Ligue des droits humains ASBL v Conseil des ministres.

• Jurisdiction: European Union
• Date: 21 June 2022
• Court: Court of Justice (European Union)

Provisional text

JUDGMENT OF THE COURT (Grand Chamber)

21 June 2022 (*)

Table of contents

I. Legal context

A. European Union law

1. Directive 95/46/EC

2. The API Directive

3. Directive 2010/65

4. The GDPR

5. Directive 2016/680

6. The PNR Directive

7. Framework Decision 2002/475

B. Belgian law

1. The Constitution

2. The Law of 25 December 2016

II. The dispute in the main proceedings and the questions referred for a preliminary ruling

III. Consideration of the questions referred

A. Question 1

B. Questions 2 to 4 and Question 6

1. Interferences with the fundamental rights guaranteed in Articles 7 and 8 of the Charter resulting from the PNR Directive

2. Justification for the interferences resulting from the PNR Directive

(a) Observance of the principle of legality and respect for the essence of the fundamental rights in question

(b) Objective of general interest and appropriateness of the processing of PNR data having regard to that objective

(c) Whether the interferences from the PNR Directive are necessary

(1) Air passenger data covered by the PNR Directive

(2) The purposes for which PNR data may be processed

(3) The link between PNR data and the purposes for which those data are processed

(4) The air passengers and flights concerned

(5) Advance assessment of PNR data by automated processing

(i) Comparing PNR data against databases

(ii) Processing PNR data against pre-determined criteria

(iii) Safeguards surrounding the automated processing of PNR data

(6) The disclosure and subsequent assessment of PNR data

C. Question 5

D. Question 7

E. Question 8

F. Question 9(a)

G. Question 9(b)

H. Question 10

IV. Costs

(Reference for a preliminary ruling – Processing of personal data – Passenger Name Records (PNR) – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers of flights operated within the European Union – Automated processing of that data – Retention period – Fight against terrorist offences and serious crime – Validity – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 21 as well as Article 52(1) – National legislation extending the application of the PNR system to other transport operations within the European Union – Freedom of movement within the European Union – Charter of Fundamental Rights – Article 45)

In Case C‑817/19,

REQUEST for a preliminary ruling under Article 267 TFEU from the Cour constitutionnelle (Constitutional Court, Belgium), made by decision of 17 October 2019, received at the Court on 31 October 2019, in the proceedings

Ligue des droits humains

v

Conseil des ministres,

THE COURT (Grand Chamber),

composed of K. Lenaerts, President, A. Arabadjiev, S. Rodin, I. Jarukaitis and N. Jääskinen, Presidents of Chambers, T. von Danwitz (Rapporteur), M. Safjan, F. Biltgen, P.G. Xuereb, N. Piçarra, L.S. Rossi, A. Kumin and N. Wahl, Judges,

Advocate General: G. Pitruzzella,

Registrar: M. Krausenböck, Administrator,

having regard to the written procedure and further to the hearing on 13 July 2021,

after considering the observations submitted on behalf of:

– the Ligue des droits humains, by C. Forget, avocate,

– the Belgian Government, by P. Cottin, J.-C. Halleux, C. Pochet, M. Van Regemorter, acting as Agents, and by C. Caillet, advocaat, E. Jacubowitz, avocat, G. Ceuppens, V. Dethy and D. Vertongen,

– the Czech Government, by T. Machovičová, O. Serdula, M. Smolek and J. Vláčil, acting as Agents,

– the Danish Government, by M. Jespersen, J. Nymann-Lindegren, V. Pasternak Jørgensen and M. Søndahl Wolff, acting as Agents,

– the German Government, by D. Klebs and J. Möller, acting as Agents,

– the Estonian Government, by N. Grünberg, acting as Agent,

– Ireland, by M. Browne, A. Joyce, J. Quaney, acting as Agents, and D. Fennelly, Barrister-at-Law,

– the Spanish Government, by L. Aguilera Ruiz, acting as Agent,

– the French Government, by D. Dubois, E. de Moustier and T. Stéhelin, acting as Agents,

