Dutch DPA threatens passenger data processing ban over ‘unlawful’ implementation

Writing to the Dutch Ministry of Justice and Safety this week, the DPA asked it to immediately stop the “unlawful processing of passenger name record (PNR) data on a fairly massive scale”, in light of a ruling by the Court of Justice of the EU (CJEU) in June 2022. It has given the government 14 days to bring its PNR practices in line with the requirements set out in the ruling, and has threatened to impose a ban on processing passenger data under the power granted to it by article 58 of the General Data Protection Regulation (GDPR) if the government fails to comply within this time frame.

On 21 June 2022, the CJEU ruled to strictly limit the scope of EU data collection rules designed to fight terrorism and serious crime. The PNR Directive requires the systematic processing of passenger data on flights between the EU and third-party countries. The directive previously enabled member states to collect, transfer and store passenger data from intra-EU flights for up to five years. But the ruling has imposed strict limits on how data can be stored and transferred in the absence of a “genuine and present or foreseeable terrorist threat”.

The court clarified that the system introduced by the PNR Directive can only cover clearly identifiable and circumscribed information listed in its Annex I and is limited to terrorist offences and serious crimes “with at least an indirect objective connection to the transportation of passengers”. 

The Dutch PNR Act provides the ground for the mass collection of passenger and flight data in the Netherlands, and imposes an obligation on airline companies to provide that data to the Passenger Information Unit of the Netherlands (Pi-NL), which is under the Ministry of Justice and Safety. The DPA had already criticised the Act in a letter to the Justice Minister last year.

Privacy law expert Sari van Grondelle of Pinsent Masons described the Dutch DPA’s ultimatum as a “notable move”.

“This activist attitude of the DPA fits into a pattern of many proactive actions towards the Dutch government, such as in the case against the Dutch Tax and Customs Administration for its use of discriminatory data processing practices, the Dutch Ministry of Foreign Affairs for flaws in the way data in the National Visa Information System (NVIS) was handled and shared, and in its many compelling recommendations to the Dutch legislator regarding draft legislation,” she said.

“The DPA seems just as aggressive and critical to the Dutch government as to commercial businesses that are violating the GDPR,” she added.

The DPA’s challenge towards the government’s PNR practices could potentially shape the development of mass tort claims under the GDPR, predicted Wouter Seinen of Pinsent Masons.   

“This could fuel mass claims based on unlawful data processing in the Netherlands,” he said. “The CJEU has not yet taken a position in respect of data subjects’ claims for damages as result of this type of privacy violations, but this action by the DPA certainly gives potential petitioners extra ammunition. While the decision in Lloyd v Google has put a halt on such class action claims in the UK, in Europe this is still in flux.”

The latest action by the Dutch DPA comes shortly after the European Data Protection Board (EDPB) also expressed a negative opinion (13-page / 684KB PDF) on the way the PNR Directive is implemented following the CJEU’s ruling. The EDPB has called on member states to instantly take all necessary steps to ensure that the respective national implementations of the PNR Directive are in line with the Charter, in particular with the fundamental right to protection of personal data.

For airline companies, several questions remain to be answered, including “whether airline companies can successfully oppose the obligation imposed on them under the Dutch PNR Act because it violates EU law”, said van Grondelle.