Brexit trade agreements ‘fragile’ after CJEU opinion on Passenger Name Record data

Any future agreement between the EU and UK would similarly be open to challenge if the UK’s laws do not uphold the privacy of EU citizens. The Opinion reinforces arguments that privacy and data protection rights in the UK could be put under intense scrutiny, if the agreement covers transfers of personal data, which are fundamental for most communications and commerce.

Executive Director of Open Rights Group, Jim Killock responded:
“This decision has massive implications for Brexit. The EU courts have rejected an agreement that failed to protect fundamental rights, including the rights to privacy and protection of personal data.

“Any future trade agreement between the UK and EU would be subject to the same stringent requirements. Given the UK’s mass surveillance laws and indiscriminate data retention, any trade agreement for digital, communications and even banking and insurance businesses, could look very fragile indeed.”

Current UK arrangements to collect and use PNR data are also likely to need improved safeguards, along the lines the court requires for the EU-Canada agreement.

Notes to Editors
The CJEU have explained their decision in a press release which notes:

“the Court considers that the agreement should:
• determine in a more clear and precise manner certain of the PNR data to be transferred;

• provide that the models and criteria used for the automated processing of PNR data will be specific, reliable and non-discriminatory;

• provide that the databases used will be limited to those used by Canada in relation to the fight against terrorism and serious transnational crime;

• provide that PNR data may be disclosed by the Canadian authorities to the government authorities of a non-EU country only if there is an agreement between the European Union and that country equivalent to the envisaged agreement or a decision of the European Commission in that field;

• provide for a right to individual notification for air passengers in the event of use of PNR data concerning them during their stay in Canada and after their departure from that country, and in the event of disclosure of that data to other authorities or to individuals;

• guarantee that the oversight of the rules relating to the protection of air passengers with regard to the processing of their PNR data is carried out by an independent supervisory authority.

“Since the interferences which the envisaged agreement entails are not all limited to what is strictly necessary and are therefore not entirely justified, the Court concludes that the envisaged agreement may not be concluded in its current form.”

Open Rights Group is a member of European Digital Rights (EDRi), which have also issued a statement.