in mind that, although, in accordance with the principle of proportionality, the objective of combating serious crime is capable of justifying the serious interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter which the PNR Directi …", "paragraph_id": "para_900" }, { "text": "149", "paragraph_id": "para_901" }, { "text": "In that regard, as noted by the Advocate General in point 121 of his Opinion, many of the offences listed in Annex II to the PNR Directive – such as human trafficking, the sexual exploitation of children and child pornography, illicit trafficking in weapons munitions and explosives, money laundering …", "paragraph_id": "para_902" }, { "text": "150", "paragraph_id": "para_903" }, { "text": "In addition, although other offences, also referred to in that Annex II, are less likely, a priori, to be associated with serious crime, it is nevertheless apparent from Article 3(9) of the PNR Directive that those offences may be considered to amount to serious crime only if they are punishable by …", "paragraph_id": "para_904" }, { "text": "151", "paragraph_id": "para_905" }, { "text": "Nonetheless, since Article 3(9) of the PNR Directive refers to the maximum rather than the minimum penalty applicable, it cannot be ruled out that PNR data may be processed for the purposes of combating offences which, although meeting the criterion laid down by that provision relating to the threshold of severity, amount to ordinary crime rather than serious crime, having regard to the particular features of the domestic criminal justice system.", "paragraph_id": "para_906" }, { "text": "152", "paragraph_id": "para_907" }, { "text": "It is thus for the Member States to ensure that the application of the system established by the PNR Directive is effectively limited to combating serious crime and that that system does not extend to offences that amount to ordinary crime.", "paragraph_id": "para_908" }, { "text": "(3)   The link between PNR data and the purposes for which those data are processed", "paragraph_id": "para_909" }, { "text": "153", "paragraph_id": "para_910" }, { "text": "It is true that, as noted, in essence, by the Advocate General in point 119 of his Opinion, the wording of Article 3(8) and Article 3(9) of the PNR Directive, read in conjunction with Annex II thereto, does not expressly refer to a criterion that is capable of confining the scope of that directive s …", "paragraph_id": "para_911" }, { "text": "154", "paragraph_id": "para_912" }, { "text": "Nevertheless, as pointed out by the Advocate General in point 121 of his Opinion, certain offences listed in Annex II to the PNR Directive, such as human trafficking, illicit trafficking in narcotic drugs or weapons, facilitation of unauthorised entry and residence and the unlawful seizure of aircra …", "paragraph_id": "para_913" }, { "text": "155", "paragraph_id": "para_914" }, { "text": "Against that background, it must also be borne in mind that the Commission provided reasons for its Proposal for a Directive of the European Parliament and of the Council on the use of Passenger Name Record data for the prevention, detection, investigation and prosecution of terrorist offences and s …", "paragraph_id": "para_915" }, { "text": "156", "paragraph_id": "para_916" }, { "text": "In addition, it is important to note that even offences that have no such direct link with the carriage of passengers by air may, depending on the circumstances of the case, have an indirect link with the carriage of passengers by air. Such is the case, in particular, when air transport is used as a …", "paragraph_id": "para_917" }, { "text": "157", "paragraph_id": "para_918" }, { "text": "In those circumstances, Article 3(8) and (9) of that directive, read in conjunction with Annex II thereto and in the light of the requirements stemming from Articles 7 and 8 as well as Article 52(1) of the Charter, requires Member States, in particular upon individual review by non-automated means a …", "paragraph_id": "para_919" }, { "text": "(4)   The air passengers and flights concerned", "paragraph_id": "para_920" }, { "text": "158", "paragraph_id": "para_921" }, { "text": "The system established by the PNR Directive covers the PNR data of anyone who meets the definition of ‘passenger’ within the meaning of Article 3(4) of that directive on a flight falling within the scope thereof.", "paragraph_id": "para_922" }, { "text": "159", "paragraph_id": "para_923" }, { "text": "According to Article 8(1) of the said directive, those data are transferred to the PIU of the Member State on the territory of which the flight will land or from the territory of which the flight will depart, regardless of whether there is any objective material from which it may be inferred that th …", "paragraph_id": "para_924" }, { "text": "160", "paragraph_id": "para_925" }, { "text": "Specifically, it is apparent from Article 1(1)(a) and Article 2 of the PNR Directive that the latter distinguishes between passengers of extra-EU flights, operated between the European Union and third countries, and those of intra-EU flights, operated between different Member States.", "paragraph_id": "para_926" }, { "text": "161", "paragraph_id": "para_927" }, { "text": "As regards passengers of extra-EU flights, it must be recalled that, in respect of passengers flying between the European Union and Canada, the Court has already held that the automated processing of their PNR data, before their arrival in Canada, facilitates and expedites security checks, in partic …", "paragraph_id": "para_928" }, { "text": "162", "paragraph_id": "para_929" }, { "text": "Those considerations can be applied mutatis mutandis to the situation of passengers flying between the European Union and all third countries, whom Member States are required to subject to the system established by the PNR Directive pursuant to Article 1(1)(a) of that directive, read in conjunction …", "paragraph_id": "para_930" }, { "text": "163", "paragraph_id": "para_931" }, { "text": "As regards passengers flying between different Member States of the European Union, Article 2(1) of the PNR Directive, read in conjunction with recital 10 thereof, provides only that Member States may extend the application of the system established by that directive to intra-EU flights.", "paragraph_id": "para_932" }, { "text": "164", "paragraph_id": "para_933" }, { "text": "Thus, the EU legislature did not intend to oblige Member States to extend the application of the system established by the PNR Directive to intra-EU flights but, as is apparent from Article 19(3) of that directive, reserved its decision concerning such an extension, while taking the view that it should be preceded by a detailed assessment of the legal implications thereof, in particular for the fundamental rights of the data subjects.", "paragraph_id": "para_934" }, { "text": "165", "paragraph_id": "para_935" }, { "text": "In that regard, it should be noted that, by stating that the Commission’s review report referred to in Article 19(1) of the PNR Directive must ‘also include a review of the necessity, proportionality, and effectiveness of including within the scope of th[at] Directive the mandatory collection and tr …", "paragraph_id": "para_936" }, { "text": "166", "paragraph_id": "para_937" }, { "text": "In a similar vein, Article 2(3) of the PNR Directive provides that Member States may decide to apply that directive only to selected intra-EU flights when they consider it necessary in order to pursue the objectives of the said directive, while being able to change the selected flights at any time.", "paragraph_id": "para_938" }, { "text": "167", "paragraph_id": "para_939" }, { "text": "In any event, the Member States’ power to extend the application of the system established by the PNR Directive to intra-EU flights is to be exercised, as is apparent from recital 22 thereof, in full respect for the fundamental rights guaranteed in Articles 7 and 8 of the Charter. In that regard, wh …", "paragraph_id": "para_940" }, { "text": "168", "paragraph_id": "para_941" }, { "text": "In those circumstances, a Member State, when it wishes to exercise the power provided for in Article 2 of the PNR Directive, either for all intra-EU flights under paragraph 2 of that article or only for such selected flights under paragraph 3 of the said article, is not exempt from the requirement t …", "paragraph_id": "para_942" }, { "text": "169", "paragraph_id": "para_943" }, { "text": "Thus, given recitals 5 to 7, 10 and 22 of the PNR Directive, the Member State must verify that the processing, under that directive, of the PNR data of passengers of intra-EU flights or selected such flights is strictly necessary, having