The European Court of Justice on the EU-Canada Passenger Name Record Agreement

Introduction

In a world constantly struggling against the continuing threat of international terrorism since the events of 2001, which has grown even stronger in recent years, the rights to privacy and data protection are frequently curtailed by counter-terrorism policies in an attempt to guarantee security. Surveillance measures entailing an indiscriminate collection and retention of data, which are then accessed and analysed by intelligence agencies, are examples of this. ¹ These mechanisms are ensconced in both national and EU law (indeed, the latter often influences the former). Among the EU’s tools, not only could one point to certain directives that explicitly call upon Member States to collect and retain a wide range of data for crime prevention purposes, ² but also to several international agreements signed by the EU and third countries, on which this case comment will focus. In this context, the information at stake is frequently collected haphazardly and without distinction, and does not necessarily pertain to terrorist suspects.

Indeed, not all EU institutions are firmly committed to a securitarian attitude. ³ The Council and the Commission appear to follow this trend, commonly allowing security to prevail over rights. In this respect, it is enough to consider their approach to asset freezing: they implemented UN resolutions imposing financial sanctions on suspect terrorists, regardless of their rights to property and, above all, a fair trial. ⁴ The European Parliament, instead, often takes privacy and data protection more seriously. For example, in the case that is going to be analysed, it asked the European Court of Justice to assess the compatibility of antiterrorism measures with fundamental rights. Over the last few years, the Court of Justice has played a key role in striking a balance between the rights to privacy and data protection on the one hand, and public security, on the other. Examples of the Court’s case law range from the Digital Rights Ireland decision ⁵ of 2014, in which the Data Retention Directive was quashed ⁶ due to human rights concerns, to the Schrems judgment ⁷ that, in 2015, invalidated the Commission adequacy decision on which the Safe Harbour (i.e. the agreement regulating the exchange of personal data between the EU and the US) was grounded. Principles affirmed in Digital Rights were reiterated in Tele2 Sverige AB, ⁸ again dealing with data retention (this time, envisaged by national law) and human rights, after a request for preliminary ruling by British and Swedish courts.

Opinion 1/15 was issued by the Court of Justice at the request of the Parliament, pursuant to Article 218(11) TFEU. The Parliament asked the Court to rule on the compatibility with EU law of the draft Agreement between the EU and Canada on the exchange of Passenger Name Record data. In July 2017, the Court found that Agreement incompatible with fundamental rights enshrined in the Charter of Fundamental Rights of the European Union. The Court’s Opinion should be regarded as a noteworthy effort to weigh up competing interests.

After an overview of the factual and legal background, this case comment retraces the main steps of the Court of Justice’s reasoning. Specifically, this analysis addresses three critical areas arising from the Opinion: (i) its practical impact, meaning the (already expressed or foreseeable) reactions of other EU institutions, and subsequent changes in EU law concerned with privacy; (ii) its standing within the abovementioned established case law of the Court; and (iii) whether and how the relationship between rights and security will be affected by mass surveillance, which – under strict conditions – is allowed in the age of terrorism.

Passenger Name Record Agreements in EU law

Passenger Name Record data include information such as names, travel dates, itineraries, seats, baggage, contact details, means of payment and many other facts related to the life and habits of travellers. The transfer of data collected by airline carriers to the authorities of third countries towards which flights are headed ⁹ has been regulated over time by several agreements signed between the EU and non-EU countries to prevent and counter international terrorism. Data can be collected, alternatively, through the ‘push’ or ‘pull’ methods. The latter simply means that the authority vested with the power to collect it can directly access the data; the former method implies a data request to an air carrier. Pursuant to Article 25 of Directive 95/46/EC, ¹⁰ in order to allow the exchange of Passenger Name Record data between the EU and a third country, the third country must ensure an ‘adequate level of protection’, certified by the European Commission through a so-called adequacy decision based on the existence of appropriate guarantees in the third country’s domestic law or in its international commitments. According to the Court of Justice, an ‘adequate level of protection’ means that protection must be ‘essentially equivalent’ ¹¹ to that guaranteed by the EU.

