LUXEMBOURG (CN) — An adviser to the European Union’s highest court gave narrow approval on Thursday to an EU law requiring countries to share airline passenger data.
Advocate General Giovanni Pitruzzella wrote in his nonbinding opinion for the European Court of Justice that the 2016 Passenger Name Record Directive complies with EU privacy rules if there are sufficient safeguards. The opinion was not immediately available in English.
The directive requires EU countries to collect the personal data of millions of passengers on flights to and from Europe as well as travelers on flights within the EU, including names, dates of travel, payment methods and seat numbers.
The case was referred to the Luxembourg-based Court of Justice by the Belgian Constitutional Court after the Belgian branch of the Human Rights League brought a complaint in 2017 to stop the new regulation. The nonprofit group claims the requirements are too broad and don’t sufficiently protect personal information.
Even before the regulations came into effect, the EU's data protection czar at the time, Giovanni Buttarelli, expressed concern about its far-reaching requirements. "The European Data Protection Supervisor urges caution before such a scheme is agreed and recalls that the Court of Justice of the European Union defined a high threshold for the untargeted and indiscriminate collection of data,” Buttarelli said in a statement.
In his advisory opinion Thursday, Pitruzzella found that the data is a useful tool for countries to fight terrorism and crime. The Belgian government argued that the information is widely used to detect suspicious travel patterns, identify criminal associates and stop human trafficking. Pitruzzella concluded that collecting the information from airlines and sharing it with other EU member states is largely acceptable.
However, the advocate general concluded that the data can only be retained under certain conditions. Storage of specific data for up to five years is permitted, according to Pitruzzella, if “a connection is established, on the basis of objective criteria, between those data and the fight against terrorism or serious crime.” Should countries want to hold on to traveler data for longer than five years, they can only do so in the event of a serious security threat.
The Court of Justice has frequently found fault with EU or national regulations requiring the retention of personal data. In 2014, it struck down an EU law requiring telecommunications providers to collect and retain subscribers’ traffic and location data and in 2016 concluded that providers cannot keep customer data indefinitely. Spy agencies were told in 2020 that they can only keep data in the event of national emergencies.
Advocate general opinions are nonbinding, although the court follows their legal reasoning in about 80% of cases. A final ruling from the Court of Justice is expected later this year.
Follow @mollyquell
Subscribe to Closing Arguments
Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.
