A Challenge to Systematic and Undifferentiated Data Collection Through Strategic Litigation: The Passenger Name Record Case (Ligue des Droits Humains) Before the Court of Justice of the EU

Abstract

At a time when the European Union and its Member States are constantly adopting measures to combat serious crime and terrorism, particularly through the prism of data protection rules, the CJEU is acting as a bulwark by imposing compliance with strict conditions, thereby encroaching on national rules of criminal procedure, which are initially the responsibility of the Member States. In this contribution, we will examine how and on what basis the Ligue des Droits Humains was able to get the CJEU to rule on the Passenger Name Records Directive, and to what extent this action was indeed “strategic.”

A. Introduction

The adoption of Directive 2016/681¹ on the processing of passenger data (“PNR Directive” for “Passenger Name Record”) was the subject of lengthy negotiations and criticism. The measure involves the systematic processing and transfer of all air passenger data in order to determine “risk profiles” using “dynamic” algorithms or pre-established behavioral models.² The aim is to explore data in order to “situate” passengers on a risk scale and thus enable the identification of “possible or probable” criminals.³ According to the Council of Europe, such a mechanism targeting people “who have not committed any offence” could in no way pursue “a legitimate aim,” especially as there is an unavoidable risk of error that could lead to discriminatory profiling.⁴ Against the backdrop of the Charlie Hebdo attacks in Paris in January 2015, the European Parliament nonetheless agreed to the PNR Directive, in line with the resolutions adopted by the United Nations Security Council in 2017 and 2019, recommending that States introduce such a system.⁵

The Belgian legislature implemented the PNR Directive fairly quickly through the Law of December 25, 2016 on the processing of passenger data⁶ (the “PNR Law”). Given the serious interference this law entails in fundamental rights, including the right to privacy and the right to protection of personal data guaranteed respectively by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (the “Charter”), in July 2017, the Ligue des droits Humains (“LDH”) decided to lodge an action for annulment with the Belgian Constitutional Court. Indeed, Belgium offers associations the possibility of directly challenging the legality of a legislative or regulatory measure, in other words, without the intervention of a person concerned, thus facilitating the introduction of strategic appeals. Once the matter had been referred to it, the Constitutional Court in turn asked ten questions for a preliminary ruling to the Court of Justice of the EU (“CJEU”) to determine whether the PNR Directive complied with Articles 7, 8, 45 and 52(1) of the Charter.

In this Article, after briefly outlining the PNR Law, we will review the various stages of the proceedings in this strategic dispute. We will see that, via the proportionality test of the interference, the CJEU automatically took up issues that had not been specifically raised by the LDH or by the Constitutional Court. We will conclude by presenting the new Belgian draft law that implements the conditions imposed by the CJEU—an implementation that is not without its challenges given the particularly flexible interpretation of the Belgian legislator.

B. European and National Legislative Context

The PNR Directive requires the systematic transfer of all passenger data⁷ on a flight outside the EU, in other words, between a third country and the European Union, to the Passenger Information Unit (“PIU”) of the Member State of departure of the flight or of destination for the purposes of combating serious crime and terrorism.⁸ This transfer is carried out in order to automatically and systematically compare passenger data with “useful” databases or using pre-established criteria.⁹ If a passenger presenting a risk to public security is identified, further checks may be carried out, leading to binding individual decisions.¹⁰ These data are then kept for a period of five years after having been de-identified—by masking—after a period of six months and are made accessible at the request of the competent authorities.¹¹

