# Official Journal C 110/2008

| | ISSN 1725-2423 |
| --- | --- |
| Official Journal
  of the European Union | C 110 |
| | |
| English edition | Information and Notices | Volume 511 May 2008 |

ISSN 1725-2423

Official Journal

of the European Union

C 110

English edition

Information and Notices

Volume 511 May 2008

---

| Notice No | Contents | page |
| --- | --- | --- |
| | I   Resolutions, recommendations and opinions |
| | OPINIONS |
| | European Data Protection Supervisor |
| 2008/C 110/01 | Opinion of the European Data Protection Supervisor on the draft Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes | 1 |

Notice No

Contents

page

I   Resolutions, recommendations and opinions

OPINIONS

European Data Protection Supervisor

2008/C 110/01

Opinion of the European Data Protection Supervisor on the draft Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes

1

| | II   Information |
| --- | --- |
| | INFORMATION FROM EUROPEAN UNION INSTITUTIONS AND BODIES |
| | Commission |
| 2008/C 110/02 | Authorisation for State aid pursuant to Articles 87 and 88 of the EC Treaty — Cases where the Commission raises no objections | 16 |
| 2008/C 110/03 | Non-opposition to a notified concentration (Case COMP/M.5084 — PARE/Acea/JV) (
  1
  ) | 17 |
| 2008/C 110/04 | Non-opposition to a notified concentration (Case COMP/M.5104 — Altor Fund II/Papyrus) (
  1
  ) | 17 |
| 2008/C 110/05 | Non-opposition to a notified concentration (Case COMP/M.4784 — Suez Environnement/SITA) (
  1
  ) | 18 |
| 2008/C 110/06 | Non-opposition to a notified concentration (Case COMP/M.5092 — GDF/Suez/Teesside Power) (
  1
  ) | 18 |
| 2008/C 110/07 | Non-opposition to a notified concentration (Case COMP/M.5061 — Renault/Russian Technologies/AvtoVaz) (
  1
  ) | 19 |

II   Information

INFORMATION FROM EUROPEAN UNION INSTITUTIONS AND BODIES

Commission

2008/C 110/02

Authorisation for State aid pursuant to Articles 87 and 88 of the EC Treaty — Cases where the Commission raises no objections

16

2008/C 110/03

Non-opposition to a notified concentration (Case COMP/M.5084 — PARE/Acea/JV) (
  1
  )

1

17

2008/C 110/04

Non-opposition to a notified concentration (Case COMP/M.5104 — Altor Fund II/Papyrus) (
  1
  )

1

17

2008/C 110/05

Non-opposition to a notified concentration (Case COMP/M.4784 — Suez Environnement/SITA) (
  1
  )

1

18

2008/C 110/06

Non-opposition to a notified concentration (Case COMP/M.5092 — GDF/Suez/Teesside Power) (
  1
  )

1

18

2008/C 110/07

Non-opposition to a notified concentration (Case COMP/M.5061 — Renault/Russian Technologies/AvtoVaz) (
  1
  )

1

19

| | IV   Notices |
| --- | --- |
| | NOTICES FROM EUROPEAN UNION INSTITUTIONS AND BODIES |
| | Commission |
| 2008/C 110/08 | Euro exchange rates | 20 |
| | NOTICES FROM MEMBER STATES |
| 2008/C 110/09 | Information communicated by Member States regarding state aid granted under Commission Regulation (EC) No 70/2001 on the application of Articles 87 and 88 of the EC Treaty to state aid to small and medium-sized enterprises | 21 |
| 2008/C 110/10 | Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 1857/2006 on the application of Articles 87 and 88 of the EC Treaty to State aid to small and medium-sized enterprises active in the production of agricultural products and amending Regulation (EC) No 70/2001 | 22 |

IV   Notices

NOTICES FROM EUROPEAN UNION INSTITUTIONS AND BODIES

Commission

2008/C 110/08

Euro exchange rates

20

NOTICES FROM MEMBER STATES

2008/C 110/09

Information communicated by Member States regarding state aid granted under Commission Regulation (EC) No 70/2001 on the application of Articles 87 and 88 of the EC Treaty to state aid to small and medium-sized enterprises

21

2008/C 110/10

Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 1857/2006 on the application of Articles 87 and 88 of the EC Treaty to State aid to small and medium-sized enterprises active in the production of agricultural products and amending Regulation (EC) No 70/2001

22

| | V   Announcements |
| --- | --- |
| | ADMINISTRATIVE PROCEDURES |
| | Commission |
| 2008/C 110/11 | Call for proposals under the work programme of the Ambient Assisted Living (AAL) Joint Programme | 27 |
| | PROCEDURES RELATING TO THE IMPLEMENTATION OF THE COMMON COMMERCIAL POLICY |
| | Commission |
| 2008/C 110/12 | Notice concerning the anti-dumping measures in force in respect of imports into the Community of polyethylene terephthalate (PET) film originating in India: modification of the address of a company subject to an individual anti-dumping duty rate | 28 |
| 2008/C 110/13 | Planned closure of complaint 2005/4347 | 29 |

V   Announcements

ADMINISTRATIVE PROCEDURES

Commission

2008/C 110/11

Call for proposals under the work programme of the Ambient Assisted Living (AAL) Joint Programme

27

PROCEDURES RELATING TO THE IMPLEMENTATION OF THE COMMON COMMERCIAL POLICY

Commission

2008/C 110/12

Notice concerning the anti-dumping measures in force in respect of imports into the Community of polyethylene terephthalate (PET) film originating in India: modification of the address of a company subject to an individual anti-dumping duty rate

28

2008/C 110/13

Planned closure of complaint 2005/4347

29

| | |
| --- | --- |
| | (1)   Text with EEA relevance |

---

(1)   Text with EEA relevance

1

| EN | |
| --- | --- |

EN

---

I Resolutions, recommendations and opinions

OPINIONS

European Data Protection Supervisor

| 1.5.2008 | EN | Official Journal of the European Union | C 110/1 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/1

---

Opinion of the European Data Protection Supervisor on the draft Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes

(2008/C 110/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (2), and in particular its Article 41,

Having regard to the request for an opinion in accordance with Article 28(2) of Regulation (EC) No 45/2001 received on 13 November 2007 from the European Commission,

HAS ADOPTED THE FOLLOWING OPINION

I.   INTRODUCTION

Consultation of the EDPS

| 1. | The draft Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes was sent by the Commission to the EDPS for consultation, in accordance with Article 28(2) of Regulation No 45/2001/EC (hereinafter ‘the proposal’). |
| --- | --- |

1.

The draft Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes was sent by the Commission to the EDPS for consultation, in accordance with Article 28(2) of Regulation No 45/2001/EC (hereinafter ‘the proposal’).

| 2. | The proposal concerns the processing of PNR data within the EU and is closely related to other schemes of collection and use of passengers' data, in particular the EU-US agreement of July 2007. These schemes are of great interest to the EDPS, who already had the opportunity to send some preliminary comments on the Commission's questionnaire on the intended EU PNR system, sent in December 2006 to relevant stakeholders (3). The EDPS welcomes the consultation of the Commission. According to the EDPS, the present opinion should be mentioned in the preamble of the Council Decision. |
| --- | --- |

2.

The proposal concerns the processing of PNR data within the EU and is closely related to other schemes of collection and use of passengers' data, in particular the EU-US agreement of July 2007. These schemes are of great interest to the EDPS, who already had the opportunity to send some preliminary comments on the Commission's questionnaire on the intended EU PNR system, sent in December 2006 to relevant stakeholders (3). The EDPS welcomes the consultation of the Commission. According to the EDPS, the present opinion should be mentioned in the preamble of the Council Decision.

The proposal in its context

| 3. | The proposal intends to harmonise Member States' provisions on obligations for air carriers operating flights to or from the territory of at least one Member State regarding the transmission of PNR data to the competent authorities for the purpose of preventing and fighting terrorist offences and organised crime. |
| --- | --- |

3.

The proposal intends to harmonise Member States' provisions on obligations for air carriers operating flights to or from the territory of at least one Member State regarding the transmission of PNR data to the competent authorities for the purpose of preventing and fighting terrorist offences and organised crime.

| 4. | Arrangements for transmission of PNR data for comparable purposes have been concluded by the European Union with the USA, as well as with Canada. A first agreement concluded with the USA in May 2004 was replaced by a new agreement in July 2007 (4). A similar agreement was concluded with Canada in July 2005 (5). In addition, negotiations are due to start between the EU and Australia for an agreement on the exchange of PNR data, and South Korea is also requiring PNR data from flights to its territory, without any plan for negotiation at European level at this stage. |
| --- | --- |

4.

Arrangements for transmission of PNR data for comparable purposes have been concluded by the European Union with the USA, as well as with Canada. A first agreement concluded with the USA in May 2004 was replaced by a new agreement in July 2007 (4). A similar agreement was concluded with Canada in July 2005 (5). In addition, negotiations are due to start between the EU and Australia for an agreement on the exchange of PNR data, and South Korea is also requiring PNR data from flights to its territory, without any plan for negotiation at European level at this stage.

| 5. | Within the EU, the proposal comes as an addition to Council Directive 2004/82/EC (6) on the obligation of carriers to communicate passengers' data known as API data, in order to combat illegal immigration and improve border control. This directive should have been transposed in national law of Member States not later than 5 September 2006. Implementation is however not ensured yet in all Member States. |
| --- | --- |

5.

Within the EU, the proposal comes as an addition to Council Directive 2004/82/EC (6) on the obligation of carriers to communicate passengers' data known as API data, in order to combat illegal immigration and improve border control. This directive should have been transposed in national law of Member States not later than 5 September 2006. Implementation is however not ensured yet in all Member States.

| 6. | Contrary to Advanced Passenger Information (API) data that are supposed to help identifying individuals, PNR data mentioned in the proposal would contribute to carrying out risk assessments of persons, obtaining intelligence and making associations between known and unknown people. |
| --- | --- |

6.

Contrary to Advanced Passenger Information (API) data that are supposed to help identifying individuals, PNR data mentioned in the proposal would contribute to carrying out risk assessments of persons, obtaining intelligence and making associations between known and unknown people.

| 7. | The proposal includes the following main elements:






  — | It provides for the making available by air carriers of PNR data to the competent authorities of Member States, for the purpose of preventing and combating terrorist offences and organised crime. |
| --- | --- | --- |

7.

The proposal includes the following main elements:

—

It provides for the making available by air carriers of PNR data to the competent authorities of Member States, for the purpose of preventing and combating terrorist offences and organised crime.

| — | It foresees the designation of a Passenger Information Unit (PIU) in principle in each Member State, responsible for collecting the PNR data from air carriers (or designated intermediaries) and for carrying out a risk assessment of passengers. |
| --- | --- |

—

It foresees the designation of a Passenger Information Unit (PIU) in principle in each Member State, responsible for collecting the PNR data from air carriers (or designated intermediaries) and for carrying out a risk assessment of passengers.

| — | Information assessed accordingly will be transmitted to competent authorities in each Member State. This information will be exchanged with other Member States on a case by case basis and for the purpose indicated above. |
| --- | --- |

—

Information assessed accordingly will be transmitted to competent authorities in each Member State. This information will be exchanged with other Member States on a case by case basis and for the purpose indicated above.

| — | Transfer to countries outside the European Union is subject to additional conditions. |
| --- | --- |

—

Transfer to countries outside the European Union is subject to additional conditions.

| — | Data will be retained for thirteen years, eight of which in a dormant database. |
| --- | --- |

—

Data will be retained for thirteen years, eight of which in a dormant database.

| — | The processing is to be governed by the (draft) Council Framework decision on the Protection of Personal Data Processed in the Framework of Police and Judicial Cooperation in Criminal Matters (hereafter the ‘data protection framework decision’) (7). |
| --- | --- |

—

The processing is to be governed by the (draft) Council Framework decision on the Protection of Personal Data Processed in the Framework of Police and Judicial Cooperation in Criminal Matters (hereafter the ‘data protection framework decision’) (7).

| — | A Committee with representatives of Member States will assist the Commission with regard to protocol and encryption issues, as well as with regard to criteria and practice for risk assessment. |
| --- | --- |

—

A Committee with representatives of Member States will assist the Commission with regard to protocol and encryption issues, as well as with regard to criteria and practice for risk assessment.

| — | A review of the decision is to take place within three years after its entry into force. |
| --- | --- |

—

A review of the decision is to take place within three years after its entry into force.

Focus of the opinion

| 8. | The proposal on which the EDPS is consulted is a further step in a movement towards a routine collection of data of individuals who are in principle not suspected of any crime. As mentioned above, this evolution is taking place at international and European level. |
| --- | --- |

8.

The proposal on which the EDPS is consulted is a further step in a movement towards a routine collection of data of individuals who are in principle not suspected of any crime. As mentioned above, this evolution is taking place at international and European level.

| 9. | The EDPS notes that also the Article 29 Working Party and the Working Party on Police and Justice have presented a joint opinion on the proposal (8). The EDPS supports that opinion. The present opinion emphasises and develops a number of additional points. |
| --- | --- |

9.

The EDPS notes that also the Article 29 Working Party and the Working Party on Police and Justice have presented a joint opinion on the proposal (8). The EDPS supports that opinion. The present opinion emphasises and develops a number of additional points.

| 10. | While the opinion of the EDPS will analyse all relevant aspects of the proposal, it will concentrate on four main issues.






  — | The first of these issues is the legitimacy of the intended measures. The question of the purpose, necessity and proportionality of the proposal will be assessed against the criteria of Article 8 of the Charter of Fundamental Rights of the European Union. |
| --- | --- | --- |

10.

While the opinion of the EDPS will analyse all relevant aspects of the proposal, it will concentrate on four main issues.

—

The first of these issues is the legitimacy of the intended measures. The question of the purpose, necessity and proportionality of the proposal will be assessed against the criteria of Article 8 of the Charter of Fundamental Rights of the European Union.

| — | The opinion will also analyse the question of the law applicable to the proposed processing operation. In particular, the scope of application of the data protection framework decision in relation to the application of first pillar data protection legislation deserves specific attention. The consequence of the applicable data protection regime with regard to the exercise of data subject's rights will also be questioned. |
| --- | --- |

—

The opinion will also analyse the question of the law applicable to the proposed processing operation. In particular, the scope of application of the data protection framework decision in relation to the application of first pillar data protection legislation deserves specific attention. The consequence of the applicable data protection regime with regard to the exercise of data subject's rights will also be questioned.

| — | The opinion will then focus on the quality of recipients of data at national level. In particular, the quality of PIUs, of intermediaries and of competent authorities designated to perform risk assessment and analyse passenger data raises specific concerns as no precision is given in the proposal in this respect. |
| --- | --- |

—

The opinion will then focus on the quality of recipients of data at national level. In particular, the quality of PIUs, of intermediaries and of competent authorities designated to perform risk assessment and analyse passenger data raises specific concerns as no precision is given in the proposal in this respect.

| — | The fourth issue relates to the conditions of transfer of data to third countries. It is not clear what conditions will apply to such transfers where different sets of rules exist: the conditions of transfer under the present proposal, together with those of the data protection framework decision, and the existing international agreements (with the USA and Canada). |
| --- | --- |

—

The fourth issue relates to the conditions of transfer of data to third countries. It is not clear what conditions will apply to such transfers where different sets of rules exist: the conditions of transfer under the present proposal, together with those of the data protection framework decision, and the existing international agreements (with the USA and Canada).

| 11. | Other substantive points will be identified in a last part, including positive steps in terms of data protection but also additional sources of concern in the proposal. |
| --- | --- |

11.

Other substantive points will be identified in a last part, including positive steps in terms of data protection but also additional sources of concern in the proposal.

II.   LEGITIMACY OF THE PROPOSED MEASURES

| 12. | In order to analyse the legitimacy of the proposed measures in accordance with fundamental data protection principles, and notably Article 8 of the European Charter of Fundamental Rights and Articles 5 to 8 of Council of Europe Convention No 108 (9), it is necessary to identify clearly the purpose of the intended processing of personal data, to assess its necessity and its proportionality. It should be ensured that no other means is available, that would be less invasive, to reach the envisaged purpose. |
| --- | --- |

12.

In order to analyse the legitimacy of the proposed measures in accordance with fundamental data protection principles, and notably Article 8 of the European Charter of Fundamental Rights and Articles 5 to 8 of Council of Europe Convention No 108 (9), it is necessary to identify clearly the purpose of the intended processing of personal data, to assess its necessity and its proportionality. It should be ensured that no other means is available, that would be less invasive, to reach the envisaged purpose.

Identification of purpose

| 13. | The wording of the proposal and its impact assessment indicate that the objective is not simply to identify known terrorists or known criminals involved in organised crime, by comparing their names with those included in lists managed by law enforcement authorities. The purpose is to gather intelligence with regard to terrorism or organised crime, and more precisely ‘to carry out risk assessment of persons, obtain intelligence and make association between known and unknown people’ (10). The purpose stated in Article 3(5) of the proposal is, in the same line and firstly, ‘to identify persons who are or may be involved in a terrorist or organised crime offence, as well as their associates.’ |
| --- | --- |

13.

The wording of the proposal and its impact assessment indicate that the objective is not simply to identify known terrorists or known criminals involved in organised crime, by comparing their names with those included in lists managed by law enforcement authorities. The purpose is to gather intelligence with regard to terrorism or organised crime, and more precisely ‘to carry out risk assessment of persons, obtain intelligence and make association between known and unknown people’ (10). The purpose stated in Article 3(5) of the proposal is, in the same line and firstly, ‘to identify persons who are or may be involved in a terrorist or organised crime offence, as well as their associates.’

| 14. | This is the reason invoked to explain that API data are not sufficient to reach the alleged purpose. Indeed, as already mentioned, while API data are supposed to help identifying individuals, PNR data do not have an identification purpose, but the details of the PNR would contribute to carrying out risk assessments of the persons, obtaining intelligence and making associations between known and unknown people. |
| --- | --- |

14.

