The Court of Justice of the European Union recently issued an opinion determining that the agreement envisaged between the EU and Canada on the transfer of Passenger Name Record (PNR) data may not be concluded in its current form, since several provisions of the draft agreement don’t meet requirements stemming from the fundamental rights of the European Union.

The Agreement, negotiated and signed in 2014, concerns the flow of personal data relating to persons travelling to Canada and aims to allow the systematic transfer, retention and usage of PNR data of all air passengers to the Canadian Authorities and their storage for a period of five years.

Despite the serious doubts expressed by the European Data Protection Supervisor such as the envisaged lack of necessity and proportionality of bulk transfers of PNR data to third countries – the Agreement was not amended by the Council but was submitted to the approval of the EU Parliament.

On 25 November 2014, in application of Article 218(11) TFEU, the EU Parliament asked for the CJEU’s position before its final adoption. The matter was referred to the CJEU in order to ascertain the compatibility of the Agreement with the EU Charter of Fundamental Rights and, in particular, with provisions relating to the respect for private life and the protection of personal data.

The Agreement acts as a form of “adequacy decision”, pursuant to Article 25(6) of Directive 95/46/EC,  providing a legal basis for the lawful transfer of PNR data from the EU to Canada.

In its opinion, the CJEU declared that the Agreement involved particularly serious interferences with the fundamental rights guaranteed in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Accordingly, the transfer of PNR data to Canada required a solid justification, based on grounds other than the protection of public security against terrorism and serious transnational crime.

Furthermore, the Agreement did not specify the identities of the “other government authorities in Canada” to which the Canadian Competent Authority is authorised to disclose PNR data. As stated  by the Advocate General in the opinion 1/15,  it is the frequently inaccuracy of the terms of the Agreement, more than the identity of that authority, that raises doubts from the prospective of the principle of proportionality as to the authorities liable to process the PNR data.

The CJEU’s opinion may also have significant consequences on other EU secondary law, such as the recently adopted EU PNR Directive, and it may also impact other international agreements being negotiated with other countries (i.e., the PNR agreements concluded with USA and Australia could be immediately suspended, as well as the related ongoing negotiations with Mexico).