Similarly, the PNR Law introduces into Belgian law an obligation for carriers and travel operators in the various international transport sectors—air, rail, road, and sea—to collect information relating to their passengers.¹² This data, which is sent to the PIU,¹³ is analyzed prior to a person’s arrival, transit, or departure on national territory.¹⁴ Using algorithms based on pre-established criteria, the processing must make it possible to “assess the potential threat and determine which passengers are of interest for the performance of their duties or, for example, require action to be taken (execution of an arrest warrant, search, etc.).”¹⁵ In addition, these data are correlated with databases or lists managed by the competent services or which are directly accessible to them as part of their duties.¹⁶ If a passenger is identified as presenting a risk to public security, further checks may be carried out, leading to binding individual decisions.¹⁷ In practice, a positive “HIT” has to be validated by the PIU within 24 hours and is then translated into a “match.” Data processing is therefore not fully automated. Once validated, the result of the assessment is forwarded to the competent services, which must ensure follow-up within an appropriate timeframe, in other words, for example, arrest the person concerned at the airport or control his identity.¹⁸ This data is then kept for a period of five years after being de-identified—by masking—at the end of a six-month period, and is made accessible at the request of the competent services.¹⁹ The latter may carry out ad hoc searches within the limits of their missions and the purposes set out in the law, in particular the fight against terrorism, the investigation and prosecution of certain offenses, and the fight against illegal immigration.²⁰ The scope of the PNR Law and the purposes for which it applies are therefore particularly broad, and in any case broader than in the PNR Directive.

C. The National Litigation Phase

Given the serious interference of the PNR law into the fundamental rights of all travelers, it was obvious for the LDH to introduce a legal action to challenge the use of automated means without sufficient guarantees and the possibility of using such a system to combat immigration and for border control purposes. This tendency towards “crimimmigration,”²¹ which consists of mixing “repressive” and “border management” purposes, had already been criticized on numerous occasions in the past, in the context of discussions on VIS, SIS, and EURODAC, and in the context of the introduction of smart borders, for example.²² The interference caused by the PNR Law was all the more significant because the PNR system applied in Belgium not only to air travel, but also to rail, land, and even sea travel, to and from Belgium within the EU, without crossing external borders with third countries.

From the point of view of the litigants, it should be noted that the LDH is organized into different commissions that reflect on human rights topics. These commissions provide reactions to current events and aim to look to the future with the objective to safeguard fundamental rights. The work of the commissions can be disseminated in a variety of forms: Press articles, conferences, papers, and even legal actions. In this case, after discussions and debates held by its members, the Commission des nouvelles technologies et de la vie privée suggested to one of its lawyers to take legal action. The LDH has a pool of lawyers, who are prepared to intervene and take legal action on a pro bono basis—with little or no remuneration. This can lead to a few difficulties, particularly when it comes to writing detailed legal arguments or developing a concrete strategy to launch legal proceedings. Lawyers work in their spare time, often in isolation, although they sometimes benefit from the help of legal academics who are willing to devote their time on a pro bono basis.²³ In contrast, the State is often defended by numerous lawyers who are often from large legal firms. It could be compared to David fighting Goliath. The PNR case is even more emblematic in that the subject matter is extremely technical.

However, the need to challenge this legislation was even more pressing given that shortly before the adoption of the PNR Directive, the ECJ invalidated the so-called “data retention” Directive 2006/24/EC²⁴ on the grounds that there were insufficient safeguards to limit the interference “to what is strictly necessary.”²⁵ This legal instrument required telephone operators to systematically and indiscriminately collect²⁶ metadata for the purpose of combating serious crime. It therefore entailed a “particularly serious” interference with the right to respect for private life and the protection of personal data.²⁷ A few years later, the ECJ clearly censured the data retention obligation imposed on operators on the grounds that it was “generalized and indiscriminate” and recommended “targeted” retention of metadata.²⁸ According to the Court, any intrusion into the right to respect for private life and the protection of personal data must comply with the principle of proportionality and must therefore be within the limits of what is “strictly necessary.”²⁹ Therefore, we were hoping that this case law could be used to invalidate the PNR Directive.