This is the reason invoked to explain that API data are not sufficient to reach the alleged purpose. Indeed, as already mentioned, while API data are supposed to help identifying individuals, PNR data do not have an identification purpose, but the details of the PNR would contribute to carrying out risk assessments of the persons, obtaining intelligence and making associations between known and unknown people.

| 15. | The purpose of the measures envisaged does not only cover the catching of known persons but also the locating of persons that may fall within the criteria of the proposal.
  In order to identify these persons, risk analysis and identification of patterns are at the core of the project. Recital 9 of the proposal states explicitly that data must be kept ‘for a sufficiently long period as to fulfil the purpose of developing risk indicators and establishing patterns of travel and behaviour’. |
| --- | --- |

15.

The purpose of the measures envisaged does not only cover the catching of known persons but also the locating of persons that may fall within the criteria of the proposal.

In order to identify these persons, risk analysis and identification of patterns are at the core of the project. Recital 9 of the proposal states explicitly that data must be kept ‘for a sufficiently long period as to fulfil the purpose of developing risk indicators and establishing patterns of travel and behaviour’.

| 16. | The purpose is thus described in two layers: the first layer consists of the global objective to fight against terrorism and organised crime, while the second layer includes the means and measures inherent to the achievement of this objective. While the purpose of fighting terrorism and organised crime appears to be clear enough and legitimate, the means used to reach this purpose leave room for discussion. |
| --- | --- |

16.

The purpose is thus described in two layers: the first layer consists of the global objective to fight against terrorism and organised crime, while the second layer includes the means and measures inherent to the achievement of this objective. While the purpose of fighting terrorism and organised crime appears to be clear enough and legitimate, the means used to reach this purpose leave room for discussion.

Establishing patterns and risk assessment

| 17. | The proposal gives no indication on the way patterns will be established and risk assessment will be performed. The impact assessment gives the following precision as to the way PNR data will be used: to run the data of passengers ‘against a combination of characteristics and behavioural patterns, aimed at creating a risk-assessment. When a passenger fits within a certain risk-assessment, then he could be identified as a high-risk passenger’ (11). |
| --- | --- |

17.

The proposal gives no indication on the way patterns will be established and risk assessment will be performed. The impact assessment gives the following precision as to the way PNR data will be used: to run the data of passengers ‘against a combination of characteristics and behavioural patterns, aimed at creating a risk-assessment. When a passenger fits within a certain risk-assessment, then he could be identified as a high-risk passenger’ (11).

| 18. | Suspected persons could be selected according to concrete elements of suspicion included in their PNR data (e.g. contact with a suspicious travel agency, reference of a stolen credit card), as well as on the basis of ‘patterns’ or an abstract profile. Different standard profiles could indeed be constituted on the basis of travel patterns, for ‘normal passengers’ or ‘suspicious passengers’. These profiles would enable investigating further those passengers who do not fall within the ‘normal passenger category’, all the more so if their profile is associated with other suspicious elements such as a stolen credit card. |
| --- | --- |

18.

Suspected persons could be selected according to concrete elements of suspicion included in their PNR data (e.g. contact with a suspicious travel agency, reference of a stolen credit card), as well as on the basis of ‘patterns’ or an abstract profile. Different standard profiles could indeed be constituted on the basis of travel patterns, for ‘normal passengers’ or ‘suspicious passengers’. These profiles would enable investigating further those passengers who do not fall within the ‘normal passenger category’, all the more so if their profile is associated with other suspicious elements such as a stolen credit card.

| 19. | Although it cannot be assumed that passengers would be targeted according to their religion or other sensitive data, it appears nevertheless that they would be subject to investigation on the basis of a mix of in concreto and in abstracto information, including standard patterns and abstract profiles. |
| --- | --- |

19.

Although it cannot be assumed that passengers would be targeted according to their religion or other sensitive data, it appears nevertheless that they would be subject to investigation on the basis of a mix of in concreto and in abstracto information, including standard patterns and abstract profiles.

| 20. | One could discuss whether this type of investigation would qualify as profiling. Profiling would consist of a ‘computer method making use of data mining on a data warehouse, enabling or intended to enable the classification, with some probability — and thus with some margin of error — of an individual in a specific category in order to take individual decisions towards that person’ (12). |
| --- | --- |

20.

One could discuss whether this type of investigation would qualify as profiling. Profiling would consist of a ‘computer method making use of data mining on a data warehouse, enabling or intended to enable the classification, with some probability — and thus with some margin of error — of an individual in a specific category in order to take individual decisions towards that person’ (12).

| 21. | The EDPS is aware that there are ongoing discussions on the definition of profiling. Whether or not it is officially recognised that the proposal aims at profiling passengers, the main point at stake is not about definitions. It is about the impact on individuals. |
| --- | --- |

21.

The EDPS is aware that there are ongoing discussions on the definition of profiling. Whether or not it is officially recognised that the proposal aims at profiling passengers, the main point at stake is not about definitions. It is about the impact on individuals.

| 22. | The main concern of the EDPS relates to the fact that decisions on individuals will be taken on the basis of patterns and criteria established using the data of passengers in general. Thus decisions on one individual might be taken, using as a reference (at least partially), patterns derived from the data of other individuals. It is thus in relation to an abstract context that decisions will be taken, which can greatly affect data subjects. It is extremely difficult for individuals to defend themselves against such decisions. |
| --- | --- |

22.

The main concern of the EDPS relates to the fact that decisions on individuals will be taken on the basis of patterns and criteria established using the data of passengers in general. Thus decisions on one individual might be taken, using as a reference (at least partially), patterns derived from the data of other individuals. It is thus in relation to an abstract context that decisions will be taken, which can greatly affect data subjects. It is extremely difficult for individuals to defend themselves against such decisions.

| 23. | In addition, the risk assessment is to be performed in absence of uniform standards of identification of suspects. The EDPS seriously questions the legal certainty of the whole filtering process, considering that the criteria against which every passenger will be scanned are so poorly defined. |
| --- | --- |

23.

In addition, the risk assessment is to be performed in absence of uniform standards of identification of suspects. The EDPS seriously questions the legal certainty of the whole filtering process, considering that the criteria against which every passenger will be scanned are so poorly defined.

| 24. | The EDPS recalls the jurisprudence of the European Court of Human Rights, according to which domestic law must be sufficiently precise to indicate to citizens in what circumstances and on what terms the public authorities are empowered to file information on their private life and make use of it. The information ‘should be accessible to the person concerned and foreseeable as to its effects’. A rule is ‘foreseeable’‘if it is formulated with sufficient precision to enable any individual — if need be with appropriate advice — to regulate his conduct’ (13). |
| --- | --- |

24.

The EDPS recalls the jurisprudence of the European Court of Human Rights, according to which domestic law must be sufficiently precise to indicate to citizens in what circumstances and on what terms the public authorities are empowered to file information on their private life and make use of it. The information ‘should be accessible to the person concerned and foreseeable as to its effects’. A rule is ‘foreseeable’‘if it is formulated with sufficient precision to enable any individual — if need be with appropriate advice — to regulate his conduct’ (13).

| 25. | To conclude, it is notably because of these types of risks, that the present proposal needs careful consideration. While the general purpose to fight against terrorism and organised crime is in itself clear and legitimate, the core of the processing to be put in place does not appear to be sufficiently circumscribed and justified. The EDPS therefore urges the EU-legislator to clearly address this issue, before adoption of the Framework Decision. |
| --- | --- |

25.

To conclude, it is notably because of these types of risks, that the present proposal needs careful consideration. While the general purpose to fight against terrorism and organised crime is in itself clear and legitimate, the core of the processing to be put in place does not appear to be sufficiently circumscribed and justified. The EDPS therefore urges the EU-legislator to clearly address this issue, before adoption of the Framework Decision.

Necessity

| 26. | The intrusive character of the measures is evident, as shown above. On the other hand, their utility is far from being demonstrated. |
| --- | --- |

26.

The intrusive character of the measures is evident, as shown above. On the other hand, their utility is far from being demonstrated.

| 27. | The impact assessment on the proposal concentrates on the best way to establish an EU PNR, more than on the necessity of such PNR. Reference is made in the assessment (14) to PNR systems in place in other countries, namely the USA and the United Kingdom. One can however deplore the lack of precise facts and figures related to those systems. ‘Numerous arrests’ are reported with regard to ‘various crimes’ in the UK semaphore system, without precision as to the link with terrorism or organised crime. No details are given with regard to the US programme, except that ‘the EU has been able to assess the value of PNR data and to realise its potential for law enforcement purposes’. |
| --- | --- |

27.

The impact assessment on the proposal concentrates on the best way to establish an EU PNR, more than on the necessity of such PNR. Reference is made in the assessment (14) to PNR systems in place in other countries, namely the USA and the United Kingdom. One can however deplore the lack of precise facts and figures related to those systems. ‘Numerous arrests’ are reported with regard to ‘various crimes’ in the UK semaphore system, without precision as to the link with terrorism or organised crime. No details are given with regard to the US programme, except that ‘the EU has been able to assess the value of PNR data and to realise its potential for law enforcement purposes’.

| 28. | Not only is there a lack of precise information in the proposal on the concrete results of such PNR systems, but reports published by other agencies, e.g. the GAO in the United States, do not confirm at this stage the efficiency of the measures (15). |
| --- | --- |

28.

Not only is there a lack of precise information in the proposal on the concrete results of such PNR systems, but reports published by other agencies, e.g. the GAO in the United States, do not confirm at this stage the efficiency of the measures (15).

| 29. | The EDPS considers that techniques consisting of assessing the risk presented by individuals using data mining tools and behavioural patterns need to be further assessed, and their utility be clearly established in the framework of the fight against terrorism, before they are used on such a wide scale. |
| --- | --- |

29.

The EDPS considers that techniques consisting of assessing the risk presented by individuals using data mining tools and behavioural patterns need to be further assessed, and their utility be clearly established in the framework of the fight against terrorism, before they are used on such a wide scale.

Proportionality

| 30. | In order to appreciate the balance between the intrusion in the privacy of the individual and the necessity of the measure (16), the following elements are taken into account:






  — | The measures apply to all passengers, be they under investigation or not by law enforcement authorities. It constitutes proactive research, on an unprecedented scale. |
| --- | --- | --- |

30.

In order to appreciate the balance between the intrusion in the privacy of the individual and the necessity of the measure (16), the following elements are taken into account:

—

The measures apply to all passengers, be they under investigation or not by law enforcement authorities. It constitutes proactive research, on an unprecedented scale.

| — | Decisions on individuals can be based on abstract profiles, thus including a significant margin of error. |
| --- | --- |

—

Decisions on individuals can be based on abstract profiles, thus including a significant margin of error.

| — | The nature of the measures to be taken against the individual relate to law enforcement: the consequences in terms of exclusion or coercion are therefore much more intrusive than in other contexts, like credit card fraud or marketing. |
| --- | --- |

—

The nature of the measures to be taken against the individual relate to law enforcement: the consequences in terms of exclusion or coercion are therefore much more intrusive than in other contexts, like credit card fraud or marketing.

| 31. | Compliance with the proportionality principle implies not only that the proposed measure is effective, but also that the purpose envisaged by the proposal can not be reached using the less privacy invasive tools. The effectiveness of the intended measures has not been demonstrated. The existence of alternatives must be carefully assessed before additional/new measures are put in place to process personal information. According to the EDPS, such comprehensive assessment has not taken place. |
| --- | --- |

31.

Compliance with the proportionality principle implies not only that the proposed measure is effective, but also that the purpose envisaged by the proposal can not be reached using the less privacy invasive tools. The effectiveness of the intended measures has not been demonstrated. The existence of alternatives must be carefully assessed before additional/new measures are put in place to process personal information. According to the EDPS, such comprehensive assessment has not taken place.

| 32. | The EDPS wishes to recall the other large scale systems monitoring the movements of individuals within or at the borders of the EU, whether in operation or about to be implemented, including in particular the Visa Information System (17) and the Schengen Information System (18). While these instruments do not have as a main goal the fight against terrorism or organised crime, they are or will be to some extent accessible to law enforcement authorities for the broader scope of the fight against crime (19). |
| --- | --- |

32.

The EDPS wishes to recall the other large scale systems monitoring the movements of individuals within or at the borders of the EU, whether in operation or about to be implemented, including in particular the Visa Information System (17) and the Schengen Information System (18). While these instruments do not have as a main goal the fight against terrorism or organised crime, they are or will be to some extent accessible to law enforcement authorities for the broader scope of the fight against crime (19).

| 33. | Another example concerns the availability of personal data included in national police data bases — especially with regard to biometric information — in the framework of the Prüm Treaty signed in May 2005, that is being extended to all Member states of the European Union (20). |
| --- | --- |

33.

Another example concerns the availability of personal data included in national police data bases — especially with regard to biometric information — in the framework of the Prüm Treaty signed in May 2005, that is being extended to all Member states of the European Union (20).

| 34. | These different instruments all have in common that they enable a global monitoring of movements of individuals, even if from different perspectives. The way in which they can already contribute to the fight against specific forms of crimes, including terrorism, should be subject to in-depth and comprehensive analysis, before deciding to establish a new form of systematic scanning of all persons leaving or entering the EU by plane. The EDPS recommends that the Commission conducts such an analysis, as a necessary step in the legislative procedure. |
| --- | --- |

34.

These different instruments all have in common that they enable a global monitoring of movements of individuals, even if from different perspectives. The way in which they can already contribute to the fight against specific forms of crimes, including terrorism, should be subject to in-depth and comprehensive analysis, before deciding to establish a new form of systematic scanning of all persons leaving or entering the EU by plane. The EDPS recommends that the Commission conducts such an analysis, as a necessary step in the legislative procedure.

Conclusion

| 35. | In the light of the foregoing, the EDPS concludes as follows on the legitimacy of the proposed measures. Building upon different data bases without a global view on the concrete results and shortcomings:






  — | Is contrary to a rational legislative policy in which new instruments must not be adopted before those existing have been fully implemented and proved to be insufficient (21). |
| --- | --- | --- |

35.

In the light of the foregoing, the EDPS concludes as follows on the legitimacy of the proposed measures. Building upon different data bases without a global view on the concrete results and shortcomings:

—

Is contrary to a rational legislative policy in which new instruments must not be adopted before those existing have been fully implemented and proved to be insufficient (21).

| — | Might otherwise lead to a move towards a total surveillance society. |
| --- | --- |

—

Might otherwise lead to a move towards a total surveillance society.

| 36. | The fight against terrorism can certainly be a legitimate ground to apply exceptions to the fundamental rights to privacy and data protection. However, to be valid, the necessity of the intrusion must be supported by clear and undeniable elements, and the proportionality of the processing must be demonstrated. This is all the more required in case of extensive intrusion in the privacy of individuals, as foreseen in the proposal. |
| --- | --- |

36.

The fight against terrorism can certainly be a legitimate ground to apply exceptions to the fundamental rights to privacy and data protection. However, to be valid, the necessity of the intrusion must be supported by clear and undeniable elements, and the proportionality of the processing must be demonstrated. This is all the more required in case of extensive intrusion in the privacy of individuals, as foreseen in the proposal.

| 37. | It can only be noted that such elements of justification are missing in the proposal and that the necessity and proportionality tests are not fulfilled. |
| --- | --- |

37.

It can only be noted that such elements of justification are missing in the proposal and that the necessity and proportionality tests are not fulfilled.

| 38. | The EDPS insists on the essential character of the necessity and proportionality tests developed above. They represent a condicio sine qua non to the entry into force of the present proposal. Any further comment of the EDPS in the present opinion must be taken in the light of this preliminary condition. |
| --- | --- |

38.

The EDPS insists on the essential character of the necessity and proportionality tests developed above. They represent a condicio sine qua non to the entry into force of the present proposal. Any further comment of the EDPS in the present opinion must be taken in the light of this preliminary condition.

III.   APPLICABLE LAW — EXERCISE OF DATA SUBJECT'S RIGHTS

Applicable law

| 39. | The analysis below will concentrate on three points:






  — | a description of the different steps of the processing foreseen in the proposal, with a view to identifying the law applicable at each stage, |
| --- | --- | --- |

39.

The analysis below will concentrate on three points:

—

a description of the different steps of the processing foreseen in the proposal, with a view to identifying the law applicable at each stage,

| — | the limitations of the Proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters in terms of scope and in terms of rights of the data subject, |
| --- | --- |

—

the limitations of the Proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters in terms of scope and in terms of rights of the data subject,

| — | a more general analysis of the extent to which a third pillar instrument can apply to private actors processing data in a first pillar framework. |
| --- | --- |

—

a more general analysis of the extent to which a third pillar instrument can apply to private actors processing data in a first pillar framework.

Applicable law at different steps of the processing

| 40. | Article 11 of the proposal states that ‘Member States shall ensure that the Council Framework Decision on the Protection of Personal data Processed in the Framework of Police and Judicial Cooperation in Criminal Matters (...) is applicable to the processing of personal data under this Framework Decision.’ |
| --- | --- |

40.

Article 11 of the proposal states that ‘Member States shall ensure that the Council Framework Decision on the Protection of Personal data Processed in the Framework of Police and Judicial Cooperation in Criminal Matters (...) is applicable to the processing of personal data under this Framework Decision.’

| 41. | However, in spite of this provision it is not clear to what extent the data protection framework decision — an instrument under the third pillar of the EU Treaty — will be applicable to data processed by airlines, collected by PIUs, and further used by other competent authorities. |
| --- | --- |

41.

