OPINION OF ADVOCATE GENERAL

PITRUZZELLA

delivered on 27 January 2022 ( 1 )

Case C‑817/19

Ligue des droits humains

v

Conseil des ministres

(Request for a preliminary ruling

from the Cour constitutionnelle (Constitutional Court, Belgium))

(Reference for a preliminary ruling – Protection of personal data – Processing of passenger name record (PNR) data – Regulation (EU) 2016/679 – Scope – Directive (EU) 2016/681 – Validity – Charter of Fundamental Rights of the European Union – Articles 7, 8 and Article 52(1))

Table of contents

I. Introduction II. Legal framework A. European Union law 1. The Charter 2. The GDPR 3. The PNR Directive 4. Other relevant EU legislation B. Belgian law C. The dispute in the main proceedings, the questions referred and the procedure before the Court of Justice III. Analysis A. The first question referred B. The second, third, fourth, sixth and eighth questions referred 1. The fundamental rights set out in Articles 7 and 8 of the Charter 2. Interference with the fundamental rights set out in Articles 7 and 8 of the Charter 3. Justification for the interference resulting from the PNR Directive (a) Compliance with the requirement that any limitation on the exercise of a fundamental right laid down by the Charter must be provided for by law (b) Respect for the essence of the rights set out in Articles 7 and 8 of the Charter (c) Compliance with the requirement that the interference must satisfy an objective of general interest (d) Compliance with the principle of proportionality (1) Appropriateness of the PNR data processing operations envisaged by the PNR Directive in the light of the objective pursued (2) Whether the interference is strictly necessary (i) Defining the purposes for which PNR data may be processed (ii) The categories of PNR data covered by the PNR Directive (second and third questions referred) – Whether paragraphs 12 and 18 of Annex I are sufficiently clear and precise (third question referred) – The scope of the data listed in Annex I (second question referred) – Sensitive data (iii) The definition of a ‘passenger’ (fourth question referred) (iv) Whether the advance passenger assessment is sufficiently clear, precise and limited to what is strictly necessary (sixth question referred) – Comparison of data against databases within the meaning of Article 6(3)(a) of the PNR Directive – The processing of PNR data on the basis of pre-determined criteria – The safeguards surrounding the automated processing of PNR data – Conclusion on the sixth question referred (v) Retention of PNR data (eighth question referred) 4. Conclusions on the second, third, fourth, sixth and eighth questions referred C. The fifth question referred D. The seventh question referred E. The ninth question referred F. The tenth question referred IV. Conclusion

I. Introduction

1. By this request for a preliminary ruling, the Cour constitutionnelle (Constitutional Court, Belgium) puts before the Court of Justice a series of 10 questions concerning the interpretation of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; ‘the GDPR’) ( 2 ) and concerning the validity and interpretation of Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the PNR Directive’) ( 3 ) and of Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data (‘the API Directive’). ( 4 ) These questions have arisen in an action brought by the not-for-profit association Ligue des droits humains (LDH), seeking annulment in full or in part of the loi du 25 décembre 2016 relative au traitement des données des passagers (Law of 25 December 2016 on the processing of passenger data) (‘the PNR Law’), ( 5 ) which transposes the PNR Directive and the API Directive into Belgian law.

2. The questions on which the Court is required to rule in this case embody one of the principal dilemmas of contemporary liberal democratic constitutionalism: what balance should be struck between the individual and society in this data age in which digital technologies enabled huge amounts of personal data to be collected, retained, processed and analysed for predictive purposes? The algorithms, big data analysis and artificial intelligence used by public authorities can serve to further and protect the fundamental interests of society to a hitherto unimaginable degree of effectiveness – from the protection of public health to environmental sustainability, from combating terrorism to preventing crime, and serious crime in particular. At the same time, the indiscriminate collection of personal data and the use of digital technologies by public authorities may give rise to a digital panopticon – where public authorities can be all-seeing without being seen – an omniscient power able to oversee and predict the behaviour of each and every person and take the necessary measures, to the point of the paradoxical outcome imagined by Steven Spielberg in the film Minority Report, where the perpetrator of a crime that has not yet been committed is deprived of his liberty. It is well known that in some countries society takes precedence over the individual and the use of personal data legitimately enables effective mass surveillance aimed at protecting what are considered to be fundamental public interests. In contrast, European constitutionalism, whether national or supranational, in which the individual and the individual’s liberties hold centre stage, imposes a significant obstacle to the advent of a mass surveillance society, especially now that the protection of privacy and personal data have been recognised as fundamental rights. To what extent, however, can that obstacle be set up without seriously undermining certain fundamental interests of society – such as those cited above – which may nevertheless be bound up with the constitution? This is at the heart of the relationship between the individual and society in the digital age. That relationship, on the one hand, calls for delicate balancing acts between the interests of society and the rights of individuals, premised on the paramount importance of the individual in the European constitutional tradition, and, on the other, makes it necessary to establish safeguards against abuse. Here, too, we have a contemporary twist on a classic theme of constitutionalism since, as The Federalist categorically asserted, men are not angels, which is why legal mechanisms are needed to constrain and monitor public authorities.

3. This Opinion addresses those broad questions, necessarily confined as it is to interpreting EU law in the light of the Court’s earlier case-law, using well-established techniques including that of interpreting national law in conformity with EU law. I will resort frequently to that mechanism in this Opinion, where the law appears to allow it, as I seek to strike the balance necessary, in constitutional terms, between the public objectives that underpin the system for the transfer, collection and processing of passenger name record data (‘PNR data’) and the rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’).

II. Legal framework

A. European Union law

1. The Charter

4. Under Article 7 of the Charter ‘everyone has the right to respect for his or her private and family life, home and communications’.

5. According to Article 8 of the Charter: ‘1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority’.

6. Under Article 52(1) of the Charter ‘any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the [European] Union or the need to protect the rights and freedoms of others.’

2. The GDPR

7. According to Article 2(2)(d) of the GDPR, the regulation does not apply to the processing of personal data ‘by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’

8. Under Article 23(1)(d) of the GDPR: ‘[EU] or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as in Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: … (d) the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security’.

3. The PNR Directive

9. I will set out below only a brief sketch of how the system established by the PNR directive functions. During the legal analysis I will provide more details of the contents of the provisions of the PNR Directive relevant to the answers to be given to the questions referred.

10. According to Article 1, the PNR Directive, adopted under Article 82(1)(d) and Article 87(2)(a) TFEU, organises at EU level a system for the transfer by air carriers of PNR data relating to extra-EU flights ( 6 ) and for the collection, processing and retention of those data by the competent authorities of the Member States for the purposes of combating terrorism and serious crime.

11. Under Article 3(5) of that directive, ‘passenger name record’ or ‘PNR’ is ‘a record of each passenger’s travel requirements which contains information necessary to enable reservations to be processed and controlled by the booking and participating air carriers for each journey booked by or on behalf of any person, whether it is contained in reservation systems, departure control systems used to check passengers onto flights, or equivalent systems providing the same functionalities’.

12. Annex I to the PNR Directive (‘Annex I’) lists the passenger name record data as far as collected by air carriers that are transferred within the meaning of and in accordance with the arrangements established in Article 8 of that directive.

13. Annex II to the PNR Directive (‘Annex II’) contains a list of the offences that constitute ‘serious crime’ within the meaning of Article 3(9) of that directive.

14. Article 2 of the PNR Directive provides that Member States may decide to apply the directive also to ‘intra-EU flights’ ( 7 ) or to selected such flights it considers ‘necessary’ to include in order to pursue the objectives of the directive.

15. Under Article 4(1) of the PNR Directive ‘each Member State shall establish or designate an authority competent for the prevention, detection, investigation or prosecution of terrorist offences and of serious crime or a branch of such an authority, to act as its passenger information unit (“PIU”)’. According to Article 4(2)(a), the PIU is to be responsible inter alia for collecting PNR data from air carriers, storing and processing those data and transferring those data or the result of processing them to the competent authorities referred to in Article 7 of the PNR Directive. Under Article 7(2), those authorities are ‘authorities competent for the prevention, detection, investigation or prosecution of terrorist offences or serious crime’. ( 8 )

16. According to the second sentence of Article 6(1) of the PNR Directive, ‘where the PNR data transferred by air carriers include data other than those listed in Annex I, the PIU shall delete such data immediately and permanently upon receipt.’ Article 6(2) is worded as follows: ‘The PIU shall process PNR data only for the following purposes: (a) carrying out an assessment of passengers prior to their scheduled arrival in or departure from the Member State to identify persons who require further examination by the competent authorities referred to in Article 7, and, where relevant, by Europol in accordance with Article 10, in view of the fact that such persons may be involved in a terrorist offence or serious crime; (b) responding, on a case-by-case basis, to a duly reasoned request based on sufficient grounds from the competent authorities to provide and process PNR data in specific cases for the purposes of preventing, detecting, investigating and prosecuting terrorist offences or serious crime, and to provide the competent authorities or, where appropriate, Europol with the results of such processing; and (c) analysing PNR data for the purpose of updating or creating new criteria to be used in the assessments carried out under point (b) of paragraph 3 in order to identify any persons who may be involved in a terrorist offence or serious crime.’