On July 24, 2017, the LDH introduced an action for annulment with the Belgian Constitutional Court. Indeed, such an action needs to be lodged within six months of the adoption of the contested regulation as required by Article 3 of the special law of January 6, 1989. This action could be submitted relatively quickly, as it does not require the intervention of a person concerned. Belgium is unusual in that it allows any natural or legal person to bring an objective dispute, for example when challenging the legality of laws or regulations before the Constitutional Court³⁰ or the Council of State, respectively.³¹ It is up to the applicant to justify his or her interest in taking action, in other words, that he or she is likely to be personally, directly, and adversely affected by the contested regulation.³² However, an actio popularis (“popular action”) is not permitted.³³ In the case of a non-profit association, the Constitutional Court requires several conditions to be met: Its statutory purpose must be of a particular nature and therefore distinct from the general interest, it must defend a collective interest, the contested regulation must be likely to affect its societal purpose, and that purpose must actually be pursued.³⁴ The LDH’s interest in taking action is rarely challenged by the Constitutional Court, as its association’s Articles state that its aim is “to combat injustice and any arbitrary infringement of the rights of an individual or a community [and to defend] the principles of equality, freedom, solidarity and humanism.”³⁵

D. The Litigation Before the CJEU

In its application to the Constitutional Court, the LDH’s request was for the PNR law to be annulled on the grounds that it was incompatible with Articles 7, 8, and 52(1) of the Charter. We also claimed infringement of Article 45 of the Charter, given that the PNR system was implicitly re-establishing border controls. Contextually, it should be noted that two days after the appeal to the Constitutional Court was lodged, the CJEU published an opinion³⁶ on the PNR agreement signed in 2014 between the European Union and Canada.³⁷ The CJEU did not invalidate the agreement but imposed strict conditions.³⁸ Therefore, the LDH already assumed that the PNR Directive would probably not be invalidated by the CJEU, but that the Court would specify the conditions on the PNR Directive. Given that it was a national law implementing EU law that was challenged, in accordance with Article 267 TFEU, the Constitutional Court turned to the CJEU and referred ten questions for a preliminary ruling to the Court of Justice.³⁹ Let us examine the various arguments put forward by the LDH and the responses of the CJEU.

I. Infringement of the Right to Privacy and the Protection of Personal Data

1. The Absence of a Legitimate Aim

In its initial application, the LDH first pointed to a violation of Articles 7, 8, and 52(1) of the Charter on the grounds that the PNR measures had no legitimate purpose. According to the Council of Europe, the “pre-screening” approach, which consists of assessing the risk posed by passengers in order to anticipate their behavior or establish specific profiles, is not a “legitimate” objective.⁴⁰ The CJEU did not rule on this point, considering that the fight against terrorism and serious crime are aims in the general interest capable of justifying “even serious” interferences with fundamental rights.⁴¹ In addition, according to the CJEU, the measure did not affect the essential content of the rights to respect for private life and to the protection of personal data, because the nature of the information processed was limited to certain aspects of privacy relating to a person’s travels and did not provide a complete overview of the private life of the data subjects. According to the Court, the interference was therefore not identical to the one involved in the retention of data, which the CJEU had described as “particularly serious.”⁴²

2. The Absence of Necessity

Moreover, pointing to the high error rate and the risk of discrimination that such a system entails, the LDH regretted that the measure was not necessary, as provided for in Article 52(1) of the Charter. In this respect, during the hearing before the Grand Chamber,⁴³ the judge-rapporteur von Danwitz expressed particular concern about the large number of false positives mentioned by the European Commission and the resulting lack of reliability of the system. The European Commission’s 2020 working document mentions a positive match rate of 0.59% for 2019, of which only 0.11% was transferred to the competent authorities.⁴⁴ For 2018, the corresponding percentages were 0.25% and 0.04% respectively.⁴⁵ The judge-rapporteur was also concerned that a trivial act—getting on a plane—could result in the processing of data such as address and bank details being retained for five years. Nevertheless, in its ruling, the CJEU, while acknowledging the high number of “false positives,” considered that this was not such as to undermine the system’s suitability. Taking up the Commission’s figures, the CJEU pointed to the number of air passengers which were successfully identified thanks to the PNR system because they were presenting a risk in the fight against terrorist offenses and serious crime.⁴⁶ Furthermore, according to the CJEU, this error rate must be read in conjunction with subsequent checks of the results obtained using non-automated means⁴⁷ and therefore did not follow the argument raised by the LDH.

