Passenger Name Records – PNR – contain information about a passenger’s flight details. After September 11th 2001, the States approved agreements with other States, for the processing of personal data from PNR passenger registers. But the European Court of Justice CJEU has declared the agreement on the pnr personal name record with Canada invalid.
The EU High Court held that the indiscriminate transfer to Canada of personal data of passengers contained in personal name records is not justified. In addition to passenger travel data such as flight number, assigned seat number, route followed, baggage etc., PNR data also contains sensitive data such as:
- ethnicity;
- political opinions;
- religious orientation;
- marital status;
- health state;
- gender.
READ ALSO: Passenger Name Records in the Framework of EU Principles of Data Protection
The EU High Court highlighted the following weaknesses in the Agreement with Canada:
- the indiscriminate transmission of PNR data of all passengers;
- the high level of generalized surveillance of passengers;
- insufficient information rights regarding the use of PNR data;
- the absence of the correlation between the so-called “data retention” with the stay of the traveler in the foreign State;
- access to PNR data of the foreign authority.
In short, according to the European High Court of Justice, the transfer of passengers’ PNR data to other states is not justified either by the journey or by the passenger’s stay in the foreign state.
EU directive PNR. Data protection impact assessment. Right to privacy and access to documents for the protection of personal data.
Personal name record data is stored in Computerized Reservation Systems (CRS). These are computer systems with which the airlines exchange information on registered passengers. The main CRSs are in the USA and Europe. This means that European passenger data is accessible to US authorities.
Balancing the needs of protection and privacy of travelers’ personal data with those of security.
The personal data of personal name records are transmitted to the police and are used for investigations and controls for crimes of:
- terrorism;
- treats of slaves;
- child pornography;
- arms traffic, ammunition and explosives.
The right to Privacy and the protection of personal data and identity of the passenger. What does the EU PNR directive provide?
- It prohibits the collection and dissemination of sensitive data;
- the data can be stored for a period of 5 years;
- EU States are obliged to establish the Passenger Unit Information for the management and protection of passengers’ personal data;
- EU states must ensure that passengers are clearly informed of the collection of personal data and their rights;
- the transfer of personal data to other countries can only take place in very limited circumstances and only on a case-by-case basis.