However, in spite of this provision it is not clear to what extent the data protection framework decision — an instrument under the third pillar of the EU Treaty — will be applicable to data processed by airlines, collected by PIUs, and further used by other competent authorities.

| 42. | The first step in the processing of personal data foreseen by the proposal is processing by the airlines, which are obliged to make PNR data available — using in principle a push system — to national PIUs. It seems from the wording of the proposal and the impact assessment (22) that data could also be transmitted in bulk by airlines to intermediaries. Airlines are primarily active in a commercial environment, subject to national data protection legislation implementing Directive 95/46/EC (23). Questions on the applicable law will arise when data collected are used for law enforcement purposes (24). |
| --- | --- |

42.

The first step in the processing of personal data foreseen by the proposal is processing by the airlines, which are obliged to make PNR data available — using in principle a push system — to national PIUs. It seems from the wording of the proposal and the impact assessment (22) that data could also be transmitted in bulk by airlines to intermediaries. Airlines are primarily active in a commercial environment, subject to national data protection legislation implementing Directive 95/46/EC (23). Questions on the applicable law will arise when data collected are used for law enforcement purposes (24).

| 43. | Data would then be filtered by an intermediary (to be formatted and to exclude PNR data not included in the list of data required by the proposal) or sent directly to PIUs. Intermediaries could also be actors from the private sector, as is the case for SITA, operating in that sense in the framework of the PNR Agreement with Canada. |
| --- | --- |

43.

Data would then be filtered by an intermediary (to be formatted and to exclude PNR data not included in the list of data required by the proposal) or sent directly to PIUs. Intermediaries could also be actors from the private sector, as is the case for SITA, operating in that sense in the framework of the PNR Agreement with Canada.

| 44. | When it comes to PIUs, responsible for the risk assessment of the whole amount of data, it is not clear who will be responsible for the processing. Customs and border authorities might be involved, and not necessarily law enforcement authorities. |
| --- | --- |

44.

When it comes to PIUs, responsible for the risk assessment of the whole amount of data, it is not clear who will be responsible for the processing. Customs and border authorities might be involved, and not necessarily law enforcement authorities.

| 45. | The subsequent transmission of filtered data to ‘competent’ authorities would probably happen in a law enforcement context. The proposal states that ‘competent authorities shall only include authorities responsible for the prevention or combating of terrorist offences and organised crime’. |
| --- | --- |

45.

The subsequent transmission of filtered data to ‘competent’ authorities would probably happen in a law enforcement context. The proposal states that ‘competent authorities shall only include authorities responsible for the prevention or combating of terrorist offences and organised crime’.

| 46. | While moving forward through the steps of the processing, the actors involved and the purpose followed have a closer link with police and judicial cooperation in criminal matters. The proposal does not explicitly mention, however, when precisely the data protection framework decision will apply. The wording would even lead to think that it applies to the whole processing, and even to the airlines (25). However, the framework decision on the protection of personal data includes in itself some limitations. |
| --- | --- |

46.

While moving forward through the steps of the processing, the actors involved and the purpose followed have a closer link with police and judicial cooperation in criminal matters. The proposal does not explicitly mention, however, when precisely the data protection framework decision will apply. The wording would even lead to think that it applies to the whole processing, and even to the airlines (25). However, the framework decision on the protection of personal data includes in itself some limitations.

| 47. | In this context, the EDPS fundamentally questions the fact whether Title VI of the EU-Treaty can serve as a legal basis for legal obligations on a routine basis and for law enforcement purposes upon private sector actors. Additionally, the question is relevant whether Title VI of the EU-Treaty can serve as a legal basis for legal obligations on public authorities which are in principle outside the framework of law enforcement cooperation. These questions will be elaborated further on in this opinion. |
| --- | --- |

47.

In this context, the EDPS fundamentally questions the fact whether Title VI of the EU-Treaty can serve as a legal basis for legal obligations on a routine basis and for law enforcement purposes upon private sector actors. Additionally, the question is relevant whether Title VI of the EU-Treaty can serve as a legal basis for legal obligations on public authorities which are in principle outside the framework of law enforcement cooperation. These questions will be elaborated further on in this opinion.

Limitations of the data protection framework decision

| 48. | The text of the Proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters contains at least two limitations which are relevant in terms of scope. |
| --- | --- |

48.

The text of the Proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters contains at least two limitations which are relevant in terms of scope.

| 49. | In the first place, the scope of the data protection framework decision is well defined in the framework decision itself: it applies ‘only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties’ (26). |
| --- | --- |

49.

In the first place, the scope of the data protection framework decision is well defined in the framework decision itself: it applies ‘only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties’ (26).

| 50. | In the second place, the data protection framework decision is not supposed to apply to data processed purely at domestic level, but is limited to data exchanged between Member States and further transfer to third countries (27). |
| --- | --- |

50.

In the second place, the data protection framework decision is not supposed to apply to data processed purely at domestic level, but is limited to data exchanged between Member States and further transfer to third countries (27).

| 51. | The data protection framework decision also includes some drawbacks compared to Directive 95/46/EC, in particular a wide exception to the purpose limitation principle. With regard to this purpose principle, the proposal clearly limits the purpose of the processing to the fight against terrorism and organised crime. However, the data protection framework decision allows processing for wider purposes. In such a case, the lex specialis (the proposal) should prevail over the lex generalis (the data protection framework decision) (28). This should be made explicit in the text of the proposal. |
| --- | --- |

51.

The data protection framework decision also includes some drawbacks compared to Directive 95/46/EC, in particular a wide exception to the purpose limitation principle. With regard to this purpose principle, the proposal clearly limits the purpose of the processing to the fight against terrorism and organised crime. However, the data protection framework decision allows processing for wider purposes. In such a case, the lex specialis (the proposal) should prevail over the lex generalis (the data protection framework decision) (28). This should be made explicit in the text of the proposal.

| 52. | For this reason, the EDPS recommends adding the following provision to the proposal: ‘Personal data transmitted by airlines according to this Framework Decision may not be processed for purposes other than the fight against terrorism and organised crime. The exceptions foreseen with regard to the purpose principle in the Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters do not apply’. |
| --- | --- |

52.

For this reason, the EDPS recommends adding the following provision to the proposal: ‘Personal data transmitted by airlines according to this Framework Decision may not be processed for purposes other than the fight against terrorism and organised crime. The exceptions foreseen with regard to the purpose principle in the Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters do not apply’.

| 53. | As a conclusion, the EDPS notes a serious lack of legal certainty with regard to the data protection regime applicable to the different actors involved in the project, and in particular to airlines and other first pillar actors: be it the rules of the proposal, the rules of the data protection framework decision or the national legislation implementing Directive 95/46/EC. The legislator should make clear at what moment of the processing precisely these different rules will apply. |
| --- | --- |

53.

As a conclusion, the EDPS notes a serious lack of legal certainty with regard to the data protection regime applicable to the different actors involved in the project, and in particular to airlines and other first pillar actors: be it the rules of the proposal, the rules of the data protection framework decision or the national legislation implementing Directive 95/46/EC. The legislator should make clear at what moment of the processing precisely these different rules will apply.

Conditions of application of first and third pillar rules

| 54. | The EDPS fundamentally questions the fact that a third pillar instrument creates legal obligations on a routine basis and for law enforcement purposes upon private or public sector actors which are in principle outside the framework of law enforcement cooperation. |
| --- | --- |

54.

The EDPS fundamentally questions the fact that a third pillar instrument creates legal obligations on a routine basis and for law enforcement purposes upon private or public sector actors which are in principle outside the framework of law enforcement cooperation.

| 55. | A comparison could be made here with two other cases where the private sector was involved in the retention or transfer of data in a perspective of law enforcement:






  — | The US-PNR case where a systematic transfer of PNR data by airlines to law enforcement authorities was foreseen. The judgement of the Court of Justice in the PNR case excluded Community competence to conclude the PNR agreement. One of the justifications was that the transfer of PNR data to the US CBP constituted processing operations concerning public security and the activities of the State in areas of criminal law (29). In this case, the processing operation was a transfer to the CBP in a systematic fashion, which makes a difference with the following case: |
| --- | --- | --- |

55.

A comparison could be made here with two other cases where the private sector was involved in the retention or transfer of data in a perspective of law enforcement:

—

The US-PNR case where a systematic transfer of PNR data by airlines to law enforcement authorities was foreseen. The judgement of the Court of Justice in the PNR case excluded Community competence to conclude the PNR agreement. One of the justifications was that the transfer of PNR data to the US CBP constituted processing operations concerning public security and the activities of the State in areas of criminal law (29). In this case, the processing operation was a transfer to the CBP in a systematic fashion, which makes a difference with the following case:

| — | The general retention of data by electronic communication operators. With regard to the Community competence to establish such a retention period, a difference can be made with the US-PNR case, considering that Directive 2006/24/EC (30) only foresees an obligation of retention, with data remaining under the control of the operators. No systematic transfer of data to law enforcement authorities is envisaged. It can be concluded that, as far as the data remain under the control of the service providers, those providers also remain responsible for the respect of personal data protection obligations vis-à-vis the data subject. |
| --- | --- |

—

The general retention of data by electronic communication operators. With regard to the Community competence to establish such a retention period, a difference can be made with the US-PNR case, considering that Directive 2006/24/EC (30) only foresees an obligation of retention, with data remaining under the control of the operators. No systematic transfer of data to law enforcement authorities is envisaged. It can be concluded that, as far as the data remain under the control of the service providers, those providers also remain responsible for the respect of personal data protection obligations vis-à-vis the data subject.

| 56. | In the present EU PNR proposal, airlines have to make available in a systematic way the PNR data of all passengers. However, these data are not transferred directly in bulk to law enforcement authorities: they can be sent to an intermediary and they are assessed by a third party, the statute of which remains unclear, before selected information is sent to competent authorities. |
| --- | --- |

56.

In the present EU PNR proposal, airlines have to make available in a systematic way the PNR data of all passengers. However, these data are not transferred directly in bulk to law enforcement authorities: they can be sent to an intermediary and they are assessed by a third party, the statute of which remains unclear, before selected information is sent to competent authorities.

| 57. | The main part of the processing happens in a grey zone, having material links with the first as well as with the third pillar. As it will be developed in Chapter IV, the quality of actors processing the data is not clear. Airlines are obviously no enforcement authorities, and intermediaries could be actors of the private sector. Even with regard to PIUs which would be public authorities, it must be stressed that not every public authority has the quality and the competences to perform law enforcement tasks on a routine basis. |
| --- | --- |

57.

The main part of the processing happens in a grey zone, having material links with the first as well as with the third pillar. As it will be developed in Chapter IV, the quality of actors processing the data is not clear. Airlines are obviously no enforcement authorities, and intermediaries could be actors of the private sector. Even with regard to PIUs which would be public authorities, it must be stressed that not every public authority has the quality and the competences to perform law enforcement tasks on a routine basis.

| 58. | Traditionally, a clear separation has existed between law enforcement and private sector activities, where law enforcement tasks are performed by specifically dedicated authorities, in particular police forces, and private actors are solicited on a case by case basis to communicate personal data to these enforcement authorities. There is now a trend to impose cooperation for law enforcement purposes on private actors on a systematic basis, which raises the question which data protection framework (first or third pillar) applies to the conditions of this cooperation: should the rules be based on the quality of the data controller (private sector) or on the purpose followed (law enforcement)? |
| --- | --- |

58.

Traditionally, a clear separation has existed between law enforcement and private sector activities, where law enforcement tasks are performed by specifically dedicated authorities, in particular police forces, and private actors are solicited on a case by case basis to communicate personal data to these enforcement authorities. There is now a trend to impose cooperation for law enforcement purposes on private actors on a systematic basis, which raises the question which data protection framework (first or third pillar) applies to the conditions of this cooperation: should the rules be based on the quality of the data controller (private sector) or on the purpose followed (law enforcement)?

| 59. | The EDPS has already recalled the risk of a legal loophole between the first and third pillar activities (31). It is indeed far from clear whether activities by private companies, in some way connected with enforcement of criminal law, are covered by the field of action of the European Union legislator under the Articles 30, 31 and 34 TEU. |
| --- | --- |

59.

The EDPS has already recalled the risk of a legal loophole between the first and third pillar activities (31). It is indeed far from clear whether activities by private companies, in some way connected with enforcement of criminal law, are covered by the field of action of the European Union legislator under the Articles 30, 31 and 34 TEU.

| 60. | If the general (first pillar) framework would not apply, a service provider should have to make difficult distinctions within his data bases. Under the current regime, it is clear that the data controller has to respect the same data protection vis-à-vis the data subjects irrespectively of the purposes that justify the retention of data. An outcome in which processing by service providers for different purposes would be subject to different frameworks for data protection should therefore be avoided. |
| --- | --- |

60.

If the general (first pillar) framework would not apply, a service provider should have to make difficult distinctions within his data bases. Under the current regime, it is clear that the data controller has to respect the same data protection vis-à-vis the data subjects irrespectively of the purposes that justify the retention of data. An outcome in which processing by service providers for different purposes would be subject to different frameworks for data protection should therefore be avoided.

Exercise of data subject's rights

| 61. | The different legal regimes that would apply at national level would have a major impact primarily on the exercise of his/her rights by the data subject. |
| --- | --- |

61.

The different legal regimes that would apply at national level would have a major impact primarily on the exercise of his/her rights by the data subject.

| 62. | It is stated in the preamble of the proposal that ‘information, access, rectification, erasure and blocking, compensation and judicial remedies are to be provided under the data protection framework decision’. However, this statement does not answer the question of who the controller in charge of answering data subjects' requests is. |
| --- | --- |

62.

It is stated in the preamble of the proposal that ‘information, access, rectification, erasure and blocking, compensation and judicial remedies are to be provided under the data protection framework decision’. However, this statement does not answer the question of who the controller in charge of answering data subjects' requests is.

| 63. | While information on the processing could be communicated by airlines, the issue is more complex when it comes to access or rectification of data. These rights are indeed restricted under the data protection framework decision. As stated above, it is doubtful that a service provider such as an airline could be obliged to give differentiated access and rectification rights to the data it holds, depending on the purpose (commercial or law enforcement) followed. One might argue that these rights are to be exercised before the PIU or the otherwise designated competent authorities. The proposal however gives no further indication in this respect, and as already mentioned, it is not clear either that these authorities (at least PIUs) will be law enforcement authorities normally entrusted with restricted (possibly indirect) access procedures. |
| --- | --- |

63.

While information on the processing could be communicated by airlines, the issue is more complex when it comes to access or rectification of data. These rights are indeed restricted under the data protection framework decision. As stated above, it is doubtful that a service provider such as an airline could be obliged to give differentiated access and rectification rights to the data it holds, depending on the purpose (commercial or law enforcement) followed. One might argue that these rights are to be exercised before the PIU or the otherwise designated competent authorities. The proposal however gives no further indication in this respect, and as already mentioned, it is not clear either that these authorities (at least PIUs) will be law enforcement authorities normally entrusted with restricted (possibly indirect) access procedures.

| 64. | The individual also risks being confronted with different recipients of data, as far as PIUs are concerned: the data are indeed transmitted to the PIU of the country of departure/arrival of flights, but also possibly to PIUs of other Member States on a case by case basis. Moreover, it is possible that several member States may establish or designate one single and common PIU. The data subject might in that case have to exercise redress before an authority of another Member State. Here again, it is not clear whether the national data protection rules will apply (these are supposed to be harmonised within the EU), or if specific law enforcement legislation will have to be taken into account (given the lack of comprehensive harmonisation in the third pillar at national level). |
| --- | --- |

64.

The individual also risks being confronted with different recipients of data, as far as PIUs are concerned: the data are indeed transmitted to the PIU of the country of departure/arrival of flights, but also possibly to PIUs of other Member States on a case by case basis. Moreover, it is possible that several member States may establish or designate one single and common PIU. The data subject might in that case have to exercise redress before an authority of another Member State. Here again, it is not clear whether the national data protection rules will apply (these are supposed to be harmonised within the EU), or if specific law enforcement legislation will have to be taken into account (given the lack of comprehensive harmonisation in the third pillar at national level).

| 65. | The question is the same with regard to access to data processed by intermediaries, the statute of which is unclear, and which could also be common to airlines in different countries of the EU. |
| --- | --- |

65.

The question is the same with regard to access to data processed by intermediaries, the statute of which is unclear, and which could also be common to airlines in different countries of the EU.

| 66. | The EDPS deplores the uncertainty that remains with regard to the exercise of these fundamental rights of the data subject. He stresses the fact that this situation is mostly due to the fact that actors who do not have law enforcement as a principal task are entrusted with such responsibilities. |
| --- | --- |

66.

The EDPS deplores the uncertainty that remains with regard to the exercise of these fundamental rights of the data subject. He stresses the fact that this situation is mostly due to the fact that actors who do not have law enforcement as a principal task are entrusted with such responsibilities.

Conclusion

| 67. | The EDPS considers that the proposal should make clear what legal regime is applicable at which stage of the processing, and specify vis-à-vis which actor or authority access and redress shall be exercised. The EDPS recalls that according to Article 30.1. b) TEU, provisions on data protection should be appropriate and cover the full range of processing operations established by the proposal. A simple reference to the data protection framework decision is not sufficient, given the limited scope of that framework decision and the restriction of rights it contains. As far as law enforcement authorities are involved, the rules of the data protection framework decision should at least apply to the whole processing foreseen in the proposal, in order to guarantee the coherence of the application of data protection principles. |
| --- | --- |

67.

The EDPS considers that the proposal should make clear what legal regime is applicable at which stage of the processing, and specify vis-à-vis which actor or authority access and redress shall be exercised. The EDPS recalls that according to Article 30.1. b) TEU, provisions on data protection should be appropriate and cover the full range of processing operations established by the proposal. A simple reference to the data protection framework decision is not sufficient, given the limited scope of that framework decision and the restriction of rights it contains. As far as law enforcement authorities are involved, the rules of the data protection framework decision should at least apply to the whole processing foreseen in the proposal, in order to guarantee the coherence of the application of data protection principles.

