As announced in Official Journal C 109 of 16 April 2013, the Commission decided to withdraw this proposal, which had become obsolete.

After a presentation by the Commission, the Council held an exchange of views on progress made in the negotiations between the EU and the United States of America on a EU-US Passenger Name Records (PNR) agreement.

In December 2010, the Council adopted negotiating directives for agreements on the transfer and use of passenger name records (PNR) with Australia, Canada and the United States of America. This allowed the Commission, as the EU negotiator, to start discussions with these three countries. The goal of all three agreements is to prevent and combat terrorism and other forms of serious cross border crime.

At the same time, the EU is also committed to ensuring that any transmission of PNR data to third countries is done in a secure manner, in line with existing EU legal requirements, and that passengers are able to enforce their rights in relation to the processing of their data.

In May 2010, the European Parliament decided to postpone its vote on the request for consent on existing PNR agreements with the US and Australia. These two agreements have therefore not been concluded yet and have been applied on a provisional basis since 2007 and 2008, respectively. In a resolution, Parliament demanded that new agreements should be negotiated with the US and Australia as well as with Canada, with which a PNR agreement has been in force since 2006.

3121

The Council adopted a decision on the signing of the agreement between the European Union and Australia on the processing and transfer of Passenger Name Record (PNR) data, which will replace the one applied on a provisional basis since 2008. The signing will probably take place before the end of September 2011. After that, the European Parliament will be asked to give its consent to the agreement, which is necessary before the Council can adopt its decision on the conclusion of the agreement.

The EU currently has agreements on the transfer and use of passenger name records (PNR) with Australia, Canada and the United States of America. In May 2010, the European Parliament decided to postpone its vote on the request for consent on these existing PNR agreements with the US and Australia. These two agreements have therefore not been concluded yet and have been applied on a provisional basis since 2007 and 2008, respectively. In a resolution , Parliament demanded that new agreements should be negotiated with the US and Australia as well as with Canada, with which a PNR Agreement has been in force since 2006.

While negotiations on the PNR agreement with Australia have now been finalised, those on revised PNR agreements with the US and Canada are still ongoing.

3111

COM(2009)0702

PURPOSE: to conclude the Agreement between the EU and the USA on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS) (2007 PNR agreement).

PROPOSED ACT: Council Decision.

CONTENT: on 22 February 2007, the Council authorised the Presidency, assisted by the Commission, to open negotiations for a long-term agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS).

In accordance with Council Decision 2007/551/CFSP/JHA of 23 July 2007, the Agreement was signed on 23 and 26 July 2007, subject to its conclusion.

The Agreement has been applied provisionally since the date of its signature.

The Agreement has not yet been concluded. With the entry into force of the Treaty of Lisbon on 1 December 2009, the procedures to be followed by the Union in order to conclude the Agreement are governed by Article 218 of the Treaty on the Functioning of the European Union which states that the Council shall adopt a decision concluding the agreement, after obtaining the consent of the European Parliament .

The proposed decision aims to approve the Agreement between the EU and the USA on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS), together with the accompanying letter from the DHS and the letter from the Union in reply.

05304/2010

PURPOSE: to conclude the Agreement between the EU and the USA on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS) (2007 PNR agreement).

PROPOSED ACT: Council Decision.

BACKGROUND: the Justice and Home Affairs Council of 23 July 2007 authorised the Presidency of the Council of the European Union to sign an agreement between the EU and the USA on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the US Department of Homeland Security (DHS). The Agreement was signed by the EU on 23 July 2007 and by the USA on 26July 2007 and is applied provisionally as from 26 July 2007. The purpose of the Agreement is to ensure the exchange of European passenger information, known as Passenger Name Record or PNR data with the US Department of Homeland Security pursuant to which its services assess the risk a passenger may pose to American security.

CONTENT: the aim of the agreement is to provide a legal basis for the exchange of information relevant for law enforcement and judicial authorities between the EU and the US for the fight against terrorism and related transnational crime, including organised crime, in this case PNR data, thereby providing legal certainty for airlines, passengers and data protection authorities, whilst ensuring the protection of citizens' privacy as well as their physical security. In addition an EU agreement enables to apply this approach homogeneously throughout the EU in order to ensure respect for individuals' right to privacy and to avoid distortion of competition between airlines.

Respecting Fundamental Rights : the Agreement aims to prevent and combat terrorism while respecting fundamental rights, and notably the protection of personal data. It aims to ensure full respect for fundamental rights enshrined in Article 6 of the Treaty on European Union and for the principles of proportionality and necessity regarding the right to respect for private and family life and the protection of personal data as set out in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.

Territorial application : the UK and Ireland will take part in the adoption of the Decision. Denmark will not be bound by the Agreement.

It should be noted that in accordance with Article 218(6)(a) of the Treaty on the Functioning of the European Union, it is provided that in the case of agreements covering fields to which the ordinary legislative procedure applies, the Council shall adopt a decision concluding the agreement, after obtaining the consent of the European Parliament .

COM(2009)0702
EUR-Lex

This Agreement between the European Union and the United States concerns the processing and transfer of passenger name record (PNR) data by air carriers to the United States Department of Homeland Security (DHS) (“2007 PNR Agreement”).

The main objective of this Agreement is to ensure that EU airlines comply with international conventions, U.S. statutes, and regulations requiring each air carrier operating passenger flights in foreign air transportation to or from the United States to make PNR data available to DHS to the extent they are collected and contained in the air carrier's automated reservation/departure control systems, and comparable requirements implemented in the EU. The EU should ensure that air carriers with reservation systems located within the EU make available PNR data to DHS and comply with the technical requirements for such transfers as detailed by DHS.

