COUNCIL DECISION 2006/729/CFSP/JHA
of 16 October 2006
on the signing, on behalf of the European Union, of an Agreement between the European Union and the United States of America on the processing and transfer of passenger name record (PNR) data by air carriers to the United States Department of Homeland Security
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on European Union, and in particular Articles 24 and 38 thereof,
Whereas:
(1)
On 27 June 2006 the Council decided to authorise the Presidency, assisted by the Commission, to open negotiations for an Agreement with the United States of America on the processing and transfer of passenger name record (PNR) data by air carriers to the United States Department of Homeland Security (DHS).
(2)
In view of the Undertakings issued on 11 May 2004 by DHS, Bureau of Customs and Border Protection (1), the United States can be considered as ensuring an adequate level of protection for PNR data transferred from the European Union concerning passenger flights to or from the United States.
(3)
The competent authorities in Member States may exercise their existing powers to suspend data flows to DHS in order to protect individuals with regard to the processing of their personal data if they consider that the processing of PNR data is not in accordance with the standards of protection provided for in the Undertakings given by DHS, or where a competent United States authority has determined that DHS is in breach of those standards, until compliance with those standards is assured.
(4)
The Agreement should be signed, subject to its conclusion at a later date.
(5)
The provisions of the Agreement should be applied on a provisional basis pending its entry into force,
HAS DECIDED AS FOLLOWS:
Article 1
The signing of the Agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security, is hereby approved on behalf of the European Union, subject to the conclusion of the said Agreement.
The text of the Agreement is attached to this Decision.
Article 2
The President of the Council is hereby authorised to designate the person(s) empowered to sign the Agreement on behalf of the European Union, subject to its conclusion.
Article 3
In accordance with point 7 of the Agreement, the provisions of the Agreement shall be applied on a provisional basis as of the date of its signature, pending its entry into force.
Article 4
1. Without prejudice to their powers to take action to ensure compliance with national provisions, the competent authorities in Member States may exercise their existing powers to suspend data flows to DHS in order to protect individuals with regard to the processing of their personal data in the following cases:
(a)
where a competent United States authority has determined that DHS is in breach of the applicable standards of protection; or
(b)
where there is a substantial likelihood that the applicable standards of protection are being infringed, there are reasonable grounds for believing that DHS is not taking or will not take adequate and timely steps to settle the case at issue, the continuing transfer would create an imminent risk of grave harm to data subjects, and the competent authorities in the Member States concerned have made reasonable efforts in the circumstances to provide DHS with notice and an opportunity to respond.
2. Suspension shall cease as soon as the standards of protection are assured and the competent authorities of the Member States concerned are notified thereof.
Article 5
1. Member States shall inform the Council and the Commission without delay when measures are adopted pursuant to Article 4.
2. The Member States and the Commission shall inform each other within the Council of any changes in the standards of protection and of cases where the action of bodies responsible for ensuring compliance with the applicable standards of protection by DHS fails to secure such compliance.
3. If the Council considers that the information collected pursuant to Article 4 and pursuant to paragraphs 1 and 2 of this Article provides evidence that the basic principles necessary for an adequate level of protection for natural persons are no longer being complied with, or that any body responsible for ensuring compliance with the applicable standards of protection by DHS is not effectively fulfilling its role, DHS shall be informed thereof and the Council shall take the necessary action with a view to suspending or terminating the Agreement.
Done at Luxembourg, 16 October 2006.