The European Data Protection Board (EDPB) has adopted a statement on the implementation of the European PNR Directive. This directive regulates the collection of travel details of airline passengers, called passenger name records (PNR). This is the second statement by the EDPB on the implementation of the PNR Directive, following a ruling by a European court. That ruling has implications for European countries and their PNR laws.
In the statement on PNR, the EDPB provides recommendations for European Union (EU) member states to transpose the PNR Directive into domestic law.
The recommendations focus on some of the most important aspects of the EU Court of Justice's PNR ruling. Particularly important are:
How European countries should select the flights where PNR data are collected.
How long PNR data may be kept.
According to the EDPB, the retention period for all PNR data should not exceed 6 months. After this period, European countries may only store PNR data for as long as necessary and proportionate to the purposes of the PNR Directive.
The EDPB also recommends having a judge check in advance whether or not the appropriate authorities (e.g., the police) may see certain data.
