European Parliament resolution of 5 May 2010 on the launch of negotiations for Passenger Name Record (PNR) agreements with the United States, Australia and Canada
The European Parliament,
– having regard to Articles 16 and 218 of the Treaty on the Functioning of the European Union, Article 6 of the Treaty on European Union, the Charter of Fundamental Rights of the European Union, in particular Article 8 thereof, and the European Convention for the Protection of Human Rights and Fundamental Freedoms, in particular Articles 6, 8 and 13 thereof,
– having regard to the fundamental right to freedom of movement, as guaranteed by Article 12 of the International Covenant on Civil and Political Rights,
– having regard to its previous resolutions on the EU-US PNR issue, notably its resolutions of 13 March 2003 on transfer of personal data by airlines in the case of transatlantic flights(1), of 9 October 2003 on transfer of data by airlines in the case of transatlantic flights: state of negotiations with the USA(2), of 31 March 2004 on the draft Commission decision noting the adequate level of protection provided for personal data contained in the Passenger Name Records (PNRs) transferred to the US Bureau of Customs and Border Protection(3), its recommendation to the Council of 7 September 2006 on the negotiations for an agreement with the United States of America on the use of passenger name records (PNR) data to prevent and combat terrorism and transnational crime, including organised crime(4), its resolution of 14 February 2007 on SWIFT, the PNR agreement and the transatlantic dialogue on these issues(5), and its resolution of 12 July 2007 on the PNR Agreement with the United States of America(6),
– having regard to its recommendation to the Council of 22 October 2008 concerning the conclusion of the Agreement between the European Union and Australia on the processing and transfer of European Union-sourced passenger name record (PNR) data by air carriers to the Australian customs service(7),
– having regard to its legislative resolution of 7 July 2005 on the proposal for a Council decision on the conclusion of an Agreement between the European Community and the Government of Canada on the processing of Advance Passenger Information (API)/Passenger Name Record (PNR) data(8),
– having regard to its resolution of 20 November 2008 on the proposal for a Council framework decision on the use of Passenger Name Record (PNR) for law enforcement purposes(9),
– having regard to the judgment of 30 May 2006 of the Court of Justice in joint Cases C-317/04 and C-318/04,
– having regard to the letter of 27 June 2007 from the European Data Protection Supervisor to the President-in-Office, Mr Schäuble, concerning the new PNR agreement with the US,
– having regard to the opinion of the Working Party on the Protection of Individuals with regard to the Processing of Personal Data, as provided for in Article 29 of the Data Protection Directive (Article 29 Working Party) on the future PNR agreement,
– having regard to the opinion of the legal service of the European Parliament,
– having regard to Directive 2004/82/EC on the obligation of carriers to communicate passenger data (API Directive)(10),
– having regard to the 2005 joint review of the EU-US Agreement,
– having regard to the 2010 joint review of the EU-US Agreement,
– having regard to the 2009 EU-Canada Agreement,
– having regard to the request for consent to conclude the Agreement between the EU and the USA on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS)(11) and to conclude the Agreement between the EU and Australia on the processing and transfer of EU-sourced passenger name record (PNR) data by air carriers to the Australian Customs Service(12),
– having regard to its resolution of 25 November 2009 on the Communication from the Commission to the European Parliament and the Council – An area of freedom, security and justice serving the citizen – Stockholm programme(13),
– having regard to its resolution of 17 September 2009 on the envisaged international agreement to make available to the United States Treasury Department financial payment messaging data to prevent and combat terrorism and terrorist financing(14),
– having regard to the EU-US Joint Declaration on Aviation Security issued in Toledo on 21 January 2010,
– having regard to Rule 110(2) of its Rules of Procedure,
A. whereas the Treaty of Lisbon amending the Treaty on European Union and the Treaty establishing the European Community entered into force on 1 December 2009,
B. whereas, with the entry into force of the Treaty of Lisbon, Parliament is asked to give its consent to the agreements of the EU with the US and with Australia on the transfer of Passenger Name Records (PNR) with a view to concluding these agreements,
C. whereas the EU-Canada Agreement on the transfer of PNR is no longer valid, owing to the expiry of the Adequacy Decision in September 2009, and the transfer of PNR data has taken place since that date on the basis of unilateral undertakings by Canada to the Member States,
D. whereas other countries are already requesting the transfer of PNR, or have announced their intention of doing so in the near future,
E. whereas the Council has asked the Commission to put forward a proposal for an EU PNR scheme, which the latter did on 17 November 2007,
F. whereas in our digital age, data protection, the right of informational self-determination, personal rights and the right to privacy have become values that play an ever increasing role and must therefore be protected with special care,
G. whereas in our world, of which mobility is an essential characteristic, greater security and improved combating of crime must go hand in hand with more effective, focused and faster exchange of data within Europe and at global level,
