Luxembourg, 30/05/2006 (Agence Europe) - On Tuesday the European Court of Justice annulled the decisions by the Council and Commission on the transfer of personal airline passenger data to the US authorities. The Commission's decision, which called for the US authorities to ensure a sufficient degree of protection on this data, did not have an adequate legal basis. By deciding to approve the conclusion of the EU/US agreement on the transfer of this data, the Council used an inappropriate legal basis, Article 95 of the Treaty. The Court indicated that this article allows for relevant measures to be taken with regard to the functioning of the internal market but does not allow for fighting terrorism. For reasons related to legal security, the Court maintains that the Commission's decision will apply until 30 September 2006.
Following the terrorist attacks of 11 September 2001, the United States passed legislation providing that air carriers operating flights to, from or across United States territory have to provide the United States authorities with electronic access to the data contained in their reservation and departure control systems, called 'Passenger Name Records' (PNR). Following negotiations with the US authorities, the Commission adopted, on 14 May 2004, a decision (the decision on adequacy) finding that the United States Bureau of Customs and Border Protection (CBP) ensures an adequate level of protection for PNR data transferred from the Community. On 17 May 2004, the Council adopted a decision approving the conclusion of an agreement between the European Community and the United States on the processing and transfer of PNR data by air carriers established in the Community to the CBP.
Parliament applied for annulment of the two decisions and has just obtained this request. The Court noted that provisions in the directive of 24 October 1995 exclude from the directive's scope the processing of personal data. This directive excludes from its scope, the processing of data pertaining to public security, defence, State security and the activities of the State in areas of criminal law. The Court also explains that the as a result of the Commission's decision, “the Community is fully committed to supporting the United States in the fight against terrorism and PNR data will be used strictly for purposes of preventing and combating terrorism and related crimes, and other serious crimes, including organised crime”. Both the Court and the Commission admit that that PNR data are initially collected by airlines in the course of an activity which falls within the scope of Community law, namely sale of an aeroplane ticket which provides entitlement to a supply of services (the flight). However, the Court states that the data processing which is taken into account in the decision on adequacy is, however, quite different in nature. That decision concerns not data processing necessary for a supply of services, “but data processing regarded as necessary for safeguarding public security and for law-enforcement purposes”. For all of these reasons it concludes that the decision on adequacy is not covered in the field of the 1995 directive's application.
In order to annul the Council's decision, the Court found that Article 95 cannot justify Community competence to conclude the Agreement with the United States. The Court concludes that this agreement “relates to the same transfer of data as the decision on adequacy and therefore to data processing operations which are excluded from the scope of the 1995 directive”. Consequently, the Court only annulled what it was expected to, given that this involved the annulment of decisions, as pursued by the Parliament. Neither did the Court rule on the contents of the decisions taken, given that the Parliament had only requested that it to reach a decision on the issue of the legal basis. Advocate General Philippe Léger also proposed that these two decisions be annulled (EUROPE 9073.
On Tuesday, the European Commission spokesperson indicated that it would take the Court decision into full consideration and formally record the fact that the legal basis on which it had adopted its decision is inadequate. The Commission will consult the different parties in an attempt to find solutions that are in keeping with the Court ruling, in respect of fundamental rights and requirements in the fight against terrorism, it indicated. It also underlined on several occasions that this involved a ruling on the legal basis of decisions that had been taken and not on the content of the decisions. Sarah Ludford MEP (ALDE, Britain) declared in a press statement that “the Commission and Council had been hoisted by their own petard. The EP has been arguing for years for adequate safeguards when data is transferred in the police and intelligence fields”.