COM(2021)0018
EUR-Lex

EUR-Lex
SWD(2021)0004

COM(2017)0029

The Commission presented a report on the joint review of the implementation of the Agreement between the United States of America and the European Union on the use of Passenger Name Record (PNR) data and their Transfer to the US Department of Homeland Security.

The current agreement between the United States of America and the European Union on the use of passenger name record (PNR) data and their transfer to the US Department of Homeland Security (DHS) came into effect on 1 July 2012.

The main purpose of the joint review is to report on the follow-up to the recommendations of the previous report of 2013 and the implementation of the agreement, paying particular attention to the mode of transmission of PNR data and the subsequent transfer of such data as provided for in the relevant articles of the agreement.

The report also outlines the main findings of the 2015 joint review and the issues that still remain to be addressed by the DHS.

Implementation of the 2013 recommendations: the Commission considers that all the recommendations made following the 2013 review have either been fully respected or followed up by further improvements:

internal privacy review: the launch of the six-month period, triggering the depersonalisation of PNR data under the agreement now starts on the date when PNR data are loaded into the automated targeting system (ATS) (known as the “load date”), which is the first day the data are stored in the system; full move to the “push” method by 1 July 2014: during the 2015 review, four air carriers still did not communicate PNR data using the "push" method; The DHS helped them develop their capacity to do so; notification procedure to EU Member States in the event of sharing of EU PNR data between DHS and third countries: since July 2014 a Customs and Border Protection (CBP) officer has been seconded to Europol as liaison officer. Where the liaison officer identifies a "targeted" passenger with a link to a Member State, he shares the information with the representatives of that Member State in a report; transparency in the remedies available to individuals: the DHS’s TRS (Traveler Redress Inquiry Program) is the single point of contact for the public, but the United States should continue to examine all means to ensure that all passengers are informed of the available redress mechanisms.

Recommendations following the 2015 review: The EU Task Force noted that the United States continued to implement the agreement in accordance with the conditions set out therein:

the DHS complies with its obligations as regards access rights for passengers and has a monitoring mechanism to prevent unlawful discrimination; constant efforts have been made to ensure reciprocity and preventive sharing of analytical information derived from PNR data with Member States and, as appropriate, with Europol and Eurojust; the masking and deletion of sensitive data is respected and the DHS has stated that it has never had access to sensitive data for operational purposes; the DHS continues to honour its commitments on passenger rights, in particular with respect to the provision of passenger information and the implementation of the right of access without any derogation; data sharing with other US services is handled by the DHS in accordance with the agreement. It is done on a case-by-case basis, is recorded and takes place on the basis of written agreements. The sharing of data with third countries is strictly interpreted and is also in line with the agreement.

Opportunities for improvement: despite the successful implementation of the agreement, some improvements remain necessary:

the number of overrides to access non-US nexus PNR data has increased since the 2013 review and the DHS needs to record the reasons why overrides have been used to better understand why they occur; the DHS should continue to monitor the number of officers with access rights to PNR data in order to limit the consultation and use of PNR data only to staff with an operational need to do so; the DHS should regularly monitor the list of sensitive data codes in order to ensure that all sensitive data are automatically blocked by the system; the number of PNR data related to repressive operations and therefore not subject to masking remains high. The DHS is invited to examine this point and to ensure that the data in question no longer need to be hidden, anonymised or deleted as soon as possible; the DHS complies with the agreement by not refusing any passenger access to their data. However, response times have increased since the last review in 2013 and the DHS should establish whether it is possible to reduce them; the DHS should provide more information on the precise data currently being collected and be able to provide more information on data that has been shared with other US authorities and police, law enforcement and judicial bodies within the EU; lastly, with a view to future reviews and evaluation, the DHS should ensure that all facts and figures are collected in a uniform manner to allow for direct comparisons.