17. Article 12 of the PNR Directive contains the provisions relating to the retention of PNR data.

18. Article 5 of the PNR Directive provides that each PIU is to appoint a data protection officer responsible for monitoring the processing of PNR data and implementing relevant safeguards. Furthermore, under Article 15 of that directive, each Member State must entrust the national supervisory authority referred to in Article 25 of Framework Decision 2008/977/JHA, ( 9 ) replaced by Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977 (‘the Policing Directive’), ( 10 ) with monitoring the application within its territory of the provisions adopted pursuant to that directive. That authority, which conducts its activities with a view to protecting fundamental rights in relation to the processing of personal data, ( 11 ) is responsible, inter alia, for, first, dealing with complaints lodged by any data subject, investigating the matter and informing the data subjects of the progress and the outcome of their complaints within a reasonable time period; and, secondly, verifying the lawfulness of the data processing and conducting investigations, inspections and audits in accordance with national law, either on its own initiative or on the basis of a complaint. ( 12 )

4. Other relevant EU legislation

19. The legal framework of the present case also includes the API Directive and the Policing Directive. For ease of reading, I will set out in this Opinion the contents of the relevant provisions of those acts where necessary to address the questions relating to those provisions or where required for the legal analysis in general.

B. Belgian law

20. According to Article 22 of the Belgian Constitution, ‘everyone is entitled to respect for private and family life except in the cases and under the circumstances laid down by law’.

21. According to Article 2, the PNR Law transposes the API Directive and the PNR Directive and partially transposes Directive 2010/65/EU. ( 13 )

22. According to Article 3(1) of the PNR Law, that law ‘lays down the obligations of carriers and tour operators regarding the transfer of data relating to passengers travelling to or from or transiting through Belgian territory’. Under Article 4(1) and (2) of that law, ‘carrier’ means ‘any legal or natural person that carries people by air, sea, rail or land on a professional basis’ and ‘tour operator’ means ‘any travel organiser or agent within the meaning of the Law of 16 February 1994 governing the travel-organisation contract and the travel-agency contract’.

23. Article 8 of the PNR Law provides: ‘1. Passenger data shall be processed for the purposes of: (1) detection and prosecution (including the execution of penalties or measures depriving the person concerned of his or her liberty) of the offences referred to Article 90ter(2), … (7), … (8), … (11), … (14), … (17), (18) and (19) and Article 90ter(3) of the Code d’instruction criminelle [(Criminal Procedure Code)]; (2) detection and prosecution (including the execution of penalties or measures depriving the person concerned of his or her liberty) of the offences referred to in Article 196, in so far as concerns the offences of forgery of authentic and public documents, Articles 198, 199, 199bis, 207, 213, 375 and 505 of the Code pénal [(Criminal Code)]; (3) prevention of serious disturbances to public security in the context of violent radicalisation, through monitoring of developments and groupings in accordance with Article 44/5(1)(2) and (3) and 44/5(2) of the loi du 5 août 1992 sur la fonction de police [(Law of 5 August 1992 on the police service)]; (4) monitoring the activities referred to in Article 7(1) and (3/1), and Article 11(1)(1) to (3) and (5) of the loi du 30 novembre 1998 organique des services de renseignement et de sécurité [(Organic law of 30 November 1998 on the intelligence and security services)]; ( 14 ) (5) detection and prosecution of the offences referred to in Article 220(2) of the loi générale sur les douanes et accises du 18 juillet 1977 [(General customs and excise law of 18 July 1977)] and the third paragraph of Article 45 of the loi du 22 December 2009 relative au régime général d’accise [(Law of 22 December 2009 on the general excise regime)] … 2. Subject to the conditions in Chapter 11, passenger data shall also be processed with a view to improving external border controls on individuals and with a view to combating illegal immigration.’

24. Article 9 of the PNR Law contains a list of the data that may be transferred. Those data correspond to those listed in Annex I.

25. Under Article 18 of the PNR Law, ‘passenger data shall be retained in the passenger database for a maximum period of five years from being entered. They shall be destroyed on expiry of that period’.

26. Article 19 of that law provides that ‘on expiry of six months from the entry of passenger data in the passenger database, all passenger data shall be depersonalised by masking out the information’.

27. Article 24 of the PNR Law provides: ‘1. Passenger data shall be processed with a view to carrying out an assessment of passengers prior to their scheduled arrival in, departure from, or transit through Belgian territory, in order to identify persons who require further examination. 2. For the purposes referred to in Article 8(1)(1), (4) and (5), or relating to the threats referred to in Article 8(1)(a), (b), (c), (d), (f) and (g) and Article 11(2) of the [Organic law of 30 November 1998 on the intelligence and security services], the advance assessment of passengers shall be based on a positive match resulting from comparing passenger data against: (1) the databases managed by the competent services or which are directly available or accessible to those services in the context of their functions or with the lists of individuals drawn up by the competent services in the context of their functions. (2) the assessment criteria pre-determined by the PIU, as referred to in Article 25. 3. for the purposes referred to in Article 8(1)(3), the advance assessment of passengers shall be based on a positive match resulting from comparing passenger data against the databases referred to in Article 8(2)(1) …’

28. Article 25 of the PNR Law reproduces the contents of Article 6(4) of the PNR Directive.

29. Chapter 11 of the PNR Law contains the provisions governing the processing of passenger data with a view to improving border controls and combating illegal immigration. Those provisions transpose the API Directive into Belgian law.

30. Article 44 of the PNR Law provides that the PIU is to appoint a data protection officer within the service public fédéral intérieur (Home Affairs Federal Public Service, Belgium). The Commission de la protection de la vie privée (Commission for the protection of privacy) is to supervise application of the provisions of the PNR Law.

31. Article 51 of the PNR Law amends the Organic law of 30 November 1998 on the intelligence and security services by inserting Article 16/3, worded as follows: ‘l. The intelligence and security services may, for the better exercise of their functions, make a duly reasoned decision to access the passenger data referred to in Article 7 of the [PNR Law]. 2. The decision referred to in Paragraph 1 shall be made by the head of department and notified in writing to the Passenger Information Unit referred to in Chapter 7 of the aforementioned law. The decision and the relevant statement of reasons shall be notified to the Comité permanent R [(Standing Intelligence Agencies Review Committee; “Standing Committee I”)]. Standing Committee I shall prohibit the intelligence and security services from using data gathered in circumstances that do not comply with the statutory conditions. The decision may cover a set of data relating to a specific intelligence investigation. In such a case, Standing Committee I shall be provided once a month with a list of the passenger data searches.’

C. The dispute in the main proceedings, the questions referred and the procedure before the Court of Justice

32. By an application made to the Cour constitutionnelle (Constitutional Court) on 24 July 2017, LDH brought an action seeking annulment in full or in part of the PNR Law. It relied on two pleas in law in support of its action.

33. By its first, and primary, plea, alleging infringement of Article 22 of the Belgian Constitution, read in conjunction with Article 23 of the GDPR, Articles 7, 8 and Article 52(1) of the Charter as well as Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms, signed at Rome on 4 November 1950 (‘the ECHR’), LDH asserts that the contested law infringes the principle of proportionality in respect of its scope and the categories of data to which it refers, the data processing operations it establishes, the purposes of those operations and the period for which data are retained. Specifically, it argues that the definition of PNR data is too broad and can result in the disclosure of sensitive data, and that the definition of ‘passenger’ in that law allows the systematic, non-targeted processing of the data of all the passengers concerned. LDH is also of the view that the PNR Law does not define with sufficient clarity the nature and precise details for the pre-screening of the passenger databases or the criteria used as ‘threat indicators’. Lastly, it contends that the PNR Law goes beyond what is strictly necessary because it provides for PNR data to be processed for purposes broader than those allowed by the PNR Directive and because the five-year retention period for PNR data is disproportionate. By its second plea, submitted in the alternative and alleging infringement of Article 22 of the Belgian Constitution, read in conjunction with Article 3(2) TEU and Article 45 of the Charter, LDH challenges the provisions of Chapter 11 of the PNR Law transposing the API Directive.

34. The Conseil des ministres (Council of Ministers) of the Kingdom of Belgium, as intervener before the Cour constitutionnelle (Constitutional Court), contests LDH’s action, claiming that the two pleas advanced in its support are inadmissible and also ill-founded.

