Legislative Observatory
European Parliament
Please fill in this field to find a procedure

EU/Australia agreement: processing and transfer of passenger name record (PNR) data by air carriers to the Australian Customs and Border Protection Service

2011/0126(NLE)

The Committee on Civil Liberties, Justice and Home Affairs adopted the report drafted by Sophia in 't VELD (ADLE, NL) in which it recommends the European Parliament to give its consent to the conclusion of the Agreement between the European Union and Australia on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Australian Customs and Border Protection Service.

The report recalls that third countries are sovereign states that determine the requirements for persons to enter their country. Therefore, the European Union cannot ban the collection, storage and use of PNR data by third countries. The EU only gets to decide whether the conditions for the transfer of those data are in line with EU data protection standards. It must be borne in mind that third countries are sovereign states that determine the requirements for persons to enter their country. Therefore, the European Union cannot ban the collection, storage and use of PNR data by third countries. The European Union only gets to decide whether the conditions for the transfer of those data are in line with EU data protection standards. In the absence of an agreement, third countries will continue to collect and store PNR data of European citizens.

On 5 May 2010 and 11 November 2010, the European Parliament set out its criteria for giving its consent to agreements with third countries on the transfer of PNR data.

These criteria were:

  • the necessity for mass collection and storage of PNR data must be demonstrated, supported by factual evidence for each of the stated purposes;
  • the proportionality (i.e. that the same end cannot be achieved with less intrusive means) must be demonstrated;
  • the purpose must be limited clearly and strictly on the basis of clear legal definitions based on definitions in Council Framework Decision 2002/475/JHA of 13 June 2002 on combating terrorism and in Council Framework Decision 2002/584/JHA of 13 June 2002 on the European Arrest Warrant);
  • the method of transfer must be only "push" (i.e., filtered data to be transmitted by airlines to the requesting authorities of third countries) instead of "pull" (whereby third countries have direct access to European databases);
  • PNR data shall in no circumstances be used for data mining or profiling;
  • the onward transfer of data by the recipient country to third countries must be in line with EU standards on data protection, to be established by a specific adequacy finding;
  • results must be immediately shared with the relevant authorities of the EU and of the Member States (reciprocity).

Although most of these criteria have been included in the negotiating mandate adopted by the Council, Parliament notes that a number of criteria have not been met in full, and that a number of concerns remain:

  • proportionality of the mass collection and storage of data: the European Commission has only partially and insufficiently demonstrated the necessity and proportionality of the mass collection and storage of data. No justification has been given for the long term storage of identifiable data of all travellers. The retention period of 5.5 years appears to be fairly random, and not based on specific evidence;
  • legal basis for this Agreement: the appropriate legal basis for the Agreement should be, in any case primarily, Art 16 TFEU (on data protection). However, it is not included in the legal base, but and only a general, non binding reference is included in the pre-amble. The purpose of the Agreement is to ensure that the transfer of data is in line with EU data protection standards. Therefore, the Agreement should not be based on Article 82(1)(d) and Article 87(2)(a), but on Article 16 TFEU. If the purpose were police-judicial cooperation, then the EU could theoretically decide against the collection of PNR data by Australia. But this is a sovereign decision by a third country. Therefore, it is not EU policy as it is not for the EU to decide. The chosen legal base is clearly not the correct one.