COM(2017)0029
EUR-Lex

EUR-Lex
SWD(2017)0014

EUR-Lex
SWD(2017)0020

The Commission presented a report on the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of passenger name records (PNR Agreement) to the United States Department of Homeland Security.

Joint review : the Agreement provides for a first joint review one year after its entry into force and regularly thereafter as jointly agreed. This joint review was carried out on 8 and 9 July 2013 in Washington. Its main focus was the implementation of the Agreement, with particular attention to the method of transmission of passenger name records (PNR) as well as the onward transfer of PNR as set out in the relevant articles of the Agreement, and in accordance with recital No 18 of the Agreement.

One part consisted of a field visit to a Department of Homeland Security (DHS) operation center by the EU team of experts.

State of implementation : the EU team found that DHS implemented the Agreement in line with the conditions set out therein. For example DHS uses effective filters for filtering out data without a U.S. nexus as well as PNR data outside the 19 PNR categories described in the Annex to the Agreement.

The masking and deletion of sensitive data are respected and DHS has stated that it has never accessed sensitive data for operational purposes.

DHS also implements its commitments in relation to passenger rights, in particular as regards providing appropriate information to passengers and implementing the right to access without any exemptions.

Sharing of data with other domestic agencies is handled by DHS in line with the Agreement. Sharing is carried out on a case-by-case basis, logged and takes place on the basis of written understandings. Sharing of data with third countries is also interpreted strictly, and is also in line with the Agreement.

Proposed improvements : despite the implementation of the Agreement, some improvements remain necessary:

1) depersonalisation : in accordance with the Agreement, measures provide for a period of six months for the depersonalization of PNR. Currently the calculation of this period starts only as soon as a PNR is last updated in the DHS Automated Targeting System (ATS) which holds the PNR, not when PNR is loaded in ATS. It is recommended to start applying the six months period as from the day the PNR is loaded in ATS which is the first day the data are stored in ATS, instead of the current practice, which delays applying the six months period (until the last ATS Update of the PNR).

2) ad hoc pull method : particular attention should be paid to the use of the ad hoc “pull” method. It is recommended that DHS, in addition to its current logs, keeps better records of the reasons why the ad hoc “pull” method is applied in each case, which would allow for a better assessment of the proportionality and a more effective auditing of its use, which is meant to be an exception to the rule;

3) reciprocity : DHS is requested to respect its commitment to ensure reciprocity and pro-actively share individual PNRs and analytical information flowing from PNR data with EU Member States and where appropriate with Europol and Eurojust;

4) redress mechanisms : it is advised to provide more transparency on the redress mechanisms available under U.S. law. Such transparency should allow passengers who are not U.S. citizens or legal residents to challenge DHS decisions related to the use of PNR data, in particular when the use of such data may contribute to a recommendation to deny boarding by carriers.

5) targeting scenario rules : the report notes that the DHS also implemented measures that go beyond the Agreements’ requirements. DHS foresees a notification to the European Commission within 48 hours of access to sensitive PNRs. DHS has installed a new procedure to quarterly oversee and review the implementation of the ATS and to review all travel targeting scenarios, analysis and rules to ensure that they are proportionate to minimize the impact on bona fide travellers’ civil rights, civil liberties and privacy, and to avoid discrimination against travellers.

Fight against terrorism : a preliminary assessment of the question whether PNR serves the purpose of supporting the fight against terrorism and other crimes that are transnational in nature showed that PNR provides DHS with the possibility of carrying out pre-departure assessments of all passengers up to 96 hours which gives DHS sufficient time to carry out all the background checks before the arrival of a passenger and prepare its response. This processing also supports DHS when deciding if a passenger should board a plane or not. It also provides DHS with the opportunity to perform risk assessments on the basis of scenario-based targeting rules in order to identify the ‘unknown’ potential high-risk individuals. PNR further provides the possibility to make associations between passengers and identify criminals who belong to the same organised crime group. According to DHS PNR is also successfully used for identifying trends of how criminals tend to behave when they travel, for example by understanding which routes they use.

