• FRA conclusions

Examples of this shift in attention are renewed calls for an EU directive on passenger name records (PNR) and the discussion of whether there is a need to collect and store considerable data on all air passengers. At the same time, privacy remained top of the agenda; the Court of Justice of the European Union annulled the Data Retention Directive, and, in the Google case, clarified important aspects of EU data protection law.

FRA conclusions

The EU institutions and Member States have been negotiating the data protection package since January 2012.

• Despite the evidence that challenges to data protection remain part of today’s information society, no political agreement has yet been reached on the legislative proposals.
   
• EU Member States should promptly adopt the data protection package to provide the EU with an enhanced data protection framework that could be complemented with specialised legislation in other areas of EU competence.

Following the Snowden revelations concerning mass surveillance, the role of intelligence services and the implications of surveillance activities were discussed in the political arena, as well as in courts and by the public.

• Against this background, a number of EU Member States have engaged in a reform of security and intelligence services, as FRA comparative research shows.
   
• EU Member States should take the opportunity to enhance privacy and data protection guarantees when reforming their services. These could include adequate guarantees against abuse, which entails effec¬tive supervision by independent bodies and efficient redress mechanisms. Member States should consider such guarantees in any reforms of intelligence systems.

Data protection authorities play an important role in safeguarding general data protection legislation.

• Evidence collected by FRA shows their mandates differ widely. In several EU Member States, DPAs have the legal mandate to play a significant role in supervising security and intelligence services.
   
• Where an EU Member State allows its DPA to supervise security and intelligence services, it should further strengthen the authority’s independence and role and ensure that it is supported by adequate financial and human resources.

In 2014, various revelations concerning mass surveillance highlighted the occurrence of data security breaches.

• The legal obligations of actors, such as electronic communications service providers, thus moved to the forefront.
   
• EU Member States should ensure that data controllers, such as electronic communications service providers, adhere to their legal obligation as laid down in Article 4 of Directive 2002/58/EC and Article 17 of Directive 95/46/EC: taking into account the risks represented by data processing and the nature of the data involved, service providers have to implement appropriate technical security measures. The use of secure encryption technologies should be considered in this context, as well as the development of user-friendly encryption tools.

The CJEU’s judgment on the Data Retention Directive spelled out crucial fundamental rights principles and suggested specific safeguards.

• Some of the suggestions related to, for example, the scope of data retention, its aim and limits to law enforcement agencies’ access to the data and the retention time.
   
• FRA mapped the Member States’ reactions to this core CJEU judgement, identifying a variety of approaches in terms of both judicial and legislative reactions.
   
• When assessing the legal implication of this judgment, the European Commission and Member States should carry out research on data retention’s positive impact or lack thereof. If no significant advantages are found, less invasive alternatives should be preferred.

Discussions on creating an EU framework for acquiring and processing passenger name records played a significant part in the internal security debate in 2014.

• The EU co-legislators should ensure that the poten¬tial setting up of an EU passenger name records system be accompanied by enhanced fundamental rights safeguards, including limitations on purpose, transparency towards passengers and protection of their personal data.