The need to deal with Passenger Name Record exchange arose for the first time in 2001, when US legislation ¹² obliged airline carriers travelling to the US to transfer passengers’ data to US Customs and Border Control. ¹³ Therefore, the European Commission needed to reach an agreement with US authorities on the transfer of Passenger Name Record data. This agreement, signed on 28 May 2004, ¹⁴ had several controversial aspects. First of all, it provided US officials with direct access to data (pull system), without any active participation in the transfer of data by airline carriers. In addition, the reasons justifying data collection were vague and the retention period was long (three and a half years, which can be extended in case of investigation). ¹⁵ For these reasons, the EU-US Passenger Name Record Agreement was challenged before the Court of Justice by the Parliament, which called for the annulment of both the Council decision on the conclusion of the Agreement and the Commission adequacy decision. ¹⁶ The Court annulled both, arguing that an incorrect legal basis had been invoked. ¹⁷ Specifically, the EU institutions had acted within the first pillar, i.e. the internal market, while the Court held that they should have acted within the third pillar, i.e. cooperation in the fields of justice and home affairs, since the fight against terrorism and serious crime was the main purpose of the agreement. As a consequence, the EU institutions were urged to enter into a new agreement.

On 23 July 2007, the Council approved a new Passenger Name Record Agreement, ¹⁸ which incidentally raised even more concerns in terms of fundamental rights than the first version. In particular, a wider variety of data could be collected, encompassing also some sensitive data (although a filtering mechanism was provided) and the retention period was extended (up to seven years). Additionally, there were no ‘robust legal mechanisms’ ¹⁹ enabling people to challenge the potential misuse of their data. The shift from the ‘pull’ to the ‘push’ system in data sharing marked the only improvement in terms of rights protection. Once again, the Parliament considered guarantees for passengers’ rights to be insufficient and passed a resolution asking for the renegotiation of the Agreement. ²⁰

The third and current Passenger Name Record Agreement between the EU and the US has been in force since 1 July 2012 and has not been challenged before the Court. ²¹ It secures several important guarantees (e.g. by delimiting the purpose and duration of data retention), but still leaves wide discretion to US authorities in determining exceptions to the retention period and to the anonymisation of data. ²²

Canada enacted rules on Passenger Name Record similar to those legislated by the US ²³ and in 2005 the EU entered into an Agreement with that country too. ²⁴ That deal’s major flaws are similar to those identified in the above-mentioned EU-US Agreements. Although the EU-Canada Agreement provided for a ‘push’ system and envisaged a difference in retention times depending on whether the passengers were under investigation, it included a few controversial provisions on data re-personalisation and complex administrative procedures for filing complaints. ²⁵

When the Agreement with Canada expired in 2009, negotiations once again got underway and a new Agreement was signed on 25 June 2014. ²⁶ Parliament, worried about the detrimental effect certain provisions could potentially have on human rights, triggered the Article 218(11) TFEU procedure, which entitles it to seek the opinion of the Court of Justice on the compatibility of an international agreement with the EU Treaties before its approval and definitive entry into force. ²⁷

The Opinion of Advocate General Mengozzi

On 8 September 2016, Advocate General Paolo Mengozzi held, in his Opinion to the Court, ²⁸ that several provisions of the Passenger Name Record Agreement were patently contrary to Articles 7 (the right to privacy), 8 (the right to data protection) and 52 (the principle of proportionality) of the Charter. ²⁹

As a first step, in considering the existence of any interference with the rights to privacy and data protection, the Advocate General maintained that a serious interference did exist ³⁰ because the intrinsic characteristics of the collected data revealed a great deal about the lives and habits of passengers. Consequently, the right to privacy under Article 7 and the ‘closely connected but nonetheless distinct’ ³¹ right to data protection under Article 8 of the Charter were impaired.

The second step of Mengozzi’s Opinion focused on the justifiability of such an interference, as assessed under the scheme set forth in Article 52 of the Charter. According to this provision, three aspects must be taken into account: first, whether the interference is provided for by law and respects the essence of the right; second, whether it pursues a legitimate aim; and third, whether it complies with the principle of proportionality. ³² As to the first criterion, from a formal point of view, the Advocate General considered the interference provided for by law: pursuant to the EU Treaties, once all phases for their approval have been concluded, international agreements become part of EU law. ³³ From a substantive perspective, according to Advocate General Mengozzi, the Agreement is clear, accessible and foreseeable enough to meet the standards in terms of ‘quality of the law’ as required by the Court of Strasbourg’s case law. ³⁴ Last but not least, the essence of the right is not impaired, since a mechanism of gradual depersonalisation of data does not allow specific conclusions to be drawn on the private lives of the persons concerned. ³⁵

