Use of airline passenger data must be limited, top EU court says

"The Court considers that respect for fundamental rights requires that the powers provided for by the PNR Directive be limited to what is strictly necessary," the CJEU said.

EU airline passenger data collected to combat serious crime must be limited to what is strictly necessary, Europe's top court said on Tuesday, citing the importance of fundamental rights. The Passenger Name Record Directive (PNR), adopted in 2016, allows police and justice officials to access passenger data on flights to and from the EU to combat serious crimes and maintain security in the 27-country bloc.

Rights groups however said data retention even by law enforcement and other authorities is an invasive and unjustified encroachment on fundamental rights to privacy and data protection. In 2017, Belgium's Human Rights League (LDH) and other rights groups challenged the PNR at a Belgian court, saying it allows the collection of too much data and could lead to mass surveillance, discrimination and profiling.

The court subsequently sought advice from the Luxembourg-based Court of Justice of the European Union (CJEU). "The Court considers that respect for fundamental rights requires that the powers provided for by the PNR Directive be limited to what is strictly necessary," the CJEU said.