IV.   QUALITY OF RECIPIENTS

| 68. | The EDPS notes that the proposal does not provide for any specification with regard to the quality of the recipients of personal data collected by airlines, be it for intermediaries, Passenger Information Units, or competent authorities. It must be stressed that the quality of the recipient is in direct relation with the type of data protection guarantees applying to that recipient. The difference between guarantees provided in particular by first and third pillar rules has already been mentioned. It is essential that the applicable regime be clear for all actors involved, including national governments, law enforcement agencies, the data protection authorities, as well as data controllers and data subjects involved. |
| --- | --- |

68.

The EDPS notes that the proposal does not provide for any specification with regard to the quality of the recipients of personal data collected by airlines, be it for intermediaries, Passenger Information Units, or competent authorities. It must be stressed that the quality of the recipient is in direct relation with the type of data protection guarantees applying to that recipient. The difference between guarantees provided in particular by first and third pillar rules has already been mentioned. It is essential that the applicable regime be clear for all actors involved, including national governments, law enforcement agencies, the data protection authorities, as well as data controllers and data subjects involved.

Intermediaries

| 69. | No indication is given in the proposal with regard to the quality of intermediaries (32). The role of intermediaries as controllers or processors is not specified either. From experience, it seems that a private sector entity, be it a Computer Reservation System or another entity, could perfectly be entrusted with the task of gathering PNR data directly from the airlines to redirect them to PIUs. It is indeed the way data are processed under the PNR Agreement with Canada. SITA (33) is the company responsible for the processing of the information. The role of the intermediary is decisive, as it could be responsible for the filtering out/reformatting of data that are transmitted in bulk by airlines (34). Even if intermediaries are obliged to cancel the processed information once it has been transferred to PIUs, the processing in itself is highly sensitive: a consequence of the intervention of intermediaries is the creation of an additional database including massive amounts of data, and even, according to the proposal, sensitive data (intermediaries being obliged then to delete those sensitive data). For these reasons, the EDPS recommends that no intermediaries should be involved in the processing of passenger data, unless their quality and tasks are strictly specified. |
| --- | --- |

69.

No indication is given in the proposal with regard to the quality of intermediaries (32). The role of intermediaries as controllers or processors is not specified either. From experience, it seems that a private sector entity, be it a Computer Reservation System or another entity, could perfectly be entrusted with the task of gathering PNR data directly from the airlines to redirect them to PIUs. It is indeed the way data are processed under the PNR Agreement with Canada. SITA (33) is the company responsible for the processing of the information. The role of the intermediary is decisive, as it could be responsible for the filtering out/reformatting of data that are transmitted in bulk by airlines (34). Even if intermediaries are obliged to cancel the processed information once it has been transferred to PIUs, the processing in itself is highly sensitive: a consequence of the intervention of intermediaries is the creation of an additional database including massive amounts of data, and even, according to the proposal, sensitive data (intermediaries being obliged then to delete those sensitive data). For these reasons, the EDPS recommends that no intermediaries should be involved in the processing of passenger data, unless their quality and tasks are strictly specified.

Passenger information units

| 70. | PIUs have a decisive role in identifying persons that are or may be involved or associated with terrorism or organised crime. According to the proposal, they will be responsible for creating risk indicators and providing intelligence on travel patterns (35). Where the risk assessment is based on standardised travel patterns and not on material evidence linked with a concrete case, the analysis can be considered as constituting proactive investigation. The EDPS stresses that this kind of processing is in principle strictly regulated in Member State legislation (if not prohibited), and it is the task of specific public authorities the functioning of which is also strictly regulated. |
| --- | --- |

70.

PIUs have a decisive role in identifying persons that are or may be involved or associated with terrorism or organised crime. According to the proposal, they will be responsible for creating risk indicators and providing intelligence on travel patterns (35). Where the risk assessment is based on standardised travel patterns and not on material evidence linked with a concrete case, the analysis can be considered as constituting proactive investigation. The EDPS stresses that this kind of processing is in principle strictly regulated in Member State legislation (if not prohibited), and it is the task of specific public authorities the functioning of which is also strictly regulated.

| 71. | PIUs are therefore entrusted with very sensitive processing of information, without the proposal giving any detail on their quality and the conditions in which they would exercise this competence. Although it is likely that this task will be performed by a governmental body, possibly customs or border control, the proposal does not explicitly prevent Member States to entrust intelligence agencies or even any kind of processor with its performance. The EDPS underlines the fact that the transparency and guarantees applying to intelligence agencies are not always identical to those applicable to traditional law enforcement authorities. Details on the quality of PIUs are decisive, as this will have direct consequences on the applicable legal framework and the conditions of supervision. The EDPS considers that the proposal must include an additional provision detailing the specificities of PIUs. |
| --- | --- |

71.

PIUs are therefore entrusted with very sensitive processing of information, without the proposal giving any detail on their quality and the conditions in which they would exercise this competence. Although it is likely that this task will be performed by a governmental body, possibly customs or border control, the proposal does not explicitly prevent Member States to entrust intelligence agencies or even any kind of processor with its performance. The EDPS underlines the fact that the transparency and guarantees applying to intelligence agencies are not always identical to those applicable to traditional law enforcement authorities. Details on the quality of PIUs are decisive, as this will have direct consequences on the applicable legal framework and the conditions of supervision. The EDPS considers that the proposal must include an additional provision detailing the specificities of PIUs.

Competent authorities

| 72. | It appears from Article 4 of the proposal that any authority responsible for the prevention or combating of terrorist offences and organised crime can receive the data. While the purpose is clearly defined, the quality of the authority is missing. The proposal does not foresee any limitation of recipients to law enforcement authorities.
  As mentioned above with regard to PIUs, it is decisive that the sensitive information at stake be processed in an environment with a clear legal framework. This is much more the case, e.g., for law enforcement authorities than for intelligence agencies. Considering the data mining elements and the proactive research included in the proposal, it cannot be excluded that such intelligence agencies be involved in the processing of the data, without exclusion of any other type of authorities. |
| --- | --- |

72.

It appears from Article 4 of the proposal that any authority responsible for the prevention or combating of terrorist offences and organised crime can receive the data. While the purpose is clearly defined, the quality of the authority is missing. The proposal does not foresee any limitation of recipients to law enforcement authorities.

As mentioned above with regard to PIUs, it is decisive that the sensitive information at stake be processed in an environment with a clear legal framework. This is much more the case, e.g., for law enforcement authorities than for intelligence agencies. Considering the data mining elements and the proactive research included in the proposal, it cannot be excluded that such intelligence agencies be involved in the processing of the data, without exclusion of any other type of authorities.

Conclusion

| 73. | As a general comment, the EDPS notes that the enforcement of an EU PNR system is rendered even more difficult considering that law enforcement authorities have different competences depending on the national law of the Member States, including or not intelligence, tax, immigration or police. This is however a supplementary reason to recommend that the proposal be much more precise with regard to the quality of the mentioned actors and the guarantees to control the performance of their tasks. Additional provisions should be integrated in the proposal, to specify strictly the competences and the legal obligations of intermediaries, PIUs and other competent authorities. |
| --- | --- |

73.

As a general comment, the EDPS notes that the enforcement of an EU PNR system is rendered even more difficult considering that law enforcement authorities have different competences depending on the national law of the Member States, including or not intelligence, tax, immigration or police. This is however a supplementary reason to recommend that the proposal be much more precise with regard to the quality of the mentioned actors and the guarantees to control the performance of their tasks. Additional provisions should be integrated in the proposal, to specify strictly the competences and the legal obligations of intermediaries, PIUs and other competent authorities.

V.   CONDITIONS OF TRANSFER TO THIRD COUNTRIES

| 74. | The proposal provides for some safeguards in relation to the transfer of PNR data to third countries (36). In particular, it foresees explicitly the application of the data protection framework decision to data transfers, it provides for a specific purpose limitation and it states the need for consent of the Member State in case of onward transfer. The transfer should also comply with national legislation of the Member State concerned, as well as any applicable international agreement. |
| --- | --- |

74.

The proposal provides for some safeguards in relation to the transfer of PNR data to third countries (36). In particular, it foresees explicitly the application of the data protection framework decision to data transfers, it provides for a specific purpose limitation and it states the need for consent of the Member State in case of onward transfer. The transfer should also comply with national legislation of the Member State concerned, as well as any applicable international agreement.

| 75. | Many questions remain however, in particular with regard to the quality of consent, the conditions of application of the data protection framework decision and the question of ‘reciprocity’ in the transmission of data to third countries. |
| --- | --- |

75.

Many questions remain however, in particular with regard to the quality of consent, the conditions of application of the data protection framework decision and the question of ‘reciprocity’ in the transmission of data to third countries.

Quality of consent

| 76. | The Member State of origin must give express consent for onward transfer of data from a third country to another third country. The proposal does not specify under what conditions and by whom this consent will be given, and whether national DPAs should be involved in the decision. The EDPS considers that the way consent will be given should at least be in conformity with national laws stating conditions of transfer of personal data to third countries. |
| --- | --- |

76.

The Member State of origin must give express consent for onward transfer of data from a third country to another third country. The proposal does not specify under what conditions and by whom this consent will be given, and whether national DPAs should be involved in the decision. The EDPS considers that the way consent will be given should at least be in conformity with national laws stating conditions of transfer of personal data to third countries.

| 77. | Besides, consent of a Member State should not prevail over the principle according to which an adequate level of protection must be foreseen by the recipient country for the intended processing. These conditions should be cumulative, as they are in the data protection framework decision (Article 14). The EDPS therefore suggests adding a point (c) to paragraph 1 of Article 8 that would read ‘and (c) the third State ensures an adequate level of protection for the intended data processing.’ The EDPS recalls in this respect that mechanisms ensuring common standards and coordinated decisions with regard to adequacy must be put in place (37). |
| --- | --- |

77.

Besides, consent of a Member State should not prevail over the principle according to which an adequate level of protection must be foreseen by the recipient country for the intended processing. These conditions should be cumulative, as they are in the data protection framework decision (Article 14). The EDPS therefore suggests adding a point (c) to paragraph 1 of Article 8 that would read ‘and (c) the third State ensures an adequate level of protection for the intended data processing.’ The EDPS recalls in this respect that mechanisms ensuring common standards and coordinated decisions with regard to adequacy must be put in place (37).

Application of the data protection framework decision

| 78. | The proposal refers to the conditions and safeguards contained in the data protection framework decision while also specifying explicitly some conditions, in particular the above mentioned consent of the Member State concerned, and a limitation of the purpose to preventing and fighting terrorist offences and organised crime. |
| --- | --- |

78.

The proposal refers to the conditions and safeguards contained in the data protection framework decision while also specifying explicitly some conditions, in particular the above mentioned consent of the Member State concerned, and a limitation of the purpose to preventing and fighting terrorist offences and organised crime.

| 79. | The data protection framework decision itself provides for conditions to the transfer of personal data to third countries, namely with regard to the purpose limitation, the quality of recipients, the consent of Member State, and the adequacy principle. However, it also foresees derogations to these conditions of transfer: legitimate prevailing interests, especially important public interests, can be a sufficient basis for transfer even if the conditions listed above are not fulfilled. |
| --- | --- |

79.

The data protection framework decision itself provides for conditions to the transfer of personal data to third countries, namely with regard to the purpose limitation, the quality of recipients, the consent of Member State, and the adequacy principle. However, it also foresees derogations to these conditions of transfer: legitimate prevailing interests, especially important public interests, can be a sufficient basis for transfer even if the conditions listed above are not fulfilled.

| 80. | As already mentioned in Chapter III of this opinion, the EDPS considers that it must be stated clearly in the text of the proposal that the more precise guarantees of the proposal prevail over the general conditions — and exceptions — of the data protection framework decision, where it applies. |
| --- | --- |

80.

As already mentioned in Chapter III of this opinion, the EDPS considers that it must be stated clearly in the text of the proposal that the more precise guarantees of the proposal prevail over the general conditions — and exceptions — of the data protection framework decision, where it applies.

Reciprocity

| 81. | The proposal addresses the issue of possible ‘retaliation requests’ of countries that might ask the EU for PNR data for flights from the EU to their territory. Where the EU requests data from databases of airlines of such third countries, because they operate a flight to or from the EU, such third country could ask the same from airlines based in the EU, including data from citizens of the EU. Although the Commission considers this eventuality as ‘very remote’, it allows for it. The proposal refers in this regard to the fact that the agreement with the US and with Canada foresee such reciprocal treatment ‘which may be enforced automatically’ (38). The EDPS questions the significance of such an automatic reciprocity and the application of safeguards to such transfers, notably taking into account the existence of an adequate level of protection of the country concerned. |
| --- | --- |

81.

The proposal addresses the issue of possible ‘retaliation requests’ of countries that might ask the EU for PNR data for flights from the EU to their territory. Where the EU requests data from databases of airlines of such third countries, because they operate a flight to or from the EU, such third country could ask the same from airlines based in the EU, including data from citizens of the EU. Although the Commission considers this eventuality as ‘very remote’, it allows for it. The proposal refers in this regard to the fact that the agreement with the US and with Canada foresee such reciprocal treatment ‘which may be enforced automatically’ (38). The EDPS questions the significance of such an automatic reciprocity and the application of safeguards to such transfers, notably taking into account the existence of an adequate level of protection of the country concerned.

| 82. | A distinction should be made between third countries which have already concluded an agreement with the EU, and those countries which do not have such agreement. |
| --- | --- |

82.

A distinction should be made between third countries which have already concluded an agreement with the EU, and those countries which do not have such agreement.

Countries having no agreement with the EU

| 83. | The EDPS notes that reciprocity might lead to transfer personal data to countries where no guarantees can be provided in terms of democratic standards and adequate level of data protection. |
| --- | --- |

83.

The EDPS notes that reciprocity might lead to transfer personal data to countries where no guarantees can be provided in terms of democratic standards and adequate level of data protection.

| 84. | The impact assessment gives further elements with regard to the conditions of transfer of data to third countries: the advantage of the EU-PNR system, where data are filtered by PIUs, is emphasised. Only selected data of suspected individuals (and not bulk data) would be transferred to the competent authorities of Member States and presumably to third countries as well (39). The EDPS recommends clarifying this point in the text of the proposal. A simple statement in the impact assessment does not provide for the necessary protection. |
| --- | --- |

84.

The impact assessment gives further elements with regard to the conditions of transfer of data to third countries: the advantage of the EU-PNR system, where data are filtered by PIUs, is emphasised. Only selected data of suspected individuals (and not bulk data) would be transferred to the competent authorities of Member States and presumably to third countries as well (39). The EDPS recommends clarifying this point in the text of the proposal. A simple statement in the impact assessment does not provide for the necessary protection.

| 85. | While the selection of data would contribute to minimise the impact on the privacy of passengers, it must be recalled that data protection principles go far beyond data minimisation, and include principles such as necessity, transparency and exercise of data subject rights, all principles to be taken into account when determining whether a third country provides for an adequate level of protection. |
| --- | --- |

85.

While the selection of data would contribute to minimise the impact on the privacy of passengers, it must be recalled that data protection principles go far beyond data minimisation, and include principles such as necessity, transparency and exercise of data subject rights, all principles to be taken into account when determining whether a third country provides for an adequate level of protection.

Countries having a bilateral agreement with the EU

| 86. | The impact assessment indicates that such processing will provide the EU with the ability ‘to insist on certain standards and to ensure consistency in such bilateral agreements with third countries. It will also provide for the possibility of requesting reciprocal treatment from third countries with which the EU has an agreement, something that is not possible today’ (40). |
| --- | --- |

86.

The impact assessment indicates that such processing will provide the EU with the ability ‘to insist on certain standards and to ensure consistency in such bilateral agreements with third countries. It will also provide for the possibility of requesting reciprocal treatment from third countries with which the EU has an agreement, something that is not possible today’ (40).

| 87. | From these observations arises the question of the impact of the proposal on the existing agreements with Canada and the USA. The conditions of access to data in these agreements are indeed much broader, as they are not subject to a similar selection before being transferred to those third countries. |
| --- | --- |

87.

From these observations arises the question of the impact of the proposal on the existing agreements with Canada and the USA. The conditions of access to data in these agreements are indeed much broader, as they are not subject to a similar selection before being transferred to those third countries.

| 88. | The impact assessment indicates that ‘in cases in which the EU has an international agreement with a third country for the exchange/transmission of PNR data to such third country, such agreements shall be duly taken into account. The carriers should send the PNR data to the Passengers Information Units according to the normal practice under the current measure. The PIU which receives such data shall transmit them to the competent authority of the third country with which such an agreement exists’ (41). |
| --- | --- |

88.

The impact assessment indicates that ‘in cases in which the EU has an international agreement with a third country for the exchange/transmission of PNR data to such third country, such agreements shall be duly taken into account. The carriers should send the PNR data to the Passengers Information Units according to the normal practice under the current measure. The PIU which receives such data shall transmit them to the competent authority of the third country with which such an agreement exists’ (41).

| 89. | While on the one hand, the proposal seems to aim at a transfer of only selected data to any competent authority, be it within the EU or outside, on the other hand, the impact assessment, the preamble of the proposal (recital 21) and Article 11 itself recall that existing agreements should be duly taken into account. This might lead to the conclusion that filtering may only be a valid measure for agreements to be concluded in the future. It could be foreseen in this perspective that bulk access will still be the rule for access e.g. by US authorities to PNR data, in conformity with the provisions of the EU-US agreement, but that in parallel and on a case by case basis, a transfer of data to the US could occur, relating to specific data identified by PIUs, including but not limited to data concerning flights to the US. |
| --- | --- |

89.

