The European Court of Justice (ECJ) has ruled an EU agreement with Canada on the transfer of airline passenger name record (PNR) data incompatible with EU rights.
The EU-Canada PNR agreement was signed in 2014 but requires the consent of the European Parliament, which referred it to the Court of Justice, before coming into effect.
MEPs sought the European court’s view on whether the agreement includes sufficient safeguards of citizens’ personal data and privacy.
The court ruled this week that “several provisions” of the agreement “do not meet requirements . . . although the systematic transfer, retention and use of passenger data are, in essence, permissible”.
The ECJ ruled data could not be retained for five years as the agreement allows, but only held for “as long as necessary”.
The court also ruled that EU citizens would be entitled to notification if their data was used in any way, that restrictions apply to the sharing of data with a third country, and that the entire process should be subject to independent oversight.
Law firm Hill Dickinson, a specialist in legal issues affecting aviation and travel, noted that although the ECJ ruling “is not technically binding” on the European Parliament it would be likely to lead to legal challenges “without amendments” to the agreement.