The LDH also pointed to the lack of an impact assessment carried out prior to the introduction of the PNR system. According to the European Data Protection Supervisor (EDPS), an impact assessment can demonstrate why the planned measure is effective and why other, less intrusive measures, would not achieve the desired objective.⁴⁸ For example, in the case of large-scale processing of personal data or profiling, the General Data Protection Regulation (GDPR) requires an impact assessment to be carried out,⁴⁹ containing the following elements in particular: A systematic description of the operations—nature, scope, and context—the purposes, the categories of data and their retention period, an assessment of the necessity and proportionality with regard to the intended purpose, the rights of the data subjects, the safeguards concerning international data flows, an assessment of the risks to the rights and freedoms of the data subjects, and the measures envisaged to address these risks.⁵⁰ This approach would have made it possible to assess the impact of the planned processing operations on the rights and freedoms of the data subjects of the PNR Directive and to demonstrate its compliance with the Charter. Surprisingly, neither the Constitutional Court nor the CJEU responded to this argument.

3. The Absence of Proportionality

As regards the lack of proportionality, in its initial application, the LDH pointed to the systematic, “non-targeted,” nature of the measure, resulting in excessive interference with Articles 7 and 8 of the Charter. More specifically, it argued that the safeguards were insufficient, particularly noting the following: The data processed, the categories of data and the databases were not specified, the purposes were too broad—they included the fight against illegal immigration and the fight against ordinary crime and intelligence, the data retention period was excessive, and there was a possible correlation with databases that were not linked to terrorism or serious crime.

In its decision, aligning itself with Opinion 1/2015 and the Opinion of Advocate General,⁵¹ the Court of Justice confirmed the validity of Directive 2016/681 under the Charter but set strict conditions.⁵² It held that the PNR Directive entailed a serious interference with the rights guaranteed by Articles 7 and 8 of the Charter, namely the right to respect for private life and the right to protection of personal data. According to the Court, the purpose of such a measure is to establish “a system of continuous, untargeted and systematic surveillance, including the automated evaluation of personal data relating to all persons using air transport services.”⁵³ While such data taken on its own does not seem capable of revealing precise information about the private lives of the data subjects, the fact remains that, taken together, such data can—among other things—reveal a complete travel itinerary, travel habits, relationships existing between two or more persons, as well as information about the financial situation of air passengers, their eating habits, their states of health, or even reveal other sensitive information about these passengers.⁵⁴

Thus, in order to limit the interference to what is strictly necessary, the Court has methodically examined the substantive and procedural rules governing the scope of the measures provided for by the PNR Directive and whether the system which it puts in place meets objective criteria establishing a link between the PNR data and the purposes pursued.⁵⁵ In this respect, firstly, the data processed under the system must be clearly identifiable and restricted to the headings set out in Annex I.⁵⁶ Furthermore, with regard to prior assessment on the basis of PNR data, the PIU may compare this information only with its own databases concerning persons or objects wanted, or for which an alert has been issued.⁵⁷ In order to meet the requirement that the criteria laid down be targeted, proportionate, and specific, the databases must be used in connection with the fight against terrorist offenses and serious crime with an objective—or at least indirect—link to the carriage of passengers by air.⁵⁸ Moreover, the period for which data is kept must be linked to the objective pursued⁵⁹ and access to such data must—in principle, except in duly justified cases of urgency—be subject to prior control either by a court, or by an independent administrative authority, upon a reasoned request from the competent authorities.⁶⁰

