Passenger Name Record Agreements in EU law

Passenger Name Record data include information such as names, travel dates, itineraries, seats, baggage, contact details, means of payment and many other facts related to the life and habits of travellers. The transfer of data collected by airline carriers to the authorities of third countries towards which flights are headedFootnote ⁹ has been regulated over time by several agreements signed between the EU and non-EU countries to prevent and counter international terrorism. Data can be collected, alternatively, through the ‘push’ or ‘pull’ methods. The latter simply means that the authority vested with the power to collect it can directly access the data; the former method implies a data request to an air carrier. Pursuant to Article 25 of Directive 95/46/EC,Footnote ¹⁰ in order to allow the exchange of Passenger Name Record data between the EU and a third country, the third country must ensure an ‘adequate level of protection’, certified by the European Commission through a so-called adequacy decision based on the existence of appropriate guarantees in the third country’s domestic law or in its international commitments. According to the Court of Justice, an ‘adequate level of protection’ means that protection must be ‘essentially equivalent’Footnote ¹¹ to that guaranteed by the EU.

The need to deal with Passenger Name Record exchange arose for the first time in 2001, when US legislationFootnote ¹² obliged airline carriers travelling to the US to transfer passengers’ data to US Customs and Border Control.Footnote ¹³ Therefore, the European Commission needed to reach an agreement with US authorities on the transfer of Passenger Name Record data. This agreement, signed on 28 May 2004,Footnote ¹⁴ had several controversial aspects. First of all, it provided US officials with direct access to data (pull system), without any active participation in the transfer of data by airline carriers. In addition, the reasons justifying data collection were vague and the retention period was long (three and a half years, which can be extended in case of investigation).Footnote ¹⁵ For these reasons, the EU-US Passenger Name Record Agreement was challenged before the Court of Justice by the Parliament, which called for the annulment of both the Council decision on the conclusion of the Agreement and the Commission adequacy decision.Footnote ¹⁶ The Court annulled both, arguing that an incorrect legal basis had been invoked.Footnote ¹⁷ Specifically, the EU institutions had acted within the first pillar, i.e. the internal market, while the Court held that they should have acted within the third pillar, i.e. cooperation in the fields of justice and home affairs, since the fight against terrorism and serious crime was the main purpose of the agreement. As a consequence, the EU institutions were urged to enter into a new agreement.

On 23 July 2007, the Council approved a new Passenger Name Record Agreement,Footnote ¹⁸ which incidentally raised even more concerns in terms of fundamental rights than the first version. In particular, a wider variety of data could be collected, encompassing also some sensitive data (although a filtering mechanism was provided) and the retention period was extended (up to seven years). Additionally, there were no ‘robust legal mechanisms’Footnote ¹⁹ enabling people to challenge the potential misuse of their data. The shift from the ‘pull’ to the ‘push’ system in data sharing marked the only improvement in terms of rights protection. Once again, the Parliament considered guarantees for passengers’ rights to be insufficient and passed a resolution asking for the renegotiation of the Agreement.Footnote ²⁰

The third and current Passenger Name Record Agreement between the EU and the US has been in force since 1 July 2012 and has not been challenged before the Court.Footnote ²¹ It secures several important guarantees (e.g. by delimiting the purpose and duration of data retention), but still leaves wide discretion to US authorities in determining exceptions to the retention period and to the anonymisation of data.Footnote ²²

Canada enacted rules on Passenger Name Record similar to those legislated by the USFootnote ²³ and in 2005 the EU entered into an Agreement with that country too.Footnote ²⁴ That deal’s major flaws are similar to those identified in the above-mentioned EU-US Agreements. Although the EU-Canada Agreement provided for a ‘push’ system and envisaged a difference in retention times depending on whether the passengers were under investigation, it included a few controversial provisions on data re-personalisation and complex administrative procedures for filing complaints.Footnote ²⁵

When the Agreement with Canada expired in 2009, negotiations once again got underway and a new Agreement was signed on 25 June 2014.Footnote ²⁶ Parliament, worried about the detrimental effect certain provisions could potentially have on human rights, triggered the Article 218(11) TFEU procedure, which entitles it to seek the opinion of the Court of Justice on the compatibility of an international agreement with the EU Treaties before its approval and definitive entry into force.Footnote ²⁷

