By Foo Yun Chee

BRUSSELS (Reuters). – A EU law that collects passenger information from airlines is compliant with its rights and data protection laws. But such data should be deleted only if there’s a threat to national security and for no more than five years afterward, according to an EU adviser.

The Passenger Name Record Directive, (PNR), was adopted in 2016. It allows law enforcement and police to have access to passenger information on EU flights. This is to help prevent serious crime.

This has attracted criticism from rights organizations, such as Belgium’s LDH. They asked a domestic court in 2017 to declare it invalid for violating data privacy norms.

Giovanni Pitruzzella was the EU Court of Justice’s Advocate General. He stated on Thursday that PNR compliance with the bloc’s data protection law.

Although he acknowledged that there are sufficient security measures to protect the confidentiality and security of the data, he said that the authorities shouldn’t be permitted to keep that information for more than five years unless it can be proven that the data is linked to terrorist or serious criminal activities.

Four out of five non-binding opinions are followed by the CJEU. The CJEU will issue a ruling in the next few months.