35. The Cour constitutionnelle (Constitutional Court), for its part, makes the following observations.

36. In respect of the first plea, it has doubts, first of all, as to whether the definition of PNR data in Annex I is sufficiently clear and precise. In its view, some of those data are described by way of example rather than exhaustively. The referring court then notes that the definition of ‘passenger’ in Article 3(4) of the PNR Directive involves the collection, transfer, processing and retention of PNR data in relation to any person carried or to be carried who is on the passengers list, regardless of whether there are substantial grounds to believe that the data subject has committed an offence, is on the point of committing an offence or has been found guilty of an offence. In respect of the processing of PNR data, it observes that those data systematically undergo advance assessment that involves cross-checking the PNR data of all passengers against databases or pre-determined criteria in order to find matches. The Cour constitutionnelle (Constitutional Court) states that, although the criteria must be specific, reliable and non-discriminatory, it believes it is nevertheless technically impossible to define any further the pre-determined criteria to be used to identify risk profiles. As regards the retention period for PNR data under Article 12(1) of the PNR Directive, according to which those data can be retained for five years, the referring court finds that PNR data are retained irrespective of whether or not the passengers in question were identified, in the advance assessment, as presenting a public security risk. Under those circumstances, the referring court is uncertain whether, in the light of the case-law established in, inter alia, the judgment of 21 December 2016, Tele2 Sverige and Watson and Others, ( 15 ) and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, ( 16 ) the system for collecting, transferring, processing and retaining PNR data established by the PNR Directive can be considered not to go beyond what is strictly necessary. Against that background, the referring court enquires, also, whether the PNR Directive precludes national rules, such as those resulting from Article 8(1)(4) of the PNR Law, under which PNR data may be processed for a purpose other than those established by that directive. Lastly, it asks whether the PIU can be regarded as ‘another national authority’ able, under Article 12(3)(b)(ii) of the PNR Directive, to authorise the disclosure of full PNR data after a period of six months. In relation to the second plea, the referring court observes that it is directed against Article 3(1), Article 8(2) and Articles 28 to 31 of the PNR Law, governing the collection and processing of passenger data for the purposes of combating illegal immigration and improving border controls. Recalling that, according to Article 3(1), that law covers flights to and from and transiting through national territory, the referring court notes that the national legislature had included intra-EU flights within the scope of the said law in order to obtain ‘a fuller picture of the passengers who represent a potential threat to … security [within the European Union] and national security’, relying on the option available under Article 2, read in conjunction with recital 10, of the PNR Directive.

37. In that context, the Cour constitutionnelle (Constitutional Court) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling: ‘(1) Is Article 23 of [the GDPR], read in conjunction with Article 2(2)(d) of that regulation, to be interpreted as applying to national legislation such as the [PNR Law], which transposes [the PNR Directive] as well as [the API Directive] and Directive [2010/65]? (2) Is Annex I … compatible with Articles 7, 8 and Article 52(1) of the [Charter], given that the data it refers to are very wide in scope – particularly the data referred to in paragraph 18 of [that Annex I], which go beyond the data referred to in Article 3(2) of [the API Directive] – and also given that, taken together, they may reveal sensitive information, and thus go beyond what is “strictly necessary”? (3) Are paragraphs 12 and 18 of Annex I … compatible with Articles 7, 8 and Article 52(1) of the [Charter], given that, having regard to the word “including”, the data referred to in those paragraphs are given by way of example and not exhaustively, such that the requirement for precision and clarity in rules which interfere with the right to respect for private life and the right to protection of personal data is not satisfied? (4) Are Article 3(4) of [the PNR Directive] and Annex I … compatible with Articles 7, 8 and Article 52(1) of the [Charter], given that the system of generalised collection, transfer and processing of passenger data established by those provisions relates to any person using the mode of transport concerned, regardless of whether there is any objective ground for considering that that person may present a risk to public security? (5) Is Article 6 of [the PNR Directive], read in conjunction with Articles 7, 8 and Article 52(1) of the [Charter], to be interpreted as precluding national legislation such as the contested law, which includes, among the purposes for which PNR data is processed, [monitoring] activities within the remit of the intelligence and security services, thus treating that purpose as an integral part of the prevention, detection, investigation and prosecution of terrorist offences and serious crime? (6) Is Article 6 of [the PNR Directive] compatible with Articles 7, 8 and Article 52(1) of the [Charter], given that the advance assessment for which it provides, which is made by comparing passenger data against databases and pre-determined criteria, applies to such data in a systematic and generalised manner, regardless of whether there is any objective ground for considering that the passengers concerned may present a risk to public security? (7) Can the expression “another national authority competent under national law” in Article 12(3) of [the PNR Directive] be interpreted as including the PIU created by the [PNR Law], which would then have power to authorise access to PNR data after six months had passed, for the purposes of ad hoc searches? (8) Is Article 12 of [the PNR Directive], read in conjunction with Articles 7, 8 and Article 52(1) of the [Charter], to be interpreted as precluding national legislation such as the contested law which provides for a general data retention period of five years, without making any distinction in terms of whether the advance assessment indicated that the passengers might present a risk to public security? (9) (a) Is [the API Directive] compatible with Article 3(2) [TEU] and Article 45 of the [Charter], given that the obligations for which it provides apply to flights within the European Union? (b) Is [the API Directive], read in conjunction with Article 3(2) [TEU] and Article 45 of the [Charter], to be interpreted as precluding national legislation such as the contested law which, for the purposes of combating illegal immigration and improving border controls, authorises a system of collection and processing of data relating to passengers “travelling to or from or transiting through Belgian territory”, which may indirectly involve a re-establishment of internal border controls? (10) If, on the basis of the answers to the preceding questions, the Cour constitutionnelle (Constitutional Court) concludes that the contested law, which transposes, inter alia, [the PNR Directive], fails to fulfil one or more of the obligations arising under the provisions referred to in those questions, would it be open to it to maintain the effects of the [PNR Law] on a temporary basis, in order to avoid legal uncertainty and enable the data hitherto collected and retained to continue to be used for the purposes envisaged by th[at] law?’

38. LDH, the Belgian, Czech, Danish, German and Estonian Governments, Ireland, the Spanish, French, Cypriot, Latvian, Netherlands, Austrian, Polish and Finnish Governments and the European Parliament, the Council of the European Union and the European Commission submitted written observations under Article 23 of the Statute of the Court of Justice of the European Union. In accordance with Article 24 of the Statute of the Court of Justice of the European Union, the Commission, the European Data Protection Supervisor (EDPS) and the European Union Agency for Fundamental Rights (FRA) were invited to reply in writing to questions put by the Court. A hearing took place on 13 July 2021.

III. Analysis

A. The first question referred

39. By its first question, the referring court asks the Court in essence whether Article 2(2)(d) of the GDPR must be interpreted as meaning that that regulation – especially Article 23(1), according to which EU or Member State law may, on grounds listed exhaustively in that article, restrict by way of a legislative measure the scope of the obligations and rights provided for – applies to data processing operations carried out under national legislation, such as the PNR Law, which transposes the PNR Directive, the API Directive and Directive 2010/65 into internal law.

40. Article 2(2) of the GDPR lays down exceptions to the scope of that regulation, which is defined, very broadly, ( 17 ) in Article 2(1). ( 18 ) As derogations from application of a regulation governing the processing of personal data and capable of encroaching upon fundamental freedoms, those exceptions must be interpreted strictly. ( 19 )

41. Article 2(2)(d) of the GDPR contains, in particular, an exception according to which the regulation does not apply to the processing of personal data ‘by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security’. That exception is premised on a dual criterion which is both subjective and objective. Data processing operations are accordingly excluded from the scope of that regulation where they are carried out (i) by the ‘competent authorities’ and (ii) for the purposes listed in that article. It is therefore necessary to assess the various types of data processing covered by the PNR Law in the light of that dual criterion.

42. In the first place, the data processing operations carried out by carriers (whether air, rail, land or sea) to PIUs or by tour operators for service provision or commercial purposes, even though they are covered by that law, remain governed by the GDPR since neither the subjective component nor the objective component of the exception in Article 2(2)(d) of that regulation is satisfied.

43. In the second place, the transfer of PNR data to PIUs by the carriers or tour operators which is, in itself, ‘processing’ within the meaning of Article 4(2) of the GDPR, ( 20 ) is not so obviously included in the scope of that regulation.

44. First, the transfer is not by a ‘competent authority’ within the meaning of Article 3(7) of the Policing Directive, which can appropriately be referred to by analogy because the GDPR does not define that concept. ( 21 ) An economic operator, such as a transport undertaking or tour operator, which is subject only to a statutory obligation to transfer personal data and which has not been entrusted to exercise public powers, ( 22 ) cannot be regarded as a body or entity within the meaning of Article 3(7)(b). ( 23 )

45. Secondly, transport undertakings and tour operators transfer PNR data in order to perform an obligation imposed by the law in order to achieve the aims listed in Article 2(2)(d) of the GDPR.

46. To my mind it is clearly apparent from the wording of that provision that only processing operations that satisfy both the subjective and the objective component of the exemption criterion set out in that article fall outside the scope of the GDPR. The transfer of PNR data to the PIU by transport undertakings and tour operators as required by the PNR Law is therefore covered by that regulation.

47. In respect of the provisions of the PNR Law that transpose the PNR Directive, that finding is corroborated by Article 21(2) of that directive, according to which the directive ‘is without prejudice to the applicability of [Directive 95/46/EC] ( 24 ) to the processing of personal data by air carriers’. To my mind, the interpretation of that article suggested by the French Government, among others, to the effect that it merely provides that carriers remain subject to the obligations laid down by the GDPR in respect of data processing operations not referred to in the PNR Directive, must be rejected. Given its wording, the scope of that ‘without prejudice’ caveat is broad and defined only by reference to the person carrying out the processing, since it makes no mention of either the purpose of the processing or the context in which it takes place, whether it is carried out in the course of the commercial activity of an air carrier or in performance of a legal obligation. I also note that Article 13(3) of the PNR Directive contains a caveat to the same effect, referring specifically to air carriers’ obligations under the GDPR ‘to take appropriate technical and organisational measures to protect the security and confidentiality of personal data’. That provision is one of the provisions organising the protection of personal data processed under the PNR Directive and follows Article 13(1) of that directive according to which, in general terms, all data processing carried out under the PNR Directive is subject to the provisions of Framework Decision 2008/977 to which it refers. Contrary to the French Government’s assertion, that approach means, first, that Article 13(3) can be read as bringing within the scope of the GDPR only the data processing under the PNR Directive that is not carried out by ‘competent authorities’ within the meaning of the Policing Directive and, secondly, that the reference to compliance with the data security and confidentiality obligations imposed by that regulation can be understood as a reminder of the safeguards which must in all cases be in place when carriers transfer PNR data to PIUs.