The Opinion of Advocate General Mengozzi

On 8 September 2016, Advocate General Paolo Mengozzi held, in his Opinion to the Court,Footnote ²⁸ that several provisions of the Passenger Name Record Agreement were patently contrary to Articles 7 (the right to privacy), 8 (the right to data protection) and 52 (the principle of proportionality) of the Charter.Footnote ²⁹

As a first step, in considering the existence of any interference with the rights to privacy and data protection, the Advocate General maintained that a serious interference did existFootnote ³⁰ because the intrinsic characteristics of the collected data revealed a great deal about the lives and habits of passengers. Consequently, the right to privacy under Article 7 and the ‘closely connected but nonetheless distinct’Footnote ³¹ right to data protection under Article 8 of the Charter were impaired.

The second step of Mengozzi’s Opinion focused on the justifiability of such an interference, as assessed under the scheme set forth in Article 52 of the Charter. According to this provision, three aspects must be taken into account: first, whether the interference is provided for by law and respects the essence of the right; second, whether it pursues a legitimate aim; and third, whether it complies with the principle of proportionality.Footnote ³² As to the first criterion, from a formal point of view, the Advocate General considered the interference provided for by law: pursuant to the EU Treaties, once all phases for their approval have been concluded, international agreements become part of EU law.Footnote ³³ From a substantive perspective, according to Advocate General Mengozzi, the Agreement is clear, accessible and foreseeable enough to meet the standards in terms of ‘quality of the law’ as required by the Court of Strasbourg’s case law.Footnote ³⁴ Last but not least, the essence of the right is not impaired, since a mechanism of gradual depersonalisation of data does not allow specific conclusions to be drawn on the private lives of the persons concerned.Footnote ³⁵

Given the correspondence between the proclaimed goal of the Agreement, i.e. combating terrorism and other serious crime, and the ‘general interest’ prescribed by Article 52 of the Charter, the Advocate General examined the proportionality of the means employed, stressing the necessity of strict scrutiny, also in light of the Digital Rights and Schrems judgments.Footnote ³⁶ From this perspective, the Advocate General noted that, even if the means had been suitable for pursuit of the aim,Footnote ³⁷ they were not strictly necessary. On the one hand, according to Mengozzi’s Opinion, sensitive data should be excluded; on the other, an exhaustive list of ‘serious offences’ should be drawn up. Moreover, the Advocate General pointed out the very long retention period, which could not be justified for any objective reason:Footnote ³⁸ pursuant to the Agreement, all data must be retained for five years from the date of collection, albeit ‘masked’ after 30 days. However, under specific circumstances – such as investigative necessity – they could be unmasked. Thus, data are simply pseudonymised, rather than anonymised (the difference between the two being in fact that anonymisation is irreversible, whilst pseudonymisation is not). Pseudonymised data do not cease to fit the category of ‘personal data’; this means that data protection guarantees still apply (which would be different if the data had been anonymised).Footnote ³⁹ Additionally, the Advocate General criticised the indiscriminate application of the measures, irrespective of any suspicion of involvement in terrorist activity.Footnote ⁴⁰ Furthermore, these flaws were combined with the vaguely defined Canadian authority tasked with processing the data, a lack of strict rules on access to data and the uncertain reference to judicial remedies.

Concluding his Opinion, Advocate General Mengozzi warned EU institutions against the adoption of the Agreement in its current version. Although admitting that there were ways to bring Passenger Name Record data transfer into compliance with human rights protection,Footnote ⁴¹ he stated that this was not the case with the 2014 EU-Canada Agreement.

The Court of Justice’s Opinion: main points

The Court of Justice delivered its Opinion on 26 July 2017,Footnote ⁴² adhering to the Advocate General’s stance and arguing that the Agreement could not be adopted in its current form. Although EU institutions could even decide not to adopt any agreement at all, in October 2017 the Commission issued a recommendation for a Council decision on re-opening negotiations in compliance with the Court’s Opinion.Footnote ⁴³ Therefore, it is likely that a new agreement will be signed to avert – among other things – the impairment of EU-Canada relations.

