ECJ: Passenger monitoring goes too far

According to a decision of the European Court of Justice (ECJ), the previous passenger surveillance of the Federal Criminal Police Office (BKA) goes too far. According to the ruling, storage of data without any reason, as was the case from August 2018 to April 2022, is not permitted.

Learn the details here.

Previous approach of the BKA

In the period from August 2018 to April 2022, the BKA says it stored and analyzed data records of 145,821,880 passengers as part of its passenger surveillance program. Approximately 61% of these data records were collected and stored without cause.

This approach is based on an EU directive on Passenger Name Records (PNR). This directive serves to combat terrorism and serious crime. The German police authorities have fed the data records of all airline passengers into a matching system for this purpose. Here, for example, a comparison of passenger data with police databases takes place. This is used, for example, to identify fugitive criminals. If the matching system finds a match, the data is then checked manually, according to the BKA.

Previously, this data was stored indiscriminately for all airline passengers for five years. After six months, however, "depersonalization" took place, but this was reversible by judicial order. The case of such a reversal is said to have occurred in 670 cases in recent years, according to the BKA.

Decision of the ECJ

The ECJ stated in a decision (Case C-817/19) that the processing of PNR data in the EU must be limited to what is necessary.

On the one hand, the European PNR Directive does provide for the systematic processing of passenger data when crossing an external EU border. This involves data such as address, baggage details, telephone number and names of fellow passengers.

On the other hand, the ECJ now clarifies that the directive must be interpreted narrowly. The transfer, processing and storage of PNR data to combat terrorism and serious crime must therefore be limited to what is absolutely necessary. The ECJ goes on to state that only the information listed in the Annex to the PNR Directive may be collected. In addition, there must always be an objective connection between terrorism or serious crime and the transportation of passengers. An extension to all flights is then only permissible if a country is confronted with a terrorist threat.

The PNR Directive should precisely not be misused for other purposes such as improving border control or fighting illegal immigration, the ECJ emphasized.

In addition to the amount of data collected, the ECJ also requires a reduction in the storage period.

Reactions to the ECJ decision

The BKA expressed that it considered the new restrictions "not conducive" to effective law enforcement and ensuring security.

A corresponding amendment to the German Passenger Data Act is still pending. Federal Minister of the Interior Nancy Faeser stated that she would first evaluate the decision before initiating a corresponding amendment.

Are you looking for expert support in the area of data protection and data security? Our team of experts is ready to help you in word and deed. Contact us!