While on the one hand, the proposal seems to aim at a transfer of only selected data to any competent authority, be it within the EU or outside, on the other hand, the impact assessment, the preamble of the proposal (recital 21) and Article 11 itself recall that existing agreements should be duly taken into account. This might lead to the conclusion that filtering may only be a valid measure for agreements to be concluded in the future. It could be foreseen in this perspective that bulk access will still be the rule for access e.g. by US authorities to PNR data, in conformity with the provisions of the EU-US agreement, but that in parallel and on a case by case basis, a transfer of data to the US could occur, relating to specific data identified by PIUs, including but not limited to data concerning flights to the US.

| 90. | The EDPS regrets the lack of clarity on this decisive point of the proposal. He considers of the utmost importance that the conditions of transfer of PNR data to third countries be coherent and subject to a harmonised level of protection. Besides, for reasons of legal certainty, precisions with regard to the guarantees applying to the transfer of data should be included in the proposal itself and not only in the impact assessment, as it is the case now. |
| --- | --- |

90.

The EDPS regrets the lack of clarity on this decisive point of the proposal. He considers of the utmost importance that the conditions of transfer of PNR data to third countries be coherent and subject to a harmonised level of protection. Besides, for reasons of legal certainty, precisions with regard to the guarantees applying to the transfer of data should be included in the proposal itself and not only in the impact assessment, as it is the case now.

VI.   OTHER SUBSTANTIVE POINTS

Automated processing

| 91. | The EDPS notes that the proposal explicitly excludes that enforcement actions be taken by the Passenger Information Units and the competent authorities of the Member Sates only by reason of the automated processing of PNR data or by reason of a person's race or ethnic origin, religious or philosophical belief, political opinion or sexual orientation (42). |
| --- | --- |

91.

The EDPS notes that the proposal explicitly excludes that enforcement actions be taken by the Passenger Information Units and the competent authorities of the Member Sates only by reason of the automated processing of PNR data or by reason of a person's race or ethnic origin, religious or philosophical belief, political opinion or sexual orientation (42).

| 92. | Such precision is welcome as it limits the risks of arbitrary measures against individuals. The EDPS however notes that its scope is limited to enforcement actions by PIUs or competent authorities. It does not exclude, in its present wording, the automated filtering of individuals according to standard profiles, nor does it prevent the automated constitution of lists of suspected persons and the taking of measures such as extended surveillance, as long as these measures are not considered as enforcement actions. |
| --- | --- |

92.

Such precision is welcome as it limits the risks of arbitrary measures against individuals. The EDPS however notes that its scope is limited to enforcement actions by PIUs or competent authorities. It does not exclude, in its present wording, the automated filtering of individuals according to standard profiles, nor does it prevent the automated constitution of lists of suspected persons and the taking of measures such as extended surveillance, as long as these measures are not considered as enforcement actions.

| 93. | The EDPS considers that the notion of enforcement actions is too vague, and that, as a principle, no decision should be taken with regard to individuals only by reason of the automated processing of their data (43). The EDPS recommends modifying the text accordingly. |
| --- | --- |

93.

The EDPS considers that the notion of enforcement actions is too vague, and that, as a principle, no decision should be taken with regard to individuals only by reason of the automated processing of their data (43). The EDPS recommends modifying the text accordingly.

Quality of data

| 94. | The proposal gives in Article 5.2 an important precision as it makes clear that no obligation is put on airlines to collect or retain additional data to those collected for the initial commercial purpose. |
| --- | --- |

94.

The proposal gives in Article 5.2 an important precision as it makes clear that no obligation is put on airlines to collect or retain additional data to those collected for the initial commercial purpose.

| 95. | Several aspects of the processing of these data still deserve further comment:






  — | The data to be made available, as listed in Annex 1 of the proposal, are very extensive, and the list is similar to the list of data available to US authorities in the EU-US agreement. The quality of some of the data requested has already been questioned at several occasions by Data Protection Authorities, and especially by the Article 29 Working Party (44). |
| --- | --- | --- |

95.

Several aspects of the processing of these data still deserve further comment:

—

The data to be made available, as listed in Annex 1 of the proposal, are very extensive, and the list is similar to the list of data available to US authorities in the EU-US agreement. The quality of some of the data requested has already been questioned at several occasions by Data Protection Authorities, and especially by the Article 29 Working Party (44).

| — | It seems from the wording of the impact assessment (45) and Article 6.3 of the proposal that data could also be transmitted in bulk by airlines to intermediaries. In a first stage, data transmitted to a third party would not even be limited in compliance with the PNR data listed in Annex 1 of the proposal. |
| --- | --- |

—

It seems from the wording of the impact assessment (45) and Article 6.3 of the proposal that data could also be transmitted in bulk by airlines to intermediaries. In a first stage, data transmitted to a third party would not even be limited in compliance with the PNR data listed in Annex 1 of the proposal.

| — | With regard to the processing of sensitive data, even if these data might be filtered out at the stage of intermediaries, the question still remains whether the transfer of the open field by airlines is strictly necessary. |
| --- | --- |

—

With regard to the processing of sensitive data, even if these data might be filtered out at the stage of intermediaries, the question still remains whether the transfer of the open field by airlines is strictly necessary.

The EDPS supports the points made in the WP29-opinion in this respect.

Method of transfer of PNR data

| 96. | Air carriers established outside the EU are required to push data to PIUs or intermediaries as long as they possess the technical architecture to do it. If this is not the case they will have to permit the extraction of data through the pull method. |
| --- | --- |

96.

Air carriers established outside the EU are required to push data to PIUs or intermediaries as long as they possess the technical architecture to do it. If this is not the case they will have to permit the extraction of data through the pull method.

| 97. | Allowing for different methods of communication of data depending on the airlines concerned will only raise more difficulties with regard to the control of the compliance of transfer of PNR data with data protection rules. This risks as well to distort competition between EU and non-EU airlines. |
| --- | --- |

97.

Allowing for different methods of communication of data depending on the airlines concerned will only raise more difficulties with regard to the control of the compliance of transfer of PNR data with data protection rules. This risks as well to distort competition between EU and non-EU airlines.

| 98. | The EDPS recalls that the push method, allowing airlines to keep control on the quality of data transferred and the circumstances of transfers, is the only admissible method with regard to the proportionality of the processing. Besides, it must consist of an effective push, that is, the data should not be sent in bulk to an intermediary but filtered at the very first step of the processing. It is not admissible that non necessary data — and data not included in Annex 1 of the proposal — be sent to a third party, even if those data are to be deleted immediately by this third party. |
| --- | --- |

98.

The EDPS recalls that the push method, allowing airlines to keep control on the quality of data transferred and the circumstances of transfers, is the only admissible method with regard to the proportionality of the processing. Besides, it must consist of an effective push, that is, the data should not be sent in bulk to an intermediary but filtered at the very first step of the processing. It is not admissible that non necessary data — and data not included in Annex 1 of the proposal — be sent to a third party, even if those data are to be deleted immediately by this third party.

Data retention

| 99. | Article 9 of the proposal foresees a 5 years retention period of PNR data, with an additional 8 years period where data are to be kept in a ‘dormant’ database that will be accessible in restricted conditions. |
| --- | --- |

99.

Article 9 of the proposal foresees a 5 years retention period of PNR data, with an additional 8 years period where data are to be kept in a ‘dormant’ database that will be accessible in restricted conditions.

| 100. | The EDPS questions the difference between the two types of data bases: it is questionable whether the dormant database constitutes a real archive, with different methods of storage and retrieval of data. Indeed, most of the conditions put to the access to the dormant database consist of security requirements that could be applicable to the ‘five years retention database’ as well. |
| --- | --- |

100.

The EDPS questions the difference between the two types of data bases: it is questionable whether the dormant database constitutes a real archive, with different methods of storage and retrieval of data. Indeed, most of the conditions put to the access to the dormant database consist of security requirements that could be applicable to the ‘five years retention database’ as well.

| 101. | The total duration of storage — that is 13 years — is in any case excessive. It is justified in the impact assessment by the need to develop risk indicators and establish patterns of travel and behaviour (46), the efficiency of which deserves further demonstration. While it is obvious that data can be retained as long as necessary in a specific case as far as an investigation is ongoing, no justification can support the retention of data of all passengers in total absence of suspicion for 13 years. |
| --- | --- |

101.

The total duration of storage — that is 13 years — is in any case excessive. It is justified in the impact assessment by the need to develop risk indicators and establish patterns of travel and behaviour (46), the efficiency of which deserves further demonstration. While it is obvious that data can be retained as long as necessary in a specific case as far as an investigation is ongoing, no justification can support the retention of data of all passengers in total absence of suspicion for 13 years.

| 102. | The EDPS further notes that this retention period is not supported by the answers of Member States to the questionnaire of the Commission, according to which the average duration of storage required would be 3,5 years (47). |
| --- | --- |

102.

The EDPS further notes that this retention period is not supported by the answers of Member States to the questionnaire of the Commission, according to which the average duration of storage required would be 3,5 years (47).

| 103. | Moreover, the period of 13 years is comparable to the retention period of 15 years in the most recent agreement with the United States. The EDPS has always understood that this long retention period was only agreed upon because of strong pressure by the US Government to have a much longer period than 3.5 years, not because it was in any stage defended by the Council or the Commission. There is no reason to transpose such a compromise — that only has been justified as a necessary result of negotiations — to a legal instrument within the EU itself. |
| --- | --- |

103.

Moreover, the period of 13 years is comparable to the retention period of 15 years in the most recent agreement with the United States. The EDPS has always understood that this long retention period was only agreed upon because of strong pressure by the US Government to have a much longer period than 3.5 years, not because it was in any stage defended by the Council or the Commission. There is no reason to transpose such a compromise — that only has been justified as a necessary result of negotiations — to a legal instrument within the EU itself.

Role of the Committee of Member States

| 104. | The Committee of Member States established under Article 14 of the proposal will be competent with regard to security issues including protocol and encryption of PNR data, but also with regard to guidance for common general criteria, methods and practices related to risk assessment. |
| --- | --- |

104.

The Committee of Member States established under Article 14 of the proposal will be competent with regard to security issues including protocol and encryption of PNR data, but also with regard to guidance for common general criteria, methods and practices related to risk assessment.

| 105. | Apart from these indications, the proposal does not include any element or criteria with regard to the concrete conditions and framework of the risk assessment process. The impact assessment mentions that the criteria will ultimately depend on intelligence held by each Member State, which is constantly evolving. The risk assessment is to be performed in absence of uniform standards of identification of suspects. The extent to which the Committee of Member States will be able to play a role in this regard thus appears questionable. |
| --- | --- |

105.

Apart from these indications, the proposal does not include any element or criteria with regard to the concrete conditions and framework of the risk assessment process. The impact assessment mentions that the criteria will ultimately depend on intelligence held by each Member State, which is constantly evolving. The risk assessment is to be performed in absence of uniform standards of identification of suspects. The extent to which the Committee of Member States will be able to play a role in this regard thus appears questionable.

Security

| 106. | The proposal details a series of security measures (48) to be taken by PIUs, intermediaries and other competent authorities in order to protect the data. Considering the importance of the data base and the sensitivity of the processing, the EDPS considers that in addition to the measures envisaged, the entity processing the data should also be obliged to officially notify any security breach. |
| --- | --- |

106.

The proposal details a series of security measures (48) to be taken by PIUs, intermediaries and other competent authorities in order to protect the data. Considering the importance of the data base and the sensitivity of the processing, the EDPS considers that in addition to the measures envisaged, the entity processing the data should also be obliged to officially notify any security breach.

| 107. | The EDPS is aware of the project to establish such a notification procedure in the sector of electronic communications at European level. He advises to include such safeguard in the present proposal, and refers in this respect to the security breach system put in place in the United States with regard to state agencies (49). Security incidents can indeed happen in any field of activity, and in the private as well as the public sector, as the recent loss of a whole citizens' database by the British administration has shown (50). Large scale databases such as the one envisaged in the proposal would be first on a priority list to benefit from such an alert system. |
| --- | --- |

107.

The EDPS is aware of the project to establish such a notification procedure in the sector of electronic communications at European level. He advises to include such safeguard in the present proposal, and refers in this respect to the security breach system put in place in the United States with regard to state agencies (49). Security incidents can indeed happen in any field of activity, and in the private as well as the public sector, as the recent loss of a whole citizens' database by the British administration has shown (50). Large scale databases such as the one envisaged in the proposal would be first on a priority list to benefit from such an alert system.

Review and Sunset Clause

| 108. | The EDPS notes that a review is to take place within three years of the entry into force of the framework decision, on the basis of a report prepared by the Commission. He acknowledges the fact that this review, based on information provided by Member States, will give specific attention to data protection safeguards, and include the implementation of the ‘push’ method, the data retention and the quality of the risk assessment. Such review should, to be comprehensive, include the results of an analysis of the statistical data produced on the basis of the processing of PNR information. These statistics should, in addition to the elements mentioned in Article 18 of the proposal, include statistical details on the identification of high risk persons, such as the criteria for such identification and the concrete results of any law enforcement action resulting of the identification. |
| --- | --- |

108.

The EDPS notes that a review is to take place within three years of the entry into force of the framework decision, on the basis of a report prepared by the Commission. He acknowledges the fact that this review, based on information provided by Member States, will give specific attention to data protection safeguards, and include the implementation of the ‘push’ method, the data retention and the quality of the risk assessment. Such review should, to be comprehensive, include the results of an analysis of the statistical data produced on the basis of the processing of PNR information. These statistics should, in addition to the elements mentioned in Article 18 of the proposal, include statistical details on the identification of high risk persons, such as the criteria for such identification and the concrete results of any law enforcement action resulting of the identification.

| 109. | The EDPS has already insisted in this opinion on the absence of concrete elements to establish the necessity of the system proposed. He considers however that, should the framework decision enter into force, it should as a minimum be complemented by a sunset clause. At the end of the three years period, the Framework Decision should be repealed in case no element would come to support its continuation. |
| --- | --- |

109.

The EDPS has already insisted in this opinion on the absence of concrete elements to establish the necessity of the system proposed. He considers however that, should the framework decision enter into force, it should as a minimum be complemented by a sunset clause. At the end of the three years period, the Framework Decision should be repealed in case no element would come to support its continuation.

Impact on other legal instruments

| 110. | In its final provisions the proposal puts a condition to the further application of already existing bilateral or multilateral agreements or arrangements. Those instruments can only be applied as far as they are compatible with the objectives of the proposed framework decision. |
| --- | --- |

110.

In its final provisions the proposal puts a condition to the further application of already existing bilateral or multilateral agreements or arrangements. Those instruments can only be applied as far as they are compatible with the objectives of the proposed framework decision.

| 111. | The EDPS questions the scope of this provision. As already mentioned in Chapter V under Reciprocity, it is not clear what the impact of this provision will be on the content of agreements with third countries, such as the agreement with the US. In a different perspective, it is not clear either whether the provision could have an impact on the conditions of application of instruments with a broader scope, such as Council of Europe Convention No 108. Although this might appear unlikely in view of the difference of institutional context and actors involved, any risk of misinterpretation should be avoided and the proposal should make clear that it does not have any impact on instruments with a broader scope, notably those having as object the protection of fundamental rights. |
| --- | --- |

111.

The EDPS questions the scope of this provision. As already mentioned in Chapter V under Reciprocity, it is not clear what the impact of this provision will be on the content of agreements with third countries, such as the agreement with the US. In a different perspective, it is not clear either whether the provision could have an impact on the conditions of application of instruments with a broader scope, such as Council of Europe Convention No 108. Although this might appear unlikely in view of the difference of institutional context and actors involved, any risk of misinterpretation should be avoided and the proposal should make clear that it does not have any impact on instruments with a broader scope, notably those having as object the protection of fundamental rights.

VII.   CONCLUSION

| 112. | The EDPS stresses the major impact in terms of data protection of the present proposal. He has concentrated his analysis on four fundamental issues raised by the proposal, and insists on the fact that the issues raised need to be addressed in a comprehensive manner. Under the present circumstances, the proposal is not in conformity with fundamental rights, notably Article 8 of the Charter of the Fundamental Rights of the Union, and should not be adopted. |
| --- | --- |

112.

The EDPS stresses the major impact in terms of data protection of the present proposal. He has concentrated his analysis on four fundamental issues raised by the proposal, and insists on the fact that the issues raised need to be addressed in a comprehensive manner. Under the present circumstances, the proposal is not in conformity with fundamental rights, notably Article 8 of the Charter of the Fundamental Rights of the Union, and should not be adopted.

| 113. | Should the comments above be complied with, especially the legitimacy test, some drafting proposals have been made in the present opinion that should be taken into account by the legislator. Reference is made in particular to points 67, 73, 77, 80, 90, 93, 106, 109 and 111 of the opinion. |
| --- | --- |

113.

Should the comments above be complied with, especially the legitimacy test, some drafting proposals have been made in the present opinion that should be taken into account by the legislator. Reference is made in particular to points 67, 73, 77, 80, 90, 93, 106, 109 and 111 of the opinion.

Legitimacy of the proposed measures

| 114. | While the general purpose to fight against terrorism and organised crime is in itself clear and legitimate, the core of the processing to be put in place is not sufficiently circumscribed and justified. |
| --- | --- |

114.

While the general purpose to fight against terrorism and organised crime is in itself clear and legitimate, the core of the processing to be put in place is not sufficiently circumscribed and justified.

| 115. | The EDPS considers that techniques consisting of assessing the risk presented by individuals using data mining tools and behavioural patterns need to be further assessed, and their utility be clearly established in the framework of the fight against terrorism, before they are used on such a wide scale. |
| --- | --- |

115.

The EDPS considers that techniques consisting of assessing the risk presented by individuals using data mining tools and behavioural patterns need to be further assessed, and their utility be clearly established in the framework of the fight against terrorism, before they are used on such a wide scale.

| 116. | Building upon different data bases without a global view on the concrete results and shortcomings:






  — | Is contrary to a rational legislative policy in which new instruments must not be adopted before existing instruments have been fully implemented and proved to be insufficient. |
| --- | --- | --- |

116.