The Agreement comprises an exchange of letters which gives assurances as regards the protection of data transferred by the EU to DHS.

On a technical level : DHS will electronically access the PNR from air carriers' reservation systems located within the territory of the Member States of the European Union until there is a satisfactory system in place allowing for the transmission of such data by the air carriers. DHS shall process PNR data received and treat data subjects concerned by such processing in accordance with applicable U.S. laws, constitutional requirements, and without unlawful discrimination, in particular on the basis of nationality and country of residence. DHS's letter sets forth these and other safeguards. DHS will immediately transition to a push system for the transmission of data by such air carriers no later than 1 January, 2008 for all such air carriers that have implemented such a system that complies with DHS's technical requirements. DHS will electronically access the PNR from air carriers' reservation systems located within the territory of the Member States of the European Union until there is a satisfactory system in place allowing for the transmission of such data by the air carriers.

It is also provided that DHS and the EU will periodically review the implementation of this Agreement, the DHS letter, and U.S. and EU PNR policies and practices with a view to mutually assuring the effective operation and privacy protection of their systems.

Data protection : by this Agreement, DHS shall not undertake data protection measures in its PNR system that are more stringent than those applied by European authorities for their domestic PNR systems. DHS shall not ask European authorities to adopt data protection measures in their PNR systems that are more stringent than those applied by the U.S. for its PNR system. If its expectation is not met, DHS reserves the right to suspend relevant provisions of the DHS letter while conducting consultations with the EU with a view to reaching a prompt and satisfactory resolution.

For the application of this Agreement, DHS is deemed to ensure an adequate level of protection for PNR data transferred from the European Union .

This Agreement will apply provisionally as of the date of signature, pending its conclusion.

DHS Letter : this Agreement includes an exchange of letters between the EU and DHS which is intended to explain how the United States Department of Homeland Security (DHS) handles the collection, use and storage of Passenger Name Records (PNR). It provides the assurances and reflects the policies which DHS applies to PNR data derived from flights between the U.S. and European Union (EU PNR) under U.S. law.

This letter develops the following issues:

Purpose for which PNR is used : DHS uses EU PNR strictly for the purpose of preventing and combating: (1) terrorism and related crimes; (2) other serious crimes, including organized crime, that are transnational in nature; and (3) flight from warrants or custody for crimes described above. PNR may be used where necessary for the protection of the vital interests of the data subject or other persons, or in any criminal judicial proceedings, or as otherwise required by law.

Sharing of PNR : DHS shall treat EU PNR data as sensitive and confidential in accordance with U.S. laws and, at its discretion, provides PNR data only to other domestic government authorities with law enforcement, public security, or counterterrorism functions, in support of counterterrorism, transnational crime and public security related cases. Access shall be strictly and carefully limited to the cases described above in proportion to the nature of the case. EU PNR data is only exchanged with other government authorities in third countries after consideration of the recipient's intended use(s) and ability to protect the information .

Types of Information Collected : most data elements contained in PNR data can be obtained by DHS upon examining an individual's airline ticket and other travel documents (PNR record locator code, date of reservation, names, etc) pursuant to its normal border control authority, but the ability to receive this data electronically significantly enhances DHS's ability to focus its resources on high risk concerns, thereby facilitating and safeguarding bona fide travel. To the extent that sensitive EU PNR data (i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, etc), as specified by the PNR codes and terms which DHS has identified in consultation with the European Commission, are included in the above types of EU PNR data, DHS shall employ an automated system which filters those sensitive PNR codes and terms and shall not use this information. Unless the data is accessed for an exceptional case, DHS shall promptly delete the sensitive EU PNR data.

Access and Redress : DHS shall also maintain a system accessible by individuals, regardless of their nationality or country of residence, for providing redress to persons seeking information about or correction of PNR.

Data retention : DHS shall retain EU PNR data in an active analytical database for seven years , after which time the data will be moved to dormant, non-operational status. Data in dormant status will be retained for eight years and may be accessed only with approval of a senior DHS official designated by the Secretary of Homeland Security and only in response to an identifiable case, threat, or risk . It is expected that EU PNR data shall be deleted at the end of this period.

Transmission : the exchange of letters recalls that DHS is prepared to move as expeditiously as possible to a "push" system of transmitting PNR from airlines operating flights between the EU and the U.S. to DHS. Thirteen airlines have already adopted this approach. The responsibility for initiating a transition to "push" rests with the carriers, who must make resources available to migrate their systems and work with DHS to comply with DHS's technical requirements. DHS will immediately transition to such a system for the transmission of data by such air carriers no later than 1 January 2008. Under normal circumstances DHS will receive an initial transmission of PNR data 72 hours before a scheduled departure and afterwards will receive updates as necessary to ensure data accuracy.

Reciprocity : as provided in the Agreement itself, reciprocity measures stipulate that DHS does not ask European authorities to adopt data protection measures in their PNR systems that are more stringent than those applied by the U.S. for its PNR system. In order to foster police and judicial cooperation, DHS will encourage the transfer of analytical information flowing from PNR data by competent US authorities to police and judicial authorities of the Member States concerned and, where appropriate, to Europol and Eurojust. DHS expects that the EU and its Member States will likewise encourage their competent authorities to provide analytical information flowing from PNR data to DHS and other US authorities concerned.

Review : DHS and the EU will periodically review the implementation of this Agreement, the DHS letter, and U.S. and EU PNR policies and practices with a view to mutually assuring the effective operation and privacy protection of their systems.

It should be noted that this Agreement does not constitute a precedent for any future discussions or negotiations between the United States and the European Union, or between either of the Parties and any State regarding the processing and transfer of PNR or any other form of data.

11595/2007