REPORT on the proposal for a Council decision on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection
(COM(2004) 190 – C5‑0162/2004 – 2004/0064(CNS))

7 April 2004 - *

Committee on Citizens' Freedoms and Rights, Justice and Home Affairs
Rapporteur: Johanna L.A. Boogerd-Quaak

PROCEDURAL PAGE

By letter of 25 March 2004 the Council consulted Parliament, pursuant to Article 300(3), first subparagraph of the EC Treaty, on the proposal for a Council decision on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection (COM(2004) 190 – 2004/0064(CNS)).

At the sitting of 29 March 2004 the President of Parliament announced that he had referred the proposal to the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs as the committee responsible and the Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy for its opinion (C5‑0162/2004).

The Committee on Citizens' Freedoms and Rights, Justice and Home Affairs appointed Johanna L.A. Boogerd-Quaak rapporteur at its meeting of 19 May 2003.

The committee considered the proposal for a Council decision and draft report at its meetings of 30 March 2004 and 6 April 2004.

At the last meeting it adopted the draft legislative resolution by 24 votes to 11, with 2 abstentions.

The following were present for the vote: Jorge Salvador Hernández Mollar (chairman), Johanna L.A. Boogerd-Quaak (vice-chairwoman and rapporteur), Mary Elizabeth Banotti, Regina Bastos (for Carlos Coelho pursuant to Rule 153(2)), Maria Berger (for Gerhard Schmid), Christian Ulrik von Boetticher, Marco Cappato (for Mario Borghezio), Carmen Cerdeira Morterero, Ozan Ceyhun, Gérard M.J. Deprez, Antonio Di Pietro (for Francesco Rutelli), Rosa M. Díez González (for Sérgio Sousa Pinto), Olivier Duhamel (for Adeline Hazan), Marie-Thérèse Hermange (for Bernd Posselt), Sylvia-Yvonne Kaufmann (for Fodé Sylla), Margot Keßler, Heinz Kindermann (for Martin Schulz pursuant to Rule 153(2)), Timothy Kirkhope, Eva Klamt, Ole Krarup, Jean Lambert (for Alima Boumediene-Thiery), Lucio Manisco (for Giuseppe Di Lello Finuoli), Manuel Medina Ortega (for Robert J.E. Evans), Hartmut Nassauer, Bill Newton Dunn, Marcelino Oreja Arburúa, Elena Ornella Paciotti, Hubert Pirker, Martine Roure, Heide Rühle, Ilka Schröder, Ole Sørensen (for Baroness Ludford), Patsy Sörensen, The Earl of Stockton (for Giacomo Santini), Joke Swiebel, Anna Terrón i Cusí, Maurizio Turco and Ian Twinn.

The opinion of the Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy is attached.

The report was tabled on 7 April 2004.

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a Council decision on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection

(COM(2004) 190 – C5‑0162/2004 – 2004/0064(CNS))

(Consultation procedure)

The European Parliament,

–   having regard to the proposal for a Council decision (COM(2004) 190)[1],

–   having regard to draft agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection (Annex of COM(2004) 190),

–   having regard to Articles 95 and 300(2), first subparagraph of the EC Treaty,

–   having regard to Article 300(3), first subparagraph, of the EC Treaty, pursuant to which the Council consulted Parliament (C5‑0162/2004),

–   having regard to Article 300(6) of the EC Treaty,

–   having regard to Rules 67 and 97(7) of its Rules of Procedure,

–   having regard to the report of the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs and the opinion of the Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy (A5‑0271/2004),

1.   Does not approve the conclusion of the agreement;

2.   Instructs its President to call on the Council not to conclude the agreement;

3.   Calls on the Council to refrain from concluding this agreement until the Court of Justice has deliverd its opinion on the compatibility with the Treaty (Article 300(6) of the EC Treaty);

4.   Instructs its President to forward its position to the Council and Commission, and the governments and parliaments of the Member States and the United States of America.

• [1] Not yet published in OJ.