1. Recalls its determination to fight terrorism and organised and transnational crime, and, at the same time, its firm belief in the need to protect civil liberties and fundamental rights, while ensuring the utmost respect for privacy, informational self-determination and data protection; reaffirms that necessity and proportionality are key principles without which the fight against terrorism will never be effective;
2. Stresses that the European Union is based on the rule of law and that all transfers of personal data from the EU and its Member States to third countries for security purposes should be based on international agreements with the status of legislative acts, in order to provide necessary safeguards for EU citizens, respect procedural guarantees and defence rights, and comply with data-protection legislation at national and European level;
3. Asks the European Commission, in accordance with Article 218 of the Treaty on the Functioning of the European Union, to provide Parliament with all the relevant information and background documents, particularly the specific information asked for in its EU PNR resolution as mentioned above;
4. Decides to postpone the vote on the request for consent on the agreements with the US and Australia until it has explored the options for arrangements for the use of PNR that are in line with EU law and meet the concerns expressed by Parliament in earlier resolutions on PNR;
5. Considers that any new legislative instrument must be preceded by a Privacy Impact Assessment, and a proportionality test demonstrating that existing legal instruments are not sufficient; calls in particular for an analysis of:
–
the use of API data within the EU and by third countries as a possible less intrusive means of passenger data collection and use,
–
data collected by the US and Australia in their respective systems for Electronic Travel Authorisation, and
-
PNR data which may be available from sources not covered by international agreements, such as computer reservation systems located outside the EU; calls on the Commission to consult all stakeholders, including air carriers;
6. Believes that appropriate mechanisms for independent review and judicial oversight and democratic control must be provided for in any new agreement;
7. Calls for a coherent approach on the use of PNR data for law enforcement and security purposes, establishing a single set of principles to serve as a basis for agreements with third countries; invites the Commission to present, no later than mid-July 2010, a proposal for such a single model and a draft mandate for negotiations with third countries;
8. Asks the Commission to request, as soon as possible, that the European Union Agency for Fundamental Rights provide a detailed opinion on the fundamental rights dimension of any new PNR agreement;
9. Considers that the model should meet the following minimum requirements:
(a)
PNR data may only be used for law enforcement and security purposes in cases of organised and transnational serious crime or terrorism of a cross-border nature, on the basis of the legal definitions laid down in Council Framework Decision 2002/475/JHA of 13 June 2002 on combating terrorism(15) and in Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant(16);
(b)
the use of PNR data for law enforcement and security purposes must be in line with European data protection standards, in particular regarding purpose limitation, proportionality, legal redress, limitation of the amount of data to be collected and of the length of storage periods;
(c)
in no circumstances may PNR data be used for data mining or profiling; no ‘no-fly’ decision or decision to investigate or prosecute may ever be taken on the sole results of such automated searches or browsing of databases; use of data must be limited to specific crimes or threats, on a case-by-case basis;
(d)
in the case of the transfer of PNR data of EU citizens to third countries, the terms of such transfers shall be laid down in a binding international treaty, providing legal certainty and equal treatment for EU citizens and companies;
(e)
the onward transfer of data by the recipient country to third countries shall be in line with EU standards on data protection, to be established by a specific adequacy finding; this will apply equally to any possible onward transfer of data by the recipient country to third countries;
(f)
PNR data may only be provided on the basis of the PUSH method;
(g)
Results will immediately be shared with the relevant authorities of the EU and of the Member States;
10. Underlines the importance of legal certainty for EU citizens and airlines, as well as the need for harmonised standards for the latter;
11. Asks the Commission and the Presidency to ensure that Parliament is given full access to the negotiation documents and directives at all stages of the procedure, in line with Article 218(10) of the Treaty on the Functioning of the European Union, and that national parliaments are given access upon request;
12. Instructs its President to forward this resolution to the Council, the Commission, the governments and parliaments of the Member States and candidate countries, the United States Government and the two Chambers of Congress, the Government of Australia and the two Chambers of Parliament, and the Government of Canada and the two Chambers of Parliament.
Proposal for a Council Decision on the conclusion of the Agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS) (2007 PNR agreement) (COM(2009)0702).
Proposal for a Council Decision on the conclusion of the Agreement between the European Union and Australia on the processing and transfer of EU-sourced passenger name record (PNR) data by air carriers to the Australian Customs Service (COM(2009)0701).