In its ruling, the Court addressed both parts of Parliament’s request, i.e. the appropriate legal basis for the Council decision on the conclusion of the Agreement and the compatibility of the text with Articles 7 and 8, read in light of Article 52 of the Charter.

As to the first question, the Council decision was based on Articles 82(1)(d) and 87(1)-(2)(a) TFEU, concerning measures that facilitate judicial cooperation among Member States in relation to criminal matters and measures on the collection of information aimed at police cooperation, respectively. The Parliament claimed that the correct legal basis was instead Article 16 TFEU,Footnote ⁴⁴ which ensures the protection of personal data and empowers the Council and the Parliament to enact measures regulating their processing. According to the Court of Justice, the Agreement should have been based on Articles 16 and 87(2)(a) jointly,Footnote ⁴⁵ but not on Article 82(1)(d). In particular, the Court argued that there were no provisions envisaging a facilitation of judicial cooperation and that the Canadian authority in charge of the use of Passenger Name Record data was not a judicial authority, nor equivalent to one. In order to reach its conclusion, the Court underlined that the Agreement has a twofold aim: the transfer of Passenger Name Record data must both serve the interest of public security and respect the rights to privacy and data protection. The Court noted that such objectives lie within the scope of both Articles 16 and 87(2)(a) TFEU and reiterated that the transfer of Passenger Name Record data to third countries cannot take place unless an ‘adequate level of protection’ is demonstrated,Footnote ⁴⁶ i.e. the level of protection must be ‘essentially equivalent’Footnote ⁴⁷ to that guaranteed by the EU.

The Court of Justice went on to evaluate the compatibility of the Agreement with the standards set by the TFEU and the Charter. And the Court remarked that, in the case at hand, only Article 8 of the Charter should be regarded as a parameter for data protection, without separately considering Article 16 TFEU, the former being more specific than the latter.

First of all, the Court of Justice found an interference with the rights concerned; Passenger Name Record data reveal information that allows identification of the personal data of specific individuals, which must then be processed within the meaning of Article 8 of the Charter.Footnote ⁴⁸ In order to assess whether such an interference is justified, the Court examined the basis for its limitation, finding itFootnote ⁴⁹ to be legitimate, laid down by law and pursuing an objective of general interest (public security). Moreover, such interference did not affect the essence of the rights concerned.

However, when extensively addressing the necessity of the interference, the Court of Justice considered several EU law parameters violated by the current text of the Agreement.

First, the Court argued that it was not clear which types of Passenger Name Record data were covered by the Agreement.Footnote ⁵⁰ For example, use of the word ‘etc.’ was criticised,Footnote ⁵¹ as well as the expression ‘all available contact information’.Footnote ⁵² In addition, the transfer may include sensitive data, which were then transferred and processed with no solid justification. Remarkably, prevention of terrorism was not deemed to be justification by the Court.Footnote ⁵³

Second, the Court of Justice addressed automatic processing. According to the Agreement,Footnote ⁵⁴ data are collected and automatically analysed, and cross-checked against databases containing information on suspect terrorists; if any profiles match, the analysis is repeated in a non-automated manner in order to decide whether it is necessary to take individual measures against targeted passengers. The Court welcomed the fact that automatic processing has to be followed by a re-examination through non-automated means.Footnote ⁵⁵ It did, however, specify that the databases against which data are cross-checked must be ‘reliable, up to date and limited to databases used by Canada in relation to the fight against terrorism and serious transnational crime’.Footnote ⁵⁶

Third, the Court of Justice found some of the purposes for processing Passenger Name Record data to be unclear, not well enough defined. Although the definitions of ‘terrorist offence’ and ‘serious transnational crime’ were well specified,Footnote ⁵⁷ the Agreement stated that Passenger Name Record data could also be processed for ‘other purposes’ which were not specified in detail.Footnote ⁵⁸

The fourth and fifth points analysed by the Court, i.e. the competent Canadian authority charged with processing the data and the passengers affected by measures contained in the Agreement, were deemed to comply with EU law standards since they were defined with sufficient clarity and precision.Footnote ⁵⁹