EXPLANATORY STATEMENT

Following the terrorist attacks of 11 September 2001, the United States adopted on 19 November 2001 the Aviation and Transportation Security Act, requiring airlines flying into the territory of the United States to transfer passenger data to the US customs and immigration services.

This kind of international transfer of European passenger data is, for some categories of the data, in clear breach of EU data protection legislation, as declared in the opinion by the Article 29 Working Party on data protection[1], a situation recognised by the Commission that has been engaged in negotiations with the US side with a view to finding a solution to the illegal data transfer.

In December 2003, the Commission decided to follow a two-tier approach: First, to adopt a draft decision declaring that PNR data are adequately protected in the USA and second, to propose a "light international agreement" (meaning that the European Parliament is only consulted but does not have to give its assent), which will oblige the airlines to give access to the data and authorise the US administration to pull the data from the EU territory.

The proposal for a Council decision on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection constitutes the legal act incorporating the envisaged international agreement into European law.

II.   The EC/US "light" international agreement: first remarks

1.   The explanatory memorandum of the proposed Council Decision is rather elliptic on the reasons why an international agreement is needed for the issue of PNR. It only says that "The latter is necessary to deal with such legal problems as are not addressed by the adequacy finding."

The reasons are more clearly stated in a Commission Staff Working Paper which has been submitted to the Council and not transmitted to the EP (emphasis added):

" OBJECTIVES OF THE INTERNATIONAL AGREEMENT

There are two legal problems that need to be addressed in the international agreement.

Firstly, access by US law enforcement authorities to PNR databases situated on Community territory ('pull') amounts to exercise of US sovereign power in Community territory. The exercise of extra-territorial authority is only possible under international law if there is consent. An international agreement would thus be required to authorise US authorities to pull PNR data from the EU, as long as a system whereby PNR data would be 'pushed' from the Community to the US is not in place.

Secondly, Article 7 of Directive 95/46/EC establishes a list of circumstances under which, and only under which, personal data may be processed. One of the circumstances foreseen (under paragraph (c)) is that processing be necessary for compliance with a legal obligation to which the controller is subject. However, the legal obligations in question are understood to be those imposed by Community or Member States' law and not by a third country. Hence, an international agreement imposing an obligation on air carriers and CRS to process PNR data as required by CBP and TSA, insofar as they are covered by an adequacy finding, would be an appropriate way of achieving the aim of providing a legitimate basis for air carriers and CRS to process data in accordance with Directive 95/46/EC.

Beyond these concrete legal issues, the objective of this Agreement would also be to enshrine general principles such as non-discrimination (i.e. the way in which PNR data are used by the US should not unlawfully discriminate against EU passengers) and reciprocity (i.e. the Agreement should ensure reciprocal support from the US for any European passenger identification system that may be adopted in the future). In addition, the Agreement could incorporate the mechanism of joint reviews of the implementation of the US Undertakings on the protection of PNR data that has already been agreed with the US (as will be reflected in the US Undertakings)."

2.   The most important point in this reasoning is the assumption that this international agreement could be considered by the airlines as the source of a "legal obligation" under which, according to Article 7 (c) of Council Directive 95/46/EC they will be obliged to transfer (or give access to) the PNR data to the US administration. It has to be noted that the legal basis chosen by the Council for this international agreement is the same of the Directive 95/45/EC (Art. 95 of the EC Treaty) but the agreement modifies the Directive (as far as the exchange of data with the US is concerned) because it :

• -declares applicable in the European Union and for the European citizens the US legislation in this domain;
• -transfers to the European level the discretionary power of the Member States to authorise, according to Art. 13 of the Directive, the utilisation for security purposes of data originally collected for commercial use and to create, according to Art. 7c of the Directive, a legal obligation for European airlines to give access to these data;
• -creates new obligations for follow up and monitoring for the Commission on the smooth functioning of the agreement.

3.   Being aware of these important consequences one can guess if the proposal is well founded from a constitutional perspective as far as the protection of fundamental rights and as far as the European Parliament prerogatives are concerned.

