The rule and the reviewer¶

Every passenger flying into or out of the European Union has their booking data run against a set of criteria before the aircraft lands. Most of them never learn that this happened, which is correct, because for most of them nothing happened. A small number produce a match, and a person then looks at the match and decides whether anybody needs to do anything about it.

That last step is written into the law. Article 6(5) of Directive (EU) 2016/681 requires member states to ensure that “any positive match resulting from the automated processing of PNR data … is individually reviewed by non-automated means”. A human being examines every hit before it becomes an action.

The Directive says nothing about the passengers who did not match. It could not, because a non-match is not an event. Nothing is created, nothing is recorded as having been decided, and there is nobody to review.

The clerk’s brief¶

March 2025: The supervisors return to the subject¶

The European Data Protection Board adopted Statement 2/2025 on 14 March 2025, on implementing the PNR Directive in the light of the Court’s judgment, addressing among other things retention periods and the criteria by which flights are selected. The clerks record the interval: the judgment came in June 2022, and the supervisory board was still setting out what national law needed to change nearly three years later.

June 2022: The Court names the false positives¶

In Case C-817/19 (ECLI:EU:C:2022:491) the Grand Chamber declared the PNR Directive valid, subject to conditions, on a reference from the Belgian Constitutional Court. At paragraph 106 it recorded, citing the Commission’s working document SWD(2020) 128, that positive matches proving incorrect after individual review amounted in 2018 and 2019 “to at least five out of six individuals identified”. At paragraph 111 it described the system as “a surveillance regime that is continuous, untargeted and systematic”. At paragraph 194 it held that the requirement of pre-determined criteria precludes “the use of artificial intelligence technology in self-learning systems (‘machine learning’), capable of modifying without human intervention or review the assessment process”. The clerks note the Court’s answer to the obvious objection, at paragraphs 210 and 211: a person must be able to understand how the criteria work in order to decide whether to bring proceedings, and in those proceedings the criteria themselves become examinable. Both provisions are drafted around somebody who has received a decision.

Five in six. The Directive’s seventh recital asks for criteria that keep “to a minimum the number of innocent people wrongly identified by the system”, and the Court treated the human review as what makes the scheme proportionate. Most of that review is undoing the machine.

July 2020: No amendments at this stage¶

Reviewing the Directive in COM(2020) 305 final on 24 July 2020, the Commission concluded that “no amendments to the PNR Directive should be proposed at this stage”, the priority being correct transposition of the rules already in force. The clerks observe that the review preceded the judgment by two years, and that the judgment then read a substantial number of conditions into the text the Commission had found unproblematic.

April 2016: Any positive match¶

Directive (EU) 2016/681 obliges member states to process passenger data “against pre-determined criteria” and to ensure that “any positive match … is individually reviewed by non-automated means”. The criteria are required to be “targeted, proportionate and specific” and are forbidden from resting on race, ethnic origin, political opinions, religion, trade union membership, health or sexual life. The clerks note the asymmetry the drafting creates: a matched passenger acquires a reviewer, a file and eventually a remedy, and an unmatched one acquires nothing, which is the correct treatment of somebody nothing happened to and a poor way to find out whether the criteria are any good.

The reviewer answers one question: does this passenger require action under national law. Nobody asks whether the criterion that produced the passenger was any good. One set of rules governs how criteria are written, another what happens after a match, and neither connects the person who matched to the criterion that matched them.

Where the file closes on itself¶

Somebody matches every time, not because of anything on the prohibited list but because of the shape of their travel: the routes, the booking patterns, the fare classes. Each review concludes, correctly, that no action is needed, and nothing malfunctions. The correctness of every individual review is what keeps the criteria out of reach, and the powers of oversight attach downstream of it.

This arrangement is better documented than most of its kind, and the documentation is the reason it can be examined at all. What the documents describe is a system with two well-regulated halves and no join. The criteria are written under rules, reviewed periodically, and forbidden certain contents. The matches are reviewed individually, by people, with the Court treating that review as the safeguard that makes the whole lawful. A route from one half to the other exists, and the Court took care to build it: the criteria become examinable in proceedings brought against a decision. The clerks’ standing assessment is that the route opens only for those the reviewer decided against, so the passenger the system keeps selecting and keeps releasing has the best claim to see the rule and the least standing to ask.