In addition, before the hearing, the CJEU asked questions directly to the European Commission, the European Parliament, and the European Union Agency for Fundamental Rights concerning the use of algorithms—an argument not raised by the LDH or the Constitutional Court. Indeed, as the CJEU had already pointed out in Opinion 1/2015, the extent to which automated analysis of PNR data interferes with the rights enshrined in Articles 7 and 8 of the Charter depends essentially on the models, pre-established criteria, and the databases on which this type of data processing is based.⁶¹ Asking those questions was an opportunity for the Court to clarify its previous case law by requiring compliance with additional criteria that was not mentioned in its Opinion 1/2015. Specifically, the Court added that the pre-established criteria must be additional, proportionate, and include both incriminating and exculpatory elements—as this requirement is likely to contribute to the reliability of these criteria and —in particular—to ensure that they are proportionate—as required by the second sentence of Article 6(4) of the PNR Directive.⁶² Therefore, as far as the pre-assessment using pre-established criteria is concerned, artificial intelligence technology cannot be used in the context of machine learning systems.⁶³ Given the opacity of artificial intelligence technologies,⁶⁴ it may be impossible to understand why a given program has obtained a positive match.⁶⁵ Under these conditions, the use of these technologies could also deprive the data subjects of their right to an effective judicial remedy enshrined in Article 47 of the Charter.⁶⁶ Furthermore, individuals should be able to find out about the pre-established evaluation criteria and the program applying these criteria so that they can decide—in full knowledge of the facts—whether or not to exercise a judicial remedy.⁶⁷ In so doing, the CJEU has for the first time specified the conditions of application of an artificial intelligence system in the context of the fight against serious crime and terrorism.

II. Infringement of Freedom of Movement

In addition to the violation of Articles 7 and 8 of the Charter, the LDH also invoked the infringement of the freedom of movement guaranteed by Article 21(1) TFEU and Article 45 of the Charter. Firstly, the PNR Law expressly authorized the processing of PNR data for the purposes of improving border controls and combating illegal immigration—purposes that are not covered by the PNR Directive. Secondly, the PNR Law was intended to apply to air, rail, bus, and boat travel from third countries as well as “intra-EU,” which implies an extremely broad scope. As a reminder, the Schengen Borders Code authorizes Member States to carry out checks at internal borders, provided that these checks do not have an “equivalent effect” to border checks.⁶⁸ The only exception is to authorize Member States to temporarily reintroduce checks at internal borders in exceptional circumstances in the event of a serious threat to public order and national security, limited to a maximum of 6 months.⁶⁹

With regard to the purposes pursued, following the CJEU, the application of such a system must be limited to terrorist offenses and serious crime,⁷⁰ to the exclusion of any other purpose such as the fight against illegal immigration⁷¹ or the monitoring of activities targeted by intelligence services.⁷² In addition, the PNR system may be extended to all or part of intra-EU flights—or even to other means of transport within the Union— only if there are sufficiently specific circumstances to consider that the State concerned is facing a real and present or foreseeable terrorist threat.⁷³ The measure must be limited in time and subject to review by an independent court or administrative body.⁷⁴ In the absence of such a threat, this extension must be limited to intra-Community flights involving particular air routes, modes of travel, or certain airports for which there are—in the assessment of the Member State concerned—indications to justify this application.⁷⁵ Limiting the scope of the PNR system was seen as a victory, given that the majority of flights are intra-EU—75%.⁷⁶

E. Post European Litigation Phase

Following the CJEU ruling, the Belgian Constitutional Court applied some of the requirements of C-817/19 to assess the conformity of the PNR Law with the Charter. In doing so, the Court annulled certain provisions of the PNR Law, limited the scope and the purposes of the measure, and prohibited the PIU’s use of artificial intelligence technologies in machine learning systems, which could modify the evaluation process without human intervention and control. It also required the authorization of an independent supervisory authority to allow the competent services to access the data.