• a)dealing with the protection of fundamental rights the draft agreement must comply with the principles enshrined in Art. 6 p. 2 of the TUE and outlined, for the data protection domain, by the Art. 8 of the ECHR [2], the Art. 8 of the European Charter of fundamental rights and by Art. 286 of the EC Treaty. Unfortunately the draft agreement does not define the extent and the limits of these rights but it only refers to an unilateral Commission Decision which itself refers to some unilateral Undertakings of the US administration, which finally refers to the actual and future US regulations. So far the agreement appears too generic to be considered an adequate and self-standing legal basis for transferring the competencies from the Member States to the European Community Institutions;
• b)as far as the EP prerogatives are concerned it seems that the draft agreement amends the Directive 95/46 and has to be adopted according to Art. 300 p. 3 (2nd subparagraph) with the assent of the EP. As the Parliament has been only consulted and even under a tight deadline the Agreement could be challenged for violation of procedure established by the Treaty.

4.   For these reasons and to avoid legal uncertainty and possible problems with the US it could be highly opportune before the conclusion of the agreement to ask the opinion of the Court of Justice according to Art. 300 p. 6 of the Treaty.

It has to be noted that according to a constant jurisprudence of the Court[3] the aim of the procedure for asking for a Court opinion "... is to enable the Court to resolve all questions relating to the substantive or formal compatibility of the agreement envisaged in order to avoid any subsequent challenge which might undermine the international standing of the Community. The annulment or declaration of the invalidity of a decision to enter into an international agreement could paralyse the application of the agreement in the Community legal order, which would undoubtedly have repercussions at international level. More specifically, questions relating to the legal base of the measure whereby the Community participates in an international agreement could affect the division of powers between the Community and the Member States."

For procedural reasons this procedure has to be launched before the 22nd April deadline fixed by the Council for the EP opinion on the draft agreement.

• [1] Opinion of 29.1.2004, www.europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2004/wp88_en.pdf
• [2] 1) Everyone has the right to respect for his private and family life, his home and his correspondence. (2) ..There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well‑being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others..."
• [3] Opinion 1/75 ('Local Cost Standard'[1975] ECR 1355), Opinion 1/78 ('International Agreement on Natural Rubber'[1979] ECR 2871, Opinion 2/92 on 24th of March 1995, OCDE, Opinion 2/94 on 28th of March 1996, Opinion 3/94 on 13th of December 1995...

OPINION OF THE COMMITTEE ON FOREIGN AFFAIRS, HUMAN RIGHTS, COMMON SECURITY AND DEFENCE POLICY

6 April 2004

for the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs

on the proposal for a Council decision on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection

(COM(2004) 190 – C5‑0162/2004 – 2004/0064(CNS))

Draftsman: Elmar Brok, Chairman

PROCEDURE

The Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy appointed Elmar Brok, Chairman on behalf of the Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy draftsman at its meeting of 5 April 2004.

It considered the draft opinion at its meeting of 5 and 6 April 2004.

At the latter meeting it adopted the following suggestions by 23 votes to 19 with 1 abstention.

The following were present for the vote: Elmar Brok (chairman), Baroness Nicholson of Winterbourne (first vice-chairperson), Christos Zacharakis (third vice-chairperson), Ole Andreasen, Per-Arne Arvidsson, Alexandros Baltas, Johanna L.A. Boogerd-Quaak (for Cecilia Malmström pursuant to Rule 153(2)), Philip Claeys, John Walls Cushnahan, Rijk van Dam (for Bastiaan Belder pursuant to Rule 153(2)), Véronique De Keyser, Rosa M. Díez González, Olivier Dupuis (for Emma Bonino), Michael Gahler, Gerardo Galeote Quecedo, Alfred Gomolka, Ulpu Iivari (for Glyn Ford), Klaus Hänsch, Efstratios Korakas, Georg Jarzembowski (for Jas Gawronski), Heinz Kindermann (for Raimon Obiols i Germà pursuant to Rule 153(2)), Catherine Lalumière, Armin Laschet, Nelly Maes (for Elisabeth Schroedter), Miguel Angel Martínez Martínez (for Pasqualina Napoletano), Edward H.C. McMillan-Scott (for David Sumberg), Emilio Menéndez del Valle, Reino Paasilinna (for Hannes Swoboda), Elena Ornella Paciotti (for Demetrio Volcic pursuant to Rule 153(2)), Doris Pack (for Karl von Wogau), Jacques F. Poos, José Ignacio Salafranca Sánchez-Neyra, Ulla Margrethe Sandbæk (for Paul Coûteaux) Jacques Santer, Jürgen Schröder, Ioannis Souladakis, Ursula Stenzel, The Earl of Stockton (for Charles Tannock), Gary Titley (for Richard Howitt), Maurizio Turco (for Francesco Enrico Speroni pursuant to Rule 153(2)), Joan Vallvé, Jan Marinus Wiersma and Matti Wuori.

