The top EU court’s opinion on a draft passenger name record deal with Canada is the latest setback for the European Commission’s data rules—after it knocked down data retention laws and in 2015, the safe harbour agreement allowing companies to transfer personal data to the United States.
The Commission brokered the so-called PNR agreement with Canada in 2014 as a security safeguard to help authorities monitor potentially dangerous flight passengers. But the court criticised a number of measures in the deal: a requirement to store data for five years is too long, for example.
Plus, the wide-ranging agreement would violate flight passengers’ privacy rights because it allows authorities to exchange data that could reveal “a complete travel itinerary, travel habits, relationships existing between two or more individuals, and information on the financial situation of air passengers, their dietary habits or their state of health, and may even provide sensitive information”.
Julian King, the EU Commissioner in charge of security, said during a news conference on Wednesday that he would communicate later in the day with Canadian officials about renegotiating the deal.