EUROPEAN COMMISSION Brussels, 17.11.2022 COM(2022) 646 final 2022/0382(NLE) Proposal for a COUNCIL DECISION on the position to be taken on behalf of the European Union in the Partnership Council established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, regarding the extension of the interim period referred to in Article 552(11) of that Agreement during which the United Kingdom may derogate from the obligation to delete Passenger Name Record data of passengers after their departure from the United Kingdom



EXPLANATORY MEMORANDUM 1.Subject matter of the proposal This proposal concerns the decision establishing the position to be taken on behalf of the European Union in the Partnership Council in connection with Article 552(13) of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland (hereafter: “United Kingdom”), of the other part (hereafter: “the Trade and Cooperation Agreement”. The Trade and Cooperation Agreement makes it possible for Passenger Name Record (“PNR”) data relating to passengers on flights between the Union and United Kingdom to be transferred to, processed and used by the United Kingdom. The Trade and Cooperation Agreement requires the United Kingdom to delete PNR data received pursuant to the Trade and Cooperation Agreement after passengers’ departure from the country, unless a risk assessment indicates the need to retain such PNR data. However, the Trade and Cooperation Agreement provides for a derogation to that requirement on a temporary basis, initially for an interim period of one year, i.e. until 31 December 2021, recognising the special circumstances that the United Kingdom has to make certain technical adjustments in order to transform the PNR processing systems which it operated whilst Union law (i.e. PNR Directive) applied to it and which, when carried out, would enable PNR data to be deleted in accordance with the Trade and Cooperation Agreement. This interim period can be extended by consecutive decisions of the Partnership Council for two additional years, provided certain conditions are met. During the interim period and pursuant to Article 552(11) of the Trade and Cooperation Agreement, the United Kingdom shall apply additional safeguards to the processing of PNR data, in particular by preventing the use of the PNR data that is to be deleted in accordance with Article 552(4) of the Agreement. The derogation is coupled with a process whereby the United Kingdom is required to provide to the Specialised Committee on Law Enforcement and Judicial Cooperation established by the Trade and Cooperation Agreement a report from an independent administrative body, including an opinion by the United Kingdom supervisory authority for data protection, as to whether the additional data protection safeguards that apply during the interim period pursuant to Article 552(11) of the Trade and Cooperation Agreement have been applied effectively and an assessment of whether the aforementioned special circumstances persist, together with a description of the efforts made to transform the PNR processing systems of the United Kingdom into systems which would enable PNR data to be deleted after the passengers’ departure from the United Kingdom. Moreover, a second extention by the Partnership Council requires that the United Kingdom has made substantial progress in transforming its PNR processing systems to that effect, even though it has not yet been possible to finalise that transformation. After the provisional application of the Trade and Cooperation Agreement on 1 January 2021 and its entry into force on 1 May 2021, the first year of the interim period came to an end on 31 December 2021. On the basis of the first report and the assessment submitted by the United Kingdom on 1 October 2021 and the complementary information submitted in November 2021, the Partnership Council on 21 December 2021 extended the interim period by one year until 31 December 2022. In view of obtaining a second and last extention of the interim period, the United Kingdom submitted a second report and assessment on 29 September 2022. The Specialised Committee on Law Enforcement and Judicial Cooperation considered this report and assessment provided by the United Kingdom in its meeting on 13 October 2022. During the meeting, the Union asked a number of questions for clarification to which the United Kingdom answered and which it agreed to subsequently make available in writing. Pursuant to Article 552(13), third sentence, of the Trade and Cooperation Agreement, where the above-mentioned special circumstances persist and – in addition – where substantial progress has been made by the United Kingdom, the Partnership Council shall extend the interim period for a second and final year, i.e. until 31 December 2023. The Commission notes that, at the end of this final extension, the temporary derogation due to the aforementioned special circumstances ceases to apply and the United Kingdom will need to have finalised all technical adjustments necessary to enable its PNR processing systems to delete PNR data in accordance with Article 552(4) of the Trade and Cooperation Agreement. There is no possibility for any further extension under the Trade and Cooperation Agreement. 