Building upon different data bases without a global view on the concrete results and shortcomings:

—

Is contrary to a rational legislative policy in which new instruments must not be adopted before existing instruments have been fully implemented and proved to be insufficient.

| — | Might otherwise lead to a move towards a total surveillance society. |
| --- | --- |

—

Might otherwise lead to a move towards a total surveillance society.

| 117. | The fight against terrorism can certainly be a legitimate ground to apply exceptions to the fundamental rights to privacy and data protection. However, to be valid, the necessity of the intrusion must be supported by clear and undeniable elements, and the proportionality of the processing must be demonstrated. This is all the more required in case of extensive intrusion in the privacy of individuals, as foreseen in the proposal. |
| --- | --- |

117.

The fight against terrorism can certainly be a legitimate ground to apply exceptions to the fundamental rights to privacy and data protection. However, to be valid, the necessity of the intrusion must be supported by clear and undeniable elements, and the proportionality of the processing must be demonstrated. This is all the more required in case of extensive intrusion in the privacy of individuals, as foreseen in the proposal.

| 118. | These elements of justification are missing in the proposal and the necessity and proportionality tests are not fulfilled. |
| --- | --- |

118.

These elements of justification are missing in the proposal and the necessity and proportionality tests are not fulfilled.

| 119. | The EDPS insists on the essential character of the necessity and proportionality tests developed above. They represent a condicio sine qua non to the entry into force of the proposal. |
| --- | --- |

119.

The EDPS insists on the essential character of the necessity and proportionality tests developed above. They represent a condicio sine qua non to the entry into force of the proposal.

Applicable legal framework

| 120. | The EDPS notes a serious lack of legal certainty as to the regime applicable to the different actors involved in the project, and in particular to airlines and other first pillar actors: be it the rules of the proposal, the rules of the data protection framework decision or the national legislation implementing Directive 95/46/EC. The legislator should make clear at what stages of the processing these different rules will apply. |
| --- | --- |

120.

The EDPS notes a serious lack of legal certainty as to the regime applicable to the different actors involved in the project, and in particular to airlines and other first pillar actors: be it the rules of the proposal, the rules of the data protection framework decision or the national legislation implementing Directive 95/46/EC. The legislator should make clear at what stages of the processing these different rules will apply.

| 121. | The present trend to impose cooperation for law enforcement purposes on private actors on a systematic basis raises the question which data protection framework (first or third pillar) applies to the conditions of this cooperation: it is not clear whether the rules should be based on the quality of the data controller (private sector) or on the purpose followed (law enforcement). |
| --- | --- |

121.

The present trend to impose cooperation for law enforcement purposes on private actors on a systematic basis raises the question which data protection framework (first or third pillar) applies to the conditions of this cooperation: it is not clear whether the rules should be based on the quality of the data controller (private sector) or on the purpose followed (law enforcement).

| 122. | The EDPS has already stressed the risk of a legal loophole between the first and third pillar activities (51). It is indeed far from clear whether activities by private companies, in some way connected with enforcement of criminal law, are covered by the field of action of the European Union legislator under the Articles 30, 31 and 34 TEU. |
| --- | --- |

122.

The EDPS has already stressed the risk of a legal loophole between the first and third pillar activities (51). It is indeed far from clear whether activities by private companies, in some way connected with enforcement of criminal law, are covered by the field of action of the European Union legislator under the Articles 30, 31 and 34 TEU.

| 123. | An outcome in which processing by service providers for different purposes would be subject to different frameworks for data protection should be avoided, especially considering the difficulties this would create in terms of exercise of rights by data subjects. |
| --- | --- |

123.

An outcome in which processing by service providers for different purposes would be subject to different frameworks for data protection should be avoided, especially considering the difficulties this would create in terms of exercise of rights by data subjects.

Quality of recipients

| 124. | The proposal should provide for a specification with regard to the quality of the recipients of personal data collected by airlines, be it for intermediaries, Passenger Information Units, or competent authorities. |
| --- | --- |

124.

The proposal should provide for a specification with regard to the quality of the recipients of personal data collected by airlines, be it for intermediaries, Passenger Information Units, or competent authorities.

| 125. | The quality of the recipient, that could in some cases be private sector actors, is in direct relation with the type of data protection guarantees applying to that recipient. It is essential that the applicable regime be clear for all actors involved, including the legislator, the data protection authorities, as well as data controllers and data subjects involved. |
| --- | --- |

125.

The quality of the recipient, that could in some cases be private sector actors, is in direct relation with the type of data protection guarantees applying to that recipient. It is essential that the applicable regime be clear for all actors involved, including the legislator, the data protection authorities, as well as data controllers and data subjects involved.

Transfer of data to third countries

| 126. | The EDPS stresses the need to ensure that an adequate level of protection is provided in the recipient country. He also questions the significance of the ‘reciprocity’ principle mentioned in the proposal, and its application to countries already bound by an agreement with the EU, like Canada or the US. He considers it to be of the utmost importance that the conditions of transfer of PNR data to third countries be coherent and subject to a harmonised level of protection. |
| --- | --- |

126.

The EDPS stresses the need to ensure that an adequate level of protection is provided in the recipient country. He also questions the significance of the ‘reciprocity’ principle mentioned in the proposal, and its application to countries already bound by an agreement with the EU, like Canada or the US. He considers it to be of the utmost importance that the conditions of transfer of PNR data to third countries be coherent and subject to a harmonised level of protection.

Other substantive points

| 127. | The EDPS also draws the attention of the legislator to specific aspects of the proposal that need more precision or a better taking into account of data protection principle. This is the case in particular with regard the following aspects:






  — | the conditions in which automated decisions can be taken should be restricted, |
| --- | --- | --- |

127.

The EDPS also draws the attention of the legislator to specific aspects of the proposal that need more precision or a better taking into account of data protection principle. This is the case in particular with regard the following aspects:

—

the conditions in which automated decisions can be taken should be restricted,

| — | the quantity of data processed should be reduced, |
| --- | --- |

—

the quantity of data processed should be reduced,

| — | the method of transfer of data should solely rely on push, |
| --- | --- |

—

the method of transfer of data should solely rely on push,

| — | the data retention period is considered as excessive and not justified, |
| --- | --- |

—

the data retention period is considered as excessive and not justified,

| — | the role of the committee of Member States could be more precise with regard to its guidance on ‘risk assessment’, |
| --- | --- |

—

the role of the committee of Member States could be more precise with regard to its guidance on ‘risk assessment’,

| — | the security measures should include a ‘security breach notification’ procedure, |
| --- | --- |

—

the security measures should include a ‘security breach notification’ procedure,

| — | the review of the decision should include a sunset clause, |
| --- | --- |

—

the review of the decision should include a sunset clause,

| — | the proposal should make clear that it does not have any impact on instruments with a broader scope having namely as object the protection of fundamental rights. |
| --- | --- |

—

the proposal should make clear that it does not have any impact on instruments with a broader scope having namely as object the protection of fundamental rights.

Final observations

| 128. | The EDPS notes that the present proposal is made at a moment when the institutional context of the European Union is about to change fundamentally. The consequences of the Lisbon Treaty in terms of decision making will be fundamental, especially with regard to the role of the Parliament. |
| --- | --- |

128.

The EDPS notes that the present proposal is made at a moment when the institutional context of the European Union is about to change fundamentally. The consequences of the Lisbon Treaty in terms of decision making will be fundamental, especially with regard to the role of the Parliament.

| 129. | Considering the unprecedented impact of the proposal in terms of fundamental rights, the EDPS advises not to adopt it under the present Treaty Framework, but to ensure it follows the co-decision procedure foreseen by the new Treaty. This would strengthen the legal grounds on which the decisive measures envisaged in the proposal would be taken. |
| --- | --- |

129.

Considering the unprecedented impact of the proposal in terms of fundamental rights, the EDPS advises not to adopt it under the present Treaty Framework, but to ensure it follows the co-decision procedure foreseen by the new Treaty. This would strengthen the legal grounds on which the decisive measures envisaged in the proposal would be taken.

---

(1)  OJ L 281, 23.11.1995, p. 31.

(2)  OJ L 8, 12.1.2001, p. 1.

(3)  Including Member States, Data Protection Authorities and airlines associations. This questionnaire had been prepared in view of the preparation of an impact assessment by the European Commission on the present proposal.

(4)  Agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS) (2007 PNR Agreement) (OJ L 204, 4.8.2007, p. 18).

(5)  Agreement between the European Community and the Government of Canada on the processing of Advance Passenger Information and Passenger Name Record data (OJ L 82, 21.3.2006, p. 15).

(6)  Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data (OJ L 261, 6.8.2004, p. 24).

(7)  The latest draft of this proposal is available on Council register as document number 16397/07.

(8)  Joint opinion on the proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes, presented by the Commission on 6 November 2007, adopted by the Article 29 Working Party on 5 December 2007 and by the Working Party on Police and Justice on 18 December 2007, WP 145, WPPJ 01/07.

(9)  Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of the Council of Europe, 28 January 1981.

(10)  Explanatory Memorandum of the proposal, Chapter I.

(11)  Impact assessment, Chapter 2.1, ‘Description of the problem’.

(12)  This definition comes from a recent study on profiling of the Council of Europe: L'application de la Convention 108 au mécanisme de profilage, Eléments de réflexion destinés au travail futur du Comité consultatif (T-PD), Jean-Marc Dinant, Christophe Lazaro, Yves Poullet, Nathalie Lefever, Antoinette Rouvroy, November 2007 (not published yet). See also the definition by Lee Bygrave: ‘Generally speaking, profiling is the process of inferring a set of characteristics (typically behavioural) about an individual person or collective entity and then treating that person/entity (or other persons/entities) in the light of these characteristics. As such, the profiling process has two main components: (i) profile generation — the process of inferring a profile; (ii) profile application — the process of treating persons/entities in light of this profile’ . L. A. BYGRAVE, Minding the machine: Article 15 of the EC Data Protection Directive and Automated Profiling, Computer Law & Security Report, 2001, vol. 17, pp. 17-24

http://www.austlii.edu.au/au/journals/PLPR/2000/40.html

(13)  Rotaru v. Romania, No 28341/95, §§ 50, 52 and 55.

See also Amann v. Switzerland, No 27798/95, §§ 50 et s.

(14)  Chapter 2.1., ‘Description of the problem’.

(15)  See e.g. the report of the United States Government Accountability Office to congressional requesters, May 2007, ‘Aviation Security: Efforts to Strengthen International Passenger Prescreening are Under Way, but Planning and Implementation Issues remain’

http://www.gao.gov/new.items/d07346.pdf

(16)  According to article 9 of Convention 108, ‘derogation from the provisions of Articles 5, 6 and 8 of this convention shall be allowed when such derogation is provided for by the law of the Party and constitutes a necessary measure in a democratic society in the interests of:

| 1. | protecting State security, public safety, the monetary interests of the State or the suppression of criminal offences; |
| --- | --- |

1.

protecting State security, public safety, the monetary interests of the State or the suppression of criminal offences;

| 2. | protecting the data subject or the rights and freedoms of others.’ |
| --- | --- |

2.

protecting the data subject or the rights and freedoms of others.’

(17)  Council decision 2004/512/EC of 8 June 2004 establishing the Visa Information System (VIS) (OJ L 213, 15.6.2004, p. 5). Proposal for a Regulation of the European Parliament and of the Council concerning the Visa Information System (VIS) and the exchange of data between Member States on short stay-visas, COM(2005) 0835 final; Proposal for a Council Decision concerning access for consultation of the Visa Information System (VIS) by the authorities of Member States responsible for internal security and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences, COM(2005) 0600 final.

(18)  See in particular Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II) (OJ L 205, 7.8.2007).

(19)  See on this issue: Opinion of the European Data Protection Supervisor on the Proposal for a Council Decision concerning access for consultation of the Visa Information System (VIS) by the authorities of Member States responsible for internal security and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences (COM(2005) 600 final) (OJ C 97, 25.4.2006, p. 6).

(20)  See the EDPS Opinions on the Prüm Decisions: Opinion of 4 April 2007 on the initiative of 15 Member States with a view to adopting a Council Decision on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime (OJ C 169, 21.7.2007, p. 2), and Opinion of 19 December 2007 on the Initiative of the Federal Republic of Germany, with a view to adopting a Council Decision on the implementation of Decision 2007/.../JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, available at:

http://www.edps.europa.eu

(21)  This point has been made several times by the EDPS, most recently in its opinion of 25 July 2007 on the Implementation of the Data Protection Directive (OJ C 255, 27.10.2007, p. 1).

(22)  Article 6.3 of the proposal and Impact assessment, Annex A, ‘Method of transmission of the data by the carriers’.

(23)  Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, p. 31).

(24)  See in this respect the consequences of the PNR judgement. Judgement of the Court of 30 May 2006, European Parliament v Council (C-317/04) and Commission (C-318/04), Joined cases C-317/04 and C-318/04, ECR [2006], Point 56.

(25)  Article 11 of the proposal. See also recital 10 of the preamble: ‘The Council Framework Decision on the Protection of Personal Data Processed in the Framework of Police and Judicial Cooperation in Criminal Matters (...) should be applicable to all the data processed in accordance with this Framework Decision. The rights of the data subjects in relation to such processing, such as the right to information, the right of access, the right of rectification, erasure and blocking, as well as the rights to compensation and judicial remedies should be those provided under that framework decision’.

(26)  Recital 5(a), version of 11 December 2007 of the data protection framework decision.

(27)  Article 1.

(28)  With regard to this point, the text of Article 27b of the latest draft of the Framework decision on data protection in the third pillar should be carefully considered and discussed.

(29)  Judgement of the Court of 30 May 2006, European Parliament v Council (C-317/04) and Commission (C-318/04), Joined cases C-317/04 and C-318/04, ECR [2006], Point 56.

(30)  Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC (OJ L 105, 13.4.2006, p. 54).

(31)  See the Opinion of the European Data Protection Supervisor on the Communication from the Commission to the European Parliament and the Council on the follow-up of the Work Programme for better implementation of the Data Protection Directive (OJ C 255, 27.10.2007, p. 1). See also the Annual Report 2006, p. 47.

(32)  Article 6 of the proposal.

(33)  SITA was created in 1949 by 11 member airlines. Value-added solutions are provided to air transport industry through the commercial company SITA INC (Information, Networking Computing) and network services through SITA SC on a co-operative basis.

(34)  Impact assessment, Annex A, ‘Method of transmission of the data by the carriers’.

(35)  Article 3 of the proposal.

(36)  Article 8 of the proposal.

(37)  Opinion of the EDPS of 26 June 2007 on the Proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters, points 27 to 30 (OJ C 139, 23.6.2007, p. 1).

(38)  Explanatory Memorandum of the proposal, Chapter 2.

(39)  Impact assessment, Chapter 5.2., ‘Protection of privacy’.

(40)  Impact assessment, Chapter 5.2., ‘Relations with third countries’.

(41)  Impact assessment, Annex A, ‘Bodies receiving data from the Passenger Information Units’.

(42)  Recital 20 and Article 3.3 and 3.5 of the proposal.

(43)  See in this respect Article 15.1 of Directive 95/46/EC. The Directive prohibits such automated decisions in cases where the individual would be affected by the decision. With regard to the context of the proposal, decisions in a law enforcement framework are likely to affect severely the data subjects in any case. Also the fact of being subject to secondary checks can affect the data subject, especially if these actions are taken repeatedly.

(44)  See in particular Opinion No 5/2007 of 17 August 2007 on the follow-up agreement between the European Union and the United States of America on the processing and transfer of passenger name record (PNR) data by air carriers to the United States Department of Homeland Security concluded in July 2007, WP 138.

(45)  Impact assessment, Annex A, ‘Method of transmission of the data by the carriers’.

(46)  Impact assessment, Annex A, ‘Data retention period’.

(47)  Impact assessment, annex B.

(48)  Article 12 of the proposal.

(49)  See in particular the works of the American ‘Identity Theft Task Force’:

http://www.idtheft.gov/

(50)  See the link to the British HM Revenue and Customs website:

http://www.hmrc.gov.uk/childbenefit/update-faqs.htm

See also:

http://news.bbc.co.uk/1/hi/uk_politics/7103566.stm

(51)  See the Opinion of the European Data Protection Supervisor on the Communication from the Commission to the European Parliament and the Council on the follow-up of the Work Programme for better implementation of the Data Protection Directive (OJ C 255, 27.10.2007, p. 1). See also Annual Report 2006, p. 47.