Sixth, there were no clear and precise rules on the retention of data. The Court of Justice recalled that there must be a connection, based on objective criteria, between the retention of personal data and the aim pursued by the Agreement.Footnote ⁶⁰ In addition, data use must be regulated by substantive and procedural conditions.Footnote ⁶¹ According to the Agreement, data could be retained and used before the arrival of passengers, during their stay in Canada, upon and even after their departure.Footnote ⁶² The Court of Justice warned that post-departure data retention is particularly tricky. Since such data have in fact already been checked and verified, continued retention should not be necessary, unless there are objective reasons that require doing so.Footnote ⁶³ On the contrary, as to retention and use before passengers’ arrival and during their stay in Canada, the Court acknowledged the existence of a connection with the pursued objective. Nonetheless, rules about retention and use were found to exceed what is strictly necessary,Footnote ⁶⁴ due to the lack of a review procedure (carried out by a judicial or an independent administrative body) on use of data pertaining to passengers staying in Canada.

Lastly, the Court of Justice analysed provisions concerning disclosure. The Agreement allowed the disclosure of data to Canadian and third-country authorities, as well as, under certain circumstances, to individuals. In all these cases, the concerned measures did not comply with the strict necessity test. While disclosure of data to Canadian authorities should respect rules governing the use of data, such rules are nonetheless not well-defined.Footnote ⁶⁵ Additionally, the Court noted that, in order to avoid disclosure to the authorities of third countries masking a circumvention of guarantees enshrined in EU law, an agreement between the EU and the third country or a Commission adequacy decision should certify an equivalent level of protection. The EU-Canada Passenger Name Record Agreement did not require this; therefore, disclosure was not limited to what is strictly necessary.Footnote ⁶⁶ As to disclosure to individuals, which is allowed when the ‘legitimate interests of the individual [are] concerned’, the Court found a major flaw; the Agreement did not specify legal requirements and limitations, concerned interests, envisaged purposes or judicial or administrative oversight.Footnote ⁶⁷

After assessing the necessity and proportionality of the interference, the Court of Justice examined two further important aspects of the Agreement: passengers’ guarantees and oversight mechanisms. As to the first issue, the Court condemned the lack of a system of notification. In other words, passengers should be made individually aware of the use and processing of their data.Footnote ⁶⁸ As to the second, the Agreement stated that data protection safeguards would be subject to the oversight of an ‘independent public authority’ or an ‘authority created by administrative means that exercised its functions in an impartial manner and that has proven a record of autonomy’. According to the Court, the use of this alternative wording implied that oversight, or at least part of it, could hypothetically be carried out by a body that is not fully independent.Footnote ⁶⁹ Hence, the Agreement did not ensure complete independence during the oversight process.

Reading Opinion 1/15

In order to analyse this Opinion, it is worth focusing on two crucial aspects. Firstly, the Court of Justice allowed mass surveillance as a matter of principle, but only if it respected certain detailed and strict requirements that were perhaps not easy to implement. Therefore, there was a sort of discrepancy between what was theoretically acceptable and what was practically achievable – or, at least, had been achieved until that moment. Secondly, the Court caused a sort of ‘revolution’ in the EU institutional allocation of powers, insofar as it addressed the wording and technical mechanisms of the Agreement in such a manner that it seemed to take over the role of a legislative body, concretely drafting a normative text.

The following analysis will concentrate on these two points, highlighting the importance of the Opinion and its remarkably innovative features. As to guidelines emerging from this decision, the Court clarified, once again and more specifically than in other decisions, that the transfer, retention and use of Passenger Name Record data could be deemed compatible with guarantees enshrined in EU law as long as they respected certain specific conditions.