48. The conclusion set out in point 46 of this Opinion is not undermined by recital 19 of the GDPR or recital 11 of the Policing Directive, to which the German Government, Ireland and the French Government, among others, refer when they argue that the PNR Directive is lex specialis. For the personal data processing operations covered by it, that directive does admittedly establish a data protection framework independent of the GDPR. Nevertheless, that specific framework only applies to the processing of PNR data carried out by a ‘competent authority’ within the meaning of Article 3(7) of the Policing Directive – an expression that includes, inter alia, PIUs – whereas the transfer of PNR data to the PIU remains subject to the general framework laid down by the GDPR by virtue of, inter alia, the ‘without prejudice’ caveat in Article 21(2) of the PNR Directive.

49. In support of their line of argument to the effect that the GDPR does not apply to the transfer of PNR data to the PIUs by carriers and tour operators, the Belgian Government, Ireland, and the French and Cypriot Governments refer to the judgment of 30 May 2006, Parliament v Council and Commission, ( 25 ) in which the Court held that the transfer of PNR data by Community air carriers to the authorities of the United States of America, under an agreement negotiated between that country and the European Community, did constitute the processing of personal data in accordance with the first indent of Article 3(2) of Directive 95/46 ( 26 ) and did not, in consequence, fall within the scope of that directive. In reaching that conclusion, the Court took account of the purpose behind the transfer and the fact that it ‘[fell] within a framework established by the public authorities’, even though the data were collected and transferred by private operators. ( 27 )

50. It is sufficient to note in that respect that, in its judgment of 6 October 2020, La Quadrature du Net and Others, ( 28 ) the Court held in essence that the Parliament v Council judgment could not be transposed to the context of the GDPR. ( 29 )

51. Furthermore, in paragraph 102 of the La Quadrature du Net judgment, ( 30 ) applying by analogy the reasoning followed in the Tele2 Sverige judgment and the judgment of 2 October 2018, Ministerio Fiscal, ( 31 ) the Court stated that ‘although [the GDPR] states, in Article 2(2)(d) thereof, that it does not apply to processing operations carried out “by competent authorities” for the purposes of, inter alia, the prevention and detection of criminal offences, including the safeguarding against and the prevention of threats to public security, it is apparent from Article 23(1)(d) and (h) of that regulation that the processing of personal data carried out by individuals for those same purposes falls within the scope of that regulation’. ( 32 )

52. For the reasons set out above, I am persuaded that it is clearly apparent merely from the wording of Article 2(2)(d) of the GDPR that the transfer of PNR data by transport undertakings and tour operators to PIUs does fall under the GDPR, since that article refers only to processing operations carried out by ‘competent authorities’, and that it is not necessary to refer to the exception contained in Article 23(1) of that regulation. ( 33 ) The statement in paragraph 102 of the La Quadrature du Net judgment nevertheless constitutes a clear endorsement by the Court of that view.

53. Since the transfer of PNR data by transport undertakings and tour operators does fall within the scope of the GDPR, national legislation, such as the PNR Law, under which those undertakings and operators are obliged to transfer those data, is a ‘legislative measure’ for the purposes of Article 23(1)(d) of the GDPR and must, therefore, meet the conditions laid down in that article. ( 34 )

54. As regards, in the third place, PNR data processing operations carried out by the PIU and the competent national authorities, as is apparent from the foregoing considerations, whether or not the GDPR applies depends on the purposes of those operations.

55. First, the PNR data processing operations carried out by the PIU and by the competent national authorities for the purposes listed in Article 8(1)(1) to (3) and (5) of the PNR Law ( 35 ) are excluded from the scope of the GDPR where, as would appear to be the case, those purposes are among those covered by the exception in Article 2(2)(d) of the GDPR. The protection of the personal data to which those processing operations relate is a matter of national law, subject to application of the Policing Directive ( 36 ) and, in respect of matters within its scope, of the PNR Directive.

56. Secondly, the same is true of PNR data processing operations carried out by the PIU and by the security and intelligence services in the course of monitoring the activities referred to in the provisions of the Organic law on the intelligence and security services listed in Article 8(1)(4) of the PNR Law, where those processing operations pursue the purposes listed in Article 2(2)(d) of the GDPR, a matter which is for the referring court to determine.

57. The Belgian Government submits that the processing operations carried out under Article 8(1)(4) of the PNR Law are in any event covered by the exceptions established in Article 2(2)(a) of the GDPR and Article 2(3)(a) of the Policing Directive, because the activities of the security and intelligence services do not fall within the scope of EU law.

58. Whilst noting that no question has been referred to the Court seeking interpretation of those provisions, I observe, first of all, that the Court has already held that national legislation that imposes processing obligations on private operators falls under the provisions of EU data protection law, even where it concerns the protection of national security. ( 37 ) It follows that the transfer of PNR data imposed on carriers and tour operators by the PNR Law does in principle fall under the GDPR even where it is carried out under Article 8(1)(4) of that law.

59. Next, I note that, although recital 16 of the GDPR states that the regulation does not apply to ‘activities concerning national security’ and recital 14 of the Policing Directive states that ‘activities concerning national security, activities of agencies or units dealing with national security … should not be considered to be activities falling within the scope of [that] Directive’, the criteria according to which the processing of personal data carried out by a Member State public authority, unit or agency either falls within the scope of a particular act of EU law organising the protection of the data subjects in relation to such processing or falls outside the scope of EU law correspond to a logic based on both the functions attributed to that authority, unit or agency and the purposes of that processing. In that vein, the Court has held that Article 2(2)(a) of the GDPR, read in the light of recital 16 thereof, ‘must be regarded as being designed solely to exclude from the scope of that regulation the processing of personal data carried out by State authorities in the course of an activity which is intended to safeguard national security or of an activity which can be classified in the same category, with the result that the mere fact that an activity is an activity characteristic of the State or of a public authority is not sufficient ground for that exception to be automatically applicable to such an activity’. ( 38 ) The Court also stated that ‘the activities having the aim of safeguarding national security that are envisaged in Article 2(2)(a) of the GDPR encompass, in particular, … those that are intended to protect essential State functions and the fundamental interests of society’. ( 39 ) This means that, where a Member State entrusts its security and intelligence services with tasks in the fields listed in Article 3(7)(a) of the Policing Directive, the data processing operations carried out by those services in order to perform those tasks would fall within the scope of the Policing Directive and, where applicable, the PNR Directive. More generally, I note that, when interpreting Article 4(2) TEU, which is relied upon by the Belgian Government, among others, the Court has repeatedly held that the mere fact that a national measure has been taken for the purpose of protecting national security cannot render EU law inapplicable and exempt the Member States from their obligation to comply with that law, ( 40 ) thereby demonstrating a reluctance to exclude Member States’ activities relating to the protection of national security automatically and en masse from the scope of EU law.

60. Thirdly, in accordance with the view of all the interested parties that have submitted observations, with the exception of the French Government, it should be found that the PNR data processing operations carried out by the competent Belgian authorities for the purposes set out in Article 8(2) of the PNR Law, that is to say, ‘improving external border controls on individuals and with a view to combating illegal immigration’, ( 41 ) are not covered by the exception under Article 2(2)(d) of the GDPR or by any other exception established in that article and, therefore, fall within the scope of that regulation. In contrast to the French Government’s contention, they argue that those operations cannot be governed by the PNR Directive, whose Article 1(2) provides that ‘PNR data collected in accordance with this Directive may be processed only for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime’ nor, in principle, by the Policing Directive, which provides in Article 1(1) thereof that it applies only to the processing of personal data by competent authorities ‘for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security’. As can be seen from the order for reference, Article 8(2) of the PNR Law and Chapter 11 of that law, which contains the provisions governing the processing of passenger data with a view to improving border controls and combating illegal immigration and to that end provides that those data are to be transferred by the PIU to, inter alia, the police services responsible for border control, are intended to transpose the API Directive and Directive 2010/65 into Belgian law. Both those directives require the competent authorities to comply with the provisions of Directive 95/46 in respect of the data processing operations they establish. ( 42 ) Contrary to the contention of the French Government, the reference to the data protection rules under that directive must be understood as encompassing any processing of personal data carried out under the API Directive and Directive 2010/65. The fact that the API Directive existed before Framework Decision 2008/977 came into force is irrelevant in that respect, because both that framework decision and the Policing Directive which replaced it concern only the personal data processing operations referred to in Article 3(1) of the API Directive carried out by competent authorities for law enforcement purposes. ( 43 )

61. On the basis of all the foregoing, I propose that the Court should answer the first question referred to the effect that Article 23, read in conjunction with Article 2(2)(d) of the GDPR, must be interpreted as meaning that: – it applies to national legislation that transposes the PNR Directive to the extent that that legislation governs the processing of PNR data by carriers and other economic operators, including the transfer of PNR data to the PIUs under Article 8 of that directive; – it does not apply to national legislation that transposes the PNR Directive to the extent that the PNR Directive governs data processing carried out for the purposes referred to in Article 1(2) of that directive by the competent national authorities, including the PIUs and, where applicable, the security and intelligence services of the Member State concerned; – it applies to national legislation that transposes the API Directive and Directive 2010/65 with a view to improving external border controls on individuals and with a view to combating illegal immigration.

