Search

In the following, we reflect on the Passenger Name Record Directive (PNR Directive), as recently interpreted by the Court of Justice of the European Union (CJEU) in the Ligue des droits humains judgement, from the perspective of the aforementioned postulates concerning the rule of law. The CJEU was requested to respond to a number of pertinent questions regarding the asymmetry of powers provided by the PNR Directive in relation to individuals, whose personal data and privacy are at stake by the processing of PNR data. In this contribution, we will focus specifically on how the Court addressed the problem of foreseeability of measures established under the PNR Directive. We argue that the Court shared the concern about the PNR system’s compliance with the rule of law, but failed to provide conclusively guidance on what minimum criteria to demand of the quality of the law that governs modern security measures.

The principle of ‘lawfulness’ of data processing with this explicit label assigned to it in Article 5(1)(a) of the General Data Protection Regulation (‘GDPR’) 1 seems to be one of the least disputed principles in the EU data protection framework. 2 It sounds almost like a truism to say that once the processing relies on at least one of six grounds for data processing exhaus-tively enumerated in Article 6(1) GDPR – titled ‘Lawfulness of Processing’ – such processing shall be regarded lawful. According to Article 8(1) of the Law Enforcement Directive (‘LED’), 3 in turn, ‘Member States shall provide for processing to be lawful only if and to the extent that processing is necessary for the performance of a task carried out by a competent au-thority for the [law enforcement] purposes (…) and that it is based on Union or Member State law.’ 4.