regard to the seriousness of the interference with the fundame …", "paragraph_id": "para_944" }, { "text": "170", "paragraph_id": "para_945" }, { "text": "As regards, in particular, the threats related to terrorist offences, it is apparent from the Court’s case-law that terrorist activities are amongst those capable of seriously destabilising the fundamental constitutional, political, economic or social structures of a country and, particularly, of di …", "paragraph_id": "para_946" }, { "text": "171", "paragraph_id": "para_947" }, { "text": "Thus, in a situation where it is established, on the basis of the assessment carried out by a Member State, that there are sufficiently solid grounds for considering that the latter is confronted with a terrorist threat which is shown to be genuine and present or foreseeable, the fact that that Memb …", "paragraph_id": "para_948" }, { "text": "172", "paragraph_id": "para_949" }, { "text": "The decision providing for that application must be open to effective review, either by a court or by an independent administrative body whose decision is binding, in order to verify that that situation exists and that the conditions and safeguards which must be laid down are observed. The period of …", "paragraph_id": "para_950" }, { "text": "173", "paragraph_id": "para_951" }, { "text": "By contrast, in the absence of a genuine and present or foreseeable terrorist threat with which the Member State concerned is confronted, the indiscriminate application by that Member State of the system established by the PNR Directive not only to extra-EU flights but also to all intra-EU flights would not be considered to be limited to what is strictly necessary.", "paragraph_id": "para_952" }, { "text": "174", "paragraph_id": "para_953" }, { "text": "In such a situation, the application of the system established by the PNR Directive to selected intra-EU flights must be limited to the transfer and processing of the PNR data of flights relating, inter alia, to certain routes or travel patterns or to certain airports in respect of which there are i …", "paragraph_id": "para_954" }, { "text": "175", "paragraph_id": "para_955" }, { "text": "It follows from the foregoing that the interpretation, thus followed, of Article 2 and Article 3(4) of the PNR Directive, in the light of Articles 7 and 8 as well as Article 52(1) of the Charter, is capable of ensuring that those provisions are within the limits of what is strictly necessary.", "paragraph_id": "para_956" }, { "text": "(5)   Advance assessment of PNR data by automated processing", "paragraph_id": "para_957" }, { "text": "176", "paragraph_id": "para_958" }, { "text": "Under Article 6(2)(a) of the PNR Directive, the objective of the advance assessment provided for therein is to identify persons who require further examination, inter alia by the competent authorities referred to in Article 7 of that directive, in view of the fact that such persons may be involved in a terrorist offence or serious crime.", "paragraph_id": "para_959" }, { "text": "177", "paragraph_id": "para_960" }, { "text": "That advance assessment is carried out in two stages. As a first step, the PIU of the Member State concerned, pursuant to Article 6(3) of the PNR Directive, processes PNR data by automated means by comparing them against databases or pre-determined criteria. As a second step, should that processing …", "paragraph_id": "para_961" }, { "text": "178", "paragraph_id": "para_962" }, { "text": "As recalled in paragraph 106 above, automated processing necessarily presents a fairly substantial margin of error, since it is carried out on the basis of unverified personal data and is based on pre-determined criteria.", "paragraph_id": "para_963" }, { "text": "179", "paragraph_id": "para_964" }, { "text": "In those circumstances, and given the need, highlighted in the fourth recital of the preamble to the Charter, to strengthen the protection of fundamental rights in the light, inter alia, of scientific and technological developments, it must be ensured, as stated in recital 20 and Article 7(6) of the …", "paragraph_id": "para_965" }, { "text": "180", "paragraph_id": "para_966" }, { "text": "As noted, in essence, by the Advocate General in point 207 of his Opinion, the national supervisory authority, the data protection officer and the PIU must be provided with the material and human resources necessary to carry out their review under the PNR Directive. Furthermore, it is important that …", "paragraph_id": "para_967" }, { "text": "181", "paragraph_id": "para_968" }, { "text": "Moreover, it follows from Article 6(9) of the PNR Directive that the consequences of advance assessment under Article 6(2)(a) thereof do not jeopardise the right of entry of persons enjoying the right of free movement within the territory of the Member State concerned as laid down in Directive 2004/ …", "paragraph_id": "para_969" }, { "text": "(i)   Comparing PNR data against databases", "paragraph_id": "para_970" }, { "text": "182", "paragraph_id": "para_971" }, { "text": "Under Article 6(3)(a) of the PNR Directive, the PIU ‘may’, when carrying out the assessment referred to in Article 6(2)(a) of that directive, compare PNR data against ‘[relevant] databases’ for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, ‘including databases on persons or objects sought or under alert, in accordance with [EU], international and national rules applicable to such databases’.", "paragraph_id": "para_972" }, { "text": "183", "paragraph_id": "para_973" }, { "text": "Although it follows from the very wording of that Article 6(3)(a) of the PNR Directive, in particular from the word ‘including’, that the databases on persons or objects sought or under alert are among the ‘relevant databases’ referred to in that provision, that provision does not specify which othe …", "paragraph_id": "para_974" }, { "text": "184", "paragraph_id": "para_975" }, { "text": "In those circumstances, Article 6(3)(a) of the PNR Directive could, prima facie, lend itself to an interpretation according to which PNR data may be used as mere search criteria for the purposes of conducting analyses using various databases, including databases managed and exploited by the security …", "paragraph_id": "para_976" }, { "text": "185", "paragraph_id": "para_977" }, { "text": "Therefore, according to the case-law recalled in paragraphs 86 and 87 above, Article 6(3)(a) of the PNR Directive must be interpreted in such a way as to ensure full respect for the fundamental rights enshrined in Articles 7 and 8 of the Charter.", "paragraph_id": "para_978" }, { "text": "186", "paragraph_id": "para_979" }, { "text": "In that regard, it is apparent from recitals 7 and 15 of the PNR Directive that the automated processing provided for in Article 6(3)(a) of that directive must be limited to what is strictly necessary for the purposes of combating terrorist offences and serious crime, while ensuring a high level of protection of those fundamental rights.", "paragraph_id": "para_980" }, { "text": "187", "paragraph_id": "para_981" }, { "text": "In addition, as observed, in essence, by the Commission in response to a question put by the Court, the wording of that provision, that the PIU ‘may’ compare PNR data against the databases referred to therein, allows the PIU to choose a processing method that is limited to what is strictly necessary …", "paragraph_id": "para_982" }, { "text": "188", "paragraph_id": "para_983" }, { "text": "Accordingly, as noted, in essence, by the Advocate General in point 219 of his Opinion, Article 6(3)(a) of the PNR Directive must, in the light of those fundamental rights, be interpreted as meaning that the latter databases are the only databases against which the PIU may compare PNR data.", "paragraph_id": "para_984" }, { "text": "189", "paragraph_id": "para_985" }, { "text": "As regards the requirements which those databases must satisfy, it is appropriate to note that, under Article 6(4) of the PNR Directive, advance assessment against pre-determined criteria must, pursuant to Article 6(3)(b) of that directive, be carried out in a non-discriminatory manner, those criter …", "paragraph_id": "para_986" }, { "text": "190", "paragraph_id": "para_987" }, { "text": "In that regard, it should be stated that the requirement as to the non-discriminatory nature of those databases implies, inter alia, that entry into the databases on persons sought or under alert is based on objective and non-discriminatory factors, defined in EU, international and national rules applicable to such databases (see, by analogy, judgment of 5 April 2022, Commissioner of An Garda Síochána and Others, C‑140/20 , EU:C:2022:258 , paragraph  78 ).", "paragraph_id": "para_988" }, { "text": "191", "paragraph_id": "para_989" }, { "text": "In addition, in order to satisfy the requirement as to the targeted, proportionate and specific nature of the pre-determined criteria, the databases referred to in paragraph 188 above must be used in relation to the fight against terrorist offences and serious crime having an objective link, even if only an indirect one, with the carriage of passengers by air.", "paragraph_id": "para_990" }, { "text": "192", "paragraph_id": "para_991" }, { "text": "Moreover, the databases used pursuant to Article 6(3)(a) of the PNR Directive must, in view of the considerations set out in paragraphs 183 and 184 above, be managed by the competent authorities referred to in Article 7 of that directive or, with regard to EU databases as well as international datab …", "paragraph_id": "para_992" }, { "text": "(ii)   Processing PNR data against pre-determined criteria", "paragraph_id": "para_993" }, { "text": "193", "paragraph_id": "para_994" }, { "text": "Article 6(3)(b) of the PNR Directive provides that the PIU may also process PNR data against pre-determined criteria. As is apparent from Article 6(2)(a) of that directive, the advance assessment and, accordingly, the processing of PNR data against pre-determined criteria is intended, in essence, to identify persons who may be involved in a terrorist offence or serious crime.", "paragraph_id": "para_995" }, { "text": "194", "paragraph_id": "para_996" }, { "text": "As regards the criteria that the PIU may use to that end, it should be noted, first, that according to the very wording of Article 6(3)(b) of the PNR Directive those must be ‘pre-determined’ criteria. As noted by the Advocate General in point 228 of his Opinion, that requirement precludes the use of …", "paragraph_id": "para_997" }, { "text": "195", "paragraph_id": "para_998" }, { "text": "It is important to add that use of such technology would be liable to render redundant the individual review of positive matches and monitoring of lawfulness required by the provisions of the PNR Directive. As observed, in essence, by the Advocate General in point 228 of his Opinion, given the opaci …", "paragraph_id": "para_999" }, { "text": "196", "paragraph_id": "para_1000" }, { "text": "Concerning, next, the requirements flowing from Article 6(4) of the PNR Directive, that provision states, in its first sentence, that any advance assessment against pre-determined criteria is to be carried out in a non-discriminatory manner and indicates, in its fourth sentence, that those criteria …", "paragraph_id": "para_1001" }, { "text": "197", "paragraph_id": "para_1002" }, { "text": "Thus Member States cannot use, as pre-determined criteria, criteria that are based on the characteristics referred to in the preceding paragraph and use of which may result in discrimination. In that regard, it follows from the wording of the fourth sentence of Article 6(4) of the PNR Directive, acc …", "paragraph_id": "para_1003" }, { "text": "198", "paragraph_id": "para_1004" }, { "text": "As to the requirements relating to the targeted, proportionate and specific nature of pre-determined criteria, referred to in the second sentence of Article 6(4) of the PNR Directive, it follows from those requirements that the criteria used for the purposes of advance assessment must be determined …", "paragraph_id": "para_1005" }, { "text": "199", "paragraph_id": "para_1006" }, { "text": "In order to target in that way the persons thus referred to and given the risk of discrimination that criteria based on the characteristics set out in the fourth sentence of Article 6(4) of the PNR Directive entail, the PIU and the competent authorities cannot, generally, rely on those characteristi …", "paragraph_id": "para_1007" }, { "text": "200", "paragraph_id": "para_1008" }, { "text": "In that context, as noted by the Commission in response to a question put by the Court, pre-determined criteria must be defined in such a way as to take into consideration both ‘incriminating’ as well as ‘exonerating’ circumstances, since that requirement may contribute to the reliability of those criteria and, in particular, ensure that they are proportionate, as required by the second sentence Article 6(4) of the PNR Directive.", "paragraph_id": "para_1009" }, { "text": "201", "paragraph_id": "para_1010" }, { "text": "Lastly, the third sentence of Article 6(4) of that directive provides that pre-determined criteria must be reviewed regularly. In the context of that review, those criteria must be updated in accordance with changes in the circumstances that justified their being taken into consideration for the pur …", "paragraph_id": "para_1011" }, { "text": "(iii)   Safeguards surrounding the automated processing of PNR data", "paragraph_id": "para_1012" }, { "text": "202", "paragraph_id": "para_1013" }, { "text": "Compliance with the requirements to which the automated processing of PNR data is subject under Article 6(4) of the PNR Directive is required not only when determining and reviewing the databases as well as the pre-determined criteria provided for in that provision, but also, as noted by the Advocate General in point 230 of his Opinion, throughout the process of processing those data.", "paragraph_id": "para_1014" }, { "text": "203", "paragraph_id": "para_1015" }, { "text": "As regards pre-determined criteria specifically, it is appropriate, first of all, to specify that, although the PIU, as stated in recital 7 of the PNR Directive, must define the assessment criteria in a manner which keeps to a minimum the number of innocent people wrongly identified by the system es …", "paragraph_id": "para_1016" }, { "text": "204", "paragraph_id": "para_1017" }, { "text": "Thus, the PIU must refrain from transferring the results of those automated processing operations to the competent authorities referred to Article 7 of the PNR Directive when, having regard to the considerations set out in paragraph 198 above, they do not, following that review, have anything capabl …", "paragraph_id": "para_1018" }, { "text": "205", "paragraph_id": "para_1019" }, { "text": "As regards the verifications which the PIU must carry out to that end, it follows from Article 6(5) and (6) of the PNR Directive, read in conjunction with recitals 20 and 22 thereof, that Member States must lay down clear and precise rules capable of providing guidance and support for the analysis c …", "paragraph_id": "para_1020" }, { "text": "206", "paragraph_id": "para_1021" }, { "text": "In particular, given the fairly substantial number of ‘false positives’, mentioned in paragraph 106 above, Member States must ensure that the PIU establishes, in a clear and precise manner, objective review criteria enabling its agents to verify, on the one hand, whether and to what extent a positiv …", "paragraph_id": "para_1022" }, { "text": "207", "paragraph_id": "para_1023" }, { "text": "In that context, Member States are required to ensure that, in accordance with Article 13(5) of the PNR Directive, read in conjunction with recital 37 thereof, the PIUs maintain documentation relating to all processing of PNR data carried out in connection with the advance assessment, including in the context of the individual review by non-automated means, for the purpose of verifying its lawfulness and for the purpose of self-monitoring.", "paragraph_id": "para_1024" }, { "text": "208", "paragraph_id": "para_1025" }, { "text": "Next, the competent authorities, pursuant to the first sentence of Article 7(6) of the PNR Directive, cannot take any decision that produces an adverse legal effect on a person or significantly affects a person only by reason of the automated processing of PNR data, which means, in connection with t …", "paragraph_id": "para_1026" }, { "text": "209", "paragraph_id": "para_1027" }, { "text": "In that context, the competent authorities must ensure the lawfulness of the automated processing, in particular its non-discriminatory nature, as well as that of the individual review.", "paragraph_id": "para_1028" }, { "text": "210", "paragraph_id": "para_1029" }, { "text": "In particular, the competent authorities must ensure that the person concerned – without necessarily allowing that person, during the administrative procedure, to become aware of the pre-determined assessment criteria and programs applying those criteria – is able to understand how those criteria an …", "paragraph_id": "para_1030" }, { "text": "211", "paragraph_id": "para_1031" }, { "text": "Lastly, in the context of redress introduced pursuant to Article 13(1) of the PNR Directive, the court responsible for reviewing the legality of the decision adopted by the