OPINION OF ADVOCATE GENERAL

MENGOZZI

delivered on 8 September 2016 ( 1 )

Opinion 1/15

(Request for an opinion submitted by the European Parliament)

(Request for an opinion — Admissibility — Draft agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data — ‘Passenger Name Record (PNR)’ data — Compatibility of the draft agreement with Article 16 TFEU and Articles 7 and 8 and Article 52(1) of the Charter of Fundamental Rights of the European Union — Legal basis)

Table of contents

I – Introduction II – Legal framework III – Background to the agreement envisaged IV – The procedure before the Court V – The admissibility of the request for an opinion VI – The appropriate legal basis for the act concluding the agreement envisaged (second question) A – Analysis of the arguments of the Parliament and the other interested parties B – Assessment 1. The purpose and the content of the agreement envisaged 2. The appropriate legal basis (a) The relevance of Article 82(1)(d) and Article 87(2)(a) TFEU (b) The need to base the act concluding the agreement envisaged on the first subparagraph of Article 16(2) TFEU VII – The compatibility of the agreement envisaged with the provisions of the FEU Treaty and the Charter (first question) A – Analysis of the Parliament’s request and observations and also of the observations of the other interested parties 1. Analysis of the Parliament’s request and observations 2. Analysis of the observations of the other interested parties B – Assessment 1. Preliminary observations 2. The existence of an interference with the rights guaranteed by Articles 7 and 8 of the Charter 3. The justification for the interference with the rights guaranteed by Articles 7 and 8 of the Charter (a) An interference ‘provided for by law’, within the meaning of Article 52(1) of the Charter (b) An interference meeting an objective of general interest (c) The proportionality of the interference constituted by the agreement envisaged i) General considerations ii) The ability of the interference to achieve the ‘public security’ objective pursued by the agreement envisaged iii) The strict necessity for the interference – The categories of PNR data covered by the agreement envisaged – The sufficiently precise nature of the purpose for which PNR data processing is authorised – The scope ratione personae of the agreement envisaged – Identification of the competent authority responsible for processing the PNR data – The automated processing of the PNR data – Access to the PNR data – The retention of the PNR data – The disclosure and subsequent transfer of the PNR data – The administrative surveillance and judicial control measures VIII – Conclusion

I – Introduction

1. In application of Article 218(11) TFEU, the European Parliament has requested the Court to deliver an opinion on the agreement envisaged between Canada and the European Union on the transfer and processing of Passenger Name Record data (‘the agreement envisaged’), in order to enable it to answer the Council of the European Union’s request, of July 2014, that the Parliament should approve the proposal for a decision on the conclusion of the agreement envisaged. ( 2 )

2. Schematically, the agreement envisaged provides that Passenger Name Record data (‘PNR data’), which is collected from passengers for the purpose of reserving flights between Canada and the European Union, is to be transferred to the Canadian competent authorities and then processed and used by those authorities in order to prevent and detect terrorist offences and other serious transnational criminal offences, while providing a number of guarantees in relation to privacy and the protection of passengers’ personal data.

3. The request for an opinion, which concerns both the compatibility of the agreement envisaged with primary EU law and the appropriate legal basis for the Council decision concluding the agreement envisaged, is worded as follows: ‘Is the [agreement envisaged] compatible with the provisions of the Treaties (Article 16 TFEU) and the Charter of Fundamental Rights of the European Union (Articles 7, 8 and Article 52(1)) as regards the right of individuals to protection of personal data? Do Articles 82(1)(d) and 87(2)(a) TFEU constitute the appropriate legal basis for the act of the Council concluding the [agreement envisaged] or must that act be based on Article 16 TFEU?’

4. Irrespective of its content, the Court’s answer to that request will necessarily have implications for the PNR Agreements already in force between the European Union and Australia ( 3 ) and the European Union and the United States of America, ( 4 ) and also on the future Passenger Name Record system, put in place within the Union itself, which was recently approved by the Parliament, although the present proceedings were still pending. ( 5 )

5. The present request for an opinion requires an examination of questions which are both unprecedented and delicate.

6. From the aspect of determining the appropriate legal basis for the act concluding the agreement envisaged, this request must lead the Court, in particular, to examine for the first time the scope of Article 16(2) TFEU, which was introduced following the adoption of the Treaty of Lisbon, and also the way in which that article interacts with the Treaty provisions on the area of freedom, security and justice (‘the AFSJ’). In that regard, as I shall show in this Opinion, ( 6 ) the objectives pursued by and the content of the agreement envisaged are interdependent and the act concluding