The Ombudsman was briefed on the decision of the Constitutional Court of the Republic of Slovenia in connection with the third part of the request submitted in 2017 for the review of the constitutionality of the provisions of the Police Tasks and Powers Act (ZNPPol). That decision was published on Friday, 9 December 2022. The Ombudsman assesses that his request for review of constitutionality has contributed to the important clarification of constitutional issues.

The Ombudsman submitted a request in 2017 for the review of the constitutionality of three separate sets of provisions of the Police Tasks and Powers Act (ZNPPol). In its partial ruling of 17 November 2022, the Constitutional Court ruled on the third set of provisions in connection with the processing of passenger name record (PNR) data for the purposes of preventing, detecting, investigating and prosecuting terrorist and other serious criminal offences.

At that time, the Ombudsman assessed that the collection of data from airlines regarding all passengers and for all commercial, scheduled and charter flights did not meet the requirements of Article 38 of the Constitution of the Republic of Slovenia (hereinafter: the Constitution), which protects the right to the protection of personal data. His opinion was that the legal solution in question does not define exactly which data may be collected and processed, and that the concepts of ‘information regarding frequent flyers’ and ‘other possible specific features in connection with a passenger’s journey’ are too broad. With the aim of defining more clearly and precisely which personal data of air passengers may be processed for the purposes of preventing, detecting, investigating and prosecuting terrorist and other serious criminal offences, he challenged the regulation that was adopted as a result of the Republic of Slovenia’s obligation to transpose Directive (EU) 2016/681 into Slovenian law.

The allegations of the unconstitutionality of the provisions of the law also meant that the provisions of the aforementioned directive were incompatible with the right to privacy and the right to the protection of personal data under the Charter of Fundamental Rights of the European Union. For this reason, the Slovenian Constitutional Court referred the question for a preliminary judgement to the Court of Justice of the European Union (hereinafter: the CJEU), which has exclusive jurisdiction to rule on the validity of European Union law. The CJEU also addressed the question of the clarity and precision of the personal data of air passengers in its judgment of 21 June 2022 in the matter of Ligue des droits humains v Conseil des ministres, no. C-817/19.

Thus, in its partial ruling published on 9 December 2022, the Constitutional Court found that the contested regulation was not incompatible with Article 38 of the Constitution. The personal data of air passengers set out in point 31 of Article 125 of the Police Tasks and Powers Act were not sufficiently clear and meaningful in themselves. However, the CJEU has now, through a subsequent interpretation, limited the scope of the personal data referred to in Directive (EU) 2016/681 and thus limited the scope of the personal data referred to in the contested law, which transposes the obligations laid down in the aforementioned directive. The subsequent interpretation of the CJEU thus satisfies the requirement of Article 38 of the Constitution that personal data must be defined by law.

The Human Rights Ombudsman assesses that his request for the review of the constitutionality of three independent sets of provisions of the Police Tasks and Powers Act (ZNPPol) contributed to the important clarification of constitutional issues. The Constitutional Court ruled on the first two sets of provisions regarding the use of drones and the optical recognition of licence plates in the performance of police tasks back in July 2019. At that time, it annulled the part of the law regarding the use of technical means to identify licence plates, while finding that the legal basis for the use of drones in the performance of police tasks was not unconstitutional. In its latest partial ruling, the Constitutional Court has now ruled on the third and final set of provisions, which concerns the processing of passenger name record (PNR) data.