Given the correspondence between the proclaimed goal of the Agreement, i.e. combating terrorism and other serious crime, and the ‘general interest’ prescribed by Article 52 of the Charter, the Advocate General examined the proportionality of the means employed, stressing the necessity of strict scrutiny, also in light of the Digital Rights and Schrems judgments. ³⁶ From this perspective, the Advocate General noted that, even if the means had been suitable for pursuit of the aim, ³⁷ they were not strictly necessary. On the one hand, according to Mengozzi’s Opinion, sensitive data should be excluded; on the other, an exhaustive list of ‘serious offences’ should be drawn up. Moreover, the Advocate General pointed out the very long retention period, which could not be justified for any objective reason: ³⁸ pursuant to the Agreement, all data must be retained for five years from the date of collection, albeit ‘masked’ after 30 days. However, under specific circumstances – such as investigative necessity – they could be unmasked. Thus, data are simply pseudonymised, rather than anonymised (the difference between the two being in fact that anonymisation is irreversible, whilst pseudonymisation is not). Pseudonymised data do not cease to fit the category of ‘personal data’; this means that data protection guarantees still apply (which would be different if the data had been anonymised). ³⁹ Additionally, the Advocate General criticised the indiscriminate application of the measures, irrespective of any suspicion of involvement in terrorist activity. ⁴⁰ Furthermore, these flaws were combined with the vaguely defined Canadian authority tasked with processing the data, a lack of strict rules on access to data and the uncertain reference to judicial remedies.

Concluding his Opinion, Advocate General Mengozzi warned EU institutions against the adoption of the Agreement in its current version. Although admitting that there were ways to bring Passenger Name Record data transfer into compliance with human rights protection, ⁴¹ he stated that this was not the case with the 2014 EU-Canada Agreement.

The Court of Justice’s Opinion: main points

The Court of Justice delivered its Opinion on 26 July 2017, ⁴² adhering to the Advocate General’s stance and arguing that the Agreement could not be adopted in its current form. Although EU institutions could even decide not to adopt any agreement at all, in October 2017 the Commission issued a recommendation for a Council decision on re-opening negotiations in compliance with the Court’s Opinion. ⁴³ Therefore, it is likely that a new agreement will be signed to avert – among other things – the impairment of EU-Canada relations.

In its ruling, the Court addressed both parts of Parliament’s request, i.e. the appropriate legal basis for the Council decision on the conclusion of the Agreement and the compatibility of the text with Articles 7 and 8, read in light of Article 52 of the Charter.

As to the first question, the Council decision was based on Articles 82(1)(d) and 87(1)-(2)(a) TFEU, concerning measures that facilitate judicial cooperation among Member States in relation to criminal matters and measures on the collection of information aimed at police cooperation, respectively. The Parliament claimed that the correct legal basis was instead Article 16 TFEU, ⁴⁴ which ensures the protection of personal data and empowers the Council and the Parliament to enact measures regulating their processing. According to the Court of Justice, the Agreement should have been based on Articles 16 and 87(2)(a) jointly, ⁴⁵ but not on Article 82(1)(d). In particular, the Court argued that there were no provisions envisaging a facilitation of judicial cooperation and that the Canadian authority in charge of the use of Passenger Name Record data was not a judicial authority, nor equivalent to one. In order to reach its conclusion, the Court underlined that the Agreement has a twofold aim: the transfer of Passenger Name Record data must both serve the interest of public security and respect the rights to privacy and data protection. The Court noted that such objectives lie within the scope of both Articles 16 and 87(2)(a) TFEU and reiterated that the transfer of Passenger Name Record data to third countries cannot take place unless an ‘adequate level of protection’ is demonstrated, ⁴⁶ i.e. the level of protection must be ‘essentially equivalent’ ⁴⁷ to that guaranteed by the EU.

The Court of Justice went on to evaluate the compatibility of the Agreement with the standards set by the TFEU and the Charter. And the Court remarked that, in the case at hand, only Article 8 of the Charter should be regarded as a parameter for data protection, without separately considering Article 16 TFEU, the former being more specific than the latter.