First, the categories of Passenger Name Record data covered by the Agreement should be clearly and precisely indicated and this had not been done in some of the cases listed in an ad hoc Annex. From this perspective, the Court even criticised the wording of some of its headings, engaging in a particularly careful and detailed analysis.Footnote ⁷⁰ In this passage, strict scrutiny is prescribed. In other words, in a (successful) attempt to secure the highest level of protection for individuals, the Court did not merely concern itself with appearances; it determined that the Agreement’s drafting was unacceptably vague, even if the list of Passenger Name Record data provided by its Annex contained a delimitative clause,Footnote ⁷¹ hence making it exhaustive.Footnote ⁷² In this way, the Court of Justice built upon previous decisions in which it had abstractly affirmed the need for an exhaustive list.Footnote ⁷³ This time, though, the Court scrutinised the merits of such a list, thus demonstrating the substantive nature of its review. Moreover, the strong claim of excluding sensitive data was to be expected, since other recent EU legislation contained the same prohibition. For example, Directive 2016/681,Footnote ⁷⁴ dealing with Passenger Name Records at the EU level, keeps sensitive data beyond its scope.Footnote ⁷⁵ Indeed, sensitive data could hypothetically be transferred to Canada if a ‘precise and solid justification’Footnote ⁷⁶ existed, but, and importantly, the Court of Justice considered that the need to defend public security against terrorism was not enough. This stance implied that public security was not sufficient justification if generally considered, as there might be specific situations in which it might become so. Consequently, what seems to be subject to absolute preclusion – the use of sensitive data – might instead be considered a feasible solution, albeit in very specific circumstances. This view on sensitive data was closely connected to the Court’s approach to discriminatory profiling. The Court implicitly acknowledged that, by relying on individuals’ sensitive data, such as religion or race, public authorities could be led to harshen measures against specific groups of people (e.g. Muslims). This would obviously result in discrimination of such groups, being targeted with counter-terrorism measures in a different manner from others.Footnote ⁷⁷ The Court’s stance appears prima facie to impose an absolute ban on profiling, but there are aspects that the Court did not consider and that could allow this discriminatory activity. As a matter of fact, although the use of sensitive data was undoubtedly the most blatant technique for enacting discriminatory profiling, it was not the only one. It is possible, for example, to profile people based on frequent travel destinations or food preferences. These factors do not fall within the definition of ‘sensitive data’, but could nonetheless be decisive to public authorities’ choice to target a specific group of persons. The Court should have shed more light on these points. Nevertheless, at least in principle, the prohibition against profiling, as well as the ban on the use of sensitive data, provides some clue to the Court’s attitude on the complex balance between security needs and privacy rights. And this approach is more than welcome, especially in challenging times.

Second, data should not only be processed by automated means; this should be followed by a non-automated re-examination.Footnote ⁷⁸ This is a key passage and heralds a welcome and commendable stance taken by the Court against the most extreme features of surveillance tools. The Court of Justice did not blame the envisaged Agreement for being flawed on this point, as it recognised that its Article 15 provided for non-automated analysis when it was necessary to take ‘decisions adversely affecting a passenger to a significant extent’. At any rate, the Court of Justice stated something crucial in relation to the automated processing phase, implying a cross-checking of data with databases containing data of suspected terrorists. The Grand Chamber remarked that such activity should be carried out through ‘safe’ and ‘reliable’ databases, limited to those used by Canada for counter-terrorism purposes. In this case, the statement of the Court is the result of a praiseworthy attitude towards individual rights, even if it failed to specify what ‘safe’ and ‘reliable’ meant in relation to databases. And this is the only objection that might be raised against the passage. Once again, concerns expressed about (purely) automatic analysis are coherent with a firm rejection of adverse decision-making based solely on automated profiling. Actually, if the whole mechanism worked automatically, measures would also be automatically taken in case of the existence of certain features, which would be detected by a technological device, without any human control. This strand of the Court’s reasoning closely retraced Article 15 of Directive 95/46 – which will be replaced by Article 22 of Regulation 2016/679Footnote ⁷⁹ from May 2018 onwards. Both provisions forbid resort being taken to automated decision-making for decisions affecting individuals (although some exceptions are envisaged, e.g. the subject’s explicit consent). Hence, the use of automated analysis is not banned; instead, what is prohibited is using it as a basis for taking decisions. In other words, while complex algorithms are helpful for performing ‘ordinary’ checks on passengers, human intervention (i.e. a double check) must immediately be called into play as soon as a situation of potential risk is perceived. As a matter of fact, only human beings can verify the merits of automatic results, for example by further investigating a person’s background and police record, thereby logically connecting pieces of information in a way that a machine would presumably not be able to do.

