Advocate General Mengozzi, in an opinion delivered on 8 September 20161, stated that the EU-Canada PNR agreement proposed in 2014 did not comply with EU data protection laws. The opinion raises doubts about the future of this proposed agreement, all other EU PNR agreements concluded with other countries, and what impact Brexit could have on the UK’s involvement in this PNR agreement and others.
The EU has negotiated and implemented 3 Passenger Name Record (“PNR”) agreements with other countries: the USA, Canada and Australia. The agreement with Canada was reached in 2006, and a further, more extensive deal reached in 2014. The EU Parliament believed it contravened the EU’s data protection and privacy laws. The EU Commission maintained that the agreements help prevent terrorism and other serious transnational crimes by enabling states to share and retain information relating to air passengers. This information includes all the information provided to airlines at the time of booking (such as age, name, gender, nationality, fellow passengers, and further information provided to airlines in respect of additional services which could disclose health, religious or political information).
In November 2014, the EU Parliament requested that the Court of Justice of the European Union (“the CJEU”) provide an opinion on the compatibility of the proposed agreement negotiated on behalf of the EU by the Commission. AG Mengozzi, after having thoroughly analysed all aspects of the matter, provided 5 reasons why the proposed agreement is incompatible, and suggested 11 changes that if made, would render the agreement compatible with articles 7 and 8 of the Charter of Fundamental Rights of the European Union (“the EU Charter”) that concern the rights to privacy and family life, and protection of personal data respectively.
AG Mengozzi considered that the proposed agreement allowed passengers’ personal data to be processed beyond what was strictly necessary in order to prevent and detect terrorist offences and serious transnational crime. He was also of the opinion that the proposed agreement provided for the use and retention by Canada of sensitive personal data, and to disclose PNR information beyond what was strictly necessary. Further, he found that the agreement would allow Canada to retain the data for up to 5 years without a connection to the aim of preventing terrorism and other serious transnational crimes. Finally, the agreement was found to permit the Canadian authorities to transfer data to third countries without any restrictions on a receiving country transferring the data on.
All of the above would mean that EU citizens’ right to privacy and data protection would be curtailed more than was necessary to pursue the legitimate aim of the proposed agreement. The AG held that the agreement could comply with the EU Charter if, for example: the agreement was more precisely drafted (for example, by listing exhaustively the crimes which are classified as ‘serious transnational crime’); it set out precisely why the information retained was needed for five years; and it systematically ensured the respect and protection of personal data of passengers whose PNR data is processed.
The opinion is not binding on the CJEU, but it is likely that it will be followed which could have a wide-ranging impact on the EU’s PNR agreements already agreed in addition to the one proposed because EU citizens may claim the agreements breach their rights guaranteed under the EU Charter.
The Parliament’s Response
The Parliament has so far been guarded by stating that it awaits the CJEU’’s opinion (rather than a judgment as the CJEU was asked to provide an opinion as the agreement was prospective, as opposed to ruling on the validity of an agreement already in force). If the CJEU were to follow AG Mengozzi, it is unlikely the Parliament would approve the agreement, as it had been requested to do by the EU Council on 8 July 2014. A negative opinion would thereby prevent the agreement entering into force. As such, EU-Canada PNR sharing would continue to be governed by the 2006 agreement which only allows data retention for up to 3 years (except in specific circumstances including the prosecution of criminal offences), and which requires the immediate deletion of sensitive data except where there is a clear and present danger of the loss of human life. The 2006 agreement, therefore, affords greater protection for passengers’ data compared to the proposed agreement at the cost of making less information available to state authorities.
Other PNR Agreements
If AG Mengozzi’s opinion is followed by the CJEU, the EU’s other PNR agreements would be called into question. The agreement with the USA allows for the retention of PNR data for up to 12 years and with Australia for 5.5 years. AG Mengozzi was particularly critical of the proposed agreement with Canada for allowing PNR data to be retained for 5 years without any clear statement as to why this was necessary. The proposed agreement was seen as ‘softer’ than those with the USA and Australia. It is likely that citizens and groups with an interest in protecting data and privacy would seek to challenge the validity of those agreements already in force. Many of the difficulties could likely be averted by renegotiating those agreements to incorporate AG Mengozzi’s recommendations, whether in form or in spirit. However, if it transpired that the Commission had facilitated the breach of EU citizens’ rights to privacy and data protection, the matter would be significantly more complicated. The opinion of the CJEU will, therefore, be particularly significant in this regard.
Now that the UK has voted in a referendum to leave the EU, it will be up for negotiation as to whether the UK remains bound by the existing PNR agreements or whether it would rather enter into its own bilateral agreements with other countries and territories, such as the EU. It is worth noting that the EU Charter includes the European Convention of Human Rights (“ECHR”), to which the UK is signatory. Article 8 of the ECHR gives citizens the same right to privacy as is set down in article 7 of the EU Charter. So long as the UK remains bound by the ECHR, any PNR deal will have to be compatible with the rights enshrined in the ECHR.
Although the EU Charter would cease to apply in the UK after leaving the EU2, if a post-Brexit government wished to enter into PNR agreements which boosted the powers of surveillance and data retention, when it has to balance the competing aims of, on the one hand the detection and prevention of terrorism and serious transnational crimes, and on the other hand respecting privacy and data protection rights, one can envisage the AG’s opinion being used to support legal challenges against such agreements under article 8 of the ECHR.
AG Mengozzi’s opinion constitutes a line in the sand for future EU PNR agreements in emphasising the importance of privacy and data protection rights being protected. The opinion can also be seen as the precursor to a series of significant developments in relation to a future EU and UK PNR agreement. If the CJEU follows its Advocate General’s lead, all existing PNR agreements will likely need to be revisited, and it could provide a further point of discussion around the Brexit negotiating table.
2 The extent to which the EU Charter presently applies is a matter of debate, see: http://www.publications.parliament.uk/pa/cm201314/cmselect/cmeuleg/979/979.pdf and http://www.lse.ac.uk/europeanInstitute/LSE-Commission/Hearing-6---The-implications-of-Brexit-for-fundamental-rights-protection-in-the-UK.pdf
To download your copy of this article, please click here.
Christopher Loxton and Matthew Gillett
© Chambers of Lawrence Power