Minutes from EU Court of Justice on #CanadaPNR

On 5th April, I attended the oral hearing of the Court of Justice of the European Union (CJEU) on the draft agreement between the EU and Canada on the transfer, use, and retention of air passenger data (EU-Canada PNR agreement). The European Parliament has submitted this agreement to the Court in November 2014.

It was my first time at the Court, and the Grand Chamber is really impressive. However, I watched the hearing from the press room next door in order to be able to use the laptop and wifi.

Colleague Thomas van der Valk was also tweeting.

Here are my tweets in chronological order and with some typos corrected:

EU Court of Justice hearing on EU-Canada PNR agreement about to start. I'll tweet from there.

"The Court is in session". Two short judgements are announced first, then #CanadaPNR hearing in a few minutes. #CJEU
#CanadaPNR hearing started. First: legal service of @Europarl_EN, which submitted the agreement to the Court.
.@Europarl_EN: 2 questions: lack of data protection rights, wrong legal basis of the agreement. Candadian law only allows Canadians remedy.
 .@Europarl_EN questions compatibility with Art. 8 of the Charter of Fundamental Rights (data protection): independent oversight? #CanadaPNR

.@ThmsvdVlk is also live-tweeting from the #CanadaPNR hearing at the #CJEU. 

.@Europarl_EN: Article 47 of the Charter (judicial redress / legal remedies) not met with the PNR agreement?

.@Europarl_EN: Article 52 of the Charter (proportionality and necessity) not met either, see #dataretention judgement?
.@Europarl_EN lists the several typed of processing of PNR data: transfer, access, analysis, retention, onward transfer. #CanadaPNR
 .@Europarl_EN: systematic analysis of all passenger data (profiling) not yet covered by #CJEU case law such as #dataretention or #Schrems.
.@Europarl_EN: Canadian privacy Commissioner has been critical about large-scale PNR data analysis. "mega-data" not "meta-data" #CanadaPNR
.@Europarl_EN: PNR data will be transferred to US authorities under the "beyond the border" agreement, https://www.dhs.gov/beyond-border  #CanadaPNR
Now: Council legal service, defending the #CanadaPNR agreement. "@Europarl_EN also accepted PNR agreements with USA and Australia."
(Reason for @Europarl_EN to submit #CanadaPNR agreement was CJEU #dataretention judgement. It came after USA and Australia PNR agreements.)

Council now on legal arguments about opt-out options for Denmark, Ireland and UK, Court had asked about this as well. #CanadaPNR

Council: Canadian general law allows for legal remedies for anyone, not just people in Canada. #CanadaPNR 

Funny to see the @Europarl_EN agents sitting behind the Council agent who is speaking now. They shake their heads quite often. #CanadaPNR 

Council: Legal basis for #CanadaPNR agreement (Art. 82 TFEU, judicial cooperation) is correct, we maintain our position.

Council: @Europarl_EN did not contest same legal basis for EU-Australia PNR agreement. #CanadaPNR 

.@EUCouncil conclusion: All is fine with the #CanadaPNR agreement.

 .@EU_Commission quotes EU anti-terror coordinator: number of convictions based on PNR "irrelevant". Court had asked about those! #CanadaPNR

.@EU_Commission: The #PNR data is "anonymised" after 30 days. #dataretention judgement is not applicable here. #CanadaPNR

.@EU_Commission: #CanadaPNR agreement provides for legal remedies and independent oversight: Passengers can complain with EU DPAs.
.@EU_Commission: Dispute settlement mechanism in Art. 25 of #CanadaPNR agreement is sufficient. If no solution, EU DPAs can act, cf #Schrems
.@EU_Commission on legal basis: Art. 16 TFEU (#dataprotection) cannot ovver-rule all provisions on police / judicial cooperation. #CanadaPNR
.@EU_Commission: Existing data exchange agreements (Europol etc.) Can't out-rule this agreement, because we need data exchange #CanadaPNR
.@EU_Commission: Critical report by Canadian privacy commissioner shows that independent oversight works. #CanadaPNR

Some laughter in the press room on the last argument by @EU_Commission. (I am here, so I can use the laptop.) #CanadaPNR

Estonia starts their argument with an analogy of two piles of hay. Seems to boil down to "We can eat the cake and still have it". #CanadaPNR 

Estonia: #CanadaPNR data is limited. Helps police to determine criminal intent of travellers. #Schrems not comparable, based on 1995/46/EC.