B. The second, third, fourth, sixth and eighth questions referred

62. By its second, third, fourth and sixth questions referred, the Cour constitutionnelle (Constitutional Court) asks the Court whether the PNR Directive is valid in the light of Articles 7, 8 and Article 52(1) of the Charter. The eighth question referred, although worded as a question of interpretation, likewise requests, in essence, the Court to rule on the validity of that directive.

63. Those questions concern the various components of the PNR data processing system established by the PNR directive, and in respect of each component ask the Court to determine whether it complies with the conditions for the limitations on the exercise of the fundamental rights set out in Articles 7 and 8 of the Charter to be lawful. The second and third questions referred relate to the list of PNR data in Annex I, the fourth concerns the definition of ‘passenger’ in Article 3(4) of the PNR Directive, the sixth relates to the use of PNR data for the advance assessment under Article 6 of that directive, and the eighth addresses the PNR data retention period under Article 12(1) of that directive.

1. The fundamental rights set out in Articles 7 and 8 of the Charter

64. Under Article 7 of the Charter everyone is guaranteed the right to respect for his or her private and family life, home and communications. In Article 8(1), the Charter explicitly recognises that everyone has the right to the protection of personal data concerning him or her. According to consistent case-law, those rights, which concern any information relating to an identified or identifiable individual, are closely linked, because access to a natural person’s personal data with a view to their retention or use affects that person’s right to respect for private life. ( 44 )

65. The rights enshrined in Articles 7 and 8 of the Charter are nevertheless not absolute rights, but must be considered in relation to their function in society. ( 45 ) Under Article 8(2) of the Charter the processing of personal data is therefore authorised if certain conditions are satisfied. That article provides that personal data must be processed ‘fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law’.

66. Any limitation on the right to the protection of personal data or on the right to private life must also comply with the requirements of Article 52(1) of the Charter. Any such limitation must therefore be provided for by law, respect the essence of those rights and, in accordance with the principle of proportionality, be necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.

67. When evaluating a measure that limits those rights, account must also be taken of the importance of the rights enshrined in Articles 3, 4, 6 and 7 of the Charter and of the importance of the objectives of protecting national security and combating serious crime in contributing to the protection of the rights and freedoms of others. ( 46 ) In that regard, Article 6 of the Charter lays down the right of every individual not only to liberty but also to security. ( 47 )

68. Furthermore, Article 52(3) of the Charter is intended to ensure that the rights listed in the Charter have the necessary consistency with the corresponding rights guaranteed in the ECHR, which must be taken into account as the minimum threshold of protection. ( 48 ) The right to respect for family and private life enshrined in Article 7 of the Charter corresponds to the right guaranteed under Article 8 ECHR, and must therefore be regarded as having the same meaning and the same scope. ( 49 ) It can be seen from the case-law of the European Court of Human Rights (‘the ECtHR’) that any interference with the rights guaranteed by Article 8 can only be justified under Article 8(2) if it is in accordance with the law, pursues one or more of the legitimate aims to which Article 8(2) refers and is necessary in a democratic society in order to achieve any such aim. ( 50 ) The measure must also be compatible with the rule of law, which is expressly mentioned in the preamble to the ECHR and inherent in the object and purpose of Article 8 thereof. ( 51 )

69. The questions referred by the cour constitutionnelle (Constitutional Court) concerning validity must be examined in the light of those principles.

2. Interference with the fundamental rights set out in Articles 7 and 8 of the Charter

70. The Court has already held that provisions imposing or allowing the communication of the personal data of natural persons to a third party must be characterised, in the absence of the consent of those natural persons and irrespective of the subsequent use of the data at issue, as an interference in their private life and therefore as a limitation on the right guaranteed in Article 7 of the Charter, without prejudice to the potential justification of such provisions. ( 52 ) The same is true even in the absence of circumstances which would allow that interference to be defined as ‘serious’, without it being relevant that the information in question relating to private life is sensitive or whether the persons concerned have been inconvenienced in any way. ( 53 ) Access by public authorities to that information is likewise an interference with the fundamental right to the protection of personal data enshrined in Article 8 of the Charter, because it constitutes the processing of personal data. ( 54 ) Similarly, the retention of data relating to an individual’s private life for a certain period is an interference with rights enshrined in Articles 7 and 8 of the Charter. ( 55 )

71. The Court has also held that PNR data, as listed in Annex I, include information on identified individuals, namely the air passengers concerned, and that, therefore, the various processing operations which those data may undergo affect the fundamental right to respect for private life guaranteed in Article 7 of the Charter. Those processing operations also fall within the scope of Article 8 of the Charter and, accordingly, must necessarily satisfy the data protection requirements laid down in the said article. ( 56 )

72. In consequence, the PNR data processing operations permitted by the PNR Directive and in particular, in so far as concerns this case, the transfer of those data by air carriers to the PIUs, their use by those units, their subsequent transfer to competent national authorities within the meaning of Article 7 of that directive and their retention, are all interferences with the fundamental rights guaranteed by Articles 7 and 8 of the Charter.

73. As regards how serious that interference is, it should be noted, first, that the PNR Directive envisages the systematic and continuous transfer to the PIUs of PNR data relating to any air passenger, as defined in Article 3(4) of that directive, on an ‘extra-EU flight’ within the meaning of Article 3(2) thereof. Such a transfer involves general access by the PIUs to all the PNR data disclosed. ( 57 ) In contrast to the claims of a number of Member States in these proceedings, the foregoing finding is not undermined by the fact that, because those data undergo automated processing, the PIUs will in practice only have access to data where their analysis has produced a positive result. On the one hand, that fact has not, to date, prevented the Court from finding, in relation to similar systems for the automated processing of personal data collected or retained ‘in bulk’ that the public authorities concerned have general access to those data. On the other hand, merely making personal data available to public authorities to be processed and retained by them involves those authorities having a priori general and full access to those data and an interference with the fundamental rights to respect for private life and the protection of personal data.

74. Secondly, under Article 2(1) of the PNR Directive, the Member States may decide to apply the directive to ‘intra-EU’ flights within the meaning of Article 3(3). I note in that respect that the PNR Directive does not merely establish an option for Member States to extend its application to intra-EU flights, but also lays down both the formal and substantive conditions governing exercise of that option ( 58 ) and states that where it is exercised only in respect of selected intra-EU flights, those flights must be selected on the basis of the objectives pursued by that directive. ( 59 ) Furthermore, the PNR Directive establishes the consequences of exercising that option by providing, in Article 2(2), that where a Member State decides to apply the directive to intra-EU flights, all the provisions of the directive ‘shall apply to intra-EU flights as if they were extra-EU flights and to PNR data from intra-EU flights as if they were PNR data from extra-EU flights.’

75. Under those circumstances, I believe, in contrast to the assertions of a number of governments that have submitted observations in these proceedings, that, even though application of the PNR Directive to intra-EU flights is a matter of choice for the Member States, where such a choice is made, the PNR Directive constitutes the legal basis of interferences with the rights to the respect for private life and the protection of personal data associated with the transfer, processing and retention of PNR data from those flights.

76. Apart from the Kingdom of Denmark, which is not subject to that directive, ( 60 ) almost all the Member States do in fact apply the regime it establishes to intra-EU flights. ( 61 ) That regime therefore applies to all flights entering and leaving the European Union and to virtually all flights within it.

77. Thirdly, Annex I lists the PNR data to be transferred under 19 headings, relating to biographical data, ( 62 ) particulars of the air travel ( 63 ) and other data collected in the context of the contract of transport by air such as telephone number, email addresses, payment information, travel agency or agent, baggage information and general remarks. ( 64 ) As the Court noted in paragraph 128 of Opinion 1/15, ruling on the headings in the Annex to the draft Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data (‘the draft Canada-EU PNR agreement’), which are in broadly similar terms to those in Annex I, ‘even if some of the PNR data, taken in isolation, does not appear to be liable to reveal important information about the private life of the persons concerned, the fact remains that, taken as a whole, the data may, inter alia, reveal a complete travel itinerary, travel habits, relationships existing between air passengers and the financial situation of air passengers, their dietary habits or state of health, and may even provide sensitive information about those passengers’.

