Back in April last year, I reported on a hugely important judgment handed down from Europe’s highest court, the Court of Justice of the European Union, which declared the entire Data Retention Direction invalid. That was because the court found that the Directive was a “particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data, without that interference being limited to what is strictly necessary.”
Given the uncompromising nature of that verdict, the European Parliament’s Civil Liberties Committee naturally wanted to know what its impact would be on national laws that implement data retention, and for existing international data retention agreements operating in the EU. These include the Passenger Names Records agreements (PNR), which allows countries to swap detailed information about passengers and the flights they take, and the Terrorist Finance Tracking Programme (TFTP), which is supposedly about tracking the flow of funds terrorists.
The Committee therefore requested an opinion from the European Parliament’s Legal Services department. The digital rights organisation Access has obtained a leaked copy of this, and provided auseful summary of what it says:
the European Parliament legal services indicates that these agreements [involving the retention of personal data], while controversial, are still valid as they benefit from “presumption of legality”. However, the report then adds “That said, the ‘presumption’ of legality of EU acts can also be rebutted and so it cannot be excluded, at this stage, that any other EU act could suffer the same fate as the data retention Directive”. Therefore, all existing agreements currently in place remains valid, however, citizens can request the Commission to look into the validity of these agreements, or they can choose to take legal action to test their validity. In a similar situation, the European Parliament decided last December to send the EU-Canada PNR agreement, currently being reviewed, in front of the CJEU to check its compliance with the EU Charter.