From DRD to PNR: looking for a new balance between privacy and security

In late November 2014, the European Parliament referred the PNR agreement between the EU and Canada to the Court of Justice, to obtain an advisory opinion on its compatibility with the EU Charter of Fundamental Rights. The resolution adopted by the EP came a few months after the ECJ had declared the Data Retention Directive (Dir. 2006/24/EC) to be inconsistent with EU basic law on a proportionality basis (judgment in joined cases C-293/12 and C-594/12). Though being adopted with regard to the EU-Canada agreement, the resolution promises to (re)open a lively debate on PNR retention and access procedures at large, reaching far beyond the merits of the particular case. Adopting their resolution, MEPs made explicit reference to the judgment delivered by the ECJ on 8th April 2014, casting serious doubts on the legitimacy of the agreement in the light of Article 16 TFEU (protection of personal data by EU institutions), as well as Articles 7 (protection of private and family life), 8 (data protection) and 52 (scope of protected rights) of the EU Charter of Fundamental Rights. Starting from the general remarks made by the EP around the “uncertain” legality of the agreement, this paper will analyze existing PNR agreements and (proposed) legislation at the EU level, to assess their compatibility with the clear principles set forth by the ECJ in Digital Rights Ireland. In particular, the chapter aims at understanding the predictable outcome of the Court’s demanded judgment, its potential effects on the PNR agreement between the EU and the US, and the path the EU Commission should follow to re-draft the long-awaited PNR Directive, after the first proposal was rejected by the EP Civil Liberties Committee in April 2013. In conclusion, the chapter wishes that, trough the action of the EP and the ECJ, the EU might find a new, reasonable and proportionate balance between privacy and security, acting more as a data protector than as a data collector