EU-US agreement on passenger data transfer annulled
The European Parliament obtained the annulment by the European Court of
Justice of the agreement between the European Community and the US
Government on the transfer of passenger name records (PNR) from foreign
carriers to the US with the view to combat terrorism and maintain national
security. In order to prevent problems the agreement will be still in force
until 30 September 2006. Until then the Member States have time to solve the
legal issues arising from the annulment within or outside the EU context.
After 11 September 2001 air carriers flying from Europe to the US were in a
dilemma. The US Government required to access personal data of travellers
contained in the databases of all foreign carriers. On the other hand, 1995
EU Directive on data protection restricts the transfer of personal data from
one jurisdiction to another unless there is adequate protection of that
data.
Following a series of negotiations to solve this dilemma during 2002 and
2003 on issues related to the amount of data transferred, the period of data
retention and data protection, an agreement between EU and US entered into
force in May 2004. The European Commission also decided that the US provided
adequate protection for the data transfer to take place.
The European Parliament however considered that data transfer should not
take place unless greater data protection measures were taken.It also found
that the European Commission had no legal jurisdiction to conclude such an
agreement and therefore decided to challenge the agreement at the European
Court of Justice.
The decision of the Court was taken considering the European Commission had
no legal authority to conclude such an agreement as the Directive does not
apply to this kind of data transfer.
The Commission disagreed and considered that the carriers process PNR data
within the Community jurisdiction and then make the transfer of these data
to US so these activities of private parties are related to public security
and therefore are regulated by the Directive.
The court considered that the transfer of PNR data to the US concerns public
security, and as private operators must operate
within a framework established by public authorities, the European
Commission was acting in the area of public security in which it has no
jurisdiction. The court concluded that both the agreement and the decision
on adequacy were based on the wrong legal base.
However, the court decided on the annulment of the agreement without
considering the other pleas from the Parliament related to the privacy and
human rights aspects of the agreement. This leaves open the possibility of
bi-lateral agreements between the US and each EU member state.
The decision of the Court therefore should not be considered as a real
victory of the European Parliament, which has no power of approval over such
treaties or the power to bring legal actions against them. There is also the
risk that such a separate treaty signed between a member state and the US
could be even worse than the original agreement from the point of view of
data protection standards.
Judgment of the Court of Justice – PNR case (30.05.2006)
http://curia.eu.int/jurisp/cgi-bin/form.pl?lang=EN&Submit=Rechercher$docrequire=alldocs&numaff=C-317/04&datefs=&datefe=&nomusuel=&domaine=&mots=&resmax=100
European Court of Justice press release (30.05.2006)
http://curia.eu.int/en/actu/communiques/cp06/aff/cp060046en.pdf
Courts annul EU-US air data deal (30.05.2006)
http://www.eupolitix.com/EN/News/200605/e2bac420-d618-4608-94c0-59fd19aba6a5.htm
EU-US passenger data transfer deal annulled by European Court (30.05.2006)
http://www.privacyinternational.org
Statewatch’s Observatory on the exchange of data on passengers (PNR)
http://www.statewatch.org/pnrobservatory.htm
Staying vigilant after EU-US PNR deal cancelation (French only, 31.05.2006)
http://www.iris.sgdg.org/info-debat/comm-cjcepnr0506.html
EDRI-gram : Advocate General European Court rejects PNR deal (5.12.2005)
http://www.edri.org/edrigram/number3.24/PNR