PNR Ruling Seen Helping Contest Data Storage Law
Moves against an EU directive requiring communications traffic data storage may have gotten a boost from a court rejection of a U.S./EU airline passenger name records (PNR) pact, privacy experts said. A European Court of Justice (ECJ) ruling that the PNR was based wrongly in EU internal market law, instead of tenets involving law enforce, isn’t likely to halt transfer of Europeans’ personal data to the U.S. But Ireland said it could help its case against the data retention directive.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
The ECJ annulled the PNR agreement May 30. But the Advocate General said if done correctly it wouldn’t breach the European Community treaty or the privacy directive, said James Michael, senior research fellow, London U. Institute of Advanced Legal Studies. The EC wants a mandate to negotiate the same terms with a different legal basis, aiming to firm up a new agreement by summer’s end, he said.
The data retention directive, like the PNR pact, was based on EC treaty internal market provisions. It aims to harmonize national standards for storing Internet and telecom traffic data and providing them to authorities. But if PNRs should have been treated in terms of security, perhaps the directive should have been, too, Michael said.
Ireland contested the data retention directive in the ECJ July 5, claiming it should be based on security, not internal market, laws, a govt. spokeswoman said: “Ireland considers that the ECJ ruling in the PNR case helps to support the challenge.”
The ECJ made “quite clear” PNR data transfer amounts to public security- and law enforcement-related data handling, said Joe McNamee, EU policy dir. for lobbying firm Political Intelligence: “The question is whether the data retention directive was passed in order to ensure the reduction of barriers in the single market caused by data retention or wether it relates to public security and the activities of the state in areas of criminal law.”
It’s questionable whether data retention is an internal market issue if companies whose markets the directive is supposed to protect -- communications services providers (CSPs) -- don’t want the law, McNamee said. Harmonization as stipulated by the directive far exceeds the practices of CSPs in the 25 EU nations, and the measure itself arose not from “a real need to harmonize (non) existing member state law” but from fears of terrorism, he said.
The data protection directive “seems to have created a loophole in the protection of European citizens when their data are used for law enforcement, even if it concerns data initially processed for commercial purposes like the PNR data,” said European Data Protection Supervisor Peter Hustinx.
The PNR ruling’s link to the retention directive needs “careful analysis, as it has its own features and I don’t want to give a quick and speculative answer,” Hustinx told us. It’s important to treat data retention as a different case, to be judged on its own, because it differs from the PNR, he said. Hustinx knows of Ireland’s appeal of the directive but not its grounds, he said: “We'll study them carefully, and then decide on a possible intervention before the court.” Hustinx intervened in the European Parliament’s challenge of the PNR on behalf of data subjects.
If Ireland’s suit succeeds, EU institutions will have to start from scratch to try to approve the directive under the proper legal framework or “in theory, edit the directive to squeeze it into” it, McNamee said. The ECJ always could decide data retention is properly an internal market issue, Michael said. While a revised PNR agreement is likely to emerge without much ado, he said, data retention is “the directive to watch.”