BEL: +32 (0)488 90 57 80 | IRL: +353 (0)87 7794892
Wexford & Antwerpen

Austrian Passenger Name Records complaint ? the key points

October 20, 2019 In Design News,Digital Freedom

Austrian EDRi member filed a complaint with the Austrian
data protection authority (DPA) about the Passenger Name Records (PNR)
in August 2019, with the aim to overturn the EU PNR Directive. On 6
September, the DPA rejected the complaint, which was a good news,
because that was the only way to lodge a complaint to the Federal
Administrative Court.

The complaint: Objections complaint about the PNR system to the Federal
Administrative Court contains a number of objections. The largest and
most central one concerns the entire PNR Directive itself. The Court of
Justice of the European Union (CJEU) has already repeatedly declared
similar mass surveillance measures to be contrary to fundamental rights,
for example in the case of data retention or in the expert opinion on
the PNR agreement with Canada.

Support our work with a donation!

A complaint can?t be directly lodged to the CJEU, but the Administrative
Court must submit questions on the interpretation of the law to the
CJEU, as suggested in the complaint. The first question
suggested is summarised as follows: “Does the PNR Directive contradict
the fundamental rights of the EU?”

Moreover, Austria has not correctly implemented the PNR Directive, has
partially extended its application, and has not implemented important
restrictions from the Directive. For example, the Directive obliges all
automatic hits, for example when someone is identified as a potential
terrorist, to be checked by a person. This has not been implemented in
the Austrian PNR Act. The question to the CJEU proposed in the complaint
is therefore: “If the PNR Directive is valid in principle, is the
processing of PNR data permitted even though the automatic hits do not
have to be checked by a person?”

Where the Austrian PNR Act goes beyond the Directive,
suggests that the Court should request the Constitutional Court to
repeal certain provisions.

The Austrian PNR Act goes further than the Directive

According to the PNR Directive, PNR data may only be processed for the
purpose of prosecuting terrorist offences and certain serious criminal
offences. These serious crimes are listed in an annex to the Austrian
PNR Act, which are directly translated from the PNR Directive. However,
some of these crimes do not have an equivalent crime in Austrian law,
leaving the entire provision unclear. Because of this flaw, the
complaint  asks the Constitutional Court to repeal this provision of the
PNR Act. The list of terrorist offences in the PNR Act also goes much
further than the Directive.

The PNR Directive only requires EU Member States to record flights to or
from third countries, leaving the recording of intra-EU flights optional
for Member States. Many countries have also extended this to domestic
flights. In Austria, the Minister of the Interior can do this by decree
without giving any specific reason. The complaint suggests that the
Constitutional Court should delete this provision, because it has a
strong impact on the fundamental rights of millions of people — without
any justification of its necessity or proportionality.

Finally, the PNR Act also provides for the possibility for customs
authorities and even the military to have access to PNR data. This is
neither provided for in the PNR Directive, nor necessary for the
prosecution of alleged terrorist and those suspected of serious crimes,
and therefore it?s an excessive measure. Here, too, the complaint
suggests that the Constitutional Court should delete the provisions that
give these authorities access to PNR data.

Our PNR complaint to the Federal Administrative Court

PNR: EU Court rules that draft EU/Canada air passenger data deal is
unacceptable (26.07.2017)

Why EU passenger surveillance fails its purpose (25.09.2019)

Passenger surveillance brought before courts in Germany and Austria

(Contribution by EDRi member, Austria)