Legitimizing pre-emptive data surveillance under the EU law: the case of the PNR Directive

The paper analyses the PNR Directive as pre-emptive data surveillance practice. The 2016/681 Directive regulates the use of Passenger Name Record (PNR) data in the EU for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. It obliges airlines to hand national authorities passengers’ data for all flights from third countries to the EU and vice versa, but Member States can also extend it to ‘intra-EU’ ones (i.e. from an EU country to one or more other EU countries), provided that they notify the EU Commission. Thus, PNR Directive affects all passengers who arrive in the territory of one Member State originating from a third country, or who depart from a Member State’s territory to a non-EU country, including any transfer or transit flights. Using PNR data, the individual is profiled and encoded in terms of degrees of risk.