The European Court of Justice has held today that the agreement between the Commission and the USA was unlawful

Following the terrorist attacks of 11 September 2001, the United States passed legislation in November 2001 providing that air carriers operating flights to or from the United States or across United States territory had to provide the United States customs authorities with electronic access to the data contained in their automated reservation and departure control systems, referred to as ’Passenger Name Records’ (hereinafter ’PNR data’). While acknowledging the legitimacy of the security interests at stake, the Commission informed the United States authorities, in June 2002, that those provisions could come into conflict with Community and Member State legislation on data protection and with certain provisions of Council Regulation (EEC) No 2299/89 of 24 July 1989 on a code of conduct for computerised reservation systems (OJ 1989 L 220, p. 1), as amended by Council Regulation (EC) No 323/1999 of 8 February 1999 (OJ 1999 L 40, p. 1). The United States authorities postponed the entry into force of the new provisions but, ultimately, refused to waive the right to impose penalties on airlines failing to comply with the legislation on electronic access to PNR data after 5 March 2003. Since then, a number of large airlines in the European Union have granted the United States authorities access to their PNR data.

The European Commission presented an opinion that US data protection law was adequate for the purposes of the EU directive and so PNR could be passed to the US authorities. The European Parliament sought the annulment of Council Decision 2004/496/EC of 17 May 2004 on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection

The European Court of Justice found in favour of the Parliament but on a very narrow ground: that the processing of the data does not fall within the ambit of the Directive which covers commercial transactions while PNR data processing is covered by the security exception. This is not a ’good’ result for protection of personal data as the result is that EU commercial and civil law does not cover the field. It seems from the judgment that the Council would be able to adopt the PNR legislation under the Third Pillar as the ECJ finds it is about criminal law (though possible there is a Second Pillar aspect).

Source : http://curia.eu.int/jurisp/