First of all, the Court of Justice found an interference with the rights concerned; Passenger Name Record data reveal information that allows identification of the personal data of specific individuals, which must then be processed within the meaning of Article 8 of the Charter. ⁴⁸ In order to assess whether such an interference is justified, the Court examined the basis for its limitation, finding it ⁴⁹ to be legitimate, laid down by law and pursuing an objective of general interest (public security). Moreover, such interference did not affect the essence of the rights concerned.

However, when extensively addressing the necessity of the interference, the Court of Justice considered several EU law parameters violated by the current text of the Agreement.

First, the Court argued that it was not clear which types of Passenger Name Record data were covered by the Agreement. ⁵⁰ For example, use of the word ‘etc.’ was criticised, ⁵¹ as well as the expression ‘all available contact information’. ⁵² In addition, the transfer may include sensitive data, which were then transferred and processed with no solid justification. Remarkably, prevention of terrorism was not deemed to be justification by the Court. ⁵³

Second, the Court of Justice addressed automatic processing. According to the Agreement, ⁵⁴ data are collected and automatically analysed, and cross-checked against databases containing information on suspect terrorists; if any profiles match, the analysis is repeated in a non-automated manner in order to decide whether it is necessary to take individual measures against targeted passengers. The Court welcomed the fact that automatic processing has to be followed by a re-examination through non-automated means. ⁵⁵ It did, however, specify that the databases against which data are cross-checked must be ‘reliable, up to date and limited to databases used by Canada in relation to the fight against terrorism and serious transnational crime’. ⁵⁶

Third, the Court of Justice found some of the purposes for processing Passenger Name Record data to be unclear, not well enough defined. Although the definitions of ‘terrorist offence’ and ‘serious transnational crime’ were well specified, ⁵⁷ the Agreement stated that Passenger Name Record data could also be processed for ‘other purposes’ which were not specified in detail. ⁵⁸

The fourth and fifth points analysed by the Court, i.e. the competent Canadian authority charged with processing the data and the passengers affected by measures contained in the Agreement, were deemed to comply with EU law standards since they were defined with sufficient clarity and precision. ⁵⁹

Sixth, there were no clear and precise rules on the retention of data. The Court of Justice recalled that there must be a connection, based on objective criteria, between the retention of personal data and the aim pursued by the Agreement. ⁶⁰ In addition, data use must be regulated by substantive and procedural conditions. ⁶¹ According to the Agreement, data could be retained and used before the arrival of passengers, during their stay in Canada, upon and even after their departure. ⁶² The Court of Justice warned that post-departure data retention is particularly tricky. Since such data have in fact already been checked and verified, continued retention should not be necessary, unless there are objective reasons that require doing so. ⁶³ On the contrary, as to retention and use before passengers’ arrival and during their stay in Canada, the Court acknowledged the existence of a connection with the pursued objective. Nonetheless, rules about retention and use were found to exceed what is strictly necessary, ⁶⁴ due to the lack of a review procedure (carried out by a judicial or an independent administrative body) on use of data pertaining to passengers staying in Canada.

Lastly, the Court of Justice analysed provisions concerning disclosure. The Agreement allowed the disclosure of data to Canadian and third-country authorities, as well as, under certain circumstances, to individuals. In all these cases, the concerned measures did not comply with the strict necessity test. While disclosure of data to Canadian authorities should respect rules governing the use of data, such rules are nonetheless not well-defined. ⁶⁵ Additionally, the Court noted that, in order to avoid disclosure to the authorities of third countries masking a circumvention of guarantees enshrined in EU law, an agreement between the EU and the third country or a Commission adequacy decision should certify an equivalent level of protection. The EU-Canada Passenger Name Record Agreement did not require this; therefore, disclosure was not limited to what is strictly necessary. ⁶⁶ As to disclosure to individuals, which is allowed when the ‘legitimate interests of the individual [are] concerned’, the Court found a major flaw; the Agreement did not specify legal requirements and limitations, concerned interests, envisaged purposes or judicial or administrative oversight. ⁶⁷

After assessing the necessity and proportionality of the interference, the Court of Justice examined two further important aspects of the Agreement: passengers’ guarantees and oversight mechanisms. As to the first issue, the Court condemned the lack of a system of notification. In other words, passengers should be made individually aware of the use and processing of their data. ⁶⁸ As to the second, the Agreement stated that data protection safeguards would be subject to the oversight of an ‘independent public authority’ or an ‘authority created by administrative means that exercised its functions in an impartial manner and that has proven a record of autonomy’. According to the Court, the use of this alternative wording implied that oversight, or at least part of it, could hypothetically be carried out by a body that is not fully independent. ⁶⁹ Hence, the Agreement did not ensure complete independence during the oversight process.

