(b)Security of information exchange: Information sharing should take place through appropriate channels ensuring adequate data security and be fully compliant with international and national legal frameworks for the protection of personal data.

(a)Promotion of information sharing: case-by-case exchanges of PNR data among the law enforcement authorities of different ICAO contracting States should be promoted in order to improve international cooperation on the prevention, detection, investigation and prosecution of terrorism and serious crime.

(l)Oversight and accountability: the authorities using PNR data should be accountable to and supervised by an independent public authority with effective powers of investigation and enforcement that should be in a position to execute its tasks free from any influence, in particular from law enforcement authorities.

(k)Redress: individuals should have the right to effective administrative and judicial redress in case they consider that their rights to privacy and data protection have been infringed.

(j)Access, rectification and deletion: subject to necessary and proportionate restrictions, individuals should have the right to get access to, and the right to rectification of, their PNR data.

(i)Transparency and notice: subject to necessary and proportionate restrictions, individuals should be notified of the processing of their PNR data and be informed about the rights and means of redress afforded to them.

(h)Data security: appropriate measures must be taken to protect the security, confidentiality and integrity of the PNR data.

(g)Disclosure of PNR data to authorized authorities: the further disclosure of PNR data to other government authorities within the same State or to other ICAO contracting States on a case-by-case basis may only take place if the recipient authority exercises functions related to the fight against terrorism or serious transnational crime and ensures the same protections as those afforded by the disclosing authority.

(f)Data retention: the period of retention of the PNR data should be restricted and not be longer than necessary for the original objective pursued. Deletion of the data should be ensured in accordance with the legal requirements of the source country. At the end of the retention period, the PNR data should be deleted or anonymised.

(e)Automated processing of PNR data: automated processing should be based on objective, non-discriminatory and reliable, pre-established criteria and should not be used as the sole basis for any decisions with adverse legal effects or seriously affecting a person.

(d)Use of PNR data: the further processing of the PNR data should be limited to the purposes of the original transfer, based on objective criteria and subject to substantive and procedural conditions in line with the requirements applicable to the transfers of personal data.

(c)Scope of PNR data: the PNR data elements to be transferred by airlines should be clearly identified and exhaustively listed. This list should be standardised to ensure that such data is kept to the minimum, while preventing the processing of sensitive data, including data revealing a person’s racial or ethnic origins, political opinions or religious or philosophical beliefs, trade union membership, health, sexual life or sexual orientation.

(b)Purpose limitation: the purposes for which PNR data may be used by authorities should be clearly set and should be no wider than what is necessary in view of the aims to be achieved, in particular for law enforcement and border security purposes to fight terrorism and serious crime.

(a)Lawfulness, fairness and transparency of processing: there needs to be a lawful basis for the processing of personal data, in order to make individuals aware of the risks, safeguards and rights in relation to the processing of their personal data and of how to exercise their rights in relation to the processing.

(b)Comparison against pre-determined criteria and databases: the authorities should process PNR data using evidence-based criteria and databases that are relevant for the fight against terrorism and serious crime.

(a)Timing of transmission and processing: Subject to the appropriate guarantees for the protection of privacy of the persons concerned, PNR data can be made available well in advance of a flight's arrival or departure, and hence provide authorities with more time for processing and analysing the data, and potentially taking action.

(d)No obligation on the carriers to collect additional data: Carriers should not be required to collect additional PNR data compared to what they already do or to collect certain types of data, but only to transmit what they already collect as part of their business.

(c)Frequency of transmission: The frequency and the timing of PNR data transmissions should not create an unreasonable burden on carriers and should be limited to what is strictly necessary for the purposes of law enforcement and border security to fight terrorism and serious crime.

(b)Transmission protocols: The use of suitable, secure and open standard protocols as part of internationally accepted reference protocols for the transmission of PNR data should be encouraged with the aim of gradually increasing their uptake and eventually replacing proprietary standards.

(a)Method of transmission: In order to protect the personal data that is contained in the carriers' systems and to ensure that they remain in control of those systems, data should be transmitted using the 'push' system exclusively.

The Member States, acting jointly in the interests of the Union, shall support the inclusion of the following standards and principles in any future ICAO standards and recommended practices on PNR data:

(g)promote the development of an environment in which international air transport may develop in an open, liberalised and global market and continue to grow without compromising security, and while ensuring the introduction of relevant safeguards.

