Legitimizing pre-emptive data surveillance under the EU law: the case of the PNR Directive

Julia Wojnowska-Radzińska

doi:10.14746/rpeis.2021.83.1.9

Julia Wojnowska-Radzińska

Open Access

https://doi.org/10.14746/rpeis.2021.83.1.9

Copy DOI

Abstract

The paper analyses the PNR Directive as pre-emptive data surveillance practice. The 2016/681 Directive regulates the use of Passenger Name Record (PNR) data in the EU for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. It obliges airlines to hand national authorities passengers’ data for all flights from third countries to the EU and vice versa, but Member States can also extend it to ‘intra-EU’ ones (i.e. from an EU country to one or more other EU countries), provided that they notify the EU Commission. Thus, PNR Directive affects all passengers who arrive in the territory of one Member State originating from a third country, or who depart from a Member State’s territory to a non-EU country, including any transfer or transit ﬂights. Using PNR data, the individual is profiled and encoded in terms of degrees of risk.

Highlights

The September 11 attacks on the United States and the rising threat of terrorism in the EU Member States have contributed to the development of various surveillance solutions as an attempt to ensure a high level of security and prevent another 9/11
The Directive specifies that Member States shall ensure that any positive match resulting from the automated processing of Passenger Name Record (PNR) data is individually reviewed by non-automated means to verify whether the competent authority needs to take action under the national law.[43]
PNR data provide a detailed picture of the journey and the passenger

Summary

INTRODUCTION

The September 11 attacks on the United States and the rising threat of terrorism in the EU Member States have contributed to the development of various surveillance solutions as an attempt to ensure a high level of security and prevent another 9/11. Pre-emptive surveillance does not start with a suspicion against a particular person or persons It has a proactive element, aimed at identifying a danger rather than identifying a known threat. The pre-emptive approach to security threats that concentrates on prediction requires ‘new imaginative technologies [...] to be deployed in order to detect and disrupt possible plots at the earliest stage’.4. Faced with the threat of possible nuclear, chemical, biological and conventional attacks in the Union, and bearing the responsibility for pre-empting those attacks by ‘connecting the dots’,9 for security purposes the EU has decided to enhance the collection and exchange of personal data in order to generate useful and reliable correlations and to identify suspects. The EU has adopted a pre-emptive data surveillance policy to monitor actual and potential risks and their sources through the PNR system. 10 The Passenger Name Record is a generic name given to the files created by airlines for each flight any passenger books

THE BACKGROUND OF THE EU PNR LEGAL FRAMEWORK

PNR DATA AND PROFILING

CONCLUSION

Summary