Reading Opinion 1/15

In order to analyse this Opinion, it is worth focusing on two crucial aspects. Firstly, the Court of Justice allowed mass surveillance as a matter of principle, but only if it respected certain detailed and strict requirements that were perhaps not easy to implement. Therefore, there was a sort of discrepancy between what was theoretically acceptable and what was practically achievable – or, at least, had been achieved until that moment. Secondly, the Court caused a sort of ‘revolution’ in the EU institutional allocation of powers, insofar as it addressed the wording and technical mechanisms of the Agreement in such a manner that it seemed to take over the role of a legislative body, concretely drafting a normative text.

The following analysis will concentrate on these two points, highlighting the importance of the Opinion and its remarkably innovative features. As to guidelines emerging from this decision, the Court clarified, once again and more specifically than in other decisions, that the transfer, retention and use of Passenger Name Record data could be deemed compatible with guarantees enshrined in EU law as long as they respected certain specific conditions.

First, the categories of Passenger Name Record data covered by the Agreement should be clearly and precisely indicated and this had not been done in some of the cases listed in an ad hoc Annex. From this perspective, the Court even criticised the wording of some of its headings, engaging in a particularly careful and detailed analysis. ⁷⁰ In this passage, strict scrutiny is prescribed. In other words, in a (successful) attempt to secure the highest level of protection for individuals, the Court did not merely concern itself with appearances; it determined that the Agreement’s drafting was unacceptably vague, even if the list of Passenger Name Record data provided by its Annex contained a delimitative clause, ⁷¹ hence making it exhaustive. ⁷² In this way, the Court of Justice built upon previous decisions in which it had abstractly affirmed the need for an exhaustive list. ⁷³ This time, though, the Court scrutinised the merits of such a list, thus demonstrating the substantive nature of its review. Moreover, the strong claim of excluding sensitive data was to be expected, since other recent EU legislation contained the same prohibition. For example, Directive 2016/681, ⁷⁴ dealing with Passenger Name Records at the EU level, keeps sensitive data beyond its scope. ⁷⁵ Indeed, sensitive data could hypothetically be transferred to Canada if a ‘precise and solid justification’ ⁷⁶ existed, but, and importantly, the Court of Justice considered that the need to defend public security against terrorism was not enough. This stance implied that public security was not sufficient justification if generally considered, as there might be specific situations in which it might become so. Consequently, what seems to be subject to absolute preclusion – the use of sensitive data – might instead be considered a feasible solution, albeit in very specific circumstances. This view on sensitive data was closely connected to the Court’s approach to discriminatory profiling. The Court implicitly acknowledged that, by relying on individuals’ sensitive data, such as religion or race, public authorities could be led to harshen measures against specific groups of people (e.g. Muslims). This would obviously result in discrimination of such groups, being targeted with counter-terrorism measures in a different manner from others. ⁷⁷ The Court’s stance appears prima facie to impose an absolute ban on profiling, but there are aspects that the Court did not consider and that could allow this discriminatory activity. As a matter of fact, although the use of sensitive data was undoubtedly the most blatant technique for enacting discriminatory profiling, it was not the only one. It is possible, for example, to profile people based on frequent travel destinations or food preferences. These factors do not fall within the definition of ‘sensitive data’, but could nonetheless be decisive to public authorities’ choice to target a specific group of persons. The Court should have shed more light on these points. Nevertheless, at least in principle, the prohibition against profiling, as well as the ban on the use of sensitive data, provides some clue to the Court’s attitude on the complex balance between security needs and privacy rights. And this approach is more than welcome, especially in challenging times.