(f)continue to support the development, in all ICAO contracting States, of the capability to collect, process and analyse, in furtherance of ICAO SARPs, PNR data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms for the purpose of preventing, detecting and investigating terrorist offenses and related travel, as required by the United Nations Security Council Resolution 2396 (2017) of 21 December 2017;

(e)continue to support the development by ICAO of standards for the collection, use, processing and protection of PNR data, in line with the United Nations Security Council Resolution 2396 (2017) of 21 December 2017;

(d)promote the exchange of PNR data and the results of processing those data among the ICAO contracting States, where that is deemed necessary for the prevention, detection, investigation or prosecution of terrorist offences or serious crime, in full respect of fundamental rights and freedoms;

(c)promote the development of multilateral solutions compliant with fundamental rights concerning the transfer of PNR data by airlines to law enforcement authorities, in the interest of providing legal certainty, respect of fundamental rights and to streamline the obligations placed on air carriers;

(b)raise awareness, among all ICAO contracting States, of the Union standards and principles related to the transfer of PNR data, as resulting from the relevant Union law and the case law of the Court of Justice of the European Union;

(a)act in accordance with the objectives pursued by the Union within the framework of its PNR policy, notably to ensure security, to protect the life and safety of persons, and ensure full respect for fundamental rights, in particular the rights to privacy and the protection of personal data;

Within the framework of the activities of the International Civil Aviation Organisation (ICAO) in respect of the revision of Chapter 9 of Annex 9 (‘Facilitation’) to the Chicago Convention concerning the development of standards and recommended practices (SARPs) on passenger name record (PNR) data, the Member States, acting jointly in the interests of the Union:

Position to be taken on behalf of the European Union in the Council of the International Civil Aviation Organization, in respect of the revision of Chapter 9 of Annex 9 (‘Facilitation’) to the Convention on International Civil Aviation with regard to standards and recommended practices on passenger name record data

on the position to be taken on behalf of the European Union in the Council of the International Civil Aviation Organization, in respect of the revision of Chapter 9 of Annex 9 (‘Facilitation’) to the ​Convention on International Civil Aviation with regard to standards and recommended practices on passenger name record data

EUROPEAN COMMISSION Brussels, 13.9.2019 COM(2019) 416 final 2019/0195(NLE) Proposal for a COUNCIL DECISION on the position to be taken on behalf of the European Union in the Council of the International Civil Aviation Organization, in respect of the revision of Chapter 9 of Annex 9 (‘Facilitation’) to the Convention on International Civil Aviation with regard to standards and recommended practices on passenger name record data



EXPLANATORY MEMORANDUM 1.Subject matter of the proposal This proposal concerns the decision establishing the position to be taken on behalf of the European Union in the International Civil Aviation Organization (ICAO) bodies in connection with envisaged adoption of amendments to Chapter 9 of Annex 9 (‘Facilitation’) of the Convention on International Civil Aviation (the ‘Chicago Convention’) to set out new ICAO standards on Passenger Name Record (PNR) data. 2.Context of the proposal 2.1.The Convention on International Civil Aviation (the ‘Chicago convention’) The Chicago Convention aims to regulate international air transport. It entered into force on 4 April 1947 and established the International Civil Aviation Organization (ICAO). All EU Member States are Parties to the Chicago Convention. 2.2.The International Civil Aviation Organization ICAO is a specialised agency of the United Nations. The objectives of the Organization are to develop the principles and techniques of international air navigation and to foster the planning and development of international air transport. The ICAO Council is a permanent body of ICAO with a membership of 36 contracting States elected by the ICAO Assembly for a period of three years. For the period of 2016-2019, there are seven EU Member States represented in the ICAO Council. Mandatory functions of the ICAO Council, listed in Article 54 of the Chicago Convention, include the adoption of international Standards and Recommended Practices (also known as SARPs), designated as Annexes to the Chicago Convention. The ICAO Council also convenes the Assembly, which is ICAO’s sovereign body. The ICAO Assembly meets at least once every three years and establishes the Organisation’s political direction for the upcoming triennium. The 40th Session of the ICAO Assembly will take place on 24 September-4 October in Montreal, Canada. 2.3. The envisaged act of ICAO In accordance with Article 54 point (1) of the Chicago Convention, the Council of ICAO shall adopt Standards and Recommended Practices (SARPs). SARPs on PNR are found in Parts A and D of Chapter 9, Annex 9 (‘Facilitation’), to the Chicago Convention. They are complemented by additional guidance, notably ICAO Document 9944 setting out ‘Guidelines on Passenger Name Record (PNR) Data’. PNR data are personal data of passengers collected by airlines for their business purposes, unlike other travel-related data collected on behalf of Governments such as Advance Passenger Information. The United Nations Security Council Resolution 2396 adopted on 21 December requires UN member States to “develop the capability to collect, process and analyse, in furtherance of ICAO standards and recommended practices, passenger name record (PNR) data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms”. The Resolution also urges ICAO ‘to work with its Member States to establish a standard for the collection, use, processing and protection of PNR data’. In this context, on 18 July 2019, the Council of the European Union endorsed an Information Paper on ‘Standards and principles on the collection, use, processing and protection of Passenger Name Record (PNR) data’ for submission at the 40th Session of the ICAO Assembly. This information paper has been submitted to the European Civil Aviation Conference (ECAC) for consultation. In March 2019, the ICAO Air Transport Committee (ATC) set up a Facilitation Panel Task Force to consider proposals for SARPs on the collection, use, processing and protection of PNR data in line with United Nations Security Council resolution 2396 (2017). The Task Force is mandated to: a) review the existing PNR SARPs found in Chapter 9 of Annex 9 to the Chicago Convention; b) determine whether they need to be complemented by additional SARPs and/or guidance material, taking into account the Security Council’s decision and considerations; and c) as required, develop new provisions (Standards, Recommended Practices, and/or guidance materials) for the collection, use, processing and protection of PNR data. Discussions on the revised ICAO PNR SARPs are still at an early stage. Once adopted the envisaged standards will be binding on all ICAO members, including all EU Member States, in accordance with and within the limits set out in the Chicago Convention. Article 38 of the Chicago Convention requires contracting States to notify ICAO if they intend to deviate from a standard, under the notification of differences mechanism. 2.4.EU legal framework