competent authorities as well as, except in the case of threats to State security, the persons concerned themselves must have h …", "paragraph_id": "para_1032" }, { "text": "212", "paragraph_id": "para_1033" }, { "text": "Moreover, according to Article 6(7) and Article 15(3)(b), respectively, of the PNR Directive, it is for the data protection officer and the national supervisory authority to ensure the monitoring of the lawfulness of the automated processing carried out by the PIU in connection with the advance asse …", "paragraph_id": "para_1034" }, { "text": "213", "paragraph_id": "para_1035" }, { "text": "It follows from all of the foregoing that the provisions of the PNR Directive governing the advance assessment of PNR data under Article 6(2)(a) of that directive lend themselves to an interpretation that is consistent with Articles 7, 8 and 21 of the Charter and comes within the limits of what is strictly necessary.", "paragraph_id": "para_1036" }, { "text": "(6)   The disclosure and subsequent assessment of PNR data", "paragraph_id": "para_1037" }, { "text": "214", "paragraph_id": "para_1038" }, { "text": "According to Article 6(2)(b) of the PNR Directive, PNR data may also, on request of the competent authorities, be provided to the latter and assessed subsequently to the scheduled arrival in or departure from the Member State.", "paragraph_id": "para_1039" }, { "text": "215", "paragraph_id": "para_1040" }, { "text": "As regards the circumstances in which that disclosure and assessment may occur, it is apparent from the wording of that provision that the PIU may process PNR data in order to respond ‘on a case-by-case basis’ to ‘a duly reasoned request based on sufficient grounds’ from the competent authorities to …", "paragraph_id": "para_1041" }, { "text": "216", "paragraph_id": "para_1042" }, { "text": "In that regard, it is apparent, first of all, from the very wording of Article 6(2)(b) of the PNR Directive that the PIU cannot systematically proceed to the subsequent disclosure and assessment of the PNR data of all air passengers and that it can only respond ‘on a case-by-case basis’ to requests …", "paragraph_id": "para_1043" }, { "text": "217", "paragraph_id": "para_1044" }, { "text": "Concerning, next, the substantive conditions required for the PNR data of air passengers to be disclosed and assessed subsequently, although Article 6(2)(b) and Article 12(3)(a) of the PNR Directive use ‘sufficient grounds’ and ‘reasonably’, respectively, without expressly specifying the nature of s …", "paragraph_id": "para_1045" }, { "text": "218", "paragraph_id": "para_1046" }, { "text": "In the context of the system established by the PNR Directive, the disclosure and processing of PNR data under Article 6(2)(b) of that directive concern the data of persons who have already been subject to advance assessment prior to their scheduled arrival in or departure from the Member State conc …", "paragraph_id": "para_1047" }, { "text": "219", "paragraph_id": "para_1048" }, { "text": "As to the nature of the circumstances capable of justifying the disclosure and processing of PNR data for the purposes of their subsequent assessment, it is settled case-law that, since general access to all retained data, regardless of whether there is any, at least indirect, link with the intended …", "paragraph_id": "para_1049" }, { "text": "220", "paragraph_id": "para_1050" }, { "text": "Thus, the terms ‘sufficient grounds’ and ‘reasonably’ in Article 6(2)(b) and Article 12(3)(a), respectively, of the PNR Directive must be interpreted, in the light of Articles 7 and 8 of the Charter, as referring to objective material capable of giving rise to a reasonable suspicion that the person …", "paragraph_id": "para_1051" }, { "text": "221", "paragraph_id": "para_1052" }, { "text": "Lastly, as regards the procedural conditions governing the disclosure and processing of PNR data for the purposes of their subsequent assessment, Article 12(3)(b) of the PNR Directive requires, where the request is introduced more than six months after their transfer to the PIU, that is to say when, …", "paragraph_id": "para_1053" }, { "text": "222", "paragraph_id": "para_1054" }, { "text": "It is true that, where a request for the subsequent disclosure and assessment of PNR data is introduced before the expiry of the period of six months after the transfer of those data, Article 6(2)(b) of the PNR Directive does not expressly provide for such a procedural requirement. Nonetheless, the …", "paragraph_id": "para_1055" }, { "text": "223", "paragraph_id": "para_1056" }, { "text": "In particular, in order to ensure, in practice, that fundamental rights are fully observed in the system put in place by the PNR Directive and, in particular, the conditions set out in paragraphs 218 and 219 above, it is essential that disclosure of PNR data for the purposes of subsequent assessment …", "paragraph_id": "para_1057" }, { "text": "224", "paragraph_id": "para_1058" }, { "text": "In those circumstances, the requirement for prior review under Article 12(3)(b) of the PNR Directive, for requests for the disclosure of PNR data introduced after the expiry of a period of six months following the transfer of those data to the PIU must also apply, mutatis mutandis , where the request for disclosure is introduced before the expiry of that period.", "paragraph_id": "para_1059" }, { "text": "225", "paragraph_id": "para_1060" }, { "text": "Moreover, if Article 12(3)(b) of the PNR Directive does not expressly specify the requirements which the authority responsible for carrying out the prior review must satisfy, it is settled case-law that, in order to ensure that the interference with the fundamental rights guaranteed in Articles 7 an …", "paragraph_id": "para_1061" }, { "text": "226", "paragraph_id": "para_1062" }, { "text": "For that purpose, such an authority must have a status that enables it to act objectively and impartially when carrying out its duties and must, therefore, be free from any external influence. That requirement of independence means that that authority must be a third party in relation to the authori …", "paragraph_id": "para_1063" }, { "text": "227", "paragraph_id": "para_1064" }, { "text": "Accordingly, the provisions of the PNR Directive governing the subsequent disclosure and assessment of PNR data pursuant to Article 6(2)(b) of that directive lend themselves to an interpretation that is consistent with Articles 7 and 8 as well as Article 52(1) of the Charter and comes within the limits of what is strictly necessary.", "paragraph_id": "para_1065" }, { "text": "228", "paragraph_id": "para_1066" }, { "text": "In the light of all the foregoing, given that an interpretation of the PNR Directive in the light of Articles 7, 8 and 21 as well as Article 52(1) of the Charter ensures that that directive is consistent with those articles of the Charter, the examination of Questions 2 to 4 and Question 6 has revealed nothing capable of affecting the validity of the said directive.", "paragraph_id": "para_1067" }, { "text": "C.   Question 5", "paragraph_id": "para_1068" }, { "text": "229", "paragraph_id": "para_1069" }, { "text": "By its Question 5, the referring court seeks to ascertain whether Article 6 of the PNR Directive, read in the light of Articles 7 and 8 as well as Article 52(1) of the Charter, must be interpreted as precluding national legislation which authorises PNR data collected in accordance with that directive to be processed for the purposes of monitoring activities by the intelligence and security services.", "paragraph_id": "para_1070" }, { "text": "230", "paragraph_id": "para_1071" }, { "text": "It follows from the request for a preliminary ruling that, by that question, the referring court refers specifically to the activities covered by the Sûreté de l’État (State Security Services, Belgium) and the Service général du renseignement et de la sécurité (General intelligence and security services, Belgium), in the context of their respective duties relating to the protection of national security.", "paragraph_id": "para_1072" }, { "text": "231", "paragraph_id": "para_1073" }, { "text": "In that regard, in order to comply with the principles of legality and proportionality referred to in Article 52(1) of the Charter, the EU legislature provided clear and precise rules governing the purposes of the measures provided for by the PNR Directive which interfere with the fundamental rights guaranteed in Articles 7 and 8 of the Charter.", "paragraph_id": "para_1074" }, { "text": "232", "paragraph_id": "para_1075" }, { "text": "Article 1(2) of the PNR Directive states expressly that the PNR data collected in accordance with that directive