Privacy and data protection vs. national security in transnational flights: the EU-Canada PNR agreement

In challenging times of international terrorism, the exchange, retention, and use of personal data are becoming increasingly crucial, due to their pivotal role in identifying potential threats to national security. Therefore, domestic and international lawmakers need to regulate such matter through legislation and international agreements. The exchange of passenger name record (PNR) data in transnational flights has been regulated both by EU law and international agreements signed with third countries, such as Australia, Canada, and the US. The latest EU–Canada PNR agreement was referred to the Court of Justice of the European Union (CJEU) by the European Parliament before its entry into force, pursuant to the procedure provided for by Article 218(11) TFEU, allowing EU institutions to ask for an opinion of the CJEU. In July 2017, the CJEU in Opinion 1/15 ruled the draft agreement incompatible with Article 7 (right to privacy), 8 (right to data protection) and 52 (principle of proportionality) of the Charter of Fundamental Rights of the EU. Consequently, the agreement between the EU and Canada will be renegotiated. This analysis reads Opinion 1/15 in light of the previous case law of the CJEU about privacy and national security and examines its potential implications on both institutional balances and international relations. Focusing on some novelties and noteworthy passages of Opinion 1/15, this Article claims that the vital interest of democracy can be reconciled with the need to overcome security threats, as the CJEU’s stance showed.