The processing of PNR data constitutes an essential instrument in the EU’s common response to terrorism and serious crime and a building block of the Security Union. Identifying and tracing suspicious travel patterns by processing PNR to gather evidence and, where relevant, find perpetrators of serious crime and their associates and unravel criminal networks is proving essential to prevent, detect, investigate and prosecute terrorist and serious crime offences. On 27 April 2016, the European Parliament and the Council adopted Directive (EU) 2016/681 on the use of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. This Directive enables national authorities to gain direct access to crucial information held by airlines, in full regard of data protection rights. It provides all Member States with an important tool for preventing, detecting and investigating terrorism and serious crimes, including drugs and human trafficking and child sexual exploitation. The deadline for the Member States to transpose the PNR Directive into national law was 25 May 2018. In order to facilitate the process of connecting air carriers to the Member States’ Passenger Information Units – the units responsible for collecting and processing PNR data - the European Commission adopted, on 28 April 2017, an Implementing Decision on the common protocols and data formats to be used by air carriers when transferring PNR data to the Member States. The Implementing Decision became applicable in April 2018. There are currently two international agreements in force between the EU and third countries (namely Australia and the United States) on the processing and transfer of PNR data. On 26 July 2017, the Court of Justice of the EU adopted an Opinion on the envisaged Agreement between the EU and Canada signed on 25 June 2014. The Court decided that the agreement could not be concluded in its intended form because some of its provisions were incompatible with the fundamental rights to privacy and to personal data protection recognised by the EU. In particular, the Court laid down further legal requirements with regard to oversight by an independent authority, sensitive data, automated processing of PNR data, purposes for which PNR data may be processed, and the retention, use, disclosure and further transfer of PNR data. Further to the authorization received by the Commission from the Council in December 2017, new PNR negotiations with Canada were launched in June 2018. At the 17th EU-Canada Summit in Montreal on 17-18 July 2019, the EU and Canada welcomed that they had concluded these negotiations. While Canada noted its requirement for legal review, the parties committed, subject to that review, to finalise the Agreement as soon as possible, acknowledging the vital role of this Agreement in enhancing security while ensuring privacy and the protection of personal data. An increasing number of third countries are collecting PNR data from air carriers and several of them have approached the Commission over the past few years to express their interest in concluding an international agreement on PNR with the EU. In the absence of a legal basis, air carriers are confronted with a situation of conflict of laws and risk fines and other sanctions. At the same time, further to the implementation of the PNR Directive, EU Member States are requesting air carriers from third countries to transfer PNR data to their Passenger Information Units. A number of third countries have refused such transfers – and others have threatened to do so – alleging lack of reciprocity, therefore compromising the effectiveness of the EU PNR mechanism. According to Article 3(2) TFEU the Union has exclusive competence “for the conclusion of an international agreement ... in so far as its conclusion may affect common rules or alter their scope.” An international agreement may affect common rules or alter their scope where the area covered by the agreement overlaps with Union legislation or is covered to a large extent by Union law. Moreover, to assess whether an area is largely covered by common rules, account must be taken not only of Union law as it currently stands in the area concerned, but also of its future development, in so far as that is foreseeable at the time of that analysis. In the light of the common rules mentioned above and the upcoming review according to Article 19 of Directive 2016/681, it can be concluded that the matters covered by the propose decision fall under the Union’s exclusive competence. 3.Position to be taken on the Union’s behalf In view of the importance of this matter for EU internal and external policy and in light of the above, it is necessary to establish a Union position on PNR data transfers for the purposes of the (multilateral) on-going works at the level of ICAO. In particular, the EU should seek that the core principles on the modalities of PNR transmission and processing and on the protection of personal data – to be laid down in the common position - are embedded in new ICAO PNR standards. In this respect, it is essential to steer the discussions on such new PNR standards within ICAO in a manner that is compatible with the EU regulatory framework and the relevant case law of the Court of Justice, in particular concerning the fundamental rights to privacy and data protection. The Union position, relevant both to the final decision by the ICAO Council and preparatory discussions in other ICAO bodies, is defined in accordance with the applicable EU legal framework on data protection and PNR, namely Regulation (EU) 2016/679, Directive (EU) 2016/680 and Directive (EU) 2016/681, as well as the Treaty and Charter of Fundamental Rights as interpreted in the relevant case law of the Court of Justice of the European Union, in particular Opinion 1/15 of the Court. 4.Legal basis 4.1.Procedural legal basis 4.1.1.Principles Article 218(9) of the Treaty on the Functioning of the European Union (TFEU) provides for decisions establishing “the positions to be adopted on the Union’s behalf in a body set up by an agreement, when that body is called upon to adopt acts having legal effects, with the exception of acts supplementing or amending the institutional framework of the agreement.” Article 218(9) TFEU applies regardless of whether the Union is a member of the body or a party to the agreement. The concept of “acts having legal effects” includes acts that have legal effects by virtue of the rules of international law governing the body in question. It also includes instruments that do not have a binding effect under international law, but that are “capable of decisively influencing the content of the legislation adopted by the EU legislature”. 4.1.2.Application to the present case The ICAO Council is a body set up by an agreement, namely the Chicago Convention. Any amendment to Chapter 9 of Annex 9 of the Chicago Convention adopted by the ICAO Council in accordance with Article 54 point (l) of the Convention will constitute an act having legal effects. Such an amendment is capable of decisively influencing the content of EU legislation, notably Directive (EU) 2016/681 as well as the existing and future international agreements on PNR between the EU and third countries.

