Passenger data and human rights

The treaty rules

Article 17 of the ICCPR says no one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence ¹. Article 12(2) says everyone shall be free to leave any country, including his own. Article 26 guarantees equal protection of the law without discrimination ¹. The UN General Assembly adopted the Covenant on 16 December 1966 and it entered into force on 23 March 1976 ¹.

The UN Human Rights Committee adopted General Comment No. 16 on Article 17 on 8 April 1988 ². It says interference provided for by law can still be arbitrary, and must be reasonable in the particular circumstances ². It says relevant legislation must specify in detail the precise circumstances in which interference may be permitted ². It says the gathering and holding of personal information on computers and data banks, by public authorities or private bodies, must be regulated by law ².

UN Special Rapporteur findings

On 1 March 2023, Special Rapporteur Fionnuala Ní Aoláin presented report A/HRC/52/39 to the Human Rights Council on new technologies in counter-terrorism ³. It said API and PNR collection occurs for all travellers without discrimination, which challenges necessity and proportionality ³. It said long retention lets the data become a long-term record of personal behaviour, and expressed concern about inaccurate or discriminatory algorithmic decision-making ³.

The report said Security Council resolution 2396 (2017) created a global mandate to collect biometric data on people crossing borders ³. It called for independent oversight of new technologies, remedies for people whose data is mishandled, and an external independent audit of the UN Countering Terrorist Travel Programme ³.

A 2023 position paper by the same mandate on the programme and its goTravel software recommended pausing the roll-out ⁴. It said blanket collection reverses the presumption of innocence, and that pre-departure screening could stop people leaving to seek asylum ⁴.

Official response: UNOCT says goTravel deployment follows the Secretary-General's guidance on human rights due diligence for digital technology, that the UN has no access to Member State data, and that goTravel has no automated decision-making ⁸.

EU Court of Justice rulings

In Opinion 1/15 of 26 July 2017, the Court said the draft EU-Canada PNR agreement could not be concluded in its form at the time ⁶. It said the transfer of sensitive data lacked justification, that automated analysis must use pre-established models and criteria that are specific, reliable and non-discriminatory, and that oversight must sit with an independent authority ⁶. It said passengers should have a right to individual notification ⁶.

In C-817/19 Ligue des droits humains, decided on 21 June 2022, the Court upheld the EU PNR Directive with limits ⁵. It ruled out a general five-year retention period for all passengers, barred self-learning systems in advance assessment, limited extension to intra-EU flights, and required prior review by a court or independent body for later access, except in duly justified urgency ⁵.

European Court of Human Rights rulings

The European Court of Human Rights applies Article 8 of the European Convention, the right to respect for private life. Its factsheet on personal data protection, dated February 2024, summarises these cases ⁷:

What this means for travellers

Under these rulings, courts have looked at whether a law sets clear limits, how long data are kept, whether people not suspected of wrongdoing are treated differently from people with a verified hit, and whether an independent body reviews access ^5,7. UNOCT says goTravel systems support rights of access, rectification and redress under ICAO standards and national laws ⁸.