---

II Information

INFORMATION FROM EUROPEAN UNION INSTITUTIONS AND BODIES

Commission

| 1.5.2008 | EN | Official Journal of the European Union | C 110/16 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/16

---

Authorisation for State aid pursuant to Articles 87 and 88 of the EC Treaty

Cases where the Commission raises no objections

(2008/C 110/02)

| Date of adoption of the decision | 13.2.2008 |
| --- | --- |
| Reference number of the aid | N 666/07 |
| Member State | Lithuania |
| Region | — |
| Title (and/or name of the beneficiary) | Pagalba, skirta kompensuoti draudimo įmokas |
| Legal basis | Lietuvos Respublikos žemės ūkio ir kaimo plėtros įstatymas, 2002 m. birželio 25 d. Nr. IX – 987 (Žin., 2002, Nr. 72-3009)






  — | Draudimo įmokų dalinio kompensavimo taisyklės, patvirtintos Žemės ūkio ministro 2004 m. kovo 4 d. įsakymu Nr. 3D-92 „Dėl draudimo įmokų dalinio kompensavimo taisyklių patvirtinimo“ (Žin., 2004, Nr. 38-1253, 2007, Nr. 46-1757) |

Date of adoption of the decision

13.2.2008

Reference number of the aid

N 666/07

Member State

Lithuania

Region

—

Title (and/or name of the beneficiary)

Pagalba, skirta kompensuoti draudimo įmokas

Legal basis

Lietuvos Respublikos žemės ūkio ir kaimo plėtros įstatymas, 2002 m. birželio 25 d. Nr. IX – 987 (Žin., 2002, Nr. 72-3009)

—

Draudimo įmokų dalinio kompensavimo taisyklės, patvirtintos Žemės ūkio ministro 2004 m. kovo 4 d. įsakymu Nr. 3D-92 „Dėl draudimo įmokų dalinio kompensavimo taisyklių patvirtinimo“ (Žin., 2004, Nr. 38-1253, 2007, Nr. 46-1757)

| — | Žemės ūkio ministro  įsakymo „Dėl Žemės ūkio ministro 2004 m. kovo 4 d. įsakymo Nr. 3D-92 „Dėl draudimo įmokų dalinio kompensavimo taisyklių patvirtinimo“ pakeitimo“ projektas |
| --- | --- |

—

Žemės ūkio ministro  įsakymo „Dėl Žemės ūkio ministro 2004 m. kovo 4 d. įsakymo Nr. 3D-92 „Dėl draudimo įmokų dalinio kompensavimo taisyklių patvirtinimo“ pakeitimo“ projektas

Type of measure

Reimbursement of insurance premiums

Objective

Sectoral development

Form of aid

Direct grant

Budget

Total budget: 180 000 000 LTL

Intensity

50 % of eligible costs

Duration

Until 31.12.2013

Economic sectors

Agricultural sector

Name and address of the granting authority

| Lietuvos Respublikos žemės ūkio ministerija |
| --- |
| Gedimino pr. 19 |
| LT-01103 Vilnius |

Lietuvos Respublikos žemės ūkio ministerija

Gedimino pr. 19

LT-01103 Vilnius

Other information

—

The authentic text(s) of the decision, from which all confidential information has been removed, can be found at:

http://ec.europa.eu/community_law/state_aids/

---

| 1.5.2008 | EN | Official Journal of the European Union | C 110/17 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/17

---

Non-opposition to a notified concentration

(Case COMP/M.5084 — PARE/Acea/JV)

(Text with EEA relevance)

(2008/C 110/03)

On 18 April 2008, the Commission decided not to oppose the above notified concentration and to declare it compatible with the common market. This decision is based on Article 6(1)(b) of Council Regulation (EC) No 139/2004. The full text of the decision is available only in Italian and will be made public after it is cleared of any business secrets it may contain. It will be available:

| — | from the Europa competition web site (http://ec.europa.eu/comm/competition/mergers/cases/). This web site provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes, |
| --- | --- |

—

from the Europa competition web site (http://ec.europa.eu/comm/competition/mergers/cases/). This web site provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

| — | in electronic form on the EUR-Lex website under document number 32008M5084. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu). |
| --- | --- |

—

in electronic form on the EUR-Lex website under document number 32008M5084. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu).

---

| 1.5.2008 | EN | Official Journal of the European Union | C 110/17 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/17

---

Non-opposition to a notified concentration

(Case COMP/M.5104 — Altor Fund II/Papyrus)

(Text with EEA relevance)

(2008/C 110/04)

On 21 April 2008, the Commission decided not to oppose the above notified concentration and to declare it compatible with the common market. This decision is based on Article 6(1)(b) of Council Regulation (EC) No 139/2004. The full text of the decision is available only in English and will be made public after it is cleared of any business secrets it may contain. It will be available:

| — | from the Europa competition web site (http://ec.europa.eu/comm/competition/mergers/cases/). This web site provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes, |
| --- | --- |

—

from the Europa competition web site (http://ec.europa.eu/comm/competition/mergers/cases/). This web site provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

| — | in electronic form on the EUR-Lex website under document number 32008M5104. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu). |
| --- | --- |

—

in electronic form on the EUR-Lex website under document number 32008M5104. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu).

---

| 1.5.2008 | EN | Official Journal of the European Union | C 110/18 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/18

---

Non-opposition to a notified concentration

(Case COMP/M.4784 — Suez Environnement/SITA)

(Text with EEA relevance)

(2008/C 110/05)

On 17 April 2008, the Commission decided not to oppose the above notified concentration and to declare it compatible with the common market. This decision is based on Article 6(1)(b) of Council Regulation (EC) No 139/2004. The full text of the decision is available only in English and will be made public after it is cleared of any business secrets it may contain. It will be available:

| — | from the Europa competition web site (http://ec.europa.eu/comm/competition/mergers/cases/). This web site provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes, |
| --- | --- |

—

from the Europa competition web site (http://ec.europa.eu/comm/competition/mergers/cases/). This web site provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

| — | in electronic form on the EUR-Lex website under document number 32008M4784. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu). |
| --- | --- |

—

in electronic form on the EUR-Lex website under document number 32008M4784. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu).

---

| 1.5.2008 | EN | Official Journal of the European Union | C 110/18 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/18

---

Non-opposition to a notified concentration

(Case COMP/M.5092 — GDF/Suez/Teesside Power)

(Text with EEA relevance)

(2008/C 110/06)

On 21 April 2008, the Commission decided not to oppose the above notified concentration and to declare it compatible with the common market. This decision is based on Article 6(1)(b) of Council Regulation (EC) No 139/2004. The full text of the decision is available only in English and will be made public after it is cleared of any business secrets it may contain. It will be available:

| — | from the Europa competition web site (http://ec.europa.eu/comm/competition/mergers/cases/). This web site provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes, |
| --- | --- |

—

from the Europa competition web site (http://ec.europa.eu/comm/competition/mergers/cases/). This web site provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

| — | in electronic form on the EUR-Lex website under document number 32008M5092. EUR-Lex is the on-rline access to European law (http://eur-lex.europa.eu). |
| --- | --- |

—

in electronic form on the EUR-Lex website under document number 32008M5092. EUR-Lex is the on-rline access to European law (http://eur-lex.europa.eu).

---

| 1.5.2008 | EN | Official Journal of the European Union | C 110/19 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/19

---

Non-opposition to a notified concentration

(Case COMP/M.5061 — Renault/Russian Technologies/AvtoVaz)

(Text with EEA relevance)

(2008/C 110/07)

On 8 April 2008, the Commission decided not to oppose the above notified concentration and to declare it compatible with the common market. This decision is based on Article 6(1)(b) of Council Regulation (EC) No 139/2004. The full text of the decision is available only in English and will be made public after it is cleared of any business secrets it may contain. It will be available:

| — | from the Europa competition web site (http://ec.europa.eu/comm/competition/mergers/cases/). This web site provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes, |
| --- | --- |

—

from the Europa competition web site (http://ec.europa.eu/comm/competition/mergers/cases/). This web site provides various facilities to help locate individual merger decisions, including company, case number, date and sectoral indexes,

| — | in electronic form on the EUR-Lex website under document number 32008M5061. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu). |
| --- | --- |

—

in electronic form on the EUR-Lex website under document number 32008M5061. EUR-Lex is the on-line access to European law (http://eur-lex.europa.eu).

---

IV Notices

NOTICES FROM EUROPEAN UNION INSTITUTIONS AND BODIES

Commission

| 1.5.2008 | EN | Official Journal of the European Union | C 110/20 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/20

---

Euro exchange rates (1)

30 April 2008

(2008/C 110/08)

1 euro=

| | Currency | Exchange rate |
| --- | --- | --- |
| USD | US dollar | 1,5540 |
| JPY | Japanese yen | 162,62 |
| DKK | Danish krone | 7,4620 |
| GBP | Pound sterling | 0,79015 |
| SEK | Swedish krona | 9,3575 |
| CHF | Swiss franc | 1,6147 |
| ISK | Iceland króna | 115,88 |
| NOK | Norwegian krone | 7,9740 |
| BGN | Bulgarian lev | 1,9558 |
| CZK | Czech koruna | 25,205 |
| EEK | Estonian kroon | 15,6466 |
| HUF | Hungarian forint | 253,32 |
| LTL | Lithuanian litas | 3,4528 |
| LVL | Latvian lats | 0,6983 |
| PLN | Polish zloty | 3,4515 |
| RON | Romanian leu | 3,6790 |
| SKK | Slovak koruna | 32,229 |
| TRY | Turkish lira | 2,0030 |
| AUD | Australian dollar | 1,6614 |
| CAD | Canadian dollar | 1,5689 |
| HKD | Hong Kong dollar | 12,1127 |
| NZD | New Zealand dollar | 1,9992 |
| SGD | Singapore dollar | 2,1149 |
| KRW | South Korean won | 1 562,55 |
| ZAR | South African rand | 11,8205 |
| CNY | Chinese yuan renminbi | 10,8586 |
| HRK | Croatian kuna | 7,2681 |
| IDR | Indonesian rupiah | 14 330,99 |
| MYR | Malaysian ringgit | 4,9091 |
| PHP | Philippine peso | 65,610 |
| RUB | Russian rouble | 36,8320 |
| THB | Thai baht | 49,215 |
| BRL | Brazilian real | 2,6430 |
| MXN | Mexican peso | 16,3597 |

Currency

Exchange rate

USD

US dollar

1,5540

JPY

Japanese yen

162,62

DKK

Danish krone

7,4620

GBP

Pound sterling

0,79015

SEK

Swedish krona

9,3575

CHF

Swiss franc

1,6147

ISK

Iceland króna

115,88

NOK

Norwegian krone

7,9740

BGN

Bulgarian lev

1,9558

CZK

Czech koruna

25,205

EEK

Estonian kroon

15,6466

HUF

Hungarian forint

253,32

LTL

Lithuanian litas

3,4528

LVL

Latvian lats

0,6983

PLN

Polish zloty

3,4515

RON

Romanian leu

3,6790

SKK

Slovak koruna

32,229

TRY

Turkish lira

2,0030

AUD

Australian dollar

1,6614

CAD

Canadian dollar

1,5689

HKD

Hong Kong dollar

12,1127

NZD

New Zealand dollar

1,9992

SGD

Singapore dollar

2,1149

KRW

South Korean won

1 562,55

ZAR

South African rand

11,8205

CNY

Chinese yuan renminbi

10,8586

HRK

Croatian kuna

7,2681

IDR

Indonesian rupiah

14 330,99

MYR

Malaysian ringgit

4,9091

PHP

Philippine peso

65,610

RUB

Russian rouble

36,8320

THB

Thai baht

49,215

BRL

Brazilian real

2,6430

MXN

Mexican peso

16,3597

---

(1)

Source: reference exchange rate published by the ECB.

---

NOTICES FROM MEMBER STATES

| 1.5.2008 | EN | Official Journal of the European Union | C 110/21 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/21

---

Information communicated by Member States regarding state aid granted under Commission Regulation (EC) No 70/2001 on the application of Articles 87 and 88 of the EC Treaty to state aid to small and medium-sized enterprises

(2008/C 110/09)

Aid No: XA 7002/08

Member State: Italy

Region: Regione autonoma Valle d'Aosta

Title of aid scheme: Aiuti alle aziende operanti nel settore della trasformazione e commercializzazione dei prodotti agricoli

Legal basis: Art. 56 del titolo III (Disciplina degli interventi regionali in materia di agricoltura e di sviluppo rurale. Modificazioni alle leggi regionali 16 novembre 1999, n. 36, e 28 aprile 2003, n. 18) della legge regionale 12 dicembre 2007, n. 32 «Disposizioni per la formazione del bilancio annuale e pluriennale della Regione autonoma Valle d'Aosta (Legge finanziaria per gli anni 2008/2010). Modificazioni di leggi regionali.»

Annual expenditure planned under the scheme: EUR 0,5 million

Maximum aid intensity: 40 % of eligible costs for investments in tangible and intangible fixed assets, including associated consultancy costs.

Where the aid is granted as an interest subsidy or in the form of a subsidised loan, the gross grant equivalent is calculated using the appropriate IT programme, which applies the reference rate as periodically determined by the Commission

Date of implementation: after a period of 20 working days following the date on which the Commission receives the summary

Duration of aid scheme: under the scheme, aid may be granted until 31 December 2013 and for six months thereafter

Objective of aid: to assist small and medium-sized enterprises engaged in the processing and marketing of agricultural products, i.e. promote rational business management by reducing production costs, enhancing production and quality and making improvements to the natural environment and to the hygiene and welfare conditions of the animals.

Reference to Community legislation: Article 4 of Regulation (EC) No 70/2001

Sector(s) concerned: Small and medium-sized enterprises engaged in the processing and marketing of agricultural products

Name and address of the granting authority:

Internet address: http://www.regione.vda.it/gestione/sezioni_web/allegato.asp?pk_allegato=1247

Saint-Christophe

Coordinator, Agriculture Department

Emanuele DUPONT

---

| 1.5.2008 | EN | Official Journal of the European Union | C 110/22 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/22

---

Information communicated by Member States regarding State aid granted under Commission Regulation (EC) No 1857/2006 on the application of Articles 87 and 88 of the EC Treaty to State aid to small and medium-sized enterprises active in the production of agricultural products and amending Regulation (EC) No 70/2001

(2008/C 110/10)

Aid No: XA 383/07

Member State: Spain

Region: Navarra

Title of aid scheme or name of company receiving an individual aid: Ayudas a las inversiones, en régimen asociativo, en equipamiento informático y material de apoyo a las explotaciones agrarias

Legal basis: Orden Foral de la Consejera de Desarrollo Rural y Medio Ambiente por la que se establecen las normas reguladoras que regirán la concesión de ayudas a las inversiones, en régimen asociativo, en equipamiento informático y material de apoyo a las explotaciones agrarias

Annual expenditure planned under the scheme or overall amount of individual aid granted to the company: EUR 200 000 annually, with the exception of 2007 when there was an annual expenditure of EUR 160 000

Maximum aid intensity: Aid of up to 40 % of eligible investments in agricultural undertakings

Date of application:

Duration of scheme or individual aid award: 1 December 2007 to 31 December 2010

Objective of aid: The main objectives of the aid are the following:

Article 4 of Regulation (EC) No 1857/2006: Investment in agricultural holdings. Eligible expenses: Article 4(4)(b) Aid for the purchase of equipment, including computer software

Sector(s) concerned: The primary agricultural production sector

Name and address of the granting authority:

| Gobierno de Navarra |
| --- |
| Departamento de Desarrollo Rural y Medio Ambiente |
| C/ Tudela, 20 |
| E-31003 Pamplona (Navarra) |

Gobierno de Navarra

Departamento de Desarrollo Rural y Medio Ambiente

C/ Tudela, 20

E-31003 Pamplona (Navarra)

Internet address: http://www.cfnavarra.es/agricultura/COYUNTURA/AyudasEstado/pdfs/STNO07067%20OF.pdf

Other information:

| Dirección General de Desarrollo Rural |
| --- |
| C/ Tudela, 20 |
| E-31003 Pamplona |
| Tlf: (34-848) 42 29 33 |
| E-mail: izabalzv@cfnavarra.es |
| Gobierno de Navarra |

Dirección General de Desarrollo Rural

C/ Tudela, 20

E-31003 Pamplona

Tlf: (34-848) 42 29 33

E-mail: izabalzv@cfnavarra.es

Gobierno de Navarra

Aid No: XA 385/07

Member State: Belgium

Region: Vlaanderen

Title of aid scheme or name of company receiving individual aid: Vlaams Centrum voor Agro- en Visserijmarketing vzw (VLAM)

Legal basis: Decreet van 22 december 2006 houdende de uitgavenbegroting van de Vlaamse Gemeenschap voor het begrotingsjaar 2007, inzonderheid artikel 12, gewijzigd bij het decreet van 29 juni 2007

Annual expenditure planned under the scheme or overall amount of individual aid granted to the company: A grant of EUR 120 000, broken down as follows for the three programmes:

EUR 62 000 for consultancy services provided,

EUR 11 000 for organising forums for the exchange of knowledge,

EUR 47 000 for publications

Maximum aid intensity: The aid intensity is 100 %

Date of implementation: Aid will start on 19 December 2007

Duration of scheme or individual aid award: Aid amounting to EUR 120 000 will be granted for activities carried out between 19 December 2007 and 31 July 2009

Objective of aid: The non-profit organisation VLAM wishes to undertake activities to encourage producers to participate in the PDO/PGI/TSG schemes.

By running this campaign, VLAM wishes to provide encouragement and guidance to producer groups and advise them on how to compile and submit an application dossier.

VLAM intends to undertake the following activities:

The aid is granted under Article 15 of Regulation (EC) No 1857/2006 and complies with that Article:

Article 15(2)(c): concerning consultancy services provided by third parties, the fees for services which do not constitute a continuous or periodic activity nor relate to the enterprise's usual operating expenditure, such as routine tax consultancy services, regular legal services or advertising.

Article 15(2)(d): concerning the organisation of and participation in forums to share knowledge between businesses, competitions, exhibitions and fairs.

Article 15(2)(f): publications such as catalogues or websites presenting factual information about producers from a given region or producers of a given product, provided the information and presentation is neutral and that all producers concerned have equal opportunities to be represented in the publication

Sector(s) concerned: The arable and livestock sectors

Name and address of the granting authority:

| Departement Landbouw en Visserij |
| --- |
| Duurzame Landbouwontwikkeling |
| Ellips, 6e verdieping |
| Koning Albert II laan 35, bus 40 |
| B-1030 Brussel |

Departement Landbouw en Visserij

Duurzame Landbouwontwikkeling

Ellips, 6e verdieping

Koning Albert II laan 35, bus 40

B-1030 Brussel

Internet address: http://www.ejustice.just.fgov.be/cgi/article_body.pl?numac=2007036508&caller=list&article_lang=N&row_id=1&numero=18&pub_date=2007-10-04&set3=set+character_variant+%27dutch.ftl%27&ddfm=12&dt=DECREET&language=nl&choix1=EN&choix2=EN&fromtab=+montxt&nl=n&trier=afkondiging&ddda=2006&sql=dt+%3D+%27DECREET%27+and+dd+between+date%272006-12-22%27+and+date%272006-12-22%27+&rech=18&tri=dd+AS+RANK+&ddfa=2006&dddj=22&dddm=12&ddfj=22&set1=set+stopfile+%27MON.stp%27

Other information: Without this State aid, it would not be possible to achieve the programme's objective and it would be impossible to carry out the project.

