Answer given by Ms Malmström on behalf of the Commission

9.2.2012

The PNR agreements cover PNR data transfers by air carriers operating passenger flights between the EU and those countries. They specify that PNR data that are processed or stored in the territory of the EU are covered. PNR data transferred under the agreements may only be processed for the purposes specified under the agreements.

The processing of PNR data is the responsibility of the air carriers, as they are considered the data controllers under European data protection law. The providers of computer reservation systems handle reservation data, including PNR data, under the responsibility of the air carrier.

The agreements thus cover PNR data processed or stored in the territory of the EU and subsequently transferred directly by an air carrier or, alternatively, processed or stored in the territory of the EU by the provider of a computer reservation system on behalf of an air carrier. The agreement also covers PNR data processed or stored outside the territory of the EU, as long as they concern flights between the EU and the US.

In this respect, it should be noted that it is irrelevant where a computer reservation system is located. To the extent that a computer reservation system stores data which is covered by the agreement, then the agreement will apply.

The International Civil Aviation Organisation (ICAO) has already adopted guidelines on best practices for storing PNR data to be disclosed to governments. The Commission participates at the work of ICAO and considers the standards an efficient and sufficient regulation of the issue. The Commission does not believe that further guidelines need to be developed.

It should be noted that to the extent that PNR data is processed by or on behalf of air carriers for their own commercial purposes in the EU, Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data will apply.