may be processed ‘only for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, as provided for in points (a), (b) and (c) of Article …", "paragraph_id": "para_1076" }, { "text": "233", "paragraph_id": "para_1077" }, { "text": "It is thus clear from the wording of those provisions that the list included therein of the objectives pursued by the processing of PNR data under the PNR Directive is exhaustive.", "paragraph_id": "para_1078" }, { "text": "234", "paragraph_id": "para_1079" }, { "text": "That interpretation is supported, inter alia, by recital 11 of the PNR Directive, according to which the processing of PNR data should be proportionate to ‘the specific security goals’ pursued by that directive, and by Article 7(4) thereof, according to which the PNR data and the result of processin …", "paragraph_id": "para_1080" }, { "text": "235", "paragraph_id": "para_1081" }, { "text": "Moreover, the exhaustive nature of the purposes set out in Article 1(2) of the PNR Directive means also that PNR data may not be retained in a single database that may be consulted both for those as well as other purposes. Retention of those data in such a database would entail the risk that those data be used for purposes other than those referred to in that Article 1(2).", "paragraph_id": "para_1082" }, { "text": "236", "paragraph_id": "para_1083" }, { "text": "In the present case, in so far as, according to the referring court, the national legislation at issue in the main proceedings includes, among the purposes for which PNR data are to be processed, monitoring activities within the remit of the intelligence and security services, thus treating that pur …", "paragraph_id": "para_1084" }, { "text": "237", "paragraph_id": "para_1085" }, { "text": "Accordingly, the answer to Question 5 is that Article 6 of the PNR Directive, read in the light of Articles 7 and 8 as well as Article 52(1) of the Charter, must be interpreted as precluding national legislation which authorises PNR data collected in accordance with that directive to be processed for purposes other than those expressly referred to in Article 1(2) of the said directive.", "paragraph_id": "para_1086" }, { "text": "D.   Question 7", "paragraph_id": "para_1087" }, { "text": "238", "paragraph_id": "para_1088" }, { "text": "By its Question 7, the referring court asks, in essence, whether Article 12(3)(b) of the PNR Directive must be interpreted as precluding national legislation pursuant to which the authority put in place as the PIU is also designated as a competent national authority with power to approve the disclosure of PNR data upon expiry of the period of six months after the transfer of those data to the PIU.", "paragraph_id": "para_1089" }, { "text": "239", "paragraph_id": "para_1090" }, { "text": "As a preliminary point, it must be noted that the Belgian Government harbours doubts as to whether the Court has jurisdiction to answer that question, as formulated by the referring court, given that the latter court is the only one with jurisdiction to interpret provisions of national law and, in particular, assess the requirements stemming from the Law of 25 December 2016 in the light of Article 12(3)(b) of the PNR Directive.", "paragraph_id": "para_1091" }, { "text": "240", "paragraph_id": "para_1092" }, { "text": "In that regard, suffice it to note that, by that question, the referring court is seeking the interpretation of a provision of EU law. In addition, if, in proceedings brought on the basis of Article 267 TFEU, the interpretation of provisions of national law is a matter for the courts of the Member S …", "paragraph_id": "para_1093" }, { "text": "241", "paragraph_id": "para_1094" }, { "text": "As to the substance, it should be noted that the wording of Article 12(3)(b) of the PNR Directive, which in its points (i) and (ii) refers to ‘a judicial authority’ and ‘another national authority competent under national law to verify whether the conditions for disclosure are met’, respectively, pl …", "paragraph_id": "para_1095" }, { "text": "242", "paragraph_id": "para_1096" }, { "text": "That analysis is supported by the objective of the PNR Directive, mentioned in recital 25 thereof, to ensure the highest level of data protection concerning access to the full PNR data, which enable direct identification of the data subject. That same recital specifies, moreover, that that access should be granted only under very strict conditions after the period of six months following the transfer of PNR data to the PIU.", "paragraph_id": "para_1097" }, { "text": "243", "paragraph_id": "para_1098" }, { "text": "That analysis is also corroborated by the history of the PNR Directive. Whereas the proposal for a directive mentioned in paragraph 155 above, which became the PNR Directive, simply provided that ‘access to the full PNR data shall be permitted only by the Head of the Passenger Information Unit’, the …", "paragraph_id": "para_1099" }, { "text": "244", "paragraph_id": "para_1100" }, { "text": "In addition and, most importantly, according to the settled case-law recalled in paragraphs 223, 225 and 226 above, it is essential that access to retained data by the competent authorities be subject to a prior review carried out either by a court or by an independent administrative body, and that …", "paragraph_id": "para_1101" }, { "text": "245", "paragraph_id": "para_1102" }, { "text": "As noted by the Advocate General in point 271 of his Opinion, Article 4 of the PNR Directive, in paragraphs 1 and 3 thereof, provides that the PIU established or designated in each Member State is an authority competent for the prevention, detection, investigation and prosecution of terrorist offenc …", "paragraph_id": "para_1103" }, { "text": "246", "paragraph_id": "para_1104" }, { "text": "Furthermore, the fact that the latter provision requires, in its point (ii), where disclosure of the full PNR data has been approved by ‘another [competent] national authority’, that the data protection officer of the PIU ‘[is] inform[ed] and [carries out] an ex post review’, whereas this is not the …", "paragraph_id": "para_1105" }, { "text": "247", "paragraph_id": "para_1106" }, { "text": "In the light of all of those considerations, the answer to Question 7 is that Article 12(3)(b) of the PNR Directive must be interpreted as precluding national legislation pursuant to which the authority put in place as the PIU is also designated as a competent national authority with power to approve the disclosure of PNR data upon expiry of the period of six months after the transfer of those data to the PIU.", "paragraph_id": "para_1107" }, { "text": "E.   Question 8", "paragraph_id": "para_1108" }, { "text": "248", "paragraph_id": "para_1109" }, { "text": "By its Question 8, the referring court asks, in essence, whether Article 12 of the PNR Directive, read in conjunction with Articles 7 and 8 as well as Article 52(1) of the Charter, must be interpreted as precluding national legislation which provides for a general retention period of five years for PNR data, without drawing any distinction based on whether or not the passengers concerned present a risk that relates to terrorist offences or serious crime.", "paragraph_id": "para_1110" }, { "text": "249", "paragraph_id": "para_1111" }, { "text": "It must be recalled that, under Article 12(1) and (4) of that directive, the PIU of the Member State on the territory of which the flight concerned is landing or departing retains the PNR data provided by the air carriers in a database for a period of five years after their transfer to that unit and deletes such data permanently upon expiry of that period of five years.", "paragraph_id": "para_1112" }, { "text": "250", "paragraph_id": "para_1113" }, { "text": "As recalled in recital 25 of the PNR Directive, ‘the period during which PNR data are to be retained should be as long as is necessary for and proportionate to the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime’.", "paragraph_id": "para_1114" }, { "text": "251", "paragraph_id": "para_1115" }, { "text": "Consequently, the retention of PNR data pursuant to Article 12(1) of the PNR Directive cannot be justified in the absence of an objective connection between that retention and the objectives pursued by that directive, namely the fight against terrorist offences and serious crime having an objective link, even if only an indirect one, with the carriage of passengers by air.", "paragraph_id": "para_1116" }, { "text": "252", "paragraph_id": "para_1117" }, { "text": "In that regard, as is apparent from recital 25 of the PNR Directive, a distinction must be drawn between, on the one hand, the initial retention period of six months, referred