Commission recommendations : as a general recommendation, it is advised to envisage another internal review of the Agreement by the DHS Privacy Office ahead of the next joint review. The two sides suggest organising the next joint review during the first half of 2015.

It is also recommended to ensure as quickly as possible a full move to the “push” method and in any case by 1 July 2014 .

It is further recommended that the U.S. and the EU work together to promote the use of common transmission standards, in particular the PNRGOV standard as developed by IATA, airlines, and government. In this respect it would be welcomed if the discussions in IATA on a common “Push” standard also would lead to a common standard for ad hoc “push”.

Lastly, the Joint Review Report accompanying this Report consists of three Chapters: (i) providing an overview of the background to the review and the purpose and procedural aspects of the exercise; (ii) presenting the main findings of the joint review and the issues to be further addressed by DHS; (iii) presenting the overall conclusions of the exercise. Annex B presents the composition of the EU and U.S. teams that carried out the review exercise.

EUR-Lex
COM(2013)0844

EUR-Lex
SEC(2013)0630

PURPOSE: to conclude the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security.

NON-LEGISLATIVE ACT: Council Decision 2012/472/EU on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of passenger name records to the United States Department of Homeland Security.

BACKGROUND: U.S. legislation empowers the Department of Homeland Security (DHS) to require each air carrier operating passenger flights to and from the U.S., to provide it with electronic access to Passenger Name Record (PNR) data prior to the passenger arriving or leaving the U.S. The requirements of the U.S. authorities are based on title 49, United States Code, section 44909c and its implementing regulations (title 19, Code of federal regulations, section 122.49b). This legislation aims at obtaining PNR data electronically in advance of a flight's arrival and therefore significantly enhances DHS ability to conduct efficient and effective advance risk assessment of passengers and to facilitate bona fide travel, thereby enhancing the security of the U.S. The Agreement will also foster international police and judicial cooperation through the transfer of analytical information flowing from PNR data by the U.S. to the competent Member States authorities as well as Europol and Eurojust within their respective competences.

The European Union signed an agreement in 2007 with the United States on the transfer and processing of PNR data based on a set of commitments by DHS in relation to the application of its PNR programme. Following the entry into force of the Lisbon Treaty and pending the conclusion of the agreement, the Council sent the 2007 U.S. Agreement to the European Parliament for its consent for the conclusion. The European Parliament adopted a resolution in which it decided to postpone its vote on the requested consent and requesting a renegotiation of the Agreement on the basis of certain criteria . (please refer to RSP/2010/2657 ). Pending such renegotiation, the 2007 Agreement would remain provisionally applicable.

On 2 December 2010, the Council adopted a decision authorising the Commission to open negotiations between the Union and the United States of America on the transfer and use of passenger name records (PNR) to prevent and combat terrorism and other serious transnational crime. In accordance with Council Decision 2012/471/EU, the Agreement was signed on 14 December 2011, subject to its conclusion.

It is now appropriate to conclude the Agreement.

This Agreement replaces the previous one that has been provisionally applied since 2007.

CONTENT: this Decision concludes the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security. The main points of the Agreement are as follows:

Purpose: the purpose of the Agreement is to ensure security and to protect the life and safety of the public.

PNR data: this is the information provided by passengers and collected by air carriers during the reservation and check-in procedures. It includes information such as name, dates of travel and travel itinerary, ticket information, address and phone numbers, means of payment used, credit card number, travel agent, seat number and baggage information.

Scope: the Agreement shall apply to carriers operating passenger flights between the European Union and the United States, and also apply to carriers incorporated or storing data in the EU and operating passenger flights to or from the United States.

Use of PNR data: the US collects, uses and processes PNR for the purposes of preventing, detecting, investigating, and prosecuting terrorist offences and related crimes, and serious crimes that are transnational in nature, as defined in the text. In its implementation, the agreement shall be strictly limited to the use of PNR data for the prevention and detection of terroriost offences or transnational crime.