The envisaged act does not supplement or amend the institutional framework of the Agreement. Therefore, the procedural legal basis for the proposed decision is Article 218(9) TFEU. 4.2.Substantive legal basis 4.2.1.Principles The substantive legal basis for a decision under Article 218(9) TFEU depends primarily on the objective and content of the envisaged act in respect of which a position is taken on the Union's behalf. If the envisaged act pursues two aims or has two components and if one of those aims or components is identifiable as the main one, whereas the other is merely incidental, the decision under Article 218(9) TFEU must be founded on a single substantive legal basis, namely that required by the main or predominant aim or component. With regard to an envisaged act that simultaneously pursues a number of objectives, or that has several components, which are inseparably linked without one being incidental to the other, the substantive legal basis of a decision under Article 218(9) TFEU will have to include, exceptionally, the various corresponding legal bases. 4.2.2.Application to the present case The envisaged act pursues objectives and has components in the areas of data protection and police cooperation. These elements of the envisaged act are inseparably linked without one being incidental to the other. Therefore, the substantive legal basis of the proposed decision comprises the following provisions: Article 16(2) and point (a) of Article 87(2) TFEU. 4.3.Conclusion The legal basis of the proposed decision should be Article 16(2) and point (a) of Article 87(2) TFEU, in conjunction with Article 218(9) TFEU. 2019/0195 (NLE) Proposal for a COUNCIL DECISION on the position to be taken on behalf of the European Union in the Council of the International Civil Aviation Organization, in respect of the revision of Chapter 9 of Annex 9 (‘Facilitation’) to the Convention on International Civil Aviation with regard to standards and recommended practices on passenger name record data THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2) and point (a) of Article 87(2), in conjunction with Article 218(9) thereof, Having regard to the proposal from the European Commission, Whereas: (1)The Convention on International Civil Aviation (‘the Chicago Convention’), which regulates international air transport, entered into force on 4 April 1947. It established the International Civil Aviation Organization (‘ICAO’).