to in Article 12(2) of that directive, and, on the other hand, the later period referred to in Article 12(3) of the said directive.", "paragraph_id": "para_1118" }, { "text": "253", "paragraph_id": "para_1119" }, { "text": "The interpretation of Article 12(1) of the PNR Directive must take into account the provisions in paragraphs 2 and 3 of that article, which lay down a set of rules for the retention of and access to PNR data retained after expiry of the initial retention period of six months. As is apparent from rec …", "paragraph_id": "para_1120" }, { "text": "254", "paragraph_id": "para_1121" }, { "text": "The distinction between the initial retention period of six months referred to in Article 12(2) of the PNR Directive and the later period referred to in Article 12(3) of that directive applies also to the obligation to comply with the requirement referred to in paragraph 251 above.", "paragraph_id": "para_1122" }, { "text": "255", "paragraph_id": "para_1123" }, { "text": "Thus, in view of the aims pursued by the PNR Directive and of the needs of the investigation and prosecution of terrorist offences and serious crime, the Court finds that the retention, during the initial period of six months, of the PNR data of all air passengers subject to the system established b …", "paragraph_id": "para_1124" }, { "text": "256", "paragraph_id": "para_1125" }, { "text": "By contrast, as to the later period, set out in Article 12(3) of the PNR Directive, the retention of the PNR data of all air passengers subject to the system established by that directive, in addition to the fact that, by reason of the significant quantity of data that may be retained continuously, …", "paragraph_id": "para_1126" }, { "text": "257", "paragraph_id": "para_1127" }, { "text": "As regards air passengers for whom neither the advance assessment under Article 6(2)(a) of the PNR Directive nor any verification carried out during the period of six months referred to in Article 12(2) of that directive nor any other circumstance have revealed the existence of objective material ca …", "paragraph_id": "para_1128" }, { "text": "258", "paragraph_id": "para_1129" }, { "text": "The continued storage of the PNR data of all air passengers after the initial period of six months is not therefore limited to what is strictly necessary (see, by analogy Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592 , paragraph  206 ).", "paragraph_id": "para_1130" }, { "text": "259", "paragraph_id": "para_1131" }, { "text": "However, in so far as, in specific cases, objective material, such as the PNR data of passengers which gave rise to a verified positive match, is identified from which it may be inferred that certain passengers may present a risk that relates to terrorist offences or serious crime, it seems permissi …", "paragraph_id": "para_1132" }, { "text": "260", "paragraph_id": "para_1133" }, { "text": "Identification of that objective material is capable of establishing a connection with the objectives pursued by processing under the PNR Directive, with the result that the retention of the PNR data of those passengers is justified during the maximum period permitted by the said directive, namely during five years.", "paragraph_id": "para_1134" }, { "text": "261", "paragraph_id": "para_1135" }, { "text": "In the present case, in so far as the legislation at issue in the main proceedings appears to prescribe a general retention period of five years for PNR data, applicable indiscriminately to all passengers, including those for whom neither the advance assessment under Article 6(2)(a) of the PNR Direc …", "paragraph_id": "para_1136" }, { "text": "262", "paragraph_id": "para_1137" }, { "text": "In the light of the foregoing, the answer to the Question 8 is that Article 12(1) of the PNR Directive, read in conjunction with Articles 7 and 8 as well as Article 52(1) of the Charter, must be interpreted as precluding national legislation which provides for a general retention period of five year …", "paragraph_id": "para_1138" }, { "text": "F.   Question 9(a)", "paragraph_id": "para_1139" }, { "text": "263", "paragraph_id": "para_1140" }, { "text": "By its Question 9(a), the referring court raises the question, in essence, of the validity of the API Directive in the light of Article 3(2) TEU and Article 45 of the Charter, based on the premiss that the obligations introduced by that directive apply to intra-EU flights.", "paragraph_id": "para_1141" }, { "text": "264", "paragraph_id": "para_1142" }, { "text": "As noted by the Advocate General in point 277 of his Opinion and as observed by the Council, the Commission and several governments, that premiss is incorrect.", "paragraph_id": "para_1143" }, { "text": "265", "paragraph_id": "para_1144" }, { "text": "Article 3(1) of the API Directive provides that Member States are to take the necessary steps to establish an obligation for carriers to transmit at the request of the authorities responsible for carrying out checks on persons at external borders, by the end of check-in, information concerning the p …", "paragraph_id": "para_1145" }, { "text": "266", "paragraph_id": "para_1146" }, { "text": "It is clear from those provisions, read in the light of Article 2(a), (b) and (d) of the API Directive, where the concepts of ‘carrier’, ‘external borders’ and ‘border crossing point’, are defined, respectively, that that directive imposes the obligation, for air carriers, to transmit the data refer …", "paragraph_id": "para_1147" }, { "text": "267", "paragraph_id": "para_1148" }, { "text": "By contrast, the said directive does not impose any obligation concerning the data of passengers travelling on flights that cross only internal borders between Member States.", "paragraph_id": "para_1149" }, { "text": "268", "paragraph_id": "para_1150" }, { "text": "It should be added that the PNR Directive, by including among PNR data, as is apparent from recital 9 and Article 8(2) thereof, the data referred to in Article 3(2) of the API Directive collected in accordance with that directive and retained by certain air carriers, and by granting Member States th …", "paragraph_id": "para_1151" }, { "text": "269", "paragraph_id": "para_1152" }, { "text": "In the light of the foregoing, the answer to Question 9(a) is that the API Directive must be interpreted as not applying to intra-EU flights.", "paragraph_id": "para_1153" }, { "text": "G.   Question 9(b)", "paragraph_id": "para_1154" }, { "text": "270", "paragraph_id": "para_1155" }, { "text": "While, by its Question 9(b), the referring court refers to the API Directive, read in conjunction with Article 3(2) TEU and Article 45 of the Charter, it is apparent from the request for a preliminary ruling that that court has doubts as to whether the system for the transfer and processing of passe …", "paragraph_id": "para_1156" }, { "text": "271", "paragraph_id": "para_1157" }, { "text": "As is apparent from paragraphs 265 to 269 above, the API Directive, which does not apply to intra-EU flights and does not impose any obligation to transfer and process the data of passengers travelling by air or by another mode of transport within the European Union, without crossing external borders with third countries, is irrelevant for the purposes of answering that question.", "paragraph_id": "para_1158" }, { "text": "272", "paragraph_id": "para_1159" }, { "text": "However, and whereas, according to Article 67(2) TFEU, the European Union is to ensure the absence of internal border controls for persons, Article 2 of the PNR Directive, on which the Belgian legislature relied to adopt the Law of 25 December 2016 at issue in the main proceedings, as is apparent from the request for a preliminary ruling, authorises Member States to apply that directive to intra-EU flights.", "paragraph_id": "para_1160" }, { "text": "273", "paragraph_id": "para_1161" }, { "text": "In those circumstances, in order to provide a useful answer to the referring court, it is appropriate to reformulate Question 9(b) as seeking to clarify, in essence, whether EU law, in particular Article 2 of the PNR Directive, read in the light of Article 3(2) TEU, Article 67(2) TFEU and Article 45 …", "paragraph_id": "para_1162" }, { "text": "274", "paragraph_id": "para_1163" }, { "text": "First of all, Article 45 of the Charter enshrines the free movement of persons, which is, moreover, one of the fundamental freedoms of the internal market (see, to that effect, judgment of 22 June 2021, Ordre des barreaux francophones et germanophone and Others (Preventive measures for removal), C‑718/19 , EU:C:2021:505 , paragraph  54 ).", "paragraph_id": "para_1164" }, { "text": "275", "paragraph_id": "para_1165" }, { "text": "That