Sensitive data: to the extent that PNR of a passenger as collected includes sensitive data (i.e. personal data and information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or data concerning the health or sex life of the individual), DHS shall employ automated systems to filter and mask out sensitive data from PNR. Access to, as well as processing and use of, sensitive data shall be permitted in exceptional circumstances where the life of an individual could be imperilled or seriously impaired.

Sensitive data shall be permanently deleted not later than 30 days from the last receipt of PNR containing such data by DHS, except under specified circumstances.

Guarantees: in accordance with the agreement, provisions are made for the following guarantees for individuals:

· Correction or rectification for individuals : any individual regardless of nationality, country of origin, or place of residence may seek the correction or rectification, including the possibility of erasure or blocking, of his or her PNR by DHS.

· Redress for individuals : any individual regardless of nationality, country of origin, or place of residence whose personal data and personal information has been processed and used in a manner inconsistent with the Agreement may seek effective administrative and judicial redress in accordance with US law.

Data retention : DHS retains PNR in an active database for up to five years . After the initial six months of this period, PNR shall be depersonalised and masked . Access to this active database shall be restricted to a limited number of specifically authorised officials.

After this active period, PNR shall be transferred to a dormant database for a period of up to ten years, where PNR shall not be repersonalised except in connection with law enforcement operations and then only in connection with an identifiable case, threat or risk. As regards serious transnational crime, PNR in this dormant database may only be repersonalised for a period of up to five years.

Following the dormant period, data retained must be rendered fully anonymised by deleting all data types which could serve to identify the passenger to whom PNR relate without the possibility of repersonalisation.

Data that are related to a specific case or investigation may be retained in an active PNR database until the case or investigation is archived.

The Parties agree that the necessity of a 10-year dormant period of retention will be considered when the Agreement is evaluated.

EU access to data: DHS shall provide to competent police, or other authorities of the EU Member States and Europol and Eurojust within the remit of their respective mandates, as soon as practicable, relevant, and appropriate, analytical information obtained from PNR in those cases under examination or investigation to prevent, detect, investigate, or prosecute within the EU terrorist offences and related crimes or transnational crime as described in the text.

Furthermore, a police or judicial authority of an EU Member State, or Europol or Eurojust, may request, within its mandate, access to PNR or relevant analytical information obtained from PNR that are necessary in a specific case to prevent, detect, investigate, or prosecute within the European Union terrorist offences and related crimes or transnational crime as described.

Monitoring compliance : compliance with these rules shall be subject to independent review and oversight by various Department Privacy Officers, as well as by the DHS Office of Inspector General, the Government Accountability Office and the U.S. Congress.

Respect for fundamental rights : the Agreement respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, notably the right to private and family life, the right to the protection of personal data, and the right to effective remedy and fair trial recognised by the Charter.

Onward transfer : the United States may transfer PNR to competent government authorities of third countries only under terms consistent with the Agreement and only upon ascertaining that the recipient’s intended use is consistent with those terms.

Review and evaluation : the Parties shall jointly review the implementation of the Agreement one year after its entry into force and regularly thereafter as jointly agreed, and they will jointly evaluate the Agreement four years after its entry into force.

Following the joint review, the European Commission shall present a report to the European Parliament and the Council, and the US shall be given an opportunity to provide written comments which shall be attached to the report.

Duration: the Agreement shall remain in force for a period of seven years from the date of its entry into force, and may be renewed for a further period of seven years.

Territorial provisions : the United Kingdom and Ireland are taking part in the adoption of the Decision, but Denmark is not taking part in the adoption of this Decision and is not bound by the Agreement or subject to its application.

ENTRY INTO FORCE: the Decision enters into force on 12 August 2012. The Agreement enters into force the first day of the month following the date on which the parties have notified that they have completed the necessary internal procedures.