2.Context of the proposal 2.1.The Trade and Cooperation Agreement between the Union and the United Kingdom The Trade and Cooperation Agreement establishes the basis for a broad relationship between the Union and the United Kingdom, within an area of prosperity and good neighbourliness, characterised by close and peaceful relations based on cooperation, respectful of the Parties’ autonomy and sovereignty. The Trade and Cooperation Agreement entered into force on 1 May 2021 and had been provisionally applied since 1 January 2021. 2.2.The Partnership Council The Trade and Cooperation Agreement sets up a number of joint bodies, including the Partnership Council, which is a “body set up by an agreement” in the sense of Article 218(9) of the Treaty on the Functioning of the European Union (TFEU). 2.3.The envisaged act of the Partnership Council Article 552(4) of the Trade and Cooperation Agreement provides that the United Kingdom deletes the PNR data of passengers received pursuant to that agreement, as a rule, after their departure from the country, unless a risk assessment indicates the need to retain such PNR data. This requirement follows from the 2017 opinion of the Court of Justice on the envisaged EU-Canada Agreement on the transfer and processing of Passenger Name Record data. Article 552(11) of the Trade and Cooperation Agreement provides that the United Kingdom may derogate from paragraph 4 of that article on a temporary basis for an interim period, pending the implementation by the United Kingdom of technical adjustments to their PNR processing systems as soon as possible. The duration of the interim period is for a maximum of three years after the entry into force of the Trade and Cooperation Agreement. During the interim period, the United Kingdom competent authority is obliged to prevent the use of the PNR data that is to be deleted by applying a number specific additional safeguards to that PNR data.

Article 552(10) of the Trade and Cooperation Agreement provides that paragraph 11 of that article applies due to the special circumstances that prevent the United Kingdom from making the technical adjustments necessary to transform the PNR processing systems which the United Kingdom operated whilst Union law applied to it into systems which would enable PNR data to be deleted in accordance with paragraph 4 of that article. Article 552(12) of the Trade and Cooperation Agreement sets out that the United Kingdom has to provide the Specialised Committee on Law Enforcement and Judicial Cooperation, nine months after the entry into force of that agreement, with a report from the independent administrative body referred to in paragraph 7 of that article, including an opinion by the United Kingdom supervisory authority referred to in Article 525(3) of the Trade and Cooperation Agreement, as to whether the additional data protection safeguards set out in Article 552(11) of the Trade and Cooperation Agreement have been effectively applied and an assessment of the United Kingdom of whether the special circumstances referred to in Article 552(10) of the Trade and Cooperation Agreement persist, together with a description of the efforts made to transform the PNR processing systems of the United Kingdom into systems which would enable PNR data to be deleted in accordance with paragraph 4 of that article. A second report and assessment need to be submitted again one year later, if the interim period is to be extended for a further and final year. During the interim period, the United Kingdom is obliged to apply the additional safeguards set out in points (a) to (d) of Article 552(11) of the Trade and Cooperation Agreement, in particular to prevent the use of the PNR data that is to be deleted. The effective application of these safeguards is to be demonstrated through the report from the independent administrative body and the opinion by the United Kingdom supervisory authority for data protection in accordance with with Article 552(12)(a) of the Trade and Cooperation Agreement. Article 552(13), second sentence of the Trade and Cooperation Agreement provides that where the special circumstances referred to in paragraph 10 of that article persist, the Partnership Council shall extend the interim period referred to in paragraph 11 of that article for one year. A first extension to the interim period was granted by the Partnership Council on 21 December 2021. The above procedure and conditions also apply in view of granting a second and final extension of the interim period by one more year. Additionally, pursuant to the third sentence of Article 552(13) of the Trade and Cooperation Agreement, the United Kingdom has to demonstrate that substantial progress has been made in transforming their PNR processing systems, although it has not yet been possible to transform them into systems which enable PNR data to be deleted in accordance with Article 552(4) of the Trade and Cooperation Agreement. The decision of the Partnership Council to extend the interim period may take any form. The decisions of the co-chairs of the Partnership Council shall be taken by mutual consent (see Article 1(2) of Annex 1 of the Trade and Cooperation Agreement). The decision should be taken before the end of the second year of the interim period, i.e. before 31 December 