The Committee on Foreign Affairs, Human Rights, Common Security and Defence Policy calls on the Committee on Citizens' Freedoms and Rights, Justice and Home Affairs, as the committee responsible, to reject the conclusion of the agreement.

SHORT JUSTIFICATION

Since 2003, the Commission has been working with the United States of America to put in place a sound legal framework for the transfers of Passenger Name Record (PNR) data to the US Department of Homeland Security, Bureau of Customs and Border Protection (CBP). From the Commission's point of view, this legal framework should take the form of a Decision ("Adequacy Finding") by the Commission under Article 25, paragraph 6 of the Data Protection Directive (95/46/EC), accompanied by an international agreement between the European Community and the US. This agreement is necessary to deal with certain legal problems not addressed by the Adequacy Finding Decision (namely to consent access -"pull"- by US law enforcement authorities to PNR databases situated on Community territory, and to impose an obligation on air carriers to process PRN data as required by US law enforcement authorities). Therefore, on 23 February 2004, the Council authorised the Commission to negotiate such an Agreement and on 18 March 2004, the Commission duly presented its proposal. The draft Agreement provides for its entry into force immediately upon signature, unless the Adequacy Decision is not in force. The EP has been asked to deliver its Opinion as an urgent procedure and by 22 April 2004 at the latest for the following reasons:

-   the fight against terrorism, which is the underlying justification for the measures proposed, is a top priority for the EU;

-   air carriers and passengers are currently in a situation of uncertainty, which needs to be rectified urgently;

-   it is essential to protect the financial interests of the parties concerned;

-   the last plenary session of the EP is due to be held on 19 April 2004, after which date the normal activities in the EP will cease and not be resumed until the autumn;

However, on 31 March 2004, the Parliament adopted a Resolution on the draft Commission decision rejecting its objectives after considering that the foreseen 'pull' system for accessing PNR data undermines any limitations that may be agreed and must be replaced by a 'push' system with appropriate filters. The EP asks for an arrangement with the USA on the basis of a proper and urgent international agreement respectful of fundamental rights and in compliance with the principles outlined in its resolution[1].

• [1] From the EP's point of view, the new international agreement should stipulate: (a) the data which could be transferred in an automated way (APIS) and the data which could possibly be transferred on a case-by-case basis, (b) the list of the serious crimes in respect of which an additional request could be made, (c) the list of authorities and agencies which could share the data and the data-protection conditions to be respected, (d) the data-retention period for the two kinds of data, it being clear that data dealing with the prevention of serious crimes have to be exchanged in accordance with the EU-US agreement on judicial cooperation and extradition, (e) the role to be played by airlines in transferring passengers' data and the means envisaged (APIS, PNR, etc.) for public security purposes, (f) the guarantees to be offered to passengers in order to enable them to correct the data relating to them or provide an explanation in the event of a discrepancy between the data relating to a travel contract and the data shown in identity documents, visas, passports,etc, (g) the airlines' responsibilities vis-à-vis passengers and the public authorities in the event of transcription or encoding errors and as regards protection of the data processed, (h) the right to appeal to an independent authority and redress mechanisms in the event of infringements of passengers' rights.