78. Fourthly, according to Article 6 of the PNR Directive, the data transferred by air carriers are intended to be analysed by the PIUs by automated means and systematically, that is to say, regardless of whether there is the slightest indication that the data subjects might be involved in terrorist offences or serious crime. Specifically, in the context of the advance assessment of passengers under Article 6(2)(a) of that directive and in accordance with Article 6(3), those data may be verified by cross-checking against ‘relevant’ databases (Article 6(3)(a)) and processed against pre-determined criteria (Article 6(3)(b)). That first type of processing may provide additional information on the private lives of the data subjects ( 65 ) and, depending on the databases used for the cross-checking, may even allow an exact profile of those individuals to be mapped. Under those circumstances, the argument advanced by several governments, to the effect that the PNR Directive permits access to only a relatively limited set of personal data, does not properly reflect the potential extent of the interference with the fundamental rights protected by Articles 7 and 8 of the Charter entailed by the directive, in terms of the extent of the data to which it could allow access. In respect of the second type of data processing, under Article 6(3)(b) of the PNR Directive, in paragraphs 169 and 172 of Opinion 1/15 the Court emphasised that any kind of analysis based on pre-determined criteria will inherently involve some margin of error, including a number of false positives. According to the numerical data in the Commission Staff Working Document ( 66 ) (‘2020 working document’) annexed to the 2020 Commission report, the number of positive matches which prove to be incorrect following the individual review under Article 6(5) of the PNR Directive is fairly substantial, amounting in 2018 and 2019 to at least five out of six individuals identified. ( 67 )

79. Fifthly, according to Article 12(1) of the PNR Directive, PNR data are retained in a database for five years from the time they are transferred to the PIU of the Member State on whose territory the flight arrival or departure point is situated. The PNR Directive therefore makes it possible for information on the private lives of air passengers to be available for a particularly long period of time. ( 68 ) Furthermore, since the transfer of PNR data concerns virtually all flights departing from and entering the European Union, and those within it, and since flying has become a habitual mode of transport, the personal data of a significant proportion of air passengers could be retained on a practically constant basis, simply because they travel by air at least twice every five years.

80. Lastly, in more general terms, the PNR Directive lays down measures which, considered globally, seek to set up a Union-wide surveillance system which is a ‘non-targeted’, that is to say, not triggered by a suspicion relating to one or more specific individuals; ‘mass’, in so far as it includes the personal data of a large number of individuals ( 69 ) covering one category of individuals in its entirety; ( 70 ) and ‘proactive’ system, since it is intended not only to investigate known threats but also to find or identify hitherto unknown dangers. ( 71 ) Such measures inherently give rise to serious interference with the fundamental rights protected by Articles 7 and 8 of the Charter, ( 72 ) as a result in particular of their preventive and predictive purpose, which requires personal data to be assessed in relation to broad segments of the population, since the aim is to ‘identify’ individuals who, depending on the outcome of that assessment, should be subject to further examination by the competent authorities. ( 73 ) Furthermore, the increasingly widespread use, in order to prevent certain forms of serious crime, of the processing of large quantities of diverse personal data collected ‘in bulk’ as well as the identification of links between, and the combined processing of, those data has a ‘cumulative effect’ which amplifies the seriousness of the restrictions on the fundamental rights to respect for private life and the protection of personal data and risks favouring a gradual slide towards a ‘surveillance society’. ( 74 )

81. On the basis of all the foregoing, in my view the PNR Directive entails interference with the fundamental rights protected by Articles 7 and 8 of the Charter that must be described as at least ‘serious’.

82. Admittedly, as the Commission in particular argues, the safeguards and guarantees established by the PNR Directive, in particular to prevent the misuse of PNR data, can, as a whole, reduce the degree or seriousness of that interference. The fact nevertheless remains that the seriousness of the impact on the protected fundamental rights of any regime under which public authorities can gain access to and process personal data is inherent in the objective characteristics of that regime. I believe it is necessary to determine how serious that impact is before ascertaining, as part of the evaluation of whether that interference is proportionate, whether the guarantees laid down by that regime are sufficient and adequate. That appears to have been the Court’s approach up to now.

83. In order to be compatible with the Charter, the interference that the PNR Directive entails with the fundamental rights to respect for private life and the protection of personal data must satisfy the requirements set out in points 65 and 66 of this Opinion, which will be examined below, to the extent that this falls within the matters that the referring court has put before the Court

3. Justification for the interference resulting from the PNR Directive

84. Whereas the third question referred concerns compliance with the condition under the first sentence of Article 52(1) of the Charter, according to which any interference with a fundamental right must be ‘provided for by law’, the second, fourth, sixth and eighth questions seek guidance from the Court in particular on compliance with the principle of proportionality, referred to in the second sentence of that provision.

(a) Compliance with the requirement that any limitation on the exercise of a fundamental right laid down by the Charter must be provided for by law

85. According to well-established case-law of the Court, ( 75 ) based on the case-law of the ECtHR, ( 76 ) the requirement that any limitation on the exercise of a fundamental right must be ‘provided for by law’ not only refers to the fact that the interference must have a basis ‘in law’ – which is not at issue in the present case – but also implies that the legal basis permitting the interference with those rights must itself define clearly and precisely the scope of the limitation. Since it concerns the ‘quality of the law’ and, therefore, the fact that the measure at issue must be accessible and foreseeable, ( 77 ) that second limb contained within the expressions ‘provided for by law’ within the meaning of Article 52(1) of the Charter, ‘laid down by law’ within the meaning of Article 8(2) of the Charter and ‘in accordance with the law’ within the meaning of Article 8 ECHR is not only intended to secure compliance with the principle of lawfulness and adequate protection against arbitrary interference, ( 78 ) but reflects a need for legal certainty. That requirement is further confirmed in the Opinion of 19 August 2016 on the Data protection implications of the processing of Passenger Name Records (‘the 19 August 2016 opinion’) ( 79 ) of the Consultative Committee of Convention 108 Committee. ( 80 )

86. By adopting the PNR Directive, the EU legislature itself restricted the rights enshrined in Articles 7 and 8 of the Charter. The interference with those rights permitted by that directive cannot therefore be regarded as resulting from the choice of the Member States, ( 81 ) notwithstanding any margin of discretion the latter may have had when transposing the directive into national law, but has its legal basis in the PNR Directive itself. Accordingly, in order to uphold the case-law summarised in point 85 of this Opinion and the ‘high standards’ for the protection of the fundamental rights contained inter alia in the Charter and the ECHR and referred to in recital 15 of the PNR Directive, the EU legislature needed to lay down clear and precise rules defining both the scope of the measures providing for that interference and how they are to be applied.

87. While by its third question the referring court is specifically enquiring whether that obligation was complied with in respect of paragraphs 12 and 18 of Annex I, in order to examine the second, fourth and sixth questions referred, by which that court raises doubts as to whether the interference that the PNR Directive entails with the fundamental rights set out in Articles 7 and 8 of the Charter qualifies as necessary, the Court will also have to determine whether the provisions at issue of the PNR Directive are sufficiently clear and precise.

88. Even though, as I indicated in point 85 of this Opinion, that analysis concerns the legality of the interference, as referred to in the first sentence of Article 52(1) of the Charter, I will analyse that aspect as part of my examination of its proportionality, addressed in the second sentence of that paragraph, in line with the approach followed by both the Court and the ECtHR in the cases on measures relating to the processing of personal data. ( 82 )

(b) Respect for the essence of the rights set out in Articles 7 and 8 of the Charter

89. According to the first sentence of Article 52(1) of the Charter, any limitation on the exercise of fundamental rights must not only have a sufficiently precise legal basis but must also respect the essence of those rights.

90. As I set out in point 66 of this Opinion, that requirement – which is to be found in the constitutions of various Member States ( 83 ) and, whilst not expressly laid down by the ECHR, is nevertheless well established in the case-law of the ECtHR ( 84 ) – is enshrined in Article 52(1) of the Charter. ( 85 ) Recognised by the Court a long time before it was codified, ( 86 ) that requirement has been consistently confirmed in the case-law of the EU Courts, even after entry into force of the Treaty of Lisbon.

91. It emerges from the judgment of 6 October 2015, Schrems, ( 87 ) among others, that where an EU act fails to respect the essence of a fundamental right it is automatically void or invalid, and there is no requirement to engage in a balancing exercise of competing interests. The Court has accordingly held that any fundamental right represents a ‘hard nucleus’ that guarantees to each and every individual a sphere of liberty that must always remain free from interference by the public authorities and may not be subject to limitations ( 88 ) without calling into question the democratic principle and the principles of the rule of law and respect for human dignity that underpin the protection of fundamental rights. It is also apparent, both from the wording of Article 52(1) of the Charter and from the Court’s case-law, in particular the Schrems I judgment, that the existence of interference with the essence of the fundamental right at issue must be determined before and independently of evaluation of whether the measure complained of is proportionate. That test, in other words, is autonomous.

92. That having been established, determining what constitutes the ‘essence’ and, therefore, the inalienable substance, of a fundamental right whose exercise may be limited is an extremely complex task. Although, so that it can perform its function, that concept should be capable of being defined in absolute terms in the light of the essential characteristics of the fundamental right at issue, the subjective and objective interests it is intended to protect and, more generally, its function in a democratic society based on respect for human dignity, ( 89 ) in practice it is almost impossible to do so, at least without taking into account criteria normally used when examining whether interference with the right at issue is proportionate, such as how serious that interference is or its extent or temporal dimension and, therefore, without taking into account the specific features of each particular case.

