The Wiesbaden Administrative Court ruled that the unprovoked processing of passenger data by the Federal Criminal Police Office (BKA), as regulated in the German Passenger Data Act, is not legal.

The "total surveillance of all flights" was inadmissible, the 6th chamber ruled at the beginning of December and thus upheld two lawsuits by air passengers who had taken legal action against the processing of their data.

They had flown on routes within Europe and those from the EU to third countries.

Anna Sophia Lang

Editor in the Rhein-Main-Zeitung.

  • Follow I follow

The Air Passenger Data Act was introduced in 2018 and implemented the controversial PNR (Passenger Name Records) directive enacted by the EU Parliament.

This provided for airlines to transmit their passengers' personal data to government agencies, in Germany to the Federal Criminal Police Office.

There they should be compared with police systems and stored for five years.

It is therefore also possible to pass on the data to other authorities.

The law provides for data from 20 categories, including name, address, telephone number, e-mail address, baggage details, nationality, gender, payment information, travel history, frequent flyer status, travel agency and clerk, travel status including check-in status and flights not taken,

comprehensive data on unaccompanied minors and the number and names of people traveling with them.

The law aims to combat terrorism and serious crime, but the data is stored without cause.

ECJ set limits

In June 2022, the European Court of Justice (ECJ) ruled that mass storage without cause was unlawful regarding the Belgian PNR law, citing proportionality.

Data should only be collected if there is a concrete suspicion of terrorism and if the suspicion of serious crime is related to air traffic.

In addition, the ECJ limited storage to six months.

In 2020, the Administrative Court of Wiesbaden also asked questions about the compatibility of the Air Passenger Data Act with European law, in particular the Charter of Fundamental Rights, in the course of the two lawsuits that have now been decided.

In its justification for the judgments, the 6th chamber writes that in both cases the BKA had no legal basis for comparing passenger data with police databases that conformed to fundamental rights.

According to the ECJ, this may only happen "if there are indications of terrorist threats on certain flight routes".

However, the defendant was unable to prove such a threat.

The same applies to flights to a non-EU country: the fight against common crime does not justify comparing the data of all flight passengers with alert and search databases without concrete evidence.

In order to expose passengers to such extensive data collection, the serious criminal offenses would have to be named in the law.

This is the only way to ensure that the data is only collected to combat them.

However, the German Air Passenger Data Act does not contain a catalog of criminal offences.

The judgments are not final.

Appeal to the Hessian Administrative Court and jump revision to the Federal Administrative Court are possible.

The complaints are handled by the "Society for Freedom Rights".

Proceedings are also pending at the District Court of Cologne, but there the question is whether the airlines were allowed to transmit the data to the BKA.