Estonia: PRISM programme was covert, allowed unlimited data sharing. Completely different for #CanadaPNR: Protects against covert processing

Estonia: We can't limit (target) the amount of passengers, but the profiling limits the group of suspicious passengers anyway. #CanadaPNR 

Estonia: PNR data is broader than API (passport) data. But any border agent could ask you about your credit card number as well. #CanadaPNR 

Estonia: No reason to believe that Canada would process data without good faith. #CanadaPNR will pass #Schrems "eye of the needle" test.

Estonia: We cannot allow the risk of having potentially dangerous people board airplanes. #CanadaPNR is "unavoidably necessary".

Now Ireland on #CanadaPNR: International problems demand international responsed. Agreement is necessary.

Ireland: @Europarl_EN has agreed to PNR agreements with USA and Australia!

Ireland: Choice of legal basis important for us because of our opt-in choice for judicial cooperation. (We'll participate anyway) #CanadaPNR 

 Ireland: Data and number of people affected is much more limited than data in DRI and Schrems cases. #CanadaPNR 

Ireland: @Europarl_EN is endangering international cooperation by its challenge of #CanadaPNR.

Next in #CanadaPNR hearing is Spain: We must regard the specific circumstances of the #CanadaPNR case.

Spain: #dataretention period of 5 years is absolutely necessary for criminal investigations. #CanadaPNR 

Spain: Charter requirement of "independent" DPAs is different than "total independence" under 1995/46/EC. #CanadaPNR guarantees independence

(re last argument: #CanadaPNR is overseen in Canada by an ombudsperson, not by the Canadian DPA.)

After short break, now France on #CanadaPNR: Canada provides essentially equivalent data protection rights. PNR data not intrusive anyway.

France: Judicial approval of transfer of #CanadaPNR data would make the whole approach meaningless. Agreement necessary and proportionate.

Impression so far: Everybody refers to "necessary and proportionate", but hardly anyone except @Europarl_EN is giving criteria. #CanadaPNR 

France: Investigations into crimial networks take 4 to 5 years, therefore we need 5 years #dataretention. Useful. #CanadaPNR 

France: Terrorist groups exist some years before they actually become active. #CanadaPNR 

France insisting that recent CJEU and ECtHR case-law on mass surveillance was about communications, not PNR. #CanadaPNR 

Now UK, their agent in full "Queen's Counsel" style with a wig: We must check purpose, nature of data, safeguards. #CanadaPNR 

UK: There are things we know, and there are things we don't know. We need PNR data to find unknown terrorists and trafficers. #CanadaPNR 

RT @ThmsvdVlk:#CanadaPNR UK says it provided examples to Parliament. Anekdotal yes, not evidence. UK now again providing an example

UK: Use of term "profiling" by @Europarl_EN is wrong. PNR relates to travel pattern, not person's character. [well: "terrorist"?] #CanadaPNR 

UK: Vast majority of #CanadaPNR data will never be subject to human review, only sifted through by computers.

UK attacks @Europarl_EN legal service agent: "His assertions about Canadian law are just wrong".

UK repeats @EU_Commission: Critical report by Canadian DPA shows that independent oversight works. #CanadaPNR.

Last statement by @EU_EDPS, agent is @buchtan. Refers to PNR data demands by other countries, incl. Saudi-Arabia, Russia. #CanadaPNR 

.@EU_EDPS Art. 5 of #CanadaPNR agreement presumes adequacy for Canada without additional safgeguards. No judicial remedy for Europeans.

.@EU_EDPS argues that PNR data can as well be very intrusive, including revealing religious beliefs by means of food preferences. #CanadaPNR 

.@EU_EDPS: Use of #CanadaPNR data is about predictive policing, based on abstract definitions of what is "suspicious" & big data. Like US.