2022. Before the lapse of the second and final extension of the interim period, i.e. by 31 December 2023, the United Kingdom will need to have finalised all technical adjustments necessary to enable its PNR processing systems to delete PNR data in accordance with Article 552(4) of the Trade and Cooperation Agreement. The Commission expects the United Kingdom to inform the Specialised Committee on Law Enforcement and Judicial Cooperation thereof. The Specialised Committee on Law Enforcement and Judicial Cooperation monitors and reviews the implementation and ensures the proper functioning of Part Three of the Trade and Cooperation Agreement. It remains, therefore, the approriate forum to discuss the annual assessment of the UK independent administrative body on the approach applied by the United Kingdom competent authority as regards the need to retain PNR data pursuant to Article 552(4) of the Trade and Cooperation Agreement, as set out in paragraph 7 of that article. 3.Position to be taken on the Union's behalf Background On 29 September 2022, the United Kingdom submitted to the Specialised Committee on Law Enforcement and Judicial Cooperation an assessment pursuant to Article 552(12)(b) of the Trade and Cooperation Agreement. The assessment by the United Kingdom concludes that the special circumstances in respect of the United Kingdom’s PNR data processing systems persist and that substantial progress has been made in transforming the United Kingdoms PNR processing system into systems which would enable PNR data to be deleted in accordance with Article 552(4) of the Trade and Cooperation Agreement, although it has not yet been possible to tranform them fully to that effect. The United Kingdom has to adapt a PNR data processing system configured for compliance with Union law applying to Member States into a system configured to meet the requirements of the Trade and Cooperation Agreement, and there was not sufficient time before the entry into force of the Trade and Cooperation Agreement to make the necessary adaptations to a complex PNR data procession system. The requirements of the Trade and Cooperation Agreement reflect the 2017 case law by the Court of Justice on the international transfer of PNR data from the Union to third countries (Opinion 1/15). The United Kingdom’s current PNR processing system was developed in 2004 and adapted in 2016 to be in conformity with Directive (EU) 2016/681 of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. As such, the operation of the United Kingdom’s PNR processing system was designed, like those of the Member States, to retain all PNR data for a period of five years in order to respond to duly reasoned requests in specific cases at any time during those five years. It was not designed to delete PNR data of passengers after their departure from the United Kingdom, as the Trade and Cooperation Agreement requires. Moreover, the United Kingdom’s current risk assessment process has been designed, like those of the Member States, to identify individuals whose data corresponds to objective targeting rules or other pre-determined criteria for the purpose of conducting security and border control checks. It was not designed to determine whether there is a need to retain specific PNR data after a passenger’s departure from the United Kingdom. In its assessment, submitted on 29 September 2022 pursuant to Article 552(12)(b) of the Trade and Cooperation Agreement, the United Kingdom indicated that it had recently designed and built a capability to delete PNR data in accordance with Article 552(4) of the Trade and Cooperation Agreement; this capability is now in beta testing phase. In addition, the United Kingdom informed that it was developing an automated risk assessment process based on objective evidence to determine the data that need to be retained after a passenger’s departure from the United Kingdom. In the meantime, the United Kingdom is implementing a manual risk assessment process, in order to apply the additional safeguards referred to in Article 552(11) of the Trade and Cooperation Agreement. The United Kingdom estimates that the automated risk assessment process will be in place by the end of 2023. The United Kingdom also submitted to the Specialised Committee on Law Enforcement and Judicial Cooperation on 29 September 2022 a report pursuant to Article 552(12)(a) of the Trade and Cooperation Agreement from the independent administrative body referred to in Article 552(7) of the Trade and Cooperation Agreement, outlining the effective application of the additional data protection safeguards provided for in Article 552(11) of the Trade and Cooperation Agreement. This report includes an opinion by the United Kingdom supervisory authority referred to in Article 525(3) of the Trade and Cooperation Agreement. The Specialised Committee on Law Enforcement and Judicial Cooperation considered the United Kingdom’s assessment and report on 13 October 2022. On that occasion, answering to a number of questions from the Union, the United Kingdom provided additional information on the application of the data protection safeguards provided for in Article 552(11) of the Trade and Cooperation Agreement, which it agreed to subsequently make available in writing.

