The rule and the reviewer¶

Every passenger flying into or out of the European Union has their booking data run against a set of criteria before the aircraft lands. Most of them never learn that this happened, which is correct, because for most of them nothing happened. A small number produce a match, and a person then looks at the match and decides whether anybody needs to do anything about it.

That last step is written into the law. Article 6(5) of Directive (EU) 2016/681 requires member states to ensure that “any positive match resulting from the automated processing of PNR data … is individually reviewed by non-automated means”. A human being examines every hit before it becomes an action.

The Directive says nothing about the passengers who did not match. It could not, because a non-match is not an event. Nothing is created, nothing is recorded as having been decided, and there is nobody to review.

What the reviewer is reviewing¶

The officer looking at a hit is answering one question: does this require action under national law. That is a question about the passenger in front of them. It is not a question about the criterion that produced the passenger.

The criteria themselves are regulated, and quite carefully. Article 6(4) requires them to be “targeted, proportionate and specific”, set and regularly reviewed by the passenger information unit, and never based on a person’s “race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation”. Two different bodies of rules therefore apply. One governs how the criteria are written. Another governs what happens once somebody matches. Neither connects the person who matched to the criterion that matched them.

A fairly substantial number¶

The Court of Justice, sitting as a Grand Chamber, examined this arrangement in June 2022 on a reference from the Belgian Constitutional Court, and let it stand subject to a long list of conditions. Along the way it put a number to something the operators of such systems rarely publish. Citing the Commission’s own working document, it recorded that the positive matches “which prove to be incorrect following individual review by non-automated means” amounted, in 2018 and 2019, “to at least five out of six individuals identified”.

Five in six. The Directive’s seventh recital asks that the criteria be defined so as to keep “to a minimum the number of innocent people wrongly identified by the system”, and the Court treated the proper functioning of the human review as the thing making the whole scheme proportionate. The review is therefore doing real work, and most of that work is undoing the machine.

The filter works on what arrives. A passenger wrongly identified is caught by it, most of the time, at the cost of a delay and some questions. The scheme is built around the assumption that this is the error worth catching.

The passenger who keeps matching¶

Somebody matches every time. Not because of anything in the prohibited list, which the criteria may not use, but because of the shape of their travel: the routes, the booking patterns, the fare classes, the combinations that a targeted, proportionate and specific criterion has picked out as worth a look.

Each individual review is conducted properly and concludes correctly that no action is needed. The person is released each time, having been examined each time. Nothing in the arrangement is malfunctioning.

The Court did provide for the criteria to become visible, and was careful about it. A person must be able to understand how the criteria and the programs applying them work, without necessarily being shown them during the administrative procedure, so that they can decide whether to seek judicial redress. In those proceedings the court, and the person, are to be able to examine the pre-determined criteria and the operation of the programs themselves.

Both routes open on a decision. Our passenger has never had one go against them. The correctness of every individual review is what keeps the criteria out of reach, and the powers of oversight attach downstream of it.

The clerk’s brief¶

March 2025: The supervisors return to the subject¶

The European Data Protection Board adopted Statement 2/2025 on 14 March 2025, on implementing the PNR Directive in the light of the Court’s judgment, addressing among other things retention periods and the criteria by which flights are selected. The clerks record the interval: the judgment came in June 2022, and the supervisory board was still setting out what national law needed to change nearly three years later.

June 2022: The Court names the false positives¶

In Case C-817/19 (ECLI:EU:C:2022:491) the Grand Chamber declared the PNR Directive valid, subject to conditions, on a reference from the Belgian Constitutional Court. At paragraph 106 it recorded, citing the Commission’s working document SWD(2020) 128, that positive matches proving incorrect after individual review amounted in 2018 and 2019 “to at least five out of six individuals identified”. At paragraph 111 it described the system as “a surveillance regime that is continuous, untargeted and systematic”. At paragraph 194 it held that the requirement of pre-determined criteria precludes “the use of artificial intelligence technology in self-learning systems (‘machine learning’), capable of modifying without human intervention or review the assessment process”. The clerks note the Court’s answer to the obvious objection, at paragraphs 210 and 211: a person must be able to understand how the criteria work in order to decide whether to bring proceedings, and in those proceedings the criteria themselves become examinable. Both provisions are drafted around somebody who has received a decision.

July 2020: No amendments at this stage¶

Reviewing the Directive in COM(2020) 305 final on 24 July 2020, the Commission concluded that “no amendments to the PNR Directive should be proposed at this stage”, the priority being correct transposition of the rules already in force. The clerks observe that the review preceded the judgment by two years, and that the judgment then read a substantial number of conditions into the text the Commission had found unproblematic.

April 2016: Any positive match¶

Directive (EU) 2016/681 obliges member states to process passenger data “against pre-determined criteria” and to ensure that “any positive match … is individually reviewed by non-automated means”. The criteria are required to be “targeted, proportionate and specific” and are forbidden from resting on race, ethnic origin, political opinions, religion, trade union membership, health or sexual life. The clerks note the asymmetry the drafting creates: a matched passenger acquires a reviewer, a file and eventually a remedy, and an unmatched one acquires nothing, which is the correct treatment of somebody nothing happened to and a poor way to find out whether the criteria are any good.

Where the file closes on itself¶

This arrangement is better documented than most of its kind, and the documentation is the reason it can be examined at all. What the documents describe is a system with two well-regulated halves and no join. The criteria are written under rules, reviewed periodically, and forbidden certain contents. The matches are reviewed individually, by people, with the Court treating that review as the safeguard that makes the whole lawful. A route from one half to the other exists, and the Court took care to build it: the criteria become examinable in proceedings brought against a decision. The clerks’ standing assessment is that the route opens only for those the reviewer decided against, so the passenger the system keeps selecting and keeps releasing has the best claim to see the rule and the least standing to ask.