.@EU_EDPS Profiling of #CanadaPNR similar to "Rasterfahndung" (pattern searches) in DE after 9/11. Ruled out by consitutional court in 2006.

.@EU_EDPS dissects claims by Member States & Comission about oversight in #CanadaPNR. Not equivalent to independent authority, EU DPAs out.

Statements in #CJEU #CanadaPNR hearing are over. Thomas von Danwitz, judge rapporteur, now summarising for Q&A.

Danwitz: Passengers are not informed about collection & consequences when they book a flight. Therefore, #CanadaPNR implies purpose change.

.@EU_Commission: "As Article 11 of #CanadaPNR provides..." Danwitz: "We're still at the travel agency now, not in the agreement!"

.@EU_Commission: Well, that is far-fetched. Countries can demand anything from people entering their territory. #CanadaPNR 

Danwitz: DRI judgement requires clear guarantees for data subjects. Should #CanadaPNR data categories be clarified by law, not in annex?

Danwitz: What exactly does "frequent flyer information" mean? All my previous flights under a given loyalty programme? #CanadaPNR 

Danwitz: What does "etc." stand for in point 5 of #CanadaPNR agreement? Is that sufficiently precise?

.@Europarl_EN lawyers are cracking up in the background.

Danwitz now really grilling @EU_Commission on the #CanadaPNR annex. They already have two agents at the bar in order to deal with it.

.@EU_Commission: We were told that all the data can be used for finding terrorists or criminals. #CanadaPNR 

Danwitz: That's not my question. My question is about precision of the annex of #CanadaPNR, and "mandatory" vs "optional" data. Inequality?

Danwitz: Nothing in the #CanadaPNR agreement limits databases for cross-checking to Canadian databases. Is that correct?

.@EU_Commission: Data is used for profiling first, only suspicious data compared with other databases. Danwitz: It's not in the agreement!

Danwitz: The @EU_EDPS asked you to exclude sensitive data. No explicit exclusion in #CanadaPNR agreement, however. Reason (except "useful")?

.@EU_Commission: See Article 8. Danwitz: Hmh, ok.

Danwitz: Why do you not demand statistics in #CanadaPNR agreement, as in the EU directive? .@EU_Commission: Canadians still do statistics.

Danwitz: So you don't have any data on how many convicted passengers were, let's say, muslims? - No. #CanadaPNR 

Danwitz: Can all data be freely exchanged with other Canadian authorities, subject to Art. 18? - COM: Yes, but case-by-case only #CanadaPNR 

Danwitz: Should adequacy finding better be made by EU institutions (c.f. #Schrems), not negotiated with the third country? #CanadaPNR 

Danwitz: Art. 19 only limits 3rd country transfer for "Canadian Competent Authority". What about other Canadian authorities? #CanadaPNR 

Danwitz: The whole "a posteriori" approach of rights enforcement worries me. #CanadaPNR 

Danwitz: Could I object to the algorithm that sifted through my data? - COM: No. Danwitz: Why not? COM: "Prevention" #CanadaPNR 

Danwitz: Even when I leave Canada again, my data stays with their authorities for five years. Why? I have a difficulty with this. #CanadaPNR 

Danwitz: Are all 28 Mio passengers who go to Canada each year subject to such measures, even if completely unsuspicious? COM: yes #CanadaPNR 

#CanadaPNR hearing now into lunch break until 15:00. #CJEU

#CJEU #CanadaPNR hearing has started again. @EU_Commission to answer question from before lunch - "should we all be subject to surveilance"?

.@EU_Commission also now claims there is no "profiling". And then explains what kind of profiling is done with #CanadaPNR data. m(

.@EU_Commission to answer on lack of statistics on use of data, but merely makes false claims on "anonymous" and "deleted". #CanadaPNR 

Judge von Danwitz lectures COM that data are actually not "anonymised" after 30 days. "It bothers me when you're not precise" #CanadaPNR 

Danwitz: You could really anonymise data after 30 days. Or delete data of non-suspicious persons at after they leave Canada. #CanadaPNR 

Danwitz now lecturing on ECtHR case-law re possible discrimination of persons by data stored about them. #CanadaPNR 

Danwitz: Does the data "stigmatise" everyone or just some? That's the question. #CanadaPNR. Now questions from AG and other judges.

