European Union

• Author: International Law Group
• Pages: 102-103

Page 102

On May 30, 2006, the European Court of Justice (ECJ) issued a decision that annuls the agreement that the European Union (EU) had reached regarding the transfer of airplane passenger data.

After September 11, 2001, the U.S. has required air carriers operating in the U.S. to provide U.S. authorities with data from their reservation and departure control systems ("Passenger Name Records, PNR). In 2004, the EU Commission found adequate safeguards for the passenger data on part of the United States Bureau of Customs and Border Protection (CBP), and the Council subsequently adopted "Decision 2004/496/EC on the conclusion of an Agreement between the European Community and the United States on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection" (2004 O.J. (L 183) 83). The European Parliament then applied to the ECJ for annulment of the Council Decision and the Commission's decision on data protection adequacy.

The ECJ agrees with the European Parliament and annuls both decisions. First, the ECJ reviews whether the Commission could validly fi nd data protection adequacy based on Directive 95/46/EC on the protection of individuals with regard to the processing of personal data. Article 3(2) of the Directive provides that the Directive shall not apply to the processing of personal data in the course of an activity that falls outside the scope of EU law, such as public security, defense, State security, and State activities in the area of criminal law. In essence, the ECJ disagrees with the Commission's and Council's reliance on the Directive. The transfer of PNR data to CBP constitutes processing operations concerning public security and criminal law. This transfer falls with the public framework for public security. Yet, the data is collected by private entities.

"57 While the view may rightly be taken that PNR data are initially collected by airlines in the course of an activity which falls within the scope of Community law, namely sale of an aeroplane ticket which provides entitlement to a supply of services, the data processing which is taken into account in the decision on adequacy is, however, quite different in nature. As pointed out in paragraph 55 of the present judgment, that decision concerns not data processing necessary for a supply of services, but data processing regarded as necessary for safeguarding public security and for...