Decision 2012/472
OJ L 215 11.08.2012, p. 0004

Results of vote in Parliament

Debate in Parliament

The European Parliament adopted by 409 votes to 226 with 33 abstentions, a legislative resolution on the draft Council decision on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security.

Parliament gives its consent to the conclusion of the Agreement and considers that procedure 2009/0187(NLE) has lapsed as a result of the 2007 PNR Agreement between the European Union and the United States being replaced by the new PNR Agreement.

T7-0134/2012

The Committee on Civil Liberties, Justice and Home Affairs adopted the report drafted by Sophia in't Veld (ADLE, NL) in which it recommends the European Parliament to give its consent to the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security.

In so doing, Members consider that procedure 2009/0187(NLE) has lapsed as a result of the 2007 PNR Agreement between the European Union and the United States being replaced by the new PNR Agreement.

It should be noted that in a minority opinion pursuant to Rule 52(3) of the Rules of Procedure, certain Members expressed their disagreement as regards the Agreement in question, considering that it does not meet the guarantees requested by the EP in its previous resolutions (in particular, as regards factual evidence supporting the claim that storage and processing of PNR for law enforcement purposes is necessary and proportionate and that it has not seriously explored less intrusive alternatives).

A7-0099/2012

PE480.856

PE480.773

Opinion of the European Data Protection Supervisor (EDPS) on the proposal for a Council Decision on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security

On 28 November 2011, the Commission adopted a proposal for a Council Decision on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records (PNR) to the United States Department of Homeland Security. On 9 November 2011, the EDPS was consulted informally on the draft proposal, in the context of a fast track procedure. On 11 November 2011, he issued a number of restricted comments. The aim of the present Opinion is to complement these comments in light of the present proposal and to make his views publicly available.

Background to the proposal : the agreement aims at providing a solid legal basis for the transfer of PNR data from the EU to the US. The transfer is currently based on the 2007 agreement because the Parliament decided to postpone its vote on the consent until its data protection concerns were met. In particular, in its resolution of 5 May 2010 , the Parliament referred to the following requirements:

compliance with data protection legislation at national and European level, a privacy impact assessment prior to the adoption of any legislative instrument, a proportionality test demonstrating that existing legal instruments are not sufficient, strict purpose limitation and limitation of the use of PNR data to specific crimes or threats, on a case-by-case basis, limitation of the amount of data to be collected, limited retention periods, prohibition of data mining or profiling, prohibition of automated decisions significantly affecting citizens, appropriate mechanisms for independent review, judicial oversight and democratic control, all international transfers should comply with EU data protection standards and be subject to an adequacy finding.

The present agreement must be considered in the context of the global approach to PNR, which includes negotiations with other third countries (namely Australia and Canada, and a proposal for a PNR scheme at the EU level. It also falls within the scope of the current negotiations for an agreement between the EU and the US on the exchange of personal data in the framework of police and judicial cooperation in criminal matters. In a wider context, the agreement has been initialled a few weeks before the expected adoption of the proposals for the review of the general data protection framework.

Main observations:

The EDPS welcomes the safeguards on data security and oversight provided for in the agreement and the improvement compared with the 2007 agreement. Nevertheless, various concerns persist, particularly as regards:

the consistency of the overall approach to the question of PNR data, the purpose limitation, the list of data to be transferred to the DHS, the processing of sensitive information, the exceptions to the “push” method, the rights of persons concerned and subsequent transfers of the data.

Consistency of the approach : while this agreement includes some improvements in comparison with the 2007 agreement, and includes adequate safeguards on data security and oversight, none of the main concerns expressed in the European Parliament’s resolution were met.

Purpose : although the definitions are more precise than in the 2007 agreement, there are still some vague concepts and exceptions that could override the purpose limitation and undermine legal certainty. In particular, the EDPS mentions:

the lack of precision in the list ‘other crimes that are punishable by a sentence of imprisonment of three years of more’ as this threshold includes different crimes in the EU and the US and in the different EU Member States and US States; moreover, minor offences should be explicitly excluded from the purpose of the agreement; the concept of ‘serious threat’ should be defined and the use of PNR data where ‘ordered by a court’ should be limited to very specific cases.

