Short Reads

Belgian Act on Passenger Name Records published

Belgian Act on Passenger Name Records published

Belgian Act on Passenger Name Records published

24.02.2017 BE law

On 25 January 2017, the Belgian Act on the processing of passenger name records (“PNR Act”) was published in the Belgian Official Gazette. The PNR Act implements three EU directives in the Belgian legal order: Directive 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, Directive 2010/65 on reporting formalities for ships arriving in and/or departing from ports of the Member States, and Directive 2004/82 on the obligation of carriers to communicate passenger data.

The PNR Act obliges carriers and travel operators in the different transport sectors to transmit their passenger data to a central database called the “Passenger Database”, so that these data can be analyzed in the framework of terrorism, violent radicalization, and other forms of serious crime. This will allow law enforcement agencies to determine new trends and phenomena and to assess which passengers could be a danger to the public order. Transport companies and travel operators risk fines of up to €600 000 if they do not comply with this obligation.

However, before the PNR Act can enter into force, some implementing measures have yet to be taken. For instance, a new service called the “Passengers Information Unit” has yet to be established within the Federal Public Service Internal Affairs. This Unit will be in charge of the Passenger Database and cooperate with the Passenger Information Units of other member states, with Europol, and with third countries.

The PNR Act takes into account the privacy of the passengers by, amongst other things, (i) imposing the obligation to appoint a data protection officer within the Passenger Information Unit; (ii) strictly determining which categories of data may and may not be processed (i.e., no data relating to racial or ethnic origin, political opinion, religion, health, or sex life), (iii) imposing a maximum data retention period of five years, and (iv) imposing the obligation to de-personalize the data after six months from the registration thereof.  

The date of entry into force of the PNR Act will later be determined in its implementing decisions. In any event, the lawmaker will evaluate this three years after the PNR Act enters into force.

Team

Related news

23.07.2019 LU law
The Revised CSSF Cloud Circular

Articles - On 27 March 2019, the Luxembourg supervisory authority for the financial sector (the Commission de surveillance du secteur financier or CSSF) published the long-awaited CSSF Circular 19/714 amending the CSSF Circular 17/654 on IT outsourcing relying on a cloud computing infrastructure (the Revised Cloud Circular).

Read more

05.07.2019 EU law
The two sides of the ECS coin

Articles - The concept of ‘electronic communications service’ (“ECS”) defined in Article 2(c) of Directive 2002/21/EC (“Framework Directive”) has been interpreted in two decisions of the ECJ in June 2019: C‑142/18 Skype communications and C-193/18 Google LLC.

Read more

22.07.2019 NL law
HagaZiekenhuis beboet voor datalek

Short Reads - Enkele maanden geleden vierden we de eerste verjaardag van de Algemene Verordening Gegevensbescherming (AVG) met een uitgebreide beschouwing  over de belangrijkste  ontwikkelingen uit  het eerste jaar van de verordening. We concludeerden daarin onder meer dat de door sommigen voorspelde hoge bestuurlijke boetes voor overtredingen van de AVG tot dan toe  - zowel in Nederland als in de andere EU-lidstaten - grotendeels waren uitgebleven.

Read more

02.07.2019 NL law
Debate night: HR Analytics: opportunity or threat?

Seminar - On 2 July 2019, Stibbe's Digital Economy Group will host a debate night in Amsterdam on the hot topic of HR analytics. During Stibbe's debate night, speakers from the world of business, politics, science and law will exchange views on HR analytics, how they can be used in practice, and their development in the context of employment and privacy law.

Read more

15.07.2019 EU law
ICO to impose record-breaking fines for inadequate security measures and data breaches

Short Reads - Though the European data protection authorities have taken their time in enforcing the GDPR, two announcements by the ICO in the UK regarding proposed fines for British Airways and Marriott demonstrate that large fines are about to start landing regularly. Both of the substantial fines are to be handed out as a result of shortcomings in handling data breaches caused by cyber-attacks.

Read more

27.06.2019 NL law
Stibbe launches website about Digital Economy

Inside Stibbe - Stibbe's Digital Economy group published a new website this week: Stibbedigital.com With this new website we aim to view technological developments including artificial intelligence (AI), blockchain, the Internet of Things, smart mobility and the rise of digital platforms from a legal perspective.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring