The planned EU-Canada agreement on the transfer of passenger name record (PNR) data cannot go ahead in its current form, an adviser to Europe's highest court has warned.

Advocate general Paolo Mengozzi, who is one of the top lawyers whose job it is to advise the Court of Justice of the European Union (CJEU), found that "certain provisions of the agreement envisaged, as currently drafted, are contrary to the EU Charter of Fundamental Rights," largely because the deal, he says, went beyond what was "strictly necessary" for achieving "the public security objective pursued by the agreement."

He also pointed out other areas in his non-binding opinion where the agreement would only be compatible with the EU Charter if certain conditions were met.

PNR data includes travel dates, travel itinerary, ticket information, contact details, luggage list, and payment information. According to the European Parliament, it is used to identify "persons who were previously unsuspected of involvement in terrorism or in serious crime before an analysis of that data suggests that they may be involved in such crime, and who could therefore be subject to further examination by the competent authorities."

The deal to transfer information to Canada was signed in 2014, but before approving it, the European Parliament asked the CJEU to rule on its compatibility with the EU Charter of Fundamental Rights—the first time it has been asked to do so.

Conclusions, the advocate general said, were reached on the basis of the CJEU's rulings in the Schrems and Digital Rights Ireland cases that struck down Safe Harbour and the EU data retention Directive respectively.

In explaining his opinion, Mengozzi said:

It is necessary that, at a time when modern technology allows public authorities, in the name of combating terrorism and serious transnational crime, to develop extremely sophisticated methods of monitoring the private life of individuals and analysing their personal data, the court should ensure that the proposed measures, even when they take the form of envisaged international agreements, reflect a fair balance between the legitimate desire to maintain public security and the equally fundamental right for everyone to be able to enjoy a high level of protection of his private life and his own data.

The CJEU could dismiss the advocate general's opinion, although such a move would be unlikely. If it does agree with Mengozzi's analysis, it would have far-reaching implications not just for the stalled EU-Canada PNR agreement, but existing deals with other nations, such as the US, Australia, and the EU's internal PNR Directive.

Significantly for Britain, a CJEU decision against the EU-Canada PNR agreement would also have a major impact on any post-Brexit UK-EU personal data transfer deal.