A few weeks ago we have filed a complaint with the Austrian data protection authority about the Passenger Name Record. Our aim is to overturn the directive, in other words to virtually abolish it. Four weeks ago the data protection authority has rejected our complaint, which we think is good news, because that is the only way we can go to court. We now had four weeks to draft and file a complaint for the Federal Administrative Court. But what exactly is in the complaint?

Our complaint about the PNR system to the Federal Administrative Court contains a number of objections, which we will explain in more detail here.

Our objections

The largest and most central objection concerns the entire PNR Directive itself. We consider it to be contrary to fundamental rights and disproportionate. The ECJ has already repeatedly declared similar mass surveillance measures to be contrary to fundamental rights, e.g. in the case of data retention or in the expert opinion on the PNR agreement with Canada. On our topic page you can read our main criticisms of passenger data retention again.

We cannot go directly to the ECJ ourselves, but the Administrative Court must submit questions on the interpretation of the law to the ECJ, as we suggested in the complaint. The first question suggested is summarised as follows: "Does the PNR Directive contradict the fundamental rights of the EU?"

Moreover, Austria has not correctly implemented the PNR Directive, has partially extended its application and has not implemented important restrictions from the Directive. For example, the Directive obliges all automatic hits to be checked by a person. This has not been implemented in the Austrian PNR Act. Our proposed question to the ECJ is therefore: "If the PNR Directive is valid in principle, is the processing of PNR data permitted even though the automatic hits do not have to be checked by a person?"

Where the Austrian PNR Act goes beyond the Directive, we have suggested that the Court should request the Constitutional Court to repeal certain provisions. 

PNR Act goes further than directive

According to the PNR Directive, PNR data may only be processed for the purpose of prosecuting terrorist offences and certain serious criminal offences. These serious crimes are listed in an annex to the Austrian PNR Act, which copies the PNR Directive one-to-one, but cannot be clearly transferred to Austrian law, leaving the provision unclear. We have therefore suggested that the Constitutional Court should repeal this part of the PNR Act. The list of terrorist offences in the PNR Act also goes much further than the Directive.

The PNR Directive only requires EU member states to record flights to or from third countries. However, many countries have also extended this to domestic flights. In Austria, the Minister of the Interior can do this by decree without giving any reason. The first such decree came on the first day when the law came into force. Now there is already the third decree and the extension was continuous. In the complaint, we suggest that the Constitutional Court should also delete this provision and the decree itself extending its application, because it represents a massive encroachment on the fundamental rights of millions of people - and without any justification whatsoever.

Finally, the PNR Act also provides for the possibility for customs authorities and even the military to have access to PNR data. This is neither provided for in the PNR Directive nor necessary for the prosecution of terrorist and serious crimes, and therefore excessive. Here, too, we suggest that the Constitutional Court should delete the provisions that give access to these authorities.