21 June 2022: The Court of Justice of the European Union (CJEU) has ruled that “in the absence of a genuine and present or foreseeable terrorist threat to a Member State, EU law precludes national legislation providing for the transfer and processing of the Passenger Name Record (PNR) data of intra-EU flights and transport operations carried out by other means within the European Union”. The ruling is available to download from the top right of this page.

Thus, according to the Court, Member States can collect air passenger data for intra-EU flights only if they prove that there are sufficiently solid grounds for considering that they are confronted with a terrorist threat which is shown to be genuine and present or foreseeable for a period which is limited to what is strictly necessary. If these conditions are not met, the collect of PNR data cannot be extended to all intra-EU flights, but must be limited to intra-EU flights relating, inter alia, to certain routes or travel patterns or to certain airports for which there are, at the discretion of the Member State concerned, indications that would justify that application.

Indeed, under the PNR Directive, airlines must collect passenger’s PNR data on extra-EU flights entering and leaving the European Union, for the purposes of preventing and detecting terrorist offences and serious crimes. In its current version, the PNR directive allow Member States the possibility to apply the directive to intra-EU flights.

The ruling comes after a preliminary ruling requested by the Belgian Constitutional Court in October 2019 on the validity and compatibility of the PNR Directive with EU law. In July 2017, the Ligue des droits humains (LDH) filed an action for annulment against the Law of 25 December 2016 which transposed into Belgian domestic law the PNR Directive, the API Directive and the Directive 2010/65 on reporting formalities for ships arriving in and/or departing from ports of the Member States claiming that the national law infringes the right to respect for private life and the right to the protection of personal data guaranteed under Belgian and EU law.

Following to a preliminary ruling, the CJEU does not decide the dispute itself since it only gives to national courts an interpretation of the European Union law or the validity of a European Union act. It is for the national court or tribunal to dispose of the case in accordance with the Court’s decision, which is similarly binding on other national courts or tribunals before which a similar issue is raised.