A few weeks ago, the Federal Republic of Germany received a heavy gossip from the European Court of Justice in relation to the monitoring of passenger data. The Supreme Court declared the previous practice illegal. Now the Federal Criminal Police Office, but also the health authorities, have to massively restrict the data evaluation without cause.

Since 2018, the so-called Passanger Name Records (PNR) of passengers have been stored. The corresponding EU regulation provides for numerous parameters that must be included. For example, this is the name of the passenger, the flight route, the seat, but also the way in which the ticket was paid for.

It is planned that the PNRs will be evaluated in concrete cases of suspicion, for example in order to be able to create movement profiles of suspects. In principle, it is intended that access may only be granted if there is a suspicion of serious crimes such as terrorism. In Germany, however, this was interpreted completely differently, which ultimately brought the matter before the European Court of Justice.

Quite apart from the Federal Criminal Police Office, the health authorities have also been given access to the records. These were systematically forwarded, even though the EU Commission has repeatedly pointed out that there is no legal basis for the actions of the German authorities.

Federal Republic has systematically evaluated data

However, Germany also systematically evaluated the data for general criminal prosecution and stored the PNRs for much longer than provided for in the EU regulation. The Federal Criminal Police Office gave concrete figures to the daily newspaper TAZ. Between August 2018 and April 2022, the data records of 145.821.880 were evaluated and saved.

The German Federal Criminal Police Office (BKA) has to massively restrict unreasonable passenger surveillance following a judgment by the European Court of Justice (ECJ) in June. At the request of the taz, the BKA is now giving figures on the scope and structure of the data analysis for the first time. It was also acknowledged that algorithms were used to systematically search for "unknown criminals". They weren't particularly successful, as they only had around 670 goals in four years.

On June 21, 2022, the European Court of Justice declared the practice previously practiced in Germany to be illegal. The directive could only be brought into line with EU law if it were interpreted narrowly. That was not the case in the Federal Republic, because the national law went far beyond the directive.

Specifically, the ECJ prohibits the German authorities from storing the PNRs for a whopping five years. From the point of view of the highest European judges, a maximum of six months is permissible. The Federal Republic countered that after six months the data would be "disguised". However, the fact that the removal of the names could be reversed by court order did not convince the ECJ.

Artificial intelligence must no longer be used

The European Court of Justice also considers the use of algorithms for the systematic evaluation of PNRs to be inadmissible. The Supreme Court restricts the use of data to two serious crimes: terrorism and crimes that could have a direct impact on air travel. Possible hijackings of commercial aircraft should be mentioned as an example of the last-mentioned use. According to the ECJ, queries and evaluations for other crimes are inadmissible. This also applies to the transfer of data to health authorities.

The decision of the European Court of Justice is even more far-reaching, because the previously practiced PNR storage of trips within the Union area without cause was also declared inadmissible. This may only take place if there are concrete indications of a possible terrorist threat. This means that in future the majority of the data records recorded so far will no longer be allowed to be saved.

The supreme judges expressly state that any evaluation may only be carried out manually, i.e. by officials. The use of algorithms that has been practiced to date is not permitted. The ECJ stated that the proportion of "false positive hits" would be far too high. In fact: between 2018 and 2019 alone, five sixths are said to have led to false suspicions.