Court of Justice of the European Union — Belgium PNR passenger profiling (Ligue des droits humains)

Decided by

Court of Justice of the European Union

Parties

Ligue des droits humains ASBL v. Conseil des ministres

Decision date

June 21, 2022

Remedy

The CJEU ruled that EU law precludes national legislation authorizing general and indiscriminate five-year retention of PNR data, processing for non-specified purposes, or extending PNR surveillance across intra-EU transport without a specific threat.

Appeal

Appeal status not stated

Key holdings

1. Passenger Name Record data collected under EU rules cannot be processed for purposes other than preventing, detecting, investigating, and prosecuting terrorist offences and serious crime.

   “precluding national legislation which authorises passenger name record (PNR) data collected in accordance with that directive to be processed for purposes other than those expressly referred to in Article 1(2)” — Operative part, point 3

2. National legislation cannot establish a general and indiscriminate five-year retention period for PNR data for all air passengers without objective risk indications.

   “must be interpreted as precluding national legislation which provides for a general retention period of five years for PNR data, applicable indiscriminately to all air passengers” — Operative part, point 5

3. The Passenger Information Unit cannot serve as the national authority empowered to authorize access to full PNR data after the initial six-month period.

   “must be interpreted as precluding national legislation pursuant to which the authority put in place as the passenger information unit (PIU) is also designated as a competent national authority” — Operative part, point 4

4. Extending PNR data collection to all intra-EU flights and other transport modes within the European Union is prohibited unless there is a genuine, present, or foreseeable terrorist threat.

   “national legislation which, in the absence of a genuine and present or foreseeable terrorist threat with which the Member State concerned is confronted, establishes a system for the transfer” — Operative part, point 7

In plain English

Ligue des droits humains, a human rights organization, filed an action before Belgium's Constitutional Court seeking the annulment of the Belgian Law of 25 December 2016. That national law required air, rail, road, and sea carriers, as well as tour operators, to transfer passenger name record data to a centralized database for bulk retention, automated processing, and profiling. The Belgian court stayed proceedings and referred several preliminary questions to the Court of Justice of the European Union regarding the interpretation and validity of EU passenger data directives in light of fundamental rights. The Court of Justice of the European Union found that collecting, transferring, and analyzing passenger data entails serious interferences with the fundamental rights to respect for private life and personal data protection. The court held that EU law precludes national rules permitting general and indiscriminate five-year retention of passenger data for all air travel. Storage beyond an initial six-month period is permissible only for specific passengers showing an objective risk connected to terrorism or serious crime. The court further ruled that passenger data cannot be processed for unauthorized purposes such as general border control, and that the Passenger Information Unit cannot self-approve access to full, unmasked data. Additionally, applying systematic surveillance across all internal travel within the European Union without a genuine and present terrorist threat violates EU free movement and privacy rules. This ruling establishes strict boundaries for state surveillance, prohibiting indiscriminate mass data retention and automated profiling of travelers across the European Union without targeted risk factors and independent oversight.