Third, Passenger Name Record mechanisms should be grounded on strong justification purposes. Consequently, stating that ‘other purposes’ are not well-defined,Footnote ⁸⁰ the Court is particularly strict in analysing the wording of the Agreement. And this should be praised, as it is a rights-oriented approach.

Fourth, as to the retention and use of collected data – a crucial aspect of the Passenger Name Record Agreement – information on passengers who have already left Canadian territory should be stored only when there is ‘objective evidence’Footnote ⁸¹ that those passengers still present a potential risk in relation to terrorist activities and serious crime. This is a major point of the Opinion. As a matter of fact, such differentiation (among passengers before their arrival in Canada, during their stay, upon or after departure) is not provided for by the 2016 Passenger Name Record Directive. While, for certain other aspects, the Passenger Name Record Directive complies with the Court’s guidelines (e.g., the prohibition against using sensitive dataFootnote ⁸² and the need for human intervention in the processing of dataFootnote ⁸³ ), this is a tricky issue. This lack of distinction could invite legal challenges to such legislation. In effect, if the Agreement had to be renegotiated according to that differentiation, whilst the Directive remained in its current form, it would be easy to envisage a differentiation depending on whether data are collected within EU territory or in non-EU jurisdictions (specifically, in Canada). Moreover, the addressed differentiation could impose the need to correlate the intelligence analysis of Passenger Name Record data with mechanisms aimed at border control.Footnote ⁸⁴ Undoubtedly, the Court of Justice’s reasoning is influenced by previous judgments on data retention, mainly Digital Rights and Tele2 (substantively reiterating the principles set in Digital Rights).Footnote ⁸⁵ Nonetheless, in Opinion 1/15 the Court did not merely apply previous findings. For example, in Digital Rights the Court of Justice quashed the provision of the Data Retention Directive leaving Member States leeway to choose between 6 and 24 months, while in this case a much longer period (five years) was deemed appropriate. Indeed, there was no contradiction: what the Court of Justice criticised in Digital Rights was not the length of the period per se, but the fact that specific criteria to choose between the minimum and the maximum had not been set. On the contrary, in Opinion 1/15, the retention period (five years, the same as the Passenger Name Record DirectiveFootnote ⁸⁶ ) was fixed by the Agreement and it was taken into consideration as such. Rather, what is unclear, thus potentially causing lack of legal certainty, was the standard it used to review retention periods. Furthermore, another passage deserves attention: although the Court’s Opinion followed the Advocate General, on this specific point there was a subtle difference. While the Advocate General emphasised the mechanism of depersonalisation of data (i.e. masking them after 30 days), maintaining that it played a pivotal role in the safeguard of fundamental rights, the Court did not pay much attention to it, in spite of the quite long retention period. Briefly, two (slightly) different approaches to the restriction of fundamental rights for national security reasons can be distinguished. On the one hand, the Advocate General assumed that a retention period of five years was excessive, but it could be remedied through data masking; on the other hand, the Court maintained that such a period was justifiable per se. The Advocate General’s stance must be welcomed because it was more explicit and clear than the Court’s approach. The Court did not explicitly address the length of retention, confining itself to a concise assertion on an issue that could cause uncertainty as to the criteria employed to rule on the retention period.

Fifth, if Canadian authorities have to disclose collected data to the authorities of a third country, an adequacy decision by the Commission regarding such a third country or an international agreement in place between it and the EU should be adopted, in order to avoid indirect circumvention of EU law principles. In this regard, the Court of Justice strongly relied on Schrems, which clarified the meaning of ‘adequate level of protection’ as ‘essential equivalence’. Such a statement does not mean that the standards of data protection in the third country must coincide in toto with EU standards (namely, the relevant articles of the Charter and specific data protection provisions), but that at least the essence of guarantees must be comparable. Consequently, non-EU countries should conform at least to the core of EU data protection law (e.g., purpose limitation and independent oversight).

Sixth, according to the Court, data subjects should be individually notified when their Passenger Name Record data have been used and retained by the competent Canadian authority or when data are disclosed. This is another key point. Notification does not constitute a ground for data processing (as does, for instance, explicit consent), but it is an ex post guarantee, to be enacted at a later stage, i.e. when (and if) a passenger’s data are processed for investigative purposes. Coherently, the Court specified that notification may take place ‘as soon as this information is no longer able to jeopardise the investigations’.Footnote ⁸⁷ The issue of individual notification had not been expressly addressed in detail in Digital Rights nor was it regulated by the Passenger Name Record Directive. Therefore, the Court’s stance on the matter could represent another ground for a legal challenge to the Passenger Name Record Directive.

