In this article, we examine the European framework of collecting and analysing
flight passenger name record (PNR) data for the purpose of combating terrorism and serious crime. The focus is mainly on the EU PNR Directive of 2016, but we also consider the specific legislative framework in Germany and Denmark. In light of the recent review of the Directive, the article aims at exploring the policy-related, legal and technological challenges. In doing so, it goes beyond established data protection concerns. In particular, we debunk the popular claim that PNR analysis in and of itself entails the risk of discrimination of certain groups – a claim commonly levelled against algorithmic analysis. We also provide useful insights into the specific legal safeguards vis-à-vis automated profiling and decision-making through human review.