List of PNR data to be transferred : this list should be narrowed: Annex I of the agreement contains 19 types of data that will be sent to the US. While assessing the proportionality of the list, it should also be taken into account that, due to advanced transmission, these categories will refer not only to actual passengers but also to those individuals who do not finally fly (e.g. due to cancellations). This is why the EDPS considers that data should be limited to the following information:

PNR record locator code, date of reservation, date(s) of intended travel, passenger name, other names on PNR, all travel itinerary, identifiers for free tickets, one-way tickets, ticketing field information, ATFQ (Automatic Ticket Fare Quote) data, ticket number, date of ticket issuance, no show history, number of bags, bag tag numbers, go show information, number of bags on each segment, voluntary/involuntary upgrades, historical changes to PNR data.

DHS should not process sensitive data: Article 6 of the agreement states that the DHS shall automatically filter and ‘mask out’ sensitive data. However, sensitive data will be stored at least 30 days and might be used in specific cases. The EDPS would stress that even after being ‘masked out’, these data will still be ‘sensitive’ and relate to identifiable natural persons and should therefore not be processed by the DHS .

The data retention period : Article 8 states that PNR data will be retained for up to five years in an active database and then transferred to a dormant database and stored for up to 10 years . This maximum retention period of 15 years is clearly disproportionate, irrespective of whether the data are kept in ‘active’ or ‘dormant’ databases.

Use of the ‘push’ method and frequency of the transfers : the EDPS welcomes Article 15(1), which states that data will be transferred using the ‘push’ method. However, Article 15(5) requires carriers to ‘provide access’ to PNR data in exceptional circumstances . In order to definitively preclude the use of the ‘pull’ system, the EDPS strongly advises that the agreement expressly prohibits the possibility for US officials to separately access the data via a ‘pull’ system.

Data security : although the EDPS welcomes Article 5 of the agreement on data security and integrity, certain aspects are problematic and, in particular, the recipients of the notification, who should be specified. The EDPS strongly supports the right to redress ‘regardless of nationality, country of origin, or place of residence’ laid down in Article 14(1), second subparagraph. However, he regrets that Article 21 explicitly states that the agreement ‘shall not create or confer, under US law, any right or benefit on any person’. Even if a right to ‘judicial review’ is granted in the US under the agreement, such right may not be equivalent to the right to effective judicial redress in the EU, in particular in the light of the restriction stated in Article 21.

Onward national and international transfers : the agreement prohibits the transfer of the data to domestic authorities that do not afford to PNR ‘equivalent or comparable’ safeguards to those set forth in this agreement. The EDPS welcomes this provision. The list of authorities that might receive PNR data should however be further specified.

As regards international transfers, the agreement provides that they should only take place if the recipient's intended use is consistent with this agreement and adduces privacy safeguards ‘comparable’ to the ones provided in the agreement, except in emergency circumstances.

With regard to the wording ‘comparable’ or ‘equivalent’ used in the agreement, the EDPS would like to emphasise that no domestic or international onward transfers by the DHS should take place unless the recipient adduces safeguards that are not less stringent than the ones established in this agreement. It should also be clarified in the agreement that the transfer of PNR data shall be done on a case-by-case basis, ensuring that only the necessary data will be transferred to the relevant recipients, and no exceptions should be allowed. In addition, the EDPS recommends that data transfers to third countries should be subject to prior judicial authorisation.

Article 17(4) states that when data of a resident of an EU Member State are transferred to a third country, the competent authorities of the Member State concerned should be informed in cases where the DHS is aware of this situation. This condition should be deleted, as the DHS should always be aware of onward transfers to third countries.