Now Paolo Mengozzi, advocate-general for this case, with questions on the legal basis of #CanadaPNR. "COM can rest, but just for a bit"

Council legal service on special carve-out protocols for UK, Ireland and Denmark on judicial cooperation. Q: Have they voted on #CanadaPNR?

AG Mengozzi with Q for COM: Why limitation on sensitive data only for "competent authority", not Canada as a whole? - COM: "..." #CanadaPNR 

Mengozzi: Why limitations for transfers to 3rd countries also only for "competent authority", and no limitations for recipients? #CanadaPNR 

.@EU_Commission: 3rd country authorities not really a concern for us, as they only receive already "filtered" data case-by-case. #CanadaPNR 

AG Mengozzi: "This seems absurd to me." Chance for survival of #CanadaPNR getting slimmer by the minute.

Mengozzi now with question to @Europarl_EN on #CanadaPNR: Legal basis: data protection or judicial cooperation? Could it be both? #CanadaPNR 

.@Europarl_EN: We think it's data protection (Art. 16 TFEU), but could be both. One reason we submitted #CanadaPNR to you.

Mengozzi: Article 4(1) of #CanadaPNR: "EU shall ensure air carriers are not prevented from transferring PNR data" But there are limits!

Mengozzi: Where does the /obligation/ for transfers come from then?#CanadaPNR 

.@Europarl_EU: Our problem is that we don't know Canada's or even the EU's interpretation of this. Canadian law not referenced. #CanadaPNR 

.@Europarl_EN: We also don't know who will be the supervisory authority / body in Canada either. Should be specified! #CanadaPNR 

.@Europarl_EN: Art. 4(1) would neutralise any EU data protection legislation with regards to data transfers. #CanadaPNR 

Judge Rosas to Council with question on legal basis: Should certain Member States vote on instruments that do not bind them? #CanadaPNR 

Council: Well, on the new #EUdataP directive for law enforcement, Denmark will vote, but still unclear if and how it is bound. #CanadaPNR 

Q: Has a link to the Schengen acquis been considered, including to cover Norway, Switzerland, Iceland? #CanadaPNR 

Council (other lawyer): Schengen link was not considered. Re DK, IE, UK: They are bound to a certain extent, therefore can vote. #CanadaPNR 

Judge Regan to @Europarl_EU: How do you reconcile your dataprotection arguments with your declared comittment to fight terrorism? #CanadaPNR 

.@Europarl_EU: You can have general #EUdataP rules, but you can also have special DP rules for anti-terror instruments. #CanadaPNR 

.@Europarl_EN: Look at Art. 5 #CanadaPNR: Canadian authoriy "is deemed to provide an adequate level of protection" - problematic!

Judge Rosa to COM: Which PNR data in the annex are sensitive? Art. 2(e) (sensitive data) doesn't refer to specific data types. #CanadaPNR 

.@EU_Commission: Only point 17, Special Service Request Information etc. Judge: How can we be sure none of the others? Unclear. #CanadaPNR 

Judge Rosas grilling COM now: Why is Art. 2(e) then not directly referencing point 17 of annex? #CanadaPNR 

Judge von Danwitz: What about point 18 annex? "API data collected for reservation purposes"? COM: No. Judge: How can we be sure? #CanadaPNR 

Closing statements now. .@EU_Commission, pretty deperate: Data protection must not turn into an area of fear! #CanadaPNR 

UK lawyer by far with strongest and most well-informed arguments in favour of #CanadaPNR. Must be the wig.

UK: WHole purpose of #CanadaPNR is to ensure that Canada has equivalent protections. Not to install EU DPA oversight over Candian DPA.

Advocate-General Paolo Mengozzi will present his opinion on #CanadaPNR on 30th June. Session is closed.

The @Europarl_EN inofficial twitter team says thanks for RTs and favs! #CanadaPNR @ThmsvdVlk