Hintergrund :
In two recent cases, the personal data of millions of Europeans was made directly accessible to US security services. In both cases, the US applied economic pressure on industry sectors to make them stress EU privacy rules to their limit:
Airline Passenger Data (PNR)
Following the 11 September 2001 terrorist attacks, the United States requested access to the personal information that passengers provide when booking a ticket (Passenger Name Record; PNR). They threatened airlines which refused to provide the requested data with a withdrawal of their landing authorisation.
The terms of a first agreement, under which the US could access 34 different kinds of personal information, wer ruled illegal by the European Court of Justice in May 2006. The Court ruled that "neither the Commission decision finding that the data are adequately protected by the United States nor the Council decision approving the conclusion of an agreement on their transfer to that country are founded on an appropriate legal basis".
Since the US maintained their threat to non-compliant airlines, an intermediary scheme had to enter into force when the first agreement ended at the end of September 2006. This second agreement, which was under the same terms as the agreement already ruled illegal, will end on 31 July 2007.
Half a year before that date, negotations are about to start between the Commission and an US delegation. The US has already indicated that they will not settle for anything less - namely for better privacy standards - than in the previous agreements. Since these terms have been ruled illegal by the ECJ, an impasse in the middle of summer looms.
See EurActiv, 06/10/06, 31/08/06, 31/05/06.
International Banking Data (SWIFT)
In June 2006, the New York Times revealed a scheme under which the non-profit Belgian international banking co-operative network Society for Worldwide Interbank Financial Telecommunication (SWIFT), granted the CIA access to data concerning millions of financial transactions involving €6 billion daily, in reaction to a request from US authorities. Most of the data concerns transactions outside the US, often involving one or two EU countries. Its transfer to a third-country government is a clear breach of EU privacy law. This was also confirmed by EU member states Privacy Officers, who convene in the so-called Article 29 Working Party.
See EurActiv, 27/11/06, 07/07/06, 27/06/06.