Nevertheless, the Constitutional Court ruled that the PNR system in Belgium could be extended to intra-EU flights as well as to various means of transport if national authorities demonstrated a real and present terrorist threat. In October 2023, the Organe de Coordination pour l’Analyse de la Menace (OCAM) (Authority for the Coordination of Analysis of Threats) reported a general threat level of 2 out of 4 in Belgium. Level 2 constitutes a “medium” threat level which the Constitutional Court considered as sufficient for extending the application of the PNR system to intra-EU flights and other means of transport. In addition, according to the Constitutional Court:

[I]n assessing the reality of this threat, account should also be taken of the geographical situation of the country, which has a small territory and easily crossed borders, is located at the center of Europe and is home to numerous European and international institutions. This geographical reality, which is characteristic of the country, significantly increases the risks of using all modes of transport via Belgium to commit terrorist offences or serious crime. The country is thus geographically located at the intersection of multiple air, rail and road transport routes that could be used by terrorist and criminal organizations to commit terrorist offences or serious forms of crime.⁷⁷

As a result, while the CJEU had categorically limited the PNR system, the Constitutional Court stepped into the breach, leaving new doors open to the Belgian legislator.

Following the decision of the Constitutional Court, an initial bill aimed at amending the PNR law as little as possible was tabled⁷⁸ and adopted on May 16, 2024, by the Belgian Parliament.⁷⁹ The legislator referred to the emergency of the situation and the difficulties experienced by the competent authorities—particularly in the Public Prosecutor’s Office—in carrying out ad hoc searches and accessing the PNR database.⁸⁰ In accordance with the aforementioned Constitutional Court ruling, the text limits the purposes by removing the possibility of processing the data for border control purposes.⁸¹ Access to the data is possible in the event of an offense having an objective direct or indirect link with international transport.⁸² The conditions for accessing the data have been clarified and are now subject to authorization by the investigating judge.⁸³

Given the real and present terrorist threat, the scope of the measure is particularly broad, with the PNR system being applied to intra-EU flights. However, a reassessment of the threat must be organized every three years by an independent judicial or administrative authority.⁸⁴ However, this period is particularly long given that the threat is regularly re-evaluated by the OCAM on the basis of current events. According to the legislator, it is also the existence of the threat that justifies the retention of all the passengers’ data for five years.⁸⁵ After a period of three years, if the circumstances are no longer present, a six-month retention period will have to be introduced.⁸⁶ The circumstances would allow a link to be established between the objective pursued and the retention of the data. Because the ECJ has limited the period of data retention to individual circumstances, critics emphasize this makes it possible to establish a link between the retention of the data and the objective pursued.⁸⁷

In addition, regarding the purposes pursued and the concept of serious crime, the legislator considers that “ordinary” offenses may be targeted as long as they meet the three-year penalty threshold—which will depend on the circumstances of the case. Accordingly, the legislator considers that it is not possible to draw up an exhaustive list of the offenses provided for in national law that fall a priori within the scope of serious crime as defined by the Directive, and provides that this list will have to be set out in a Royal Decree to be reviewed.⁸⁸ In so doing, the legislator entrusts the Executive with the task of determining which offenses are to be classified as serious offenses. But such elements should have been laid down in the law because the principle of formal legality is enshrined in Article 22 of the Constitution.

F. Conclusion

At a time when the European Union just adopted a regulation on artificial intelligence,⁸⁹ we can welcome the CJEU’s ban on self-adapting algorithms in the fight against serious crime and terrorism because of the difficulty for the individuals concerned to benefit from an effective remedy. This decision may have an impact on other measures such as the ETIAS regulation⁹⁰ or the European Commission’s proposal for a regulation to combat child pornography (CSAM).⁹¹ On this point, however, some authors wonder whether the CJEU might not authorize the use of artificial intelligence in the case of transparent algorithms involving human intervention.⁹² However, it is highly regrettable that the CJEU overlooked the ineffectiveness of the measure due to the false positives it generates and the difficulty of developing algorithms that do not lead to discrimination.⁹³ Be that as it may, this PNR ruling is undoubtedly the first of many in Belgium. We can only hope that the Court will continue to specify its strict conditions. For LDH, the next action against the new law is currently being drafted.