The European Court of Justice (ECJ) has annulled an agreement between Europe and the US which formed the legal basis for European airlines to provide passengers’ personal information to US authorities.
After the terrorist attacks of 11 September 2001, the US passed legislation requiring airlines flying into or out of the US to provide access to information (known as "passenger name records" or "PNR") to US customs authorities. PNR information comprises data relating to a passenger’s journey and includes details of departure and return flights, connecting flights, special services required on board and any other relevant information. The information is collected in respect of each journey booked by a passenger and is stored in the air carrier’s automated reservation/departure control systems. PNR information amounts to "personal data" or "sensitive personal data" within the meaning of EU data protection laws and disclosure of such data to the US authorities raised considerable