93. As regards the fundamental right to respect for private life in particular, account should be taken not only of the importance of having a private sphere in which to develop the inner personal core for the mental and physical health of all individuals, their well-being, autonomy, self-development and their ability to enter into and cultivate social relationships, but also of the role of that right in preserving other rights and freedoms such as freedom of thought, conscience, religion, expression and information, which can only be fully enjoyed if a private sphere is recognised. In more general terms, account should be taken of the function that respect for private life performs in a democratic society. ( 90 ) When determining whether the essence of that right has been infringed, the Court appears to consider both the intensity and the extent of the interference, suggesting that such infringement is defined quantitatively rather than qualitatively. Accordingly, on the one hand, in the Digital Rights judgment the Court found in essence that the retention of data required by Directive 2006/24/EC ( 91 ) was not so serious that it would affect the essence of the right to private life, because it did not permit ‘the acquisition of knowledge of the content of the electronic communications as such’. ( 92 ) On the other hand, in Opinion 1/15 the Court found in essence that a limitation confined to only certain aspects of the private life of the individuals concerned could not give rise to interference with the essence of that fundamental right. ( 93 )

94. As regards the fundamental right to the protection of personal data, the Court appears to find the essence of that right to be preserved when the measure providing for the interference limits the purposes of the processing and establishes rules ensuring that the data in question will be secure, in particular from accidental or unlawful destruction, or accidental loss or alteration. ( 94 )

95. In the present case, although the referring court has not explicitly referred to the requirement to respect the essence of the rights set out in Articles 7 and 8 of the Charter, the matter of compliance with that requirement in my view lies behind the fourth and sixth questions. That is why I suggest that it should be addressed by the Court.

96. I would call to mind that, in paragraph 150 of Opinion 1/15, while acknowledging that PNR data ‘may, in some circumstances, reveal very specific information concerning the private life of a person’ ( 95 ) and may, directly or indirectly, reveal sensitive information about the person concerned, ( 96 ) the Court nevertheless found that the infringement of the fundamental right to respect for private life resulting from the draft Canada-EU PNR agreement was not liable adversely to affect the essence of that right, because ‘the nature of that information [was] limited to certain aspects of that private life, in particular, relating to air travel between Canada and the European Union’.

97. Apart from the fact that the PNR data covered by the draft Canada-EU PNR agreement were to be transferred to a third country and subsequently processed by the authorities of that third country on its territory, the interference with the fundamental right to respect for private life resulting from that draft agreement and the interference contemplated by the PNR Directive are broadly the same in nature. That is true of the PNR data involved, of the fact that the transfer and processing of those data are systematic and generalised and that the processing is automated, and of the retention of those data, among other factors. What distinguishes the two cases, in contrast, is what could be termed the ‘geographical coverage’ of that interference. As I stated in point 77 of this Opinion, the data processing at issue in this case is not limited to air links with a single third country, as in Opinion 1/15, but concerns almost all flights within the European Union and those entering and leaving it. Compared with the draft Canada-EU PNR agreement, the PNR Directive therefore requires the systematic handling of an appreciably greater number of air passengers, travelling by air inside and outside the European Union. Furthermore, given the larger volume of data processed and the frequency with which they are collected, the processing of those data is likely to provide both more precise and more plentiful information on the private life of the persons concerned (for example, travel habits, personal relationships and financial situation).

98. Nevertheless, as occurred in Opinion 1/15, that information is limited to certain aspects of private life relating to air travel. Since the concept of the ‘essence’ of fundamental rights must be defined restrictively, so that it continues to perform its role as a bastion against attacks on the very substance of those rights, I believe that the finding made by the Court in paragraph 150 of Opinion 1/15 can be transposed to the present case.

99. In Opinion 1/15 the Court also found that the essence of the right to the protection of personal data was not adversely affected. ( 97 ) In my view, that finding can likewise be transposed to the circumstances of the present case. As was the case with the draft Canada-EU PNR agreement, the PNR Directive, in Article 1(2), delimits the purposes of the processing of PNR data. Moreover, that directive, in common with the other EU acts to which it refers, including the GDPR and the Policing Directive, contains specific provisions intended to ensure, in particular, the security, confidentiality and integrity of those data and to protect them from unlawful access and processing. Although it cannot be found that rules such as those established by the PNR Directive affect the essence of the fundamental rights protected by Articles 7 and 8 of the Charter, they must nevertheless be subject to a strict and rigorous review of proportionality.

(c) Compliance with the requirement that the interference must satisfy an objective of general interest

100. The PNR Directive seeks in particular to ensure the internal security of the European Union and to protect the life and safety of persons by transferring PNR data to the competent authorities of the Member States to be used in combating terrorism and serious crime. ( 98 )

101. Specifically, it can be seen from Article 1(2) of that directive, read in conjunction with recitals 6 and 7, and from the Commission’s proposal which led to the adoption of the PNR Directive (‘the proposal for a PNR directive’) ( 99 ) that, in the context of that objective, PNR data are used in various ways by the law enforcement authorities. ( 100 ) First, those data are used to identify individuals involved in or suspected of being involved in terrorist offences or serious crime that have already been committed, to gather evidence and, where relevant, to find associates of criminals and unravel criminal networks (‘reactive’ use). Secondly, PNR data can be assessed before passengers arrive or depart in order to prevent the commission of a crime and to identify persons who were previously unsuspected of involvement in terrorist offences or serious crime but who, on the basis of the outcome of that assessment, should be subject to further examination by the law enforcement authorities (use ‘in real time’). Lastly, PNR data are used to define assessment criteria that can then be applied to assess the risk that passengers pose before they arrive and before they depart (‘proactive’ use). That proactive use of PNR data should enable the law enforcement services to address the threat of terrorist offences and serious crime from a different perspective than through the processing of other categories of personal data. ( 101 )

102. It can be seen from the case-law of the Court that the objective of protecting public security, which covers in particular preventing, investigating, detecting and prosecuting terrorist offences and serious crime, constitutes an objective of general interest of the European Union within the meaning of Article 52(1) of the Charter that is capable of justifying even serious interferences with the fundamental rights enshrined in Articles 7 and 8 of the Charter. ( 102 )

103. The Court has also held that the objectives of safeguarding public security and combating serious crimes contribute to the protection of the rights and freedoms of others. ( 103 ) Accordingly, when striking a balance between those objectives and the fundamental rights enshrined in Articles 7 and 8 of the Charter, ( 104 ) it is also necessary to take into account the importance of the rights enshrined in Articles 3, 4, 6 and 7 of the Charter. Although, in the La Quadrature du Net judgment, the Court found that Article 6 of the Charter ‘cannot be interpreted as imposing an obligation on public authorities to take specific measures to prevent and punish certain criminal offences’, ( 105 ) conversely, as regards, in particular, effective action to combat criminal offences committed against, inter alia, minors and other vulnerable persons, the Court emphasised that positive obligations on the public authorities may result both from Article 7 of the Charter, requiring them to adopt legal measures to protect private and family life, and from Articles 3 and 4, as regards the protection of an individual’s physical and mental integrity and the prohibition of torture and inhuman and degrading treatment. ( 106 )

104. Lastly, the Court has found that the importance of the objective of safeguarding national security goes beyond the objectives of combating crime in general, even serious crime, and of safeguarding public security and is therefore capable of justifying measures entailing more serious interferences with fundamental rights than those which might be justified by those other objectives. ( 107 ) Since terrorist activities can constitute threats to the national security of the Member States, the system enacted by the PNR Directive, because it serves as an instrument for combating such activities, contributes to the objective of safeguarding the national security of the Member States.

(d) Compliance with the principle of proportionality

105. According to the second sentence of Article 52(1) of the Charter, subject to the principle of proportionality, limitations may be placed on the exercise of a fundamental right recognised by that article only if they are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others.

106. In that regard, according to the settled case-law of the Court, the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives. ( 108 )

107. According to the Court’s consistent case-law, the protection of the fundamental right to privacy requires that derogations from and limitations on the protection of personal data must apply only in so far as is strictly necessary. In addition, an objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected by the measure, by properly balancing the objective of general interest against the rights at issue. ( 109 ) Specifically, whether or not a limitation on the rights enshrined in Articles 7 and 8 of the Charter is proportionate must be assessed by measuring the seriousness of the interference entailed by such a limitation and verifying that the importance of the public interest objective pursued by that limitation is proportionate to that seriousness. ( 110 )

108. It emerges from the Court’s case-law that, in order to satisfy the proportionality requirement, the PNR Directive, as the legal basis entailing the interferences described in points 70 to 83 of this Opinion with the fundamental rights enshrined in Articles 7 and 8 of the Charter, must lay down clear and precise rules governing the scope and application of the measures containing the interferences in question and must impose minimum requirements to ensure that the persons whose data have been transferred have sufficient guarantees to effectively protect their personal data against the risk of abuse and against any unlawful access to and use of those data. ( 111 ) The need for such guarantees is all the greater where, as in the present case, the personal data undergo automated processing and where the protection of a particular category of personal data – sensitive data – is at stake. ( 112 )

109. As regards the extent of judicial review of compliance with the requirements flowing from the principle of proportionality, in view of the important role played by the protection of personal data in the light of the fundamental right to respect for private life and the interference with that right entailed by the PNR Directive, the EU legislature’s discretion is reduced, with the result that review should be strict. ( 113 )

(1) Appropriateness of the PNR data processing operations envisaged by the PNR Directive in the light of the objective pursued

110. In paragraph 153 of Opinion 1/15, the Court stated in relation to the draft Canada-EU PNR agreement that the transfer of PNR data to Canada and subsequent processing of those data could be regarded as being appropriate for the purpose of ensuring that the objective relating to the protection of public security and safety was achieved. It does not seem to me that this finding that those operations are appropriate, which has long been acknowledged both at EU level and globally, ( 114 ) can be called into question as regards the collection and subsequent processing of PNR data for either extra-EU flights or intra-EU flights. ( 115 )

111. Nevertheless, the efficacy of the system for the processing of PNR data established by the directive can only be determined in concrete terms, by assessing the results of its application. ( 116 ) From that perspective, that efficacy must be assessed continuously using the most precise and reliable statistical data possible. ( 117 ) In that respect, the Commission should at regular intervals conduct a review similar to that already established in Article 19 of the PNR Directive.