3.2.Proposed position In view of the above, the Commission considers that the Partnership Council should decide to extend the interim period for one further and final year to 31 December 2023 taking into account the information that the United Kingdom provided in the meeting of the Specialised Committee on Law Enforcement and Judicial Cooperation on 13 October 2022, provided that itis subsequently made available in writing. The Partnership Council should take such a decision by 31 December 2022. The Commission further notes that the Specialised Committee on Law Enforcement and Judicial Cooperation is responsible for monitoring and reviewing the proper implementation of Part Three of the Trade and Cooperation Agreement, including the annual assessment of the United Kingdom independent administrative body pursuant to Article 552(7) of the Trade and Cooperation Agreement on the approach applied by the United Kingdom competent authority as regards the need to retain PNR data pursuant Article 552(4) of the Trade and Cooperation Agreement. 4.Legal basis 4.1.Procedural legal basis 4.1.1.Principles Article 218(9) of the TFEU provides for decisions establishing ‘the positions to be adopted on the Union’s behalf in a body set up by an agreement, when that body is called upon to adopt acts having legal effects, with the exception of acts supplementing or amending the institutional framework of the agreement.’ The concept of ‘acts having legal effects’ includes acts that have legal effects by virtue of the rules of international law governing the body in question. It also includes instruments that do not have a binding effect under international law, but that are ‘capable of decisively influencing the content of the legislation adopted by the EU legislature’. 4.1.2.Application to the present case The Partnership Council is a body set up by an agreement, namely the Trade and Cooperation Agreement. Article 552(13) of the Trade and Cooperation Agreement provides that where the special circumstances referred to in paragraph 10 of that article persist and the United Kingdom demonstrates that it has made substantial progress to transform its PNR processing systems into systems which would enable PNR data to be deleted in accordance with Article 552(4) of the Trade and Cooperation Agreement, although it has not yet been possible to transform them fully to that effect, the Partnership Council shall extend the interim period referred to in paragraph 11 of that article for one more year (second and final extension). Therefore, the adoption of a Union position in respect of such decision falls within the scope of Article 218(9) TFEU. The legal effects of the extension fall completely on the Union, as a party to the Trade and Cooperation Agreement. This entails that, in accordance with Article 3(2) TFEU, the Union has exclusive competence in this matter. The decision on an extension of the period referred to in Article 552(13) of the Trade and Cooperation Agreement does not entail that the framework of the Trade and Cooperation Agreement be supplemented or amended. Therefore, the procedural legal basis for the proposed decision is Article 218(9) TFEU. 4.2.Substantive legal basis 4.2.1.Principles The substantive legal basis for a decision under Article 218(9) TFEU depends primarily on the objective and content of the envisaged act in respect of which a position is taken on the Union’s behalf. If the envisaged act pursues two aims or has two components and if one of those aims or components is identifiable as the main one, whereas the other is merely incidental, the decision under Article 218(9) TFEU must be founded on a single substantive legal basis, namely that required by the main or predominant aim or component. With regard to an envisaged act that simultaneously pursues a number of objectives, or that has several components, which are inseparably linked without one being incidental to the other, the substantive legal basis of a decision under Article 218(9) TFEU will have to include, exceptionally, the various corresponding legal bases. 4.2.2.Application to the present case The extension of the period referred to in Article 552(13) of the Trade and Cooperation Agreement pursues objectives and has components in the area of data protection and police cooperation.

