The long-standing debate concerning the transfer, processing and retention by national law enforcement authorities of Passenger Name Record (PNR) data has regained momentum with the adoption of Directive 2016/681/EU, which lays down a PNR regime operating within the EU, and, above all, with the delivery, on 26 July 2017, of the CJEU’s negative Opinion on the new envisaged EU-Canada PNR agreement. The Court’s finding that several provisions of the draft agreement do not comply with Articles 7 and 8 of the EU Charter of Fundamental Rights, on the protection of private life and personal data, inevitably raises doubts concerning the fate of the EU PNR bilateral agreements already in force (namely, with Australia and the United States) and of the PNR Directive. At the same time, this evolving scenario has immediate and very practical implications for air-carriers operating between the EU and third States, which may find themselves trapped by conflicting obligations due to the complex interplay between EU data protection laws, the EU PNR regime, and third States’ PNR legislation. Far from being limited to the EU legal order, the recent developments may exert an effect on foreign airlines’ operations to and from the EU and condition future negotiations between the EU and third countries.