These twelve fundamental rights considerations constitute a list of “dos and don'ts” on how to operationalise fundamental rights when establishing national PNR systems. They contribute to promote compliance with fundamental rights. They are a living document to be regularly updated based on experience gathered over time.
PNR data are information collected by air carriers for commercial and operational purposes in providing air transportation services. PNR data contain different information, such as travel dates, travel itinerary, ticket information, contact details, the travel agent at which the flight was booked, means of payment used, seat number and baggage information. They are provided by the passengers. PNR data are unverified information and are not necessarily accurate.
In recent times, law enforcement authorities increasingly use Passenger Name Record (PNR) data in an effort to combat serious crime and terrorism (see 2010 Guidance of the International Civil Aviation Organization). In the current absence of EU legislation, a growing number of Member States are establishing national PNR systems on the basis of domestic law.
The twelve fundamental rights considerations are not comprehensive. They do not absolve Member States from their duty to comply with all applicable legal obligations, including those set forth in national law and the relevant EU acquis, and in particular with core data protection principles, including the principles of necessity and proportionality, the principle of lawful processing as well as the principle of purpose specification and limitation. Practitioners can find guidance on these principles in the Handbook on European data protection law published by FRA, the European Court of Human Rights and the Council of Europe in January 2014. In order to ensure full compliance with data protection requirements, authorities responsible for processing PNR data are encouraged to collaborate with national data protection authorities, consulting them at an early stage of the process, including to carry out an impact assessment of the data protection implications of establishing a national PNR system.
At the EU level, the EC presented a proposal on the use of PNR data in February 2011 (COM(2011) 32 final) which is still subject to discussions between the co-legislators. The twelve fundamental rights considerations are without prejudice to any future EU law developments in this area, including conclusions that the EU co-legislator may reach on the necessity and proportionality of processing PNR data for law enforcement purposes.
The work builds on FRA's earlier opinion on the proposal for a PNR Directive and opinion for a Council Framework decision on the use of PNR data for law enforcement purposes.