Second, data should not only be processed by automated means; this should be followed by a non-automated re-examination. ⁷⁸ This is a key passage and heralds a welcome and commendable stance taken by the Court against the most extreme features of surveillance tools. The Court of Justice did not blame the envisaged Agreement for being flawed on this point, as it recognised that its Article 15 provided for non-automated analysis when it was necessary to take ‘decisions adversely affecting a passenger to a significant extent’. At any rate, the Court of Justice stated something crucial in relation to the automated processing phase, implying a cross-checking of data with databases containing data of suspected terrorists. The Grand Chamber remarked that such activity should be carried out through ‘safe’ and ‘reliable’ databases, limited to those used by Canada for counter-terrorism purposes. In this case, the statement of the Court is the result of a praiseworthy attitude towards individual rights, even if it failed to specify what ‘safe’ and ‘reliable’ meant in relation to databases. And this is the only objection that might be raised against the passage. Once again, concerns expressed about (purely) automatic analysis are coherent with a firm rejection of adverse decision-making based solely on automated profiling. Actually, if the whole mechanism worked automatically, measures would also be automatically taken in case of the existence of certain features, which would be detected by a technological device, without any human control. This strand of the Court’s reasoning closely retraced Article 15 of Directive 95/46 – which will be replaced by Article 22 of Regulation 2016/679 ⁷⁹ from May 2018 onwards. Both provisions forbid resort being taken to automated decision-making for decisions affecting individuals (although some exceptions are envisaged, e.g. the subject’s explicit consent). Hence, the use of automated analysis is not banned; instead, what is prohibited is using it as a basis for taking decisions. In other words, while complex algorithms are helpful for performing ‘ordinary’ checks on passengers, human intervention (i.e. a double check) must immediately be called into play as soon as a situation of potential risk is perceived. As a matter of fact, only human beings can verify the merits of automatic results, for example by further investigating a person’s background and police record, thereby logically connecting pieces of information in a way that a machine would presumably not be able to do.

Third, Passenger Name Record mechanisms should be grounded on strong justification purposes. Consequently, stating that ‘other purposes’ are not well-defined, ⁸⁰ the Court is particularly strict in analysing the wording of the Agreement. And this should be praised, as it is a rights-oriented approach.

Fourth, as to the retention and use of collected data – a crucial aspect of the Passenger Name Record Agreement – information on passengers who have already left Canadian territory should be stored only when there is ‘objective evidence’ ⁸¹ that those passengers still present a potential risk in relation to terrorist activities and serious crime. This is a major point of the Opinion. As a matter of fact, such differentiation (among passengers before their arrival in Canada, during their stay, upon or after departure) is not provided for by the 2016 Passenger Name Record Directive. While, for certain other aspects, the Passenger Name Record Directive complies with the Court’s guidelines (e.g., the prohibition against using sensitive data ⁸² and the need for human intervention in the processing of data ⁸³ ), this is a tricky issue. This lack of distinction could invite legal challenges to such legislation. In effect, if the Agreement had to be renegotiated according to that differentiation, whilst the Directive remained in its current form, it would be easy to envisage a differentiation depending on whether data are collected within EU territory or in non-EU jurisdictions (specifically, in Canada). Moreover, the addressed differentiation could impose the need to correlate the intelligence analysis of Passenger Name Record data with mechanisms aimed at border control. ⁸⁴ Undoubtedly, the Court of Justice’s reasoning is influenced by previous judgments on data retention, mainly Digital Rights and Tele2 (substantively reiterating the principles set in Digital Rights). ⁸⁵ Nonetheless, in Opinion 1/15 the Court did not merely apply previous findings. For example, in Digital Rights the Court of Justice quashed the provision of the Data Retention Directive leaving Member States leeway to choose between 6 and 24 months, while in this case a much longer period (five years) was deemed appropriate. Indeed, there was no contradiction: what the Court of Justice criticised in Digital Rights was not the length of the period per se, but the fact that specific criteria to choose between the minimum and the maximum had not been set. On the contrary, in Opinion 1/15, the retention period (five years, the same as the Passenger Name Record Directive ⁸⁶ ) was fixed by the Agreement and it was taken into consideration as such. Rather, what is unclear, thus potentially causing lack of legal certainty, was the standard it used to review retention periods. Furthermore, another passage deserves attention: although the Court’s Opinion followed the Advocate General, on this specific point there was a subtle difference. While the Advocate General emphasised the mechanism of depersonalisation of data (i.e. masking them after 30 days), maintaining that it played a pivotal role in the safeguard of fundamental rights, the Court did not pay much attention to it, in spite of the quite long retention period. Briefly, two (slightly) different approaches to the restriction of fundamental rights for national security reasons can be distinguished. On the one hand, the Advocate General assumed that a retention period of five years was excessive, but it could be remedied through data masking; on the other hand, the Court maintained that such a period was justifiable per se. The Advocate General’s stance must be welcomed because it was more explicit and clear than the Court’s approach. The Court did not explicitly address the length of retention, confining itself to a concise assertion on an issue that could cause uncertainty as to the criteria employed to rule on the retention period.

