The European Parliament obtained the annulment by the European Court of Justice of the agreement between the European Community and the US Government on the transfer of passenger name records (PNR) from foreign carriers to the US with the view to combat terrorism and maintain national security. In order to prevent problems the agreement will be still in force until 30 September 2006. Until then the Member States have time to solve the legal issues arising from the annulment within or outside the EU context.

After 11 September 2001 air carriers flying from Europe to the US were in a dilemma. The US Government required to access personal data of travellers contained in the databases of all foreign carriers. On the other hand, 1995 EU Directive on data protection restricts the transfer of personal data from one jurisdiction to another unless there is adequate protection of that data.

Following a series of negotiations to solve this dilemma during 2002 and 2003 on issues related to the amount of data transferred, the period of data retention and data protection, an agreement between EU and US entered into force in May 2004. The European Commission also decided that the US provided adequate protection for the data transfer to take place.

The European Parliament however considered that data transfer should not take place unless greater data protection measures were taken.It also found that the European Commission had no legal jurisdiction to conclude such an agreement and therefore decided to challenge the agreement at the European Court of Justice.

The decision of the Court was taken considering the European Commission had no legal authority to conclude such an agreement as the Directive does not apply to this kind of data transfer.

The Commission disagreed and considered that the carriers process PNR data within the Community jurisdiction and then make the transfer of these data to US so these activities of private parties are related to public security and therefore are regulated by the Directive.

The court considered that the transfer of PNR data to the US concerns public security, and as private operators must operate within a framework established by public authorities, the European Commission was acting in the area of public security in which it has no jurisdiction. The court concluded that both the agreement and the decision on adequacy were based on the wrong legal base.

However, the court decided on the annulment of the agreement without considering the other pleas from the Parliament related to the privacy and human rights aspects of the agreement. This leaves open the possibility of bi-lateral agreements between the US and each EU member state.

The decision of the Court therefore should not be considered as a real victory of the European Parliament, which has no power of approval over such treaties or the power to bring legal actions against them. There is also the risk that such a separate treaty signed between a member state and the US could be even worse than the original agreement from the point of view of data protection standards.

Judgment of the Court of Justice - PNR case (30.05.2006)
http://curia.eu.int/jurisp/cgi-bin/form.pl?lang=EN&Submit=Recherch...

European Court of Justice press release (30.05.2006)
http://curia.eu.int/en/actu/communiques/cp06/aff/cp060046en.pdf

Courts annul EU-US air data deal (30.05.2006)
http://www.eupolitix.com/EN/News/200605/e2bac420-d618-4608-94c0-59fd19...

EU-US passenger data transfer deal annulled by European Court (30.05.2006)
http://www.privacyinternational.org

Statewatch's Observatory on the exchange of data on passengers (PNR)
http://www.statewatch.org/pnrobservatory.htm

Staying vigilant after EU-US PNR deal cancelation (French only, 31.05.2006)
http://www.iris.sgdg.org/info-debat/comm-cjcepnr0506.html

EDRI-gram : Advocate General European Court rejects PNR deal (5.12.2005)
http://www.edri.org/edrigram/number3.24/PNR