The Administrative Court of Wiesbaden initiated references for a preliminary ruling to the CJEU that tackle the question of whether the EU PNR Directive (Directive 2016/681, see eucrim 2/2016, p. 78) and the German implementation law are compatible with Union law, in particular the Charter of Fundamental Rights.

In the cases at issue, the respective plaintiffs request the deletion of their passenger data (PNR data), which are currently stored by the Federal Criminal Police Office. The first proceeding concerns flights from the European Union to a third country, the second concerns flights within the European Union.

The Administrative Court has doubts as to whether the PNR Directive and the German Act on processing airline passenger name records to implement EU Directive 2016/681 (Fluggastdatengesetz) are compatible with the CFR, in particular the fundamental rights to respect for private and family life and the protection of personal data enshrined therein, as well as with the GDPR. As regards the case of intra-EU flights, compatibility with the freedom of movement within the European Union is additionally in question.

The Court considers the processing of PNR data to be comparable to the retention of telecommunications data and considers the associated encroachments on fundamental rights to be unjustified despite the objective pursued (combating terrorism and serious crime). The Court considers, inter alia, the following to be doubtful:

• The scope of PNR data collected and processed;
• The proportionality of the 5-year storage period for PNR data;
• The legal certainty of several provisions of the Directive and the transposition law;
• Whether passengers are adequately informed about the data processing;
• Whether the transfer of PNR data to third countries and domestically to the Federal Office for the Protection of the Constitution (the domestic intelligence service) is permissible;
• Whether the multiple entry of passenger data (by country of departure and destination of each intra-EU flight) is justified.

The Administrative Court has stayed the proceedings until the CJEU delivers its judgment. As regards data retention, the CJEU already took a critical stance against the mass storage of data by private companies. In 2014, the CJEU had already declared the 2006 EU data retention directive void (see eucrim 1/2014, 12). Subsequently, in 2016, the CJEU prohibited Member States from maintaining national data retention regimes if they entail a general and indiscriminate retention of data (see eucrim 4/2016, 164).