Information society, privacy and data protection

Safeguarding fundamental rights in today’s information society is a key issue for the EU and increasingly for FRA as more and more people use information and communications technologies (ICT) in their daily lives at work and at home.

However, this growing use of ICT is creating fundamental rights challenges. These range from concerns about privacy and the potential misuse of personal data online to the threats posed by cybercrime or large-scale surveillance operations. As a result, every EU citizen may, at some point, face violations of their fundamental rights, such as their right to privacy, freedom of expression or freedom of association.

In line with the positions taken by international organisations such as the United Nations and the Council of Europe, FRA supports the view that, despite the specific challenges posed by the increasing use of digital technologies, it is essential to ensure that fundamental rights are promoted and protected online in the same way and to the same extent as in the offline world. Recognising this, the Cybersecurity Strategy of the EU has underlined the impact of ICTs – and in particular the Internet – as follows: “Our daily life, fundamental rights, social interactions and economies depend on information and communication technology working seamlessly. (…) Fundamental rights, democracy and the rule of law need to be protected in cyberspace”. In the Code of EU Online Rights, the European Commission has underlined that “the fundamental rights and freedoms of natural persons as guaranteed by the Charter of Fundamental Rights of the European Union, the European Convention for the Protection of Human Rights and Fundamental Freedoms, and the general principles of EU Law shall be respected in this context.”

In this regard, one of FRA’s objectives is to help the EU and its Member States to find the right balance between the challenges linked to security and respect of fundamental rights. Through its socio-legal approach to data collection, the agency combines its legal analysis with findings from social research fieldwork related to information society, data protection and fundamental rights issues. The results of our research serve to inform both policy makers and practitioners at national and EU level working in this field.

EU legislative and policy context

Data protection is a fundamental right enshrined in Article 8 of the EU Charter of Fundamental Rights, which is distinct from respect for private and family life contained in Article 7 of the Charter. This feature sets the EU Charter apart from other major human rights documents which, for the most part, treat the protection of personal data as an extension of the right to privacy.

Historically, the EU has played a crucial role in driving the development and introduction of national data protection law in a number of legal systems where such legislation was not previously in place. A 1995 EU directive on the protection of individuals regarding the processing of personal data and the free movement of such data was a vital instrument in this respect. With the overall reform of the data protection framework initiated by the European Commission in 2012, once adopted - the EU will have the most protective regional legal framework in the field of data protection.

An updated overview of the implementation of the Charter related to the right to the protection of personal data is available via the FRA’s Charterpedia portal.

Practical guidance

Practical guidance on data protection issues

Based on its findings and research FRA provides practical guidance to support the implementation of fundamental rights in the EU Member States.

FRA provides practical guidance in the following areas:

Fundamental rights considerations for law enforcement when processing Passenger Name Record data

Airline passengers walking in the airport terminalFRA was requested by the European Commission (EC) in January 2014 to provide practical guidance on the processing of Passenger Name Record (PNR) data for law enforcement purposes, in light of efforts by Member States to establish national PNR systems. As a result, in informal consultation with EC services and the European Data Protection Supervisor (EDPS) and building on opinions by opinions by FRA, the EDPS and the Article 29 Working Party on PNR, FRA presented twelve fundamental rights considerations to EU Member States experts at technical level. These twelve fundamental rights considerations constitute a list of “dos and don'ts” on how to operationalise fundamental rights when establishing national PNR systems. They contribute to promote compliance with fundamental rights. They are a living document to be regularly updated based on experience gathered over time.

PNR data are information collected by air carriers for commercial and operational purposes in providing air transportation services. PNR data contain different information, such as travel dates, travel itinerary, ticket information, contact details, the travel agent at which the flight was booked, means of payment used, seat number and baggage information. They are provided by the passengers. PNR data are unverified information and are not necessarily accurate.

In recent times, law enforcement authorities increasingly use Passenger Name Record (PNR) data in an effort to combat serious crime and terrorism (see 2010 Guidance of the International Civil Aviation Organization). In the current absence of EU legislation, a growing number of Member States are establishing national PNR systems on the basis of domestic law.

The twelve fundamental rights considerations are not comprehensive. They do not absolve Member States from their duty to comply with all applicable legal obligations, including those set forth in national law and the relevant EU acquis, and in particular with core data protection principles, including the principles of necessity and proportionality, the principle of lawful processing as well as the principle of purpose specification and limitation. Practitioners can find guidance on these principles in the Handbook on European data protection law published by FRA, the European Court of Human Rights and the Council of Europe in January 2014. In order to ensure full compliance with data protection requirements, authorities responsible for processing PNR data are encouraged to collaborate with national data protection authorities, consulting them at an early stage of the process, including to carry out an impact assessment of the data protection implications of establishing a national PNR system.

At the EU level, the EC presented a proposal on the use of PNR data in February 2011 (COM(2011) 32 final) which is still subject to discussions between the co-legislators. The twelve fundamental rights considerations are without prejudice to any future EU law developments in this area, including conclusions that the EU co-legislator may reach on the necessity and proportionality of processing PNR data for law enforcement purposes.

Download: Twelve operational fundamental rights considerations for law enforcement when processing Passenger Name Record (PNR) data - EN


Twelve operational fundamental rights considerations for law enforcement when processing Passenger Name Record (PNR) data

[pdf]en (181.06 KB)

Latest news View all


Experts convene to discuss FRA mass surveillance project

On 7 November, data protection experts gathered at FRA to discuss the preliminary findings from FRA’s current project looking into safeguards and remedies in the context of large-scale surveillance by intelligence services.

Latest projects View all

Findings available

Handbook on European data protection case law

FRA will produce a handbook, in partnership with the Council of Europe and the European Court of Human Rights (ECtHR), which will present and explain European data protection law in a straightforward way for those working in this area.

Latest publications View all


Fundamental rights: key legal and policy developments in 2013. Highlights 2013

Annual report
The EU and its Member States took a variety of important steps in 2013 to protect and promote fundamental rights by assuming new international commitments, revamping legislation and pursuing innovative policies on the ground. Yet, fundamental rights violations seized the spotlight with distressing frequency: would‑be migrants drowning off the EU’s coast, unprecedented mass surveillance, racist and extremist‑motivated murders, child poverty and Roma deprivation.

Fundamental rights: challenges and achievements in 2013 - Annual report 2013

Annual report
This year’s FRA annual report looks at fundamental rights-related developments in asylum, immigration and integration; border control and visa policy; information society, respect for private life and data protection; the rights of the child and the protection of children; equality and non-discrimination; racism, xenophobia and related intolerance; access to justice and judicial cooperation; rights of crime victims; EU Member States and international obligations.

Handbook on European data protection law

This handbook is designed to familiarise legal practitioners who are not specialised in the field of data protection with this area of law. It provides an overview of the EU’s and the CoE’s applicable legal frameworks.