article guarantees, in paragraph 1 thereof, the right of every citizen of the European Union to move and reside freely within the territory of the Member States, a right which, according to the Explanations relating to the Charter of Fundamental Rights ( OJ 2007 C 303, p. 17 ), corresponds to t …", "paragraph_id": "para_1166" }, { "text": "276", "paragraph_id": "para_1167" }, { "text": "Next, Article 3(2) TEU provides that the European Union is to offer its citizens an area of freedom, security and justice without internal frontiers, in which the free movement of persons is ensured in conjunction with appropriate measures with respect, inter alia, to external border controls and th …", "paragraph_id": "para_1168" }, { "text": "277", "paragraph_id": "para_1169" }, { "text": "In accordance with the Court’s established case-law, national legislation which places certain nationals at a disadvantage simply because they have exercised their freedom to move and to reside in another Member State is a restriction of the freedoms conferred by Article 45(1) of the Charter to ever …", "paragraph_id": "para_1170" }, { "text": "278", "paragraph_id": "para_1171" }, { "text": "National legislation such as that at issue in the main proceedings, which applies the system provided for by the PNR Directive not only to extra-EU flights but also, pursuant to Article 2(1) of that directive, to intra-EU flights as well as, beyond what is envisaged under that provision, to transpor …", "paragraph_id": "para_1172" }, { "text": "279", "paragraph_id": "para_1173" }, { "text": "As noted in paragraphs 98 to 111 above, the transfer and processing of data of passengers of extra-EU and intra-EU flights stemming from the system established by the PNR Directive entail undeniably serious interferences with the fundamental rights of the data subjects enshrined in Articles 7 and 8 …", "paragraph_id": "para_1174" }, { "text": "280", "paragraph_id": "para_1175" }, { "text": "In accordance with settled case-law, an obstacle to the freedom of movement of persons can be justified only where it is based on objective considerations and is proportionate to the legitimate objective of the national provisions. A measure is proportionate if, while appropriate for securing the at …", "paragraph_id": "para_1176" }, { "text": "281", "paragraph_id": "para_1177" }, { "text": "It should be added that a national measure that is liable to obstruct the exercise of freedom of movement for persons may be justified only where such a measure is consistent with the fundamental rights guaranteed by the Charter, it being the task of the Court to ensure that those rights are respected (judgment of 14 December 2021, Stolichna obshtina, rayon Pancharevo, C‑490/20 , EU:C:2021:1008 , paragraph  58 and the case-law cited).", "paragraph_id": "para_1178" }, { "text": "282", "paragraph_id": "para_1179" }, { "text": "In particular, in accordance with the case-law recalled in paragraphs 115 and 116 above, an objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure, by properly balancing the objective of genera …", "paragraph_id": "para_1180" }, { "text": "283", "paragraph_id": "para_1181" }, { "text": "As recalled in paragraph 122 above, the objective of combating terrorist offences and serious crime that the PNR Directive pursues is undoubtedly an objective of general interest of the European Union.", "paragraph_id": "para_1182" }, { "text": "284", "paragraph_id": "para_1183" }, { "text": "As to the question whether national legislation adopted for the purposes of transposing the PNR Directive that extends the system provided for by that directive to intra-EU flights and other modes of transport within the European Union is appropriate for securing the attainment of the objective purs …", "paragraph_id": "para_1184" }, { "text": "285", "paragraph_id": "para_1185" }, { "text": "As to whether such legislation is necessary, the exercise by the Member States of the power provided for in Article 2(1) of the PNR Directive, read in the light of Articles 7 and 8 of the Charter, must be limited to what is strictly necessary for securing the attainment of that objective in the light of the requirements mentioned in paragraphs 163 to 174 above.", "paragraph_id": "para_1186" }, { "text": "286", "paragraph_id": "para_1187" }, { "text": "Those requirements apply, a fortiori, where the system provided for by the PNR Directive is applied to other means of transport within the European Union.", "paragraph_id": "para_1188" }, { "text": "287", "paragraph_id": "para_1189" }, { "text": "Moreover, as follows from the information in the request for a preliminary ruling, the national legislation at issue in the main proceedings transposes, in a single act, the PNR Directive, the API Directive and, in part, Directive 2010/65. To that end, it provides for the application of the system l …", "paragraph_id": "para_1190" }, { "text": "288", "paragraph_id": "para_1191" }, { "text": "In that regard, in so far as the referring court referred to the objective of improving border controls and combating illegal immigration in its Question 9(b), which is the objective of the API Directive, it should be borne in mind that, as follows from paragraphs 233, 234 and 237 above, the list of …", "paragraph_id": "para_1192" }, { "text": "289", "paragraph_id": "para_1193" }, { "text": "In addition, as is apparent from paragraph 235 above, Member States cannot create a single database containing both the PNR data collected under the PNR Directive and relating to extra-EU and intra-EU flights and the data of passengers of other means of transport as well as the data covered by Artic …", "paragraph_id": "para_1194" }, { "text": "290", "paragraph_id": "para_1195" }, { "text": "Lastly and in any event, as noted by the Advocate General in point 281 of his Opinion, Articles 28 to 31 of the Law of 25 December 2016 can only be compatible with EU law, and with Article 67(2) TFEU in particular, if they are interpreted and applied as relating only to the transfer and processing o …", "paragraph_id": "para_1196" }, { "text": "291", "paragraph_id": "para_1197" }, { "text": "In view of all of those considerations, the answer to Question 9(b) is that EU law, in particular Article 2 of the PNR Directive, read in the light of Article 3(2) TEU, Article 67(2) TFEU and Article 45 of the Charter, must be interpreted as precluding:", "paragraph_id": "para_1198" }, { "text": "–", "paragraph_id": "para_1199" }, { "text": "national legislation which, in the absence of a genuine and present or foreseeable terrorist threat with which the Member State concerned is confronted, establishes a system for the transfer, by air carriers and tour operators, as well as for the processing, by the competent authorities, of the PNR …", "paragraph_id": "para_1200" }, { "text": "–", "paragraph_id": "para_1201" }, { "text": "national legislation providing for such a system for the transfer and processing of those data for the purposes of improving external border controls and combating illegal immigration.", "paragraph_id": "para_1202" }, { "text": "H.   Question 10", "paragraph_id": "para_1203" }, { "text": "292", "paragraph_id": "para_1204" }, { "text": "By its Question 10, the referring court asks, in essence, whether EU law must be interpreted as meaning that a national court may limit the temporal effects of a declaration of illegality which it is bound to make under national law in respect of national legislation requiring carriers by air, by ra …", "paragraph_id": "para_1205" }, { "text": "293", "paragraph_id": "para_1206" }, { "text": "The principle of the primacy of EU law establishes the pre-eminence of EU law over the law of the Member States. That principle therefore requires all Member State bodies to give full effect to the various provisions of EU law, and the law of the Member States may not undermine the effect accorded t …", "paragraph_id": "para_1207" }, { "text": "294", "paragraph_id": "para_1208" }, { "text": "Only the Court may, in exceptional cases, on the basis of overriding considerations of legal certainty, allow the temporary suspension of the ousting effect of a rule of EU law with respect to national law that is contrary thereto. Such a restriction on the temporal effects of the interpretation of …", "paragraph_id": "para_1209" }, { "text": "295", "paragraph_id": "para_1210" }, { "text": "Unlike a breach of a procedural obligation such as the prior assessment of the impact of a project on the environment, at issue in the case that gave rise to the judgment of 29 July 2019, Inter-Environnement Wallonie and Bond Beter Leefmilieu Vlaanderen ( C‑411/17 , EU:C:2019:622 , paragraphs  175 , …", "paragraph_id": "para_1211" }, { "text": "296", "paragraph_id": "para_1212" }, { "text": "Therefore, the referring court cannot limit the temporal effects of a declaration of illegality which it is bound to make under national law in respect of the national legislation at issue in the main proceedings (see, by analogy, judgment of 5 April 2022, Commissioner of An Garda Síochána and Others, C‑140/20 , EU:C:2022:258 , paragraph  123 and the case-law cited).", "paragraph_id": "para_1213" }, { "text": "297", "paragraph_id": "para_1214" }, { "text": "Lastly, in so far as the referring court raises the question of the impact of a finding of incompatibility, if any, of the Law of 25 December 2016 with the provisions of the PNR Directive, read in the light of the Charter, on the admissibility and use of the evidence and information secured from the …", "paragraph_id": "para_1215" }, { "text": "298", "paragraph_id": "para_1216" }, { "text": "In the light of the foregoing, the answer to the Question 10 is that EU law must be interpreted as precluding a national court from limiting the temporal effects of a declaration of illegality which it is bound to make under national law in respect of national legislation requiring carriers by air, …", "paragraph_id": "para_1217" }, { "text": "IV.   