15 Regarding the controversial aspects of this system, see Siemen, B., “The EU-US Agreement on Passenger Name Records and EC Law: Data Protection Competences and Human Rights Issues in International Agreement of the Community,” 47 German Yearbook of International Law (2005) p. 629 Google Scholar. For more information on previous PNR, Papakostantinou, V. and De Hert, P., P., “PNR Agreement and Transatlantic Antiterrorism Co-Operation: No Firm Human Rights Framework on Either Side of the Atlantic,” 46 Market Common Law Review (2009) p. 885 Google Scholar. On 26 July 2017, the European Court of Justice (ECJ) issued an opinion stating that the proposed agreement between the EU and Canada on the transfer of passenger record data (“PNR”) cannot be concluded in its current form, as several provisions of the draft agreement (“agreement”) do not comply with the requirements of the EU`s fundamental rights. Other provisions of the agreement should include clearer definitions of PNR data to be transmitted, a right to individual notification when using PNR data, and an independent oversight authority for passenger protection rules. 49 That is, the agreement itself and not the consent. Under section 8 of the Charter, a restriction may be based on the express consent of the persons concerned or on some other legitimate statutory basis. 22 An overview of the content and critical aspects of this agreement can be found in Cole, Oben 1, p. 67, under “From DRD to PNR: Looking for a New Balance Between Privacy and Security.” 29 From a procedural point of view, the AG indicated that Article 16, paragraph 2 of the TFUE and Article 87, paragraph 2, of the AAV, in conjunction with Article 218, paragraph 6, point a) v), can be invoked as an appropriate legal basis for such an agreement.
The judgment states that the transfer of sensitive air passenger data is not justified, that the use of EU citizens` PNR data after entry into Canada must be based on new circumstances established by rules setting the conditions for this use, and that continued storage of risk-free passenger PNR data (allowed by the agreement for up to five years) is not permitted. This decision is part of ECAS`s concerns about the PNR Directive and is expected to have implications for the directive as well as other EU NNP agreements with the US and Australia, which allow the storage of PNR data for five years, fifteen years and five and a half years respectively.