Form and review of the agreement : lastly, the EDPS considers that the legal form chosen by the US for entering into this agreement and how this agreement will become legally binding in the US should be clarified. The agreement should also be reviewed in view of the new data protection framework and of the possible conclusion of a general agreement between the EU and the US on the exchange of personal data in the framework of police and judicial cooperation in criminal matters. A new provision should be added to this effect.

OJ C 035 09.02.2012, p. 0016
N7-0046/2012

PURPOSE: to conclude the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security.

PROPOSED ACT: Council Decision.

BACKGROUND: on 2 December 2010, the Council adopted a decision, together with negotiation directives, authorising the Commission to open negotiations between the Union and the United States of America on the transfer and use of Passenger Name Records (PNR) to prevent and combat terrorism and other serious transnational crime.

In accordance with a Council Decision, the Agreement between the US and the EU on the use and transfer of Passenger Name Records to the United States Department of Homeland Security was signed, subject to its conclusion.

It is now appropriate to approve this Agreement on behalf of the EU.

IMPACT ASSESSMENT: no impact assessment was carried out.

LEGAL BASE: Articles 82(1)(d) and 87(2)(a), in conjunction with Article 218(6)(a) of the Treaty on the Functioning of the European Union (TFEU).

CONTENT: under this Decision, the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security is hereby approved on behalf of the Union.

For further details as regards the content of the Agreement, please refer to the initial legislative proposal dated 23/11/2011.

Territorial provisions : in accordance with Article 3 of the Protocol (No 21) on the Position of the United Kingdom and Ireland, those Member States have notified their wish to take part in the adoption and application of this Decision. On the other hand, Denmark has decided not to take part in the adoption of this Decision and is not bound by the Agreement or subject to its application.

BUDGET IMPLICATION: this proposal has no implication for the EU budget.

17433/2011

17434/2011

PURPOSE: to conclude the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security.

PROPOSED ACT: Council Decision.

BACKGROUND: on 2 December 2010, the Council adopted a decision, together with negotiation directives, authorising the Commission to open negotiations between the Union and the United States of America on the transfer and use of Passenger Name Records (PNR) to prevent and combat terrorism and other serious transnational crime.

In accordance with a Council Decision, the Agreement between the US and the EU on the use and transfer of Passenger Name Records to the United States Department of Homeland Security was signed, subject to its conclusion.

It is now appropriate to approve this Agreement on behalf of the EU.

IMPACT ASSESSMENT: no impact assessment was carried out.

LEGAL BASE: Articles 82(1)(d) and 87(2)(a), in conjunction with Article 218(6)(a) of the Treaty on the Functioning of the European Union (TFEU).

CONTENT: under this Decision, the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security is hereby approved on behalf of the Union.

For further details as regards the content of the Agreement, please refer to the initial legislative proposal dated 23/11/2011.

Territorial provisions : in accordance with Article 3 of the Protocol (No 21) on the Position of the United Kingdom and Ireland, those Member States have notified their wish to take part in the adoption and application of this Decision. On the other hand, Denmark has decided not to take part in the adoption of this Decision and is not bound by the Agreement or subject to its application.

BUDGET IMPLICATION: this proposal has no implication for the EU budget.

17433/2011

PURPOSE: to conclude an Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records (PNR data) to the United States Department of Homeland Security.

PROPOSED ACT: Council Decision.

BACKGROUND: U.S. legislation empowers the Department of Homeland Security (DHS) to require each air carrier operating passenger flights to and from the U.S., to provide it with electronic access to Passenger Name Record (PNR) data prior to the passenger arriving or leaving the U.S. The requirements of the U.S. authorities are based on title 49, United States Code, section 44909c and its implementing regulations (title 19, Code of federal regulations, section 122.49b).

This legislation aims at obtaining PNR data electronically in advance of a flight's arrival and therefore significantly enhances DHS ability to conduct efficient and effective advance risk assessment of passengers and to facilitate bona fide travel, thereby enhancing the security of the U.S. The Agreement will also foster international police and judicial cooperation through the transfer of analytical information flowing from PNR data by the U.S. to the competent

Member States authorities as well as Europol and Eurojust within their respective competences.

