EDPS Opinion 16/2025 on the signing and conclusion of an Agreement between the EU and Norway on the transfer of Passenger Name Record data

Opinion 16/2025

on the signing and conclusion of an Agreement between the EU and Norway on the transfer of Passenger Name Record data

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 12 June 2025, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. The aim of the draft Agreement is to enable the transfer of Passenger Name Record (PNR) data by air carriers from the Union to Norway and to lay down rules and conditions subject to which those PNR data may be processed by Norway as well as to enhance police and judicial cooperation between the Union and Norway in respect of PNR data.

In the Opinion, the EDPS recalls the specific legal situation of Norway as a Schengen associated country. Pursuant to the Schengen Association Agreement between the EU and Norway of 1999, Norway is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. As a result, Norway is supposed to apply the Directive (EU) 2016/680 in a similar manner as EU Member States. In addition, as member of the European Economic Area, Norway is not considered as a third country within the meaning of Chapter V of the GDPR. However, the EU PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Norway is not bound by its provisions. Consequently, the Agreement between the EU and Norway must adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

Following his assessment of the draft Agreement, including the implementation of his previous specific recommendations on the negotiating mandate, the EDPS concludes that the draft Agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime contains the necessary safeguards required in order for it to be compatible with the EU legal framework on data protection.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 12 June 2025 the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Proposals’).

2. The aim of the draft Agreement is to enable the transfer of Passenger Name Record (PNR) data by air carriers from the Union to Norway and to lay down rules and conditions subject to which those PNR data may be processed by Norway, as well as to enhance police and judicial cooperation between the Union and Norway in respect of PNR data .

3. The negotiations on a PNR Agreement with Norway, as well as with two other Schengen associated countries - Iceland and the Swiss Confederation, began on 21 March 2024, in accordance with the negotiating mandate adopted by the Council on 4 March 2024 . On 9 April 2025, the EU and Norway negotiators initialled the text of the draft Agreement and thus formally concluded negotiations .

4. The present Opinion of the EDPS is issued in response to two consultations by the European Commission of 12 June 2025, pursuant to Article 42(1) of EUDPR. Bearing in mind that both Proposals concern the same draft Agreement, the present Opinion covers both of them. The EDPS welcomes the reference to this consultation in Recitals 6 of the Proposals.

2. General remarks

5. PNR data is information provided by passengers, and collected by and held in the air carriers’ reservation and departure control systems for their own commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (the Charter). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards.

6. In addition to the Charter, the applicable legal rules in case of transfer and processing of PNR data, include also the horizontal EU legal framework on data protection, namely Regulation (EU) 2016/679 (the GDPR) and Directive (EU) 2016/680 (the Law Enforcement 7 8 Directive) , as well as the specific Directive (EU) 2016/681 (the EU PNR Directive) .

7. Furthermore, the Court of Justice of the EU (CJEU) on two occasions interpreted the legal framework on PNR and provided guidance as regards proportionality and the necessity of PNR data processing, namely in Opinion 1/15 of 26 July 2017 and Judgment in Case C- 817/2019 of 21 June 2022 . The requirements laid down by the CJEU in the cited case law constitute an important point of reference for the assessment of any EU agreement on the transfer of PNR data, including the one at hand.

8. The EDPS also recalls that, in addition to the Union legislation, PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019 called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) from 2020, adopted by means of Amendment 28 to Annex 9 to the Convention on International Civil Aviation (Chicago Convention) . All EU Member States, as well as Norway, are Parties to the Chicago Convention.

9. An important legal aspect to be noted, which is also expressly highlighted in the Proposals, is the legal situation of Norway as a Schengen associated country as regards the application of the Union legal framework on data protection. Firstly, Norway is not considered a third country within the meaning of Chapter V of Regulation 2016/679 since the GDPR has been incorporated with adaptations in Annex XI to the European Economic Area (EEA) Agreement. Secondly, pursuant to Article 8 of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters' association with the implementation, application and development of the Schengen acquis of 1999 , Norway is bound by the Union acts which constitute a development of the provisions of the Schengen acquis, including Directive (EU) 2016/680, in a similar manner as EU Member States.

10. However, the EU PNR Directive does not constitute a development of the Schengen acquis, hence Norway does not participate in the implementation of this legal instrument . Therefore, the Agreement between the EU and Norway must adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

11. The EDPS has already issued in 2023 an Opinion on the negotiating mandate for an Agreement between the EU and Norway on the transfer of PNR data . In his Opinion, the EDPS made two specific recommendations: - to align the definition of sensitive data in the future Agreement with the definitions of special categories of data in Article 9(1) of GDPR and Article 10 of Directive (EU) 2016/680; and - to provide for in the Agreement the legal possibilities to suspend it in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent.

12. The EDPS notes with satisfaction that these recommendations have been taken into account during the negotiations and are subsequently reflected in the final text of the Agreement, as follows: - Article 8 of the draft Agreement provides for a prohibition to process special categories of PNR data in line with how this concept has been defined in the EU data protection acquis; - Article 20 of the draft Agreement provides for a suspension mechanisms and Article 21 provides for the possibility for either Party to terminate the Agreement at any time.

3. Use of the API-PNR router

13. The EDPS notes that Article 4 of the draft Agreement provides for the possibility for Norway to make use of the API-PNR router established with Regulation (EU) 2025/13 , as envisaged by Article 10(c) of that Regulation, which has not been included in the negotiating directives.

14. The EDPS recalls that he has issued an Opinion on the proposals for the so-called API Regulations , which were subsequently adopted as Regulation (EU) 2025/12 and Regulation (EU) 2025/13, where he commented, among others, on the router.

15. In view of the fact that Norway is a Schengen associated country with direct access to the EU large-scale IT systems in the area of justice and home affairs, the EDPS considers the possible use of a common technical solution for the exchange of PNR data as appropriate. In this context, the EDPS welcomes the provision of Article 4(1)(b) of the draft Agreement, which explicitly clarifies that Norway would be bound by the rules on the functioning and the conditions for the use of the API-PNR router, as established by API Regulations, if it decides to use this common technical solution.

4. Access to PNR data by Europol and Eurojust

16. The EDPS notes that according to Article 15 of the draft Agreement, Norway will share with Europol or Eurojust, within the scope of their respective mandates, the results of processing of PNR data, or analytical information based on PNR data, in specific cases where necessary to prevent, detect, investigate, or prosecute terrorist offences or serious crime. Such exchange may be carried out on its own initiative or at the request of the Union Agencies.

17. In this context, the EDPS reminds that, in as far as the data concerns extra-EU flights between the EU and Norway, this information is already processed under the EU PNR Directive by the Member States' Passenger Information Units (PIU). The EU PNR Directive does not foresee direct access to this data for Eurojust, and strictly defines the conditions under which Europol is able to access it.

18. In view of the above, it is the understanding of the EDPS that regarding Europol or Eurojust, the condition “within the scope of their respective mandates” refers not only to the tasks and powers of the two Agencies provided for in the EU regulations establishing them but also the specific rules laid down in the EU PNR Directive. Consequently, the EU-Norway PNR Agreement should not lead to situations where Union Agencies request PNR data from Norway which they would not be able to request from an EU Member State.

5. Conclusions

19. In light of the above, the EDPS concludes that the draft Agreement between the European Union and the Kingdom of Norway on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime contains the necessary safeguards required in order for it to be compatible with the EU legal framework on data protection. Brussels, 24 July 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7