With the approval of Directive (EU) 2016/681 on the use of Passenger Name Records (PNR), the personal information provided to carriers by air passengers crossing European Union (EU) borders is available for mining by national law enforcement, third countries, and Europol. This is in line with other pre-emptive security policies, but it goes further in generalizing suspicion over large numbers of EU and non-EU travelers. After years of pressure from the United States under the banner of the global war on terror, air companies are no longer between a rock and a hard place. They are now able to lawfully disclose big data gathered as part of the normal course of business. Following booking and reservation, up to 19 items of individual data must be provided to Passenger Information Units for criminal investigations and other appropriate actions. The intra-EU PNR system has managed to fly under the radar of scholars and public opinion. Most specialized literature is limited to superficial discussions on security and privacy. There is insufficient research looking at it comprehensively and in detail. This thesis explores this novel security policy in depth and questions its validity. It argues that the PNR scheme should be invalidated by the Court of Justice of the EU for two reasons. In the first place, the Union was not competent to approve a secondary law so intrusive to the national security agendas and policies of the member states. Secondly, the Directive disproportionately encroaches upon the fundamental rights of passengers. There is, as yet, no doctoral project which analyzes the EU PNR so thoroughly. This work fills a gap in scholarly writing regarding fundamental rights and creeping competences in EU law. Its novelty lies in questioning issues that have been overlooked, or insufficiently addressed, in the journey of the PNR Directive.