The European Union signed an agreement in 2007 with the United States on the transfer and processing of PNR data based on a set of commitments by DHS in relation to the application of its PNR programme

Following the entry into force of the Lisbon Treaty and pending the conclusion of the agreement, the Council sent the 2007 U.S. Agreement to the European Parliament for its consent for the conclusion. The European Parliament adopted a resolution in which it decided to postpone its vote on the requested consent and requesting a renegotiation of the Agreement on the basis of certain criteria. ( RSP/2010/2657 ). Pending such renegotiation, the 2007 Agreement would remain provisionally applicable.

On 21 September 2010, the Council received a recommendation from the Commission to authorise the opening of negotiations for an Agreement between the European Union and the United States of America for the use and transfer of Passenger Name Record (PNR) data to prevent and combat terrorism and other serious transnational crime. On 11 November 2010, the European Parliament adopted a resolution on the Recommendation from the Commission to the Council to authorise the opening of the negotiations.

On 2 December 2010, the Council adopted a Decision, together with a negotiation directive, authorising the Commission to open negotiations on behalf of the European Union. Following negotiations between the parties, the Agreement was initialled on 17 November 2011.

It is proposed to conclude the Agreement on behalf of the European Union.

IMPACT ASSESSMENT: no impact assessment has been undertaken.

LEGAL BASIS: Articles 82(1)(d) and 87(2)(a), in conjunction with Article 218(6)(a) TFEU.

CONTENT: this proposal aims to conclude the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security on behalf of the European Union.

Main principles of PNR Agreement : to recall, PNR is a record of each passenger's travel requirements which contains all information necessary to enable reservations to be processed and controlled by air carriers. Air carriers are under an obligation to provide the DHS with access to certain PNR data contained in the air carrier's automated reservation and departure control systems. However, The data protection laws of the EU do not allow European and other carriers operating flights from the EU to transmit the PNR data of their passengers to third countries which do not ensure an adequate level of protection of personal data without adducing appropriate safeguards. A solution is required that will provide the legal basis for the transfer of PNR data from the EU to the U.S. as a recognition of the necessity and importance of the use of PNR data in the fight against terrorism and other serious transnational crime, whilst avoiding legal uncertainty for air carriers. In addition, this solution should be applied homogenously throughout the European Union in order to ensure a legal certainty for air carriers and respect of individuals' rights to the protection of personal data as well as their physical security.

Safeguards : the Agreement has secured several important safeguards for those whose data will be transferred and used. In particular, the purpose of processing of PNR data is strictly limited to preventing, detecting, investigating and prosecuting terrorist offences and serious transnational crime . Individuals are provided with the right to access, correction, redress and information. The 'push' method of transfer is recognised as the standard mode of transfer, with which all carriers will need to comply within 2 years of the Agreement. Sensitive data is to be used in very exceptional cases and deleted after a very short timeframe.

Duration of data retention : the retention period of the PNR data is limited and PNR will be used for a shorter period in the fight against serious transnational crime and a longer one for terrorism. In addition, the data will be depersonalised after aperiod of 6 months.

Monitoring compliance : compliance with these rules shall be subject to independent review and oversight by various Department Privacy Officers, as well as by the DHS Office of Inspector General, the Government Accountability Office and the U.S. Congress. Respect for fundamental rights: the Agreement respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, notably the right to private and family life, the right to the protection of personal data, and the right to effective remedy and fair trial recognised by the Charter.

Territorial provisions : the United Kingdom and Ireland are taking part in the adoption of this Decision, but Denmark is not taking part in the adoption of this Decision and is not bound by the Agreement or subject to its application.

BUDGETARY IMPLICATIONS: the proposal has no implications for the EU budget.

COM(2011)0807
EUR-Lex