The European Court of Justice has ruled that the transfers of EU air passenger data to the US customs, approved by the Commission and the Council, was illegal.
The European Court of Justice (ECJ) ruled, on 30 May 2006, that "neither the Commission decision finding that the data are adequately protected by the United States nor the Council decision approving the conclusion of an agreement on their transfer to that country are founded on an appropriate legal basis".
The ECJ judgment thus annuls both the Commission and Council decisions. The agreement as such was not annulled.
The EU Justice and Home Affairs Commissioner Franco Frattini said that he will try to renegotiate the current passenger name record (PNR) agreement under different legal basis, but with similar content.
The European Data Protection Supervisor (EDPS), Peter Hustinx thinks that the ECJ judgement has created a "loophole in the protection of European citizens whereby their data are used for law enforcement purposes" and urges adoption of a comprehensive and consistent legal instrument ensuring the protection of personal data outside of the first pillar.
Association of European Airlines (AEA) expects that the Commission and other parties involved will now work together to decide on "a new legal framework that may be required as a result of the judgment".
MEP Jean-Marie Cavada (ALDE), Chair of the Parliament's Civil Liberties Committee thinks that the Parliament needs to "remain vigilant regarding the legal basis proposed for the new agreement, with which Parliament should clearly be involved. On this issue, it would be disastrous if it was decided to reach bilateral agreements instead. Better cooperation among the three European institutions is deeply necessary".
MEP Sophie In't Veld MEP (ALDE) sees no need for a new agreement with the United States. "Otherwise I fear that the Council will try to push through an agreement under the third pillar (intergovernmental cooperation) and ignore Parliament's concerns over data protection altogether," she said.
Green MEP Cem Özdemir still believes that cooperation between the EU and the US Department of Homeland Security, Bureau of Customs and Border Protection is necessary to ensure security of European as well as American citizens, but says that "it is possible to establish safeguards without infringing on fundamental rights".
In the EU, personal data is only to be transferred to third countries in 'very exceptional cases'. However, on 17 May 2004, the Council adopted a decision approving the conclusion of an agreement between the EU and the United States on the processing and transfer of passenger name records (PNR) data by air carriers established in the EU member states to the US customs and border protection. The agreement was signed on 28 May 2004 and entered into force right away.
In September 2004, the European Parliament brought a legal case against the Commission in the European Court of Justice (ECJ) on the EU/US passenger name records (PNR) agreement. Parliament accused the Commission of misuse of powers, breach of fundamental rights and of the principle of proportionality. The Parliament also appealed to the ECJ for annulment of the Council decision adopting the agreement.
The European Data Protection Supervisor (EDPS) has supported the Parliament in both cases.
