Passenger Name Records: Necessary Data Retention to Fight Crime and Terrorism, or Threatening Privacy and Data Protection?

Chapter 23 examines whether the PNR Directive—lately in the centre of the judgment Ligue des droits humains—is as such compatible with the rights to privacy and data protection. In this judgment from 21 June 2022, the Court of Justice of the European Union (CJEU) introduced several measures seeking to align the Passenger Name Record (PNR) Directive with these fundamental rights. This includes more precise definitions of various provisions, effectively reducing the scope of the Directive, as well as the length of the data retention period. The judges also impose several safeguards pertaining to the collection, processing, and retention activities, notification of passengers, automated processing, and the non-automated review of positive matches. This chapter considers these measures introduced by the CJEU in light of established data retention case law. Furthermore, it examines whether the PNR Directive remains fit for the purposes of combating serious crime and terrorism. In conclusion, we argue that the CJEU aims to introduce several commendable measures to ensure compatibility with fundamental rights, yet seemingly ignores a more fundamental concern: in its current form the PNR system as such appears unfit for the purpose of combating serious crime and terrorism.