Jules VAN LIEFFERINGE

Secretary-General

Aid No: XA 386/07

Member State: France

Region: Centre

Title of aid scheme or name of company receiving individual aid: «Aide à la création de maisons de cultures destinées à la production agricole»

A growing shed is a building in which agricultural production is carried out. It allows production to be carried out independently of weather conditions, while facilitating harvest and guaranteeing the health of the crop. The building has thermal insulation and controlled internal temperature, humidity and air flow. A group of buildings may also be equipped with a picking line

Legal basis:

| — | Article 4 of Regulation (EC) No 1857/2006 |
| --- | --- |

—

Article 4 of Regulation (EC) No 1857/2006

| — | Code général des collectivités territoriales (partie législative): articles L 1511-1 et L 1511-2 |
| --- | --- |

—

Code général des collectivités territoriales (partie législative): articles L 1511-1 et L 1511-2

| — | Délibération de la commission permanente régionale du 12 octobre 2007 |
| --- | --- |

—

Délibération de la commission permanente régionale du 12 octobre 2007

Annual expenditure planned under the scheme or overall amount of individual aid granted to the company:

| (EUR) |
| --- |
| Forecasts | 2007 | 2008 | 2009 | 2010 | 2011 | 2012 | 2013 |
| Grants | 200 000 | 200 000 | 200 000 | 200 000 | 200 000 | 200 000 | 200 000 |
| Aided investments | 500 000 | 500 000 | 500 000 | 500 000 | 500 000 | 500 000 | 500 000 |
| Number of holdings | 4 | 4 | 4 | 4 | 4 | 4 | 4 |

(EUR)

Forecasts

2007

2008

2009

2010

2011

2012

2013

Grants

200 000

200 000

200 000

200 000

200 000

200 000

200 000

Aided investments

500 000

500 000

500 000

500 000

500 000

500 000

500 000

Number of holdings

4

4

4

4

4

4

4

These amounts relate to the agricultural sector for the Centre region only

Under Article 4(4) of Regulation No 1857/2006 aid may be provided for investments to create growing sheds and in particular:

| (a) | the construction, acquisition or improvement of immovable property; |
| --- | --- |

(a)

the construction, acquisition or improvement of immovable property;

| (b) | the purchase or lease-purchase of new machinery and equipment, including computer software up to the market value of the asset; |
| --- | --- |

(b)

the purchase or lease-purchase of new machinery and equipment, including computer software up to the market value of the asset;

| (c) | general costs linked to expenditure under points (a) and (b), such as architects, engineers and consultation fees, feasibility studies, the acquisition of patents and licences |
| --- | --- |

(c)

general costs linked to expenditure under points (a) and (b), such as architects, engineers and consultation fees, feasibility studies, the acquisition of patents and licences

Maximum aid intensity: The maximum amount for which aid may be granted is EUR 150 000 per labour unit. A maximum of two labour units will be covered per holding. However, the limit is six labour units for holdings using labour-intensive production systems.

Under Article 4(9) of Regulation (EC) No 1857/2006, the maximum amount of aid granted to an individual enterprise must not exceed EUR 400 000 over any period of three fiscal years, or EUR 500 000 if the enterprise is situated in a less favoured area or in areas referred to in Article 36(a)(i), (ii) or (iii) of Council Regulation (EC) No 1698/2005, as designated by Member States in accordance with Articles 50 and 94 of that Regulation.

Only holdings meeting the conditions laid down in Article 4(5) of Regulation (EC) No 1857/2006 are eligible for aid.

The gross aid intensity increases as the total investment increases:

The Regional Council is responsible for half of the gross aid intensity. The General Councils of the Centre Region may provide additional funding for the scheme up to the authorised limits

Date of implementation: Following acknowledgement of receipt by the European Commission

Duration of scheme or individual aid: Until 31 December 2013, the date until which Regulation (EC) No 1857/2006 applies

Objectives of aid: To make holdings more competitive, improve product quality and reduce production costs (extension of the aid scheme registered under XA 16/05)

Sectors concerned: All agricultural production sectors except for horticultural and market garden greenhouses receiving or having received financial assistance under schemes already notified (N 572/01 and N 523/01)

Name and address of the granting authority:

| Conseil régional du Centre |
| --- |
| 9, rue St Pierre Lentin |
| F-45041 Orléans cedex 1 |
| Tél.: (33) 02 38 70 30 30 |
| Fax: (33) 02 38 70 31 18 |
| E-mail: Amanda.Tibble@regioncentre.fr |

Conseil régional du Centre

9, rue St Pierre Lentin

F-45041 Orléans cedex 1

Tél.: (33) 02 38 70 30 30

Fax: (33) 02 38 70 31 18

E-mail: Amanda.Tibble@regioncentre.fr

Web address: www.regioncentre.fr

Click on ‘le guide des aides’

Aid No: XA 399/07

Member State: Spain

Region: Cataluña

Title of aid scheme or name of company receiving individual aid: Ayudas para la incentivación de la mejora de la eficiencia energética en invernaderos agrícolas y en explotaciones de porcino

Legal basis: Orden ARP/XXX/2007, de 23 de octubre, por la que se aprueban las bases reguladoras de las ayudas para la incentivación de la mejora de la eficiencia energética en invernaderos agrícolas y en explotaciones porcinas, y se convocan las correspondientes al año 2007

Annual expenditure planned under the scheme or overall amount of individual aid granted: For 2007: EUR 478 800

Maximum aid intensity: The maximum subsidy per application will be 25 % of the eligible investment. It may be increased by:

5 % when the applicant is a young farmer,

2 % when the applicant is a woman

Date of application: October 2007

Duration of scheme or individual aid award:

Objective of the aid: The objective of the aid is to assist investment in agricultural holdings for the purpose of improving energy efficiency in greenhouses used for agricultural production and in pig production (Article 4).

Investment relating to the improvement of installations, insulation and covering, heating systems, ventilation and materials is eligible, as is any improvement which involves a quantifiable saving and improvement in energy efficiency in greenhouses used for agricultural production and on pig holdings.

The eligible costs are specified in Article 4(4)(a) and (b), i.e. those relating to construction, acquisition or improvement of installations, plus those relating to the purchase or lease-purchase of equipment and machinery needed to improve efficiency in greenhouses used for agricultural purposes and in pig holdings.

Overheads linked to the above expenditure, such as architects', engineers' and consultants' fees, feasibility studies and the acquisition of patents and licences, are not eligible

Sector(s) concerned: Production of products listed in Annex I to the Treaty, except for fishery and aquaculture products covered by Council Regulation (EC) No 104/2000 and products falling within CN codes 4502, 4503 and 4504 (cork products)

Name and address of the granting authority:

| Departamento de Agricultura, Alimentación y Acción Rural |
| --- |
| Generalitat de Catalunya |
| Gran Via de les Corts Catalanes, 612-614 |
| E-08007 Barcelona |

Departamento de Agricultura, Alimentación y Acción Rural

Generalitat de Catalunya

Gran Via de les Corts Catalanes, 612-614

E-08007 Barcelona

Web address: http://www.gencat.net/darp/c/serveis/ajuts/ajut.htm

Other information: —

Aid No: XA 400/07

Member State: Republic of Slovenia

Region: Območje občine Žužemberk

Title of aid scheme or name of company receiving individual aid: Dodeljevanje sredstev za ohranjanje in razvoj kmetijstva v občini Žužemberk za obdobje 2007–2013

Legal basis: Pravilnik o dodeljevanju sredstev iz naslova finančnih intervencij za ohranjanje in razvoj kmetijstva v občini Žužemberk za programsko obdobje 2007–2013 (II. Poglavje)

Annual expenditure planned under the scheme or overall amount of individual aid granted to the company:

| | 2007: EUR 70 000 |
| --- | --- |

2007: EUR 70 000

| | 2008: EUR 66 750 |
| --- | --- |

2008: EUR 66 750

| | 2009: EUR 67 500 |
| --- | --- |

2009: EUR 67 500

| | 2010: EUR 67 875 |
| --- | --- |

2010: EUR 67 875

| | 2011: EUR 68 250 |
| --- | --- |

2011: EUR 68 250

| | 2012: EUR 68 625 |
| --- | --- |

2012: EUR 68 625

| | 2013: EUR 69 000 |
| --- | --- |

2013: EUR 69 000

Maximum aid intensity:

1.   Investment in agricultural holdings:

| — | up to 50 % of eligible costs in less-favoured areas and up to 40 % of eligible costs in other areas. |
| --- | --- |

—

up to 50 % of eligible costs in less-favoured areas and up to 40 % of eligible costs in other areas.

The purpose of the aid is investment to purchase machinery and equipment to be used for agricultural production, to invest in permanent crops and to improve farmland.

2.   Conservation of traditional landscapes and buildings:

| — | for investment in non-productive features, up to 100 % of actual costs, |
| --- | --- |

—

for investment in non-productive features, up to 100 % of actual costs,

| — | for investment in productive assets on farms, up to 60 % of actual costs, or 75 % in less-favoured areas, provided that the investment does not entail any increase in the production capacity of the farm, |
| --- | --- |

—

for investment in productive assets on farms, up to 60 % of actual costs, or 75 % in less-favoured areas, provided that the investment does not entail any increase in the production capacity of the farm,

| — | additional aid may be granted at a rate of up to 100 % to cover the extra costs incurred by using traditional materials necessary to maintain the heritage features of buildings. |
| --- | --- |

—

additional aid may be granted at a rate of up to 100 % to cover the extra costs incurred by using traditional materials necessary to maintain the heritage features of buildings.

3.   Aid towards the payment of insurance premiums:

| — | the amount of municipal co-financing is the difference between the amount of co-financing of insurance premiums from the national budget and up to 50 % of eligible costs of an insurance premium for insuring crops and fruit and insuring livestock against disease. |
| --- | --- |

—

the amount of municipal co-financing is the difference between the amount of co-financing of insurance premiums from the national budget and up to 50 % of eligible costs of an insurance premium for insuring crops and fruit and insuring livestock against disease.

4.   Aid for land reparcelling:

| — | up to 100 % of actual legal and administrative costs incurred. |
| --- | --- |

—

up to 100 % of actual legal and administrative costs incurred.

5.   Aid to encourage the production of quality agricultural products:

| — | up to 100 % of actual costs incurred; this is to be provided in the form of subsidised services and must not involve direct payments of money to producers. |
| --- | --- |

—

up to 100 % of actual costs incurred; this is to be provided in the form of subsidised services and must not involve direct payments of money to producers.

6.   Provision of technical support in the agricultural sector:

| — | up to 100 % of eligible costs concerning farmers' education and training, consultancy services, the organisation of forums, competitions, exhibitions, fairs, publications and catalogues, the dissemination of scientific knowledge and the costs of replacement services. The aid is to be granted in the form of subsidised services and must not involve direct payments of money to producers |
| --- | --- |

—

up to 100 % of eligible costs concerning farmers' education and training, consultancy services, the organisation of forums, competitions, exhibitions, fairs, publications and catalogues, the dissemination of scientific knowledge and the costs of replacement services. The aid is to be granted in the form of subsidised services and must not involve direct payments of money to producers

Date of implementation: October 2007 (the aid will not be granted until a summary has been published on the European Commission's website)

Duration of scheme or individual aid award: until 31 December 2013

Objective of the aid: To support SMEs

Reference to articles in Regulation (EC) No 1857/2006 and eligible costs: Chapter II of the draft Rules on granting aid under financial measures for the preservation and development of agriculture in the municipality of Žužemberk for the programming period 2007-13 includes measures constituting State aid in accordance with the following articles of Commission Regulation (EC) No 1857/2006 of 15 December 2006 on the application of Articles 87 and 88 of the Treaty to State aid to small and medium-sized enterprises active in the production of agricultural products and amending Regulation (EC) No 70/2001 (OJ L 358, 16.12.2006, p. 3):

Article 4 of the Commission Regulation: Investment in agricultural holdings,

Article 5 of the Commission Regulation: Conservation of traditional landscapes and buildings,

Article 12 of the Commission Regulation: Aid towards the payment of insurance premiums,

Article 13 of the Commission Regulation: Aid for land reparcelling,

Article 14 of the Commission Regulation: Aid to encourage the production of quality agricultural products,

Article 15 of the Commission Regulation: Provision of technical support in the agricultural sector

Economic sector(s) concerned: Agriculture

Name and address of granting authority:

| Občina Žužemberk |
| --- |
| Grajski trg 33 |
| SLO-8360 Žužemberk |

Občina Žužemberk

Grajski trg 33

SLO-8360 Žužemberk

Internet address: http://www.uradni-list.si/1/ulonline.jsp?urlid=200790&dhid=91805

Other information:: The measure for the payment of insurance premiums to insure crops and fruit includes the following adverse climatic events which can be assimilated to natural disasters: spring frost, hail, lightning, fire caused by lightning, storm and floods.

The municipality's Rules meet the requirements of Regulation (EC) No 1857/2006 relating to the measures to be adopted by the municipality and the general provisions applicable (steps preceding grant of aid, cumulation, transparency and monitoring of aid)

Franc ŠKUFCA

Mayor of the Municipality of Žužemberk

---

V Announcements

ADMINISTRATIVE PROCEDURES

Commission

| 1.5.2008 | EN | Official Journal of the European Union | C 110/27 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/27

---

Call for proposals under the work programme of the Ambient Assisted Living (AAL) Joint Programme

(2008/C 110/11)

Notice is hereby given of the launch of a call for proposals under the work programme of the Ambient Assisted Living Joint Programme.

Proposals are invited for the following call:

AAL-2008-1.

Call documentation including deadline and budget is given in the call text, which is published on the following website:

http://www.aal-europe.eu

---

PROCEDURES RELATING TO THE IMPLEMENTATION OF THE COMMON COMMERCIAL POLICY

Commission

| 1.5.2008 | EN | Official Journal of the European Union | C 110/28 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/28

---

Notice concerning the anti-dumping measures in force in respect of imports into the Community of polyethylene terephthalate (PET) film originating in India: modification of the address of a company subject to an individual anti-dumping duty rate

(2008/C 110/12)

Council Regulation (EC) No 1292/2007 (OJ L 288, 6.11.2007. p. 1) imposed a definitive anti-dumping duty on imports of polyethylene terephthalate (PET) film originating in India following an expiry review pursuant to Article 11(2) of Council Regulation (EC) No 384/96 (OJ L 56, 6.3.1996, p. 1).

SRF Limited, a company located in India, whose exports to the Community of polyethylene terephthalate (PET) film are subject to an individual anti-dumping rate of 3,5 % by the aforementioned Regulation, has informed the Commission that on 7 November 2005 it has changed its address to:

| Block C, Sector 45 |
| --- |
| Greenwood City |
| Gurgaon 122003 |
| Haryana |
| India |

Block C, Sector 45

Greenwood City

Gurgaon 122003

Haryana

India

The company has argued that the change of address does not affect the right of the company to benefit from the individual duty rate applied to the company under its previous address of:

| Express Building 9-10 |
| --- |
| Bahadur Shah Zaraf Marg |
| New Delhi 110002 |
| India |

Express Building 9-10

Bahadur Shah Zaraf Marg

New Delhi 110002

India

The Commission has examined the information supplied and concluded that the change of address in no way affects the findings of Regulation (EC) No 1292/2007. Therefore, the reference to:

| ‘Express Building 9-10 |
| --- |
| Bahadur Shah Zaraf Marg |
| New Delhi 110002 |
| India’ |

‘Express Building 9-10

Bahadur Shah Zaraf Marg

New Delhi 110002

India’

should be read as:

| ‘Block C, Sector 45 |
| --- |
| Greenwood City |
| Gurgaon 122003 |
| Haryana |
| India’ |

‘Block C, Sector 45

Greenwood City

Gurgaon 122003

Haryana

India’

in Article 2.2 of Regulation (EC) No 1292/2007.

The Taric additional code A753 attributed to SRF limited remains unchanged.

---

| 1.5.2008 | EN | Official Journal of the European Union | C 110/29 |
| --- | --- | --- | --- |

1.5.2008

EN

Official Journal of the European Union

C 110/29

---

Planned closure of complaint 2005/4347

(2008/C 110/13)

The Commission services have completed their investigation of mass complaint case 2005/4347 regarding water management in the Lake Idro area with reference to an important site under Council Directive 92/43/EEC of 21 May 1992 on the conservation of natural habitats and of wild fauna and flora.

Following examination of the documentation submitted by the complainants and by the Italian authorities in the framework of the infringement procedure initiated by the Commission on 18 December 2005 (first letter of formal notice) and continued on 18 October 2006 (supplementary letter of formal notice), the Commission services have concluded that it is not possible, at this stage, to identify an infringement of Directive 92/43/EEC in the case in question. Consequently, the Commission services will propose to the Commission that the corresponding complaint case be closed.

Further details on the results of the examination may be found at the following website:

http://ec.europa.eu/community_law/complaints/multiple_complaints/

Should the complainants have new information about possible infringements of Community rules, this should be submitted to the Commission within a month of the publication of this notice.

This does not preclude the case being reopened and proceedings being re-initiated, should the Commission come into possession — even after closure — of new facts that could justify opening such a new procedure regarding the same issue.

---