One of the most contentious issues in data protection law since the adoption of the 1995 Directive has been the debate over the transfer of airline passenger data from the European Union (EU) to the US authorities. Following the terrorist attacks of 9/11, the US introduced the Aviation and Transportation Security Act, which obliged airlines to provide the US Bureau of Customs and Border Protection (CBP) with electronic access to passenger data contained in the airlines’ Passenger Name Record (PNR) for flights to or from the US.
Airlines had no real choice in the matter, but the data to be transferred was potentially extensive, and there was no obvious way in which the transfer would be lawful under European data protection legislation.