– the Cypriot Government, by I. Neofytou, acting as Agent,

– the Latvian Government, by E. Bārdiņš, K. Pommere and V. Soņeca, acting as Agents,

– the Netherlands Government, by M.K. Bulterman, A. Hanje, J. Langer and C.S. Schillemans, acting as Agents,

– the Austrian Government, by G. Kunnert, A. Posch and J. Schmoll, acting as Agents,

– the Polish Government, by B. Majczyna, acting as Agent,

– the Slovak Government, by B. Ricziová, acting as Agent,

– the Finnish Government, by A. Laine and H. Leppo, acting as Agent,

– the European Parliament, by O. Hrstková Šolcová and P. López-Carceller, acting as Agents,

– the Council of the European Union, by J. Lotarski, N. Rouam, E. Sitbon and C. Zadra, acting as Agents,

– the European Commission, by D. Nardi and M. Wasmeier, acting as Agents,

– the European Data Protection Supervisor, by P. Angelov, A. Buchta, F. Coudert and C.-A. Marnier, acting as Agents,

– the European Union Agency for Fundamental Rights, by L. López, T. Molnar, M. Nespor and M. O’Flaherty, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 27 January 2022,

gives the following

Judgment

1 This reference for a preliminary ruling, in essence, concerns:

– the interpretation of Article 2(2)(d) and Article 23 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’), of Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data (OJ 2004 L 261, p. 24; ‘the API Directive’) and of Directive 2010/65/EU of the European Parliament and of the Council of 20 October 2010 on reporting formalities for ships arriving in and/or departing from ports of the Member States and repealing Directive 2002/6/EC (OJ 2010 L 283, p. 1);

– the interpretation and validity, in the light of Articles 7 and 8 as well as Article 52(1) of the Charter of Fundamental Rights of the European Union (‘the Charter’), of Article 3(4) and Articles 6 and 12 of, as well as Annex I to, Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (OJ 2016 L 119, p. 132; ‘the PNR Directive’), and

– the interpretation and validity, in the light of Article 3(2) TEU and Article 45 of the Charter, of the API Directive.

2 The request has been made in proceedings between the Ligue des droits humains and the Conseil des ministres (Council of Ministers, Belgium) concerning the legality of the loi du 25 décembre 2016, relative au traitement des données des passagers (Law of 25 December 2016 on the processing of passenger data).

I. Legal context

A. European Union law

1. Directive 95/46/EC

3 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) was repealed by the GDPR, with effect from 25 May 2018. Article 3(2) of that directive provided:

‘This Directive shall not apply to the processing of personal data:

– in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,

– by a natural person in the course of a purely personal or household activity.’

2. The API Directive

4 Recitals 1, 7, 9 and 12 of the API Directive state:

‘(1) In order to combat illegal immigration effectively and to improve border control, it is essential that all Member States introduce provisions laying down obligations on air carriers transporting passengers into the territory of the Member States. In addition, in order to ensure the greater effectiveness of this objective, the financial penalties currently provided for by the Member States for cases where carriers fail to meet their obligations should be harmonised to the extent possible, taking into account the differences in legal systems and practices between the Member States.

…

(7) The obligations to be imposed on carriers by virtue of this Directive are complementary to those established pursuant to the provisions of Article 26 of the 1990 Schengen Convention implementing the Schengen Agreement of 14 June 1985, as supplemented by Council Directive 2001/51/EC [of 28 June 2001 supplementing the provisions of Article 26 of the Convention implementing the Schengen Agreement of 14 June 1985 (OJ 2001 L 187, p. 45)], the two types of obligation serving the same objective of curbing migratory flows and combating illegal immigration.

…

(9) In order to combat illegal immigration more effectively and in order to ensure the greater effectiveness of this objective, it is essential that, without prejudice to the provisions of Directive [95/46], account be taken at the earliest opportunity of any technological innovation, especially with reference to the integration and use of biometric features in the information to be provided by the carriers.

…

(12) Directive [95/46] applies with regard to the processing of personal data by the authorities of the Member States. This means, that whereas it would be legitimate to process the passenger data transmitted for the performance of border checks also for the purposes of allowing their use as evidence in proceedings aiming at the enforcement of the laws and regulations on...