(2)The Member States are contracting States of the Chicago Convention and members of ICAO, whereas the Union has observer status in certain ICAO bodies, including in the Assembly and other technical bodies. (3)Pursuant to point (l) of Article 54 of the Chicago, the ICAO Council can adopt International Standards and Recommended Practices (SARPs). (4)The United Nations (UN) Security Council decided in its Resolution 2396 (2017), adopted on 21 December 2017, that the UN Member States are to develop the capability to collect, process and analyse, in furtherance of ICAO standards and recommended practices, passenger name record (PNR) data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms for the purpose of preventing, detecting and investigating terrorist offenses and related travel. (5)Resolution 2396 (2017) also urged ICAO to work with the UN Member States to establish a standard for the collection, use, processing and protection of PNR data. (6)SARPs on PNR are in Parts A and D of Chapter 9 of Annex 9 (‘Facilitation’) to the Chicago Convention. They are complemented by additional guidance, notably ICAO Document 9944 setting out ‘Guidelines on Passenger Name Record (PNR) Data’. (7)In March 2019 the ICAO Air Transport Committee (ATC) established a Task Force, consisting of experts from the Member States of the ICAO Facilitation Panel, to consider proposals for new ISARPs on the collection, use, processing and protection of PNR data in line with Resolution 2396 (2017). A number of Member States of the Union are represented in the Task Force. The Commission participates in the Task Force as an observer. The Task Force is expected to present its final report to the ICAO ATC in October 2019. (8)The 40th Session of the ICAO Assembly will take place on 24 September-4 October 2019. The Assembly will define ICAO’s political direction for the next years, including possibly with respect to the adoption of new SARPs is on PNR. (9)On 18 July 2019, the Council endorsed an Information Paper on ‘Standards and principles on the collection, use, processing and protection of Passenger Name Record (PNR) data’ for submission at the ICAO Assembly. This information paper has been submitted to the European Civil Aviation Conference (ECAC) for consultation. (10)The paper sets out the Union’s position on the core principles compliance which would help to ensure respect for the constitutional and regulatory requirements concerning fundamental rights to privacy and data protection when processing PNR data for the purposes of countering terrorism and serious crime. ICAO is invited to include such principles in any future standards on PNR as well as in the (revised) ICAO's Guidelines on PNR (Doc 9944). (11)The Union has adopted common rules on PNR data, namely Directive (EU) 2016/681, the scope of which overlap largely with the area to be covered by the envisaged SARPs. This includes, in particular, a comprehensive set of rules to safeguard the fundamental rights to privacy and the protection of personal data, in the context of a transfer of PNR data by air carriers to Member States for the purpose of prevention, detection, investigation and prosecution of terrorist offences and serious crime. (12)There are currently two international agreements in force between the EU and third countries (namely Australia and the United States) on the processing and transfer of PNR data. On 26 July 2017, the Court of Justice of the EU adopted an Opinion on the envisaged Agreement between the EU and Canada signed on 25 June 2014. (13)It is appropriate to establish the position to be taken on the ion’s behalf in the ICAO Council and preparatory/technical bodies, as any future SARPs in the area of PNR data, in particular amendments to Chapter 9 of Annex 9 (‘Facilitation’) of the Chicago Convention adopted by the ICAO Council will be capable of decisively influencing the content of Union law, namely in particular Directive (EU) 2016/681 and the existing international PNR agreements. (14)The Union position set out in the Annex is defined in accordance with the applicable Union legal framework on data protection and PNR data, namely Regulation (EU) 2016/679 of the European Parliament and of the Council, Directive (EU) 2016/680 of the European Parliament and of the Council and Directive (EU) 2016/681 of the European Parliament and of the Council, as well as the Treaty and Charter of Fundamental Rights as interpreted in the relevant case law of the Court of Justice of the European Union, in particular Opinion 1/15 of the Court. (15)The Union's position is to be expressed by the Member States of the Union that are members of the ICAO Council, acting jointly. (16)[In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, those Member States have notified their wish to take part in the adoption and application of this Decision.]



OR



[In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, those Member States are not taking part in the adoption of this Decision and are not bound by it or subject to its application.]OR[In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, the United Kingdom is not taking part in the adoption of this Decision and is not bound by it or subject to its application.]



In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Ireland has notified (, by letter of ...,) its wish to take part in the adoption and application of this Decision.]



OR



[In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, the United Kingdom has notified (, by letter of ...,) its wish to take part in the adoption and application of this Decision.



In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Decision and is not bound by it or subject to its application.] (17)In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application, HAS ADOPTED THIS DECISION: Article 1 The position to be taken on the Union's behalf in the Council of the International Civil Aviation Organisation (‘ICAO’) in respect of the adoption of Standards and Recommended Practices regarding Passenger Name Record data, in particular through revision of Chapter 9 of Annex 9 (‘Facilitation’) to the Chicago Convention is set out in the Annex. Article 2