Fifth, if Canadian authorities have to disclose collected data to the authorities of a third country, an adequacy decision by the Commission regarding such a third country or an international agreement in place between it and the EU should be adopted, in order to avoid indirect circumvention of EU law principles. In this regard, the Court of Justice strongly relied on Schrems, which clarified the meaning of ‘adequate level of protection’ as ‘essential equivalence’. Such a statement does not mean that the standards of data protection in the third country must coincide in toto with EU standards (namely, the relevant articles of the Charter and specific data protection provisions), but that at least the essence of guarantees must be comparable. Consequently, non-EU countries should conform at least to the core of EU data protection law (e.g., purpose limitation and independent oversight).

Sixth, according to the Court, data subjects should be individually notified when their Passenger Name Record data have been used and retained by the competent Canadian authority or when data are disclosed. This is another key point. Notification does not constitute a ground for data processing (as does, for instance, explicit consent), but it is an ex post guarantee, to be enacted at a later stage, i.e. when (and if) a passenger’s data are processed for investigative purposes. Coherently, the Court specified that notification may take place ‘as soon as this information is no longer able to jeopardise the investigations’. ⁸⁷ The issue of individual notification had not been expressly addressed in detail in Digital Rights nor was it regulated by the Passenger Name Record Directive. Therefore, the Court’s stance on the matter could represent another ground for a legal challenge to the Passenger Name Record Directive.

Ultimately, independent oversight mechanisms should be provided. ⁸⁸ This caveat may cast doubts on the mechanisms set forth by the Privacy Shield, which has regulated the exchange of data between the EU and the US since that the previous framework, the Safe Harbour Agreement, was struck down as a consequence of the Schrems judgment. From this perspective, the Civil Liberties, Justice and Home Affairs Committee of the Parliament (LIBE) has raised concerns on this scheme, underlining, among other things, the insufficient independence of the body charged with oversight. ⁸⁹

In sum, not only will this Opinion have significant impact on the Passenger Name Record Directive and the Privacy Shield, but it could also influence other Passenger Name Record agreements, both existing (i.e. with the US and Australia) and future ones (relevantly, while this proceeding was pending, the Parliament asked for negotiations with Mexico to be stopped). ⁹⁰

From a more general point of view, this is the first time the Court of Justice has ruled on the compatibility of an international agreement with guarantees enshrined in the Charter, regarded as an autonomous legal parameter. In doing so, the Court took an important step, for two main reasons: on the one hand, this reinforced the ‘constitutional’ value of the Charter, ⁹¹ which was afforded the capability to function as the only parameter for deciding whether challenged acts (including international agreements) violated EU law. On the other hand, international agreements were substantively considered the equivalent, in the external dimension, of EU legislation in the internal dimension. ⁹² This equivalence was affirmed not only at the theoretical level of the hierarchy of sources, but also as to the practical implications of the standards to be respected. This approach reflects the supremacy of EU constitutional values, even over what has been negotiated at the international level.

Additionally, both the Parliament, in triggering the procedure, and the Court of Justice, in deciding the issue, took full advantage of the mechanism – explicitly envisaged by the TFEU – allowing challenges to an international treaty that allegedly derogates from EU law. The former sought the Court’s Opinion on an Agreement that was politically and strategically crucial, given the current seemingly endless threat of terrorism. In parallel, the Parliament – perhaps due to its institutional position and, more specifically, to its role within the international treaty-making procedure – did not embrace a securitarian approach, as opposed to the Council and the Commission. Therefore, not all EU institutions that take part in (lato sensu) legislation-making currently let security prevail over rights. By way of its request, the Parliament strongly invited the Court of Justice to rule definitively on the merits of a Passenger Name Record agreement. As said, when it repealed the first Agreement with the US, ⁹³ the Court’s reasoning focused exclusively on the choice of the legal basis; ⁹⁴ under such circumstances, the Parliament had not relied on the Charter when it raised human rights concerns, since it merely had interpretative value in the period before the Lisbon Treaty. For its part, the Court of Justice quickly seized the opportunity to do what it had never done before, i.e. explicitly extending principles elaborated in a long series of mainstream decisions. This conveys the idea that guarantees for the rights to privacy and data protection must be affirmed on a larger scale, even in challenging times.

