The Novelty of EU Passenger Name Records (PNR) in EU Trade Agreements: On Shifting Uses of Data Governance in Light of the EU-UK Trade and Cooperation Agreement PNR Provisions

The EU-UK Trade and Cooperation Agreement (TCA) offers a new chapter in the treatment of Passenger Name Records (PNR), placing PNR law in an EU trade agreement. The TCA exemplifies acutely pre-existing tensions now in the framework of an EU agreement with a third country. In this Article, we examine the evolution of PNR law and look at aspects of the TCA as to PNR relating to the sensitive issue of personal data protection in the context of cross-border data sharing for law enforcement, criminal justice, and border control purposes as an example of the thorny intersection of public law obligations placed on the private sector to provide bulk access to personal data collected for commercial purposes to public sector actors in the framework of counter-terrorism or countering serious crime. First, we provide a brief account of ‘repurposing’ the use of PNR data at the intersection of criminal justice and border controls in EU law and UK law. Secondly, we examine the question of oversight in EU law and under the TCA. Thirdly, we consider the TCA provisions on PNR data sharing in light of the strict fundamental rights review that the CJEU has adopted. Finally, we look at the incorporation of PNR data sharing into the agreement’s law enforcement section and the character of border control and criminal justice. The Article argues that PNR law appears vulnerable when seen in the light of the other international data transfers emerging on the question of oversight and accountability.