Therefore, the substantive legal basis of the proposed decision is Article 16(2) and Article 87(2)(a) TFEU. 4.3.Conclusion The legal basis of the proposed decision should be Articles 16(2) and 87(2)(a) TFEU, in conjunction with Article 218(9) TFEU. 5.Publication of the envisaged act As the decision of the Partnership Council agreeing to a second and final extension, until 31 December 2023, of the interim period during which the United Kingdom may derogate from the obligation to delete Passenger Name Record data of passengers after their departure from the United Kingdom has legal effects, it is appropriate to publish the decision of the Partnership Council in the Official Journal of the European Union after its adoption. 2022/0382 (NLE) Proposal for a COUNCIL DECISION on the position to be taken on behalf of the European Union in the Partnership Council established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, regarding the extension of the interim period referred to in Article 552(11) of that Agreement during which the United Kingdom may derogate from the obligation to delete Passenger Name Record data of passengers after their departure from the United Kingdom THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2) and Article 87(2)(a), in conjunction with Article 218(9) thereof, Having regard to Council Decision (EU) 2021/689 of 29 April 2021 on the conclusion, on behalf of the Union, of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, and of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland concerning security procedures for exchanging and protecting classified information, Having regard to Decision No 2/2021 of the Partnership Council established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, of 21 December 2021 as regards the extension of the interim period during which the United Kingdom may derogate from the obligation to delete Passenger Name Record data of passengers after their departure from the United Kingdom, Having regard to the proposal from the European Commission, Whereas: (1)Pursuant to Article 542 of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland (hereafter: ‘United Kingdom’), of the other part (hereafter: ‘the Trade and Cooperation Agreement’), Title III of Part Three (LAW ENFORCEMENT AND JUDICIAL COOPERATION IN CRIMINAL MATTERS) of that agreement lays down rules under which passenger name record (hereafter: ‘PNR’) data may be transferred to, processed and used by the United Kingdom competent authority for flights between the Union and the United Kingdom, and establishes specific safeguards in that regard. (2)Article 552(4) of the Trade and Cooperation Agreement provides that the United Kingdom shall delete the PNR data of passengers after their departure from the country unless a risk assessment indicates the need to retain such PNR data. (3)Article 552(11) of the Trade and Cooperation Agreement provides that the United Kingdom may derogate from paragraph 4 of that article on a temporary basis for an interim period, pending the implementation by the United Kingdom of technical adjustments as soon as possible. During this interim period, the United Kingdom competent authority shall prevent the use of the PNR data that is to be deleted in accordance with Article 552(4) of the Trade and Cooperation Agreement by applying the additional safeguards to that PNR data listed in Article 552(11), points (a)-(d) of the Trade and Cooperation Agreement. In accordance with Article 552(12)(a) of the Trade and Cooperation Agreement, the independent administrative body referred to in Article 552(7) of the Trade and Cooperation Agreement shall report on, and the United Kingdom supervisory authority for data protection referred to in Article 525(3) of the Trade and Cooperation Agreement shall provide an opinion on, whether the additional safeguards have been effectively applied. (4)Article 552(10) of the Trade and Cooperation Agreement provides that Article 552(11) of the Trade and Cooperation Agreement applies due to the special circumstances that prevent the United Kingdom from making the technical adjustments necessary to transform the PNR processing systems which the United Kingdom operated whilst Union law applied to it into systems which would enable PNR data to be deleted in accordance with Article 552(4) of the Trade and Cooperation Agreement. (5)Article 552(13) of the Trade and Cooperation Agreement provides that where the special circumstances referred to in Article 552(10) of the Trade and Cooperation Agreement persist, the Partnership Council shall extend the interim period referred to in Article 552(11) of the Trade and Cooperation Agreement for one year. A decision to that effect was taken by the Partnership Council on 21 December 2021, thereby extending the interim period until 31 December 2022.