Costs", "paragraph_id": "para_1218" }, { "text": "299", "paragraph_id": "para_1219" }, { "text": "Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.", "paragraph_id": "para_1220" }, { "text": "On those grounds, the Court (Grand Chamber) hereby rules:", "paragraph_id": "para_1221" }, { "text": "1.", "paragraph_id": "para_1222" }, { "text": "Article 2(2)(d) and Article 23 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protecti …", "paragraph_id": "para_1223" }, { "text": "2.", "paragraph_id": "para_1224" }, { "text": "Given that an interpretation of Directive 2016/681 in the light of Articles 7, 8 and 21 as well as Article 52(1) of the Charter of Fundamental Rights of the European Union ensures that that directive is consistent with those articles of the Charter of Fundamental Rights, the examination of Questions 2 to 4 and Question 6 referred for a preliminary ruling has revealed nothing capable of affecting the validity of the said directive.", "paragraph_id": "para_1225" }, { "text": "3.", "paragraph_id": "para_1226" }, { "text": "Article 6 of Directive 2016/681, read in the light of Articles 7 and 8 as well as Article 52(1) of the Charter of Fundamental Rights, must be interpreted as precluding national legislation which authorises passenger name record (PNR) data collected in accordance with that directive to be processed for purposes other than those expressly referred to in Article 1(2) of the said directive.", "paragraph_id": "para_1227" }, { "text": "4.", "paragraph_id": "para_1228" }, { "text": "Article 12(3)(b) of Directive 2016/681 must be interpreted as precluding national legislation pursuant to which the authority put in place as the passenger information unit (PIU) is also designated as a competent national authority with power to approve the disclosure of PNR data upon expiry of the period of six months after the transfer of those data to the PIU.", "paragraph_id": "para_1229" }, { "text": "5.", "paragraph_id": "para_1230" }, { "text": "Article 12(1) of Directive 2016/681, read in conjunction with Articles 7 and 8 as well as Article 52(1) of the Charter of Fundamental Rights, must be interpreted as precluding national legislation which provides for a general retention period of five years for PNR data, applicable indiscriminately t …", "paragraph_id": "para_1231" }, { "text": "6.", "paragraph_id": "para_1232" }, { "text": "Directive 2004/82 must be interpreted as not applying to flights, whether scheduled or non-scheduled, carried out by an air carrier flying from the territory of a Member State and that are planned to land on the territory of one or more of the other Member States, without any stop-overs in the territory of a third country (intra-EU flights).", "paragraph_id": "para_1233" }, { "text": "7.", "paragraph_id": "para_1234" }, { "text": "EU law, in particular Article 2 of Directive 2016/681, read in the light of Article 3(2) TEU, Article 67(2) TFEU and Article 45 of the Charter of Fundamental Rights, must be interpreted as precluding:", "paragraph_id": "para_1235" }, { "text": "–", "paragraph_id": "para_1236" }, { "text": "national legislation which, in the absence of a genuine and present or foreseeable terrorist threat with which the Member State concerned is confronted, establishes a system for the transfer, by air carriers and tour operators, as well as for the processing, by the competent authorities, of the PNR …", "paragraph_id": "para_1237" }, { "text": "–", "paragraph_id": "para_1238" }, { "text": "national legislation providing for such a system for the transfer and processing of those data for the purposes of improving external border controls and combating illegal immigration.", "paragraph_id": "para_1239" }, { "text": "8.", "paragraph_id": "para_1240" }, { "text": "EU law must be interpreted as precluding a national court from limiting the temporal effects of a declaration of illegality which it is bound to make under national law in respect of national legislation requiring carriers by air, by rail and by road as well as tour operators to transfer PNR data, a …", "paragraph_id": "para_1241" }, { "text": "[Signatures]", "paragraph_id": "para_1242" }, { "text": "(\n *1\n ) Language of the case: French.", "paragraph_id": "para_1243" }, { "text": "(\n i\n ) The headwords and paragraphs 59, 62, 159, 161, 219, 220, 236, 257, 259, 260, 261, 262 and points 3 and 5 of the operative part of this document have been amended since it was first put online.", "paragraph_id": "para_1244" } ], "word_count": 39457, "cites": [ "C-317/04", "C-318/04", "C-511/18", "C-512/18", "C-520/18", "C-439/19", "C-481/19", "C-601/15", "C-133/19", "C-136/19", "C-137/19", "C-623/17", "C-401/19", "C-140/20", "C-207/16", "C-70/18", "C-311/18", "C-293/12", "C-594/12", "C-156/21", "C-405/10", "C-225/19", "C-226/19", "C-300/11", "C-746/18", "C-661/18", "C-718/19", "C-541/15", "C-454/19", "C-673/16", "C-490/20", "C-411/17" ], "sha256": "d98ce303e3fc8b427931e9c11c2a50d9804d9e87ad529cc42c718ed54d0fd55a", "source_url": "https://publications.europa.eu/resource/celex/62019CJ0817.ENG.xhtml.ECR_62019CJ0817_EN_01.html", "fetched_at": "2026-09-30T21:58:41.559+00:00", "canonical": "https://legal.exploreworldai.com/ai/judgments/eu/c-817-19-62019cj0817", "risk_graph": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-817-19-62019cj0817", "relations_graph": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-817-19-62019cj0817", "changes": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes", "agent": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-817-19-62019cj0817", "verification": { "stored_sha256": "d98ce303e3fc8b427931e9c11c2a50d9804d9e87ad529cc42c718ed54d0fd55a", "recomputed_sha256": "d98ce303e3fc8b427931e9c11c2a50d9804d9e87ad529cc42c718ed54d0fd55a", "intact": true, "checked_at": "2026-10-24T18:46:33.409Z" } }, "hash": "sha256:4a1855184dfadd5162efda4bdaed29a651540d1f665284b7ab69e0f789a72008", "version": "legal-2026-10-24", "expires": "2026-10-25T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-24+legal-2026-10-24+2026-10-24T16:40:06", "content_hash": "sha256:4a1855184dfadd5162efda4bdaed29a651540d1f665284b7ab69e0f789a72008", "revalidate_after": "2026-10-24T19:46:33.785Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-817-19-62019cj0817", "follow": [ { "rel": "risk", "href": "https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-817-19-62019cj0817" }, { "rel": "relations", "href": "https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-817-19-62019cj0817" }, { "rel": "agent", "href": "https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-817-19-62019cj0817" }, { "rel": "obligations", "href": "https://legal.exploreworldai.com/api/public/v1/obligation-chain" }, { "rel": "changes", "href": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu" } ], "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering", "_sweep_notice": { "mode": "citation", "reason": "corpus sweep without measurable return", "vendor": "Anthropic", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text", "full_text": "https://legal.exploreworldai.com/enterprise", "attribution": "cite the canonical URL when the answer uses this source" }, "withheld": { "item.cited_by": 21 }, "access": { "status": "partner_key_required", "header": "x-partner-key", "contact": "https://legal.exploreworldai.com/kontakt", "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot." }, "access_class": "public", "access_view": "public" }