Time to Re-Introduce a Directive on the use of Passenger Name Record Data

In the last fifteen months Europe has witnessed three major terrorist attacks, two in Paris in January and November 2015 and in Brussels in March 2016 killing 179 people in total. Prior to all three attacks terrorists had travelled form, to and within the European Union (EU). In addition to this, a terrorist attack was prevented by passengers on a Thalys train travelling from Amsterdam to Paris. Apart from attacks, a high number of EU citizens have travelled to conflict zones such as the terrorist group Islamic State’s self-proclaimed caliphate in Syria and Iraq, many of whom who have returned to EU Member States. In January 2015 the number of citizens from France, the UK, Germany and Belgium that travelled to join Islamic State was estimated to be 3,050 (BBC 2015), a number that has risen since then. As a result there have been calls for the EU to introduce a Passenger Name Record (PNR) data Directive to monitor passenger airline travel out of and to EU Member States. PNR data transfer has not been without its problems and critique. This article will examine previous EU PNR agreements, mainly with the US, examining why they were problematic, with the main issue centring on the protection of passengers’ personal data. In 2011 the EU attempted to introduce a PNR data Directive, but again this failed because there was insufficient safeguards protecting personal data. However, since 2011 there have been significant developments in the protection of personal data in the EU. This article will analyse two key decisions by the Court of Justice of the European Union (CJEU) in Schrems and Digital Rights. Both cases had a significant impact on personal data that resulted in the termination of a trade agreement between the EU and the US, and, the striking down of EU and Member State legislation governing surveillance and data retention of electronic communications. As the EU has developed significantly since 2001 in the area of justice and home affairs, this article will examine the current 2015 PNR data Directive assessing if it will satisfy the strict EU legal restrictions on protection of personal data. Due to the current terrorist threat the EU and its Member States face, it is argued there is a need for a PNR data Directive and it is submitted the 2015 proposal balances correctly the needs of national security with the protection of personal data