(2) Whether the interference is strictly necessary

112. Although the Cour constitutionnelle (Constitutional Court) has not explicitly expressed doubts as regards whether, in defining the purposes for which PNR data may be processed, the PNR Directive contains clear and precise rules limited to what is strictly necessary, ( 118 ) I believe that when analysing the proportionality of the system laid down by that directive, as the referring court has requested, the Court must address that matter. ( 119 )

(i) Defining the purposes for which PNR data may be processed

113. It is an essential requirement of any data processing system, especially for law enforcement purposes, that the purposes for which the competent authorities are allowed access to personal data and can subsequently use those data must be clearly defined. That requirement must also be satisfied in order to enable the Court to assess whether the measures at issue are proportionate, using the test established in the case-law, which compares the seriousness of the interference with the importance of the objective pursued. ( 120 )

114. The Court has underscored the importance of clearly defining the purposes of measures which involve limitations on the fundamental rights to respect for private life and the protection of personal data, in particular in the Digital Rights judgment, in which it held Directive 2006/24 to be invalid. In paragraph 60 of that judgment, the Court noted that Directive 2006/24 failed to lay down ‘any objective criterion by which to determine the limits of the access of the competent national authorities to the data and their subsequent use for the purposes of prevention, detection or criminal prosecutions concerning offences that, in view of the extent and seriousness of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, may be considered to be sufficiently serious to justify such an interference’ and, in contrast, confined itself to referring ‘in Article 1(1), in a general manner to serious crime, as defined by each Member State in its national law’.

115. Article 1(2) of the PNR Directive sets out a general criterion for limiting the purposes of processing, according to which ‘PNR data collected in accordance with this Directive may be processed only for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime’. Nevertheless, in contrast to Directive 2006/24, the PNR Directive does not merely set out that criterion, but itself, in Article 3(8) and (9), defines both ‘terrorist offences’ and ‘serious crime’, the former by reference to Articles 1 to 4 of Council Framework Decision 2002/475/JHA of 13 June 2002 on combating terrorism (OJ 2002 L 164, p. 3) (replaced by Directive (EU) 2017/541), ( 121 ) and the second, on the one hand, by listing in Annex II the categories of criminal offences corresponding to that expression and, on the other, by establishing a threshold of seriousness according to the maximum custodial sentence or detention order by which those offences can be punished.

116. While the reference to the relevant provisions of Directive 2017/541 does enable the acts that can be classified as terrorist offences under Article 3(8) of the PNR Directive to be characterised sufficiently clearly and precisely and to determine their seriousness in order to weigh the importance of the objective of protecting public security pursued by that directive against the seriousness of the interference it involves with the fundamental rights enshrined in Articles 7 and 8 of the Charter, that finding is not so evidently true in relation to all the offences listed in Annex II.

117. In paragraph 177 of Opinion 1/15, the Court held that the draft Canada-EU PNR agreement defined the degree of seriousness of the offences covered by the expression ‘serious transnational crime’ with clarity and precision by requiring that they be ‘punishable by a maximum deprivation of liberty of at least four years or a more serious penalty’, referring to ‘offences defined by Canadian law’ and setting out ‘the different situations in which a crime is considered to be transnational in nature’.

118. Compared with the legislation that the Court examined in that opinion, the PNR Directive (i) does not take into account, when it defines the offences concerned, the fact that they are transnational; (ii) establishes an exhaustive list of offences which are considered, by their nature, to amount to serious crime, provided they are punishable by at least the maximum penalty laid down in Article 3(9) of that directive; (iii) in principle, lowers the seriousness threshold by adopting a criterion based on the level of the maximum penalty and by setting that threshold at three years.

119. As regards, first, the absence of any limiting criterion based on the fact that the offences are transnational, confining the matters covered by the PNR Directive solely to ‘cross-border’ serious crime would admittedly have made it possible to target offences that may, by nature, have an objective, even if only potential, link with air travel, and, therefore, with the categories of data collected and processed under the PNR Directive. ( 122 ) However, in principle I share the view expressed by the Commission to the effect that, unlike in the context of an international agreement, where the situation concerns a mechanism to combat crime whose objective is to protect the internal security of the European Union, the relevance of such a criterion and the need for it is less obvious. Furthermore, as the Commission also states, the absence of cross-border elements is not in itself a sufficient indication that an offence is not serious.

120. In respect, secondly, of the criterion fixing the threshold of seriousness for the offences concerned – which, so that the seriousness can be assessed in advance, must be interpreted as referring to the maximum duration of the custodial sentence or detention order established by the legislation rather than to the sentence or detention order that may actually be imposed in a particular case – although it is based on at least the maximum penalty rather than on at least the minimum penalty, is not inherently incapable of identifying a level of seriousness sufficient to justify the interference which the data processing under the PNR Directive entails with the fundamental rights enshrined in Articles 7 and 8 of the Charter. To my mind, however, it should be interpreted as a criterion identifying a ‘minimum’ level of seriousness. Such a criterion, although it prevents the Member States from treating offences referred to in Annex II as ‘serious crime’ where their national criminal law establishes for those offences a custodial sentence or detention order with a maximum duration of less than three years, it does not, conversely, oblige them automatically to treat as serious crime all the offences capable of being included in that annex and punishable with a penalty of or above the threshold laid down in Article 3(9) of the PNR Directive where, having regard to the specific features of their penal system, treating them as such would result in the regime established by the PNR Directive being used to prevent, detect, investigate and prosecute ordinary crimes, contrary to the purposes pursued by the directive.

121. As regards, thirdly, the list in Annex II, it should be noted, first of all, that the fact that the PNR Directive lists exhaustively the offences covered by the definition of ‘serious crime’ is a fundamental formal and substantive safeguard intended to ensure that the system established by the PNR Directive is lawful and to ensure legal certainty for passengers. Nevertheless, that list includes not only offences that are inherently and indisputably extremely serious – such as human trafficking, the sexual exploitation of children and child pornography, illicit trafficking in weapons or nuclear or radioactive materials, unlawful seizure of aircraft/ships, serious crimes within the jurisdiction of the International Criminal Court, murder, rape and kidnapping, illegal restraint and hostage-taking ( 123 ) – but also offences which are not so obviously extremely serious, such as fraud, counterfeiting and piracy of products, forgery of administrative documents and trafficking therein and trafficking in stolen vehicles. ( 124 ) Furthermore, among the offences listed in Annex II, some are, by their very nature, more likely than others to be transnational and therefore to have a link with the carriage of passengers by air, such as human trafficking, illicit trafficking in narcotic drugs or weapons, the sexual exploitation of children, facilitation of unauthorised entry and residence and the unlawful seizure of aircraft.

122. The level of clarity and precision of the headings in Annex II is, likewise, very variable. Although the list in that annex must be regarded as exhaustive, several of its headings are ‘open-ended’ ( 125 ) and others refer to generic concepts capable of including a very large number of offences of varying degrees of seriousness, albeit always within the maximum threshold under Article 3(9) of the PNR Directive. ( 126 )

123. In that respect, I note, first, that the harmonising directives adopted in the areas referred to in Article 83(1) TFEU and mentioned in footnote 123 to this Opinion provide information relevant to identifying at least some of the serious criminal offences capable of falling under the corresponding headings of Annex II. For example, Directive 2013/40, in Articles 3 to 8, defines various offences covered by the concept of ‘computer-related crime/cybercrime’ referred to in paragraph 9 of that Annex II and takes care in each case to include only acts constituting ‘cases which are not minor’. ( 127 ) Similarly, Directive 2019/713 defines a number of categories of offences of fraud, and Directive 2017/1371 defines the elements constituting ‘fraud to the [EU]’s financial interests’. It is also appropriate to mention in that context Directive 2008/99/EC, adopted under Article 175(1) EC on the protection of the environment through criminal law, ( 128 ) which, in Article 3, defines a series of serious environmental offences capable of falling under heading 10 of Annex II, including acts qualifying as ‘illicit trafficking in endangered animal species and in endangered plant species and varieties’, excluding all conduct that has a negligible impact on the protected good. I would call to mind, lastly, Directive 2002/90/EC, ( 129 ) which defines the facilitation of unauthorised entry, transit and residence; Framework Decision 2002/946/JHA, ( 130 ) intended to strengthen the penal framework to prevent those offences; Framework Decision 2003/568/JHA, ( 131 ) which defines the criminal offences classified as ‘active and passive corruption in the priv