(CN) - While acknowledging efforts to bolster security in the wake of the Paris terror attacks, the EU data-protection czar said Thursday that lawmakers should rethink a plan to collect personal data from anyone who boards an airplane.
Since 2007, EU lawmakers have debated implementing a "passenger name record" scheme, which would collect the personal data of millions of passengers on flights to and from Europe and could also collect data from travelers on flights within the EU.
The European Data Protection Superviser - an independent office within the EU government tasked with overseeing the protection of citizens' personal data - said Thursday that an agreement on the passenger name record scheme was imminent. And while the office reiterated its support of enhanced security measures to protect Europe, supervisor Giovanni Buttarelli said the plan goes too far.
"An EU passenger name record scheme would be the first large-scale and indiscriminate collection of personal data in the history of the Union," Buttarelli said in a statement. "Since it is likely to cover at least all flights to and from the EU and may also involve intra EU and/or domestic flights, millions of non-suspect passengers would potentially be affected by the proposal.
"The European Data Protection Supervisor urges caution before such a scheme is agreed and recalls that the Court of Justice of the European Union defined a high threshold for the untargeted and indiscriminate collection of data in its decision on the Digital Rights Ireland case, which invalidated the data-retention directive," Buttarelli said.
Instead, the data-protection czar recommended a targeted rather than blanket approach to ensuring flight safety, and said any measure should be limited in duration. He also said lawmakers have not offered evidence that the scheme is justified.
"Such evidence is of course a prerequisite for its lawfulness and legitimacy," Buttarelli said. "Fighting crime and terrorism are clearly legitimate objectives, but any measure must respect the rule of law."
Buttarelli urged lawmakers to consider targeting known suspects rather than profiling all passengers, and to "analyze ways to improve the use of dynamic, human intelligence rather than the fatally flawed automated intelligence that was relied upon prior to and since the recent attacks."
In a footnote, Buttarelli also noted that the scheme currently being negotiated is not a single passenger name record plan, but simply tasks member states with implementing their own plans.
The legislation, if passed, would leave the EU with 28 different passenger name record schemes and "does not provide for the coordination, collection and analysis of data at the EU level or for the mandatory exchange of information by member states," Buttarelli said.
Read the Top 8
Sign up for the Top 8, a roundup of the day's top stories delivered directly to your inbox Monday through Friday.