Ultimately, independent oversight mechanisms should be provided.Footnote ⁸⁸ This caveat may cast doubts on the mechanisms set forth by the Privacy Shield, which has regulated the exchange of data between the EU and the US since that the previous framework, the Safe Harbour Agreement, was struck down as a consequence of the Schrems judgment. From this perspective, the Civil Liberties, Justice and Home Affairs Committee of the Parliament (LIBE) has raised concerns on this scheme, underlining, among other things, the insufficient independence of the body charged with oversight.Footnote ⁸⁹

In sum, not only will this Opinion have significant impact on the Passenger Name Record Directive and the Privacy Shield, but it could also influence other Passenger Name Record agreements, both existing (i.e. with the US and Australia) and future ones (relevantly, while this proceeding was pending, the Parliament asked for negotiations with Mexico to be stopped).Footnote ⁹⁰

From a more general point of view, this is the first time the Court of Justice has ruled on the compatibility of an international agreement with guarantees enshrined in the Charter, regarded as an autonomous legal parameter. In doing so, the Court took an important step, for two main reasons: on the one hand, this reinforced the ‘constitutional’ value of the Charter,Footnote ⁹¹ which was afforded the capability to function as the only parameter for deciding whether challenged acts (including international agreements) violated EU law. On the other hand, international agreements were substantively considered the equivalent, in the external dimension, of EU legislation in the internal dimension.Footnote ⁹² This equivalence was affirmed not only at the theoretical level of the hierarchy of sources, but also as to the practical implications of the standards to be respected. This approach reflects the supremacy of EU constitutional values, even over what has been negotiated at the international level.

Additionally, both the Parliament, in triggering the procedure, and the Court of Justice, in deciding the issue, took full advantage of the mechanism – explicitly envisaged by the TFEU – allowing challenges to an international treaty that allegedly derogates from EU law. The former sought the Court’s Opinion on an Agreement that was politically and strategically crucial, given the current seemingly endless threat of terrorism. In parallel, the Parliament – perhaps due to its institutional position and, more specifically, to its role within the international treaty-making procedure – did not embrace a securitarian approach, as opposed to the Council and the Commission. Therefore, not all EU institutions that take part in (lato sensu) legislation-making currently let security prevail over rights. By way of its request, the Parliament strongly invited the Court of Justice to rule definitively on the merits of a Passenger Name Record agreement. As said, when it repealed the first Agreement with the US,Footnote ⁹³ the Court’s reasoning focused exclusively on the choice of the legal basis;Footnote ⁹⁴ under such circumstances, the Parliament had not relied on the Charter when it raised human rights concerns, since it merely had interpretative value in the period before the Lisbon Treaty. For its part, the Court of Justice quickly seized the opportunity to do what it had never done before, i.e. explicitly extending principles elaborated in a long series of mainstream decisions. This conveys the idea that guarantees for the rights to privacy and data protection must be affirmed on a larger scale, even in challenging times.

The Court of Justice also did something else that is worth remarking upon: in carefully analysing the text of the Agreement, even censuring its wording, it engaged in a task that could be defined as ‘borderline’ to that of a legislative drafting committee. The Court suggested the correct way to redraft the Agreement to other EU institutions, not only by way of principled declarations, but also by proffering concrete examples of the words and phrases to be substituted. This high rate of ‘intrusiveness’ can be related to the gist of this decision, which can be synthesised as follows. Conceiving a legal framework in which surveillance has no role would be utopian, given the seriousness of the current terrorist threat; nonetheless, mass surveillance must be kept subject to particularly strict rules. Against this background, if the policy-maker proves unable to remain within these limits and to guarantee that individual rights will not be totally sacrificed in the name of security, courts will be increasingly called to play a pivotal role, even going beyond their institutional attributions and bearing quasi-legislative (and political) responsibility.Footnote ⁹⁵