EN Official Journal of the European Union C 51/12

Executive summary of the Opinion of the European Data Protection Supervisor on the proposals for Council decisions on the conclusion and the signature of the agreement between Canada and the European Union on the transfer and processing of passenger name record data

(The full text of this Opinion can be found in English, French and German on the EDPS website: http://www.edps.europa.eu)

(2014/C 51/06)

I. Consultation of the EDPS

1. On 19 July 2013, the European Commission adopted the proposals for Council decisions on the conclusion and the signature of the agreement between Canada and the European Union on the transfer and processing of passenger name record data (1) (hereinafter: ‘the proposals’), which contain the text of the proposed agreement between Canada and the European Union (hereinafter: ‘the agreement’). The proposals were sent to the EDPS on 23 July 2013.

2. The EDPS also had the opportunity to provide his advice before the adoption of the proposals. The EDPS welcomes this previous consultation. However, as it took place after the closing of the negotiations, the EDPS input could not be taken into account. The present opinion builds on the comments provided at that occasion.

II. General remarks

3. As stated on earlier occasions (2), the EDPS questions the necessity and proportionality of PNR schemes and of bulk transfers of PNR data to third countries. Both are conditions required by the EU Charter and the European Convention of Human Rights for any limitation to fundamental rights, including to the rights respect for private life and the protection of personal data (3). According to the jurisprudence, not only the reasons put forward by the public authority to justify any such restriction should be relevant and sufficient (4), but it should also be demonstrated that other less intrusive methods are not available (5). To date, the EDPS has not seen convincing elements showing the necessity and proportionality of the massive and routine processing of data of non-suspicious passengers for law enforcement purposes.

4. Nevertheless, the EDPS welcomes the data protection safeguards provided in the agreement, although he regrets the fact that the retention period has been extended in comparison with the previous PNR agreement with Canada.

5. The EDPS also welcomes the efforts undertaken by the Commission as regards oversight and redress under the constraints entailed by the nature of the agreement. However, he is concerned about the limitations of judicial review and about the fact that administrative redress can be provided in some cases by an internal authority which is not independent. He also questions the appropriateness of an executive agreement to provide adequate and effective rights to data subjects.

6. The agreement regulates the use by the ‘Canadian competent authority’ of PNR data transferred by EU air carriers and other carriers operating flights from the EU (6). The EDPS recommends requiring confirmation that no other Canadian authority can directly access or request PNR data to those carriers, thus circumventing the agreement.

IV. Conclusions

47. As previously stated, the EDPS questions the necessity and proportionality of PNR schemes and of the bulk transfers of PNR data to third countries. He also questions the choice of the legal basis and recommends that the proposals be based on Article 16 of the TFEU, in conjunction with Article 218(5) and Article 218(6)(a) of the TFEU.

48. The EDPS is also concerned about the limited availability of independent administrative redress and full judicial redress for EU citizens not present in Canada and questions the appropriateness of an executive agreement to achieve them. He also recommends requiring confirmation that no other Canadian authority can directly access or request PNR data to the carriers covered by the agreement.

49. As regards the specific provisions of the agreement, the EDPS welcomes the data protection safeguards included. However, the agreement should: — completely exclude the processing of sensitive data, — provide for deletion or anonymisation of the data immediately after analysis and 30 days after reception as a maximum and, in any case, reduce and justify the proposed retention period, which has been extended in comparison with the previous PNR agreement with Canada, — limit the categories of PNR data to be processed, — explicitly mention that overall oversight will be carried out by an independent authority.

50. In addition, the EDPS recommends specifying the following, either in the agreement or in the accompanying documents: — further narrowing and clarifying the concepts defining the purposes of the agreement, — clarifying which types of ‘lawful’ discrimination would be possible, — providing for an obligation to notify data breaches to the European Commission and to data protection authorities, — completing the provisions on transparency, — extending the prohibition of deciding solely on the basis of automated processing to all decisions affecting passengers on the basis of the agreement, — specifying to which authorities in Canada PNR data can be further transferred, adding the requirement of prior judicial authorisation or of the existence of an immediate threat, providing for an obligation of including adequate data protection safeguards in agreements or arrangements with other recipient countries or authorities and for their notification to the European Commission and to EU data protection authorities, — naming the relevant authorities and laying down dissuasive sanctions for non-compliance with the agreement, — specifying which are the mechanisms available to persons not resident in Canada to seek judicial review under Canadian law, — clarifying if the right to judicial review could be exercised even if the relevant decision or action has not been communicated to the individual concerned, in particular if provisions of the agreement other than those related to access and rectification/notation are infringed, — specifying to which ‘other remedy which may include compensation’ Article 14(2) refers, — specifying the frequency of reviews of the implementation of the agreement, their content (which should include on the evaluation of its necessity and proportionality) and explicitly including EU data protection authorities in the EU review team.

Done at Brussels, 30 September 2013. Peter HUSTINX European Data Protection Supervisor

(1) COM(2013) 529 final.

(2) See the EDPS Opinion of 9 December 2011 on the proposal for a Council decision on the conclusion of the agreement between the United States of America and the European Union on the use and transfer of passenger name records to the United States Department of Homeland Security (OJ C 35, 9.2.2012, p. 16); Opinion of 15 July 2011 on the proposal for a Council decision on the conclusion of an agreement between the European Union and Australia on the processing and transfer of passenger name record (PNR) data by air carriers to the Australian Customs and Border Protection Service (OJ C 322, 23.12.2011, p. 1); Opinion of the EDPS of 25 March 2011 on the proposal for a directive of the European Parliament and of the Council on the use of passenger name record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime; Opinion of 19 October 2010 on the global approach to transfers of passenger name record (PNR) data to third countries; Opinion of 20 December 2007 on the proposal for a Council framework decision on the use of passenger name record (PNR) data for law enforcement purposes (OJ C 110, 1.5.2008, p. 1); Opinion of 15 June 2005 on the proposal for a Council decision on the conclusion of an agreement between the European Community and the Government of Canada on the processing of advance passenger information (API)/passenger name record (PNR) data (OJ C 218, 6.9.2005, p. 6) (all available on: http://www.edps.europa.eu/EDPSWEB/edps/cache/bypass/Consultation/OpinionsC). See also the Article 29 Working Party's opinions on PNR are available on: http://ec.europa.eu/justice/policies/privacy/workinggroup/wpdocs/index_en.htm#data_transfers

(3) See Article 7, Article 8 and Article 52(1) of the Charter of Fundamental Rights of the European Union (OJ C 83, 30.3.2010, p. 389) and Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms (ETS No 5), Council of Europe, 4.11.1950.

(4) See European Court of Human Rights, judgment of 4 December 2008, S. and Marper v. the UK.

(5) See European Court of Justice, judgment of 9 November 2010, C-92/09 Volker and Markus Schecke GbR v. Land Hessen and C-93/09 Eifert v. Land Hessen and Bundesansalt für Landwirtschaft und Ernährung.

(6) See Explanatory Memorandum of the proposals and Article 3(1) of the agreement.