The Court of Justice also did something else that is worth remarking upon: in carefully analysing the text of the Agreement, even censuring its wording, it engaged in a task that could be defined as ‘borderline’ to that of a legislative drafting committee. The Court suggested the correct way to redraft the Agreement to other EU institutions, not only by way of principled declarations, but also by proffering concrete examples of the words and phrases to be substituted. This high rate of ‘intrusiveness’ can be related to the gist of this decision, which can be synthesised as follows. Conceiving a legal framework in which surveillance has no role would be utopian, given the seriousness of the current terrorist threat; nonetheless, mass surveillance must be kept subject to particularly strict rules. Against this background, if the policy-maker proves unable to remain within these limits and to guarantee that individual rights will not be totally sacrificed in the name of security, courts will be increasingly called to play a pivotal role, even going beyond their institutional attributions and bearing quasi-legislative (and political) responsibility. ⁹⁵

Conclusion

This decision has shaped the complex balance between rights and security in an increasingly detailed manner. ⁹⁶ Given the growing demand for security, the Court of Justice’s achievement in reconciling such competing interests appears to be the most rational and enlightened in the current circumstances. In other words, being forced to depart from a wholly pro-rights stance in favour of a more realistic one, the Court showed full mastery in reading – and, to a certain extent, redrafting – a security-related tool in a rights-oriented manner.

The core of Opinion 1/15 lies in two (apparently opposite, but indeed compatible) features. On the one hand, the Court of Justice has definitely accepted that generalised and indiscriminate surveillance of travellers is a useful tool in the fight against terrorism. However, this securitarian attitude was wisely mitigated; the Court showed awareness of the serious risks that bulk surveillance implies for fundamental rights, in particular when clear and precise criteria for the concrete implementation of such measures are lacking.

After having examined the Opinion in detail, it is necessary to take stock of the outcome of this analysis with a view to drawing some manner of conclusion on the three points addressed in the introduction.

As to the first point, i.e. its impact on existing EU acts, as well as on those under negotiation, EU institutions are likely to renegotiate existing agreements and to take features established in the Court’s Opinion into account in ongoing ones. Indeed, this might be exactly the Court of Justice’s intent, as demonstrated by its willingness to involve itself in a quasi-legislative scheme, agreeing to bear quasi-political responsibility. The Parliament did not dare take such responsibility when it triggered the procedure under Article 218(11) TFEU, instead preferring to indirectly manifest its concerns about the Agreement, thereby shifting the task to the Court.

In relation to the second point, i.e. how this Opinion is positioned within the established case law of the Court, although it adheres to the same general lines of previous decisions, it undoubtedly reinvigorated and boosted previous findings. In scrutinising the EU-Canada Passenger Name Record Agreement, Opinion 1/15 has confirmed, reinforced, refined and made more specific what the Court had already stated in relation to the collection, retention and use of personal data, in at least three previous decisions.

Nevertheless, the differentiating features of this Opinion dwell in two main aspects: firstly, an increased show of confidence by the Court of Justice in dealing with highly technical matters. This is demonstrated by the fact that the Court has basically redrafted certain parts of the Agreement and showed a certain mastery in its ability to distinguish between the different timeframes in which data are retained (a level of specificity that, as remarked above, was not even envisaged by the EU lawmaker in the Passenger Name Record Directive). Secondly, it clarified that principles set in Digital Rights, Schrems and Tele2 Sverige (dealing with a directive, an adequacy decision on the transfer of a generality of data and national law, respectively) do extend to Passenger Name Record data as well, thus building a comprehensive framework for EU data protection, which will be highly beneficial to the perception of the EU as a rule of law-based institution.

Last but not least, with regard to the third point, i.e. the impact of this decision on the perception of the tricky balance between rights and security, the Court took a firm stance towards the protection of fundamental rights, avoiding, at the same time, the pitfall of a utopian approach. In other words, it remained steady on the realistic assumption that, if the Western world wants to defeat terrorism, some intrusion in fundamental rights must necessarily be tolerated. As a result, the Court of Justice definitively accepted mass surveillance, albeit only to a certain extent and under strict conditions. Ultimately, this decision may help steer the lively theoretical debate on rights and security towards the awareness that promoting and safeguarding rights does not necessarily result in waiving realism.