Surveillance of travel routes: EU plans to expand passenger data storage

The digital surveillance of travelers within the EU is to be significantly expanded. What has so far primarily concerned air passengers, many member states want to extend to almost all cross-border means of transport. An internal document of the EU Council, published by the civil liberties organization Statewatch, reveals the plans of the former Danish EU Council Presidency for the further development of the shadowing of tourists and business travelers. The paper, initially classified as confidential, clarifies that security authorities are aiming for "transport-neutral" surveillance.

Since 2016, the Directive on Passenger Name Records (PNR) has obliged airlines to transmit extensive data sets of their passengers to police authorities such as the Federal Criminal Police Office (BKA) in Germany. This data includes names, addresses, payment information, and even menu choices. Algorithms filter this information to identify "persons of interest." The new initiative shows that this principle is to be transferred to the maritime sector as well as long-distance rail and road transport.

Particular attention is being paid to maritime transport. The former Council Presidency has proposed harmonizing access to maritime travel data. This concerns information that shipping companies already collect on cruises and ferries. A special working group of member states and the EU Commission is to remove technical hurdles.

In parallel, surveillance of land transport is to be intensified: the document explicitly mentions long-distance buses and international trains. The expansion of automatic license plate recognition is also part of the strategy to make vehicle movements across borders more precisely traceable. This would create a tightly woven surveillance network across the entire continent.

Misappropriation and legal grey areas

A critical point is the planned change of purpose for the data. Originally, PNR storage was justified by the fight against terrorism. The European Court of Justice (ECJ) set strict limits in 2022 and prohibited the indiscriminate mass storage of flights within the EU. The new strategy indicates that member states are now aiming for use beyond law enforcement, for example, for border management and migration control.

Statewatch warns that this would deliberately circumvent high court rulings. If data for combating terrorism were suddenly usable for controlling residence status or uncovering social fraud, there would be a risk of eroding data protection rights. The EU Commission must examine whether "transport-neutral" rules are actually sensible instead of specific regulations for individual modes of transport.

The effectiveness of PNR collection is generally questioned. In Germany, the analysis of 548 million data sets in 2024 led to only 1525 arrests. Nevertheless, many member states are pushing for rapid action. While some delegations argue that new approaches must be proportionate and based on solid impact assessments, in 2019, then Federal Minister of Justice Christine Lambrecht (SPD) also opposed initial EU considerations to collect travel information from rail and ship passengers in advance. However, the signs point to an expansion of relevant programs.

The coming months are likely to be decisive: in the summer, the next evaluation of the PNR directive is due, which is expected to serve as the basis for further legislative proposals. Observers believe the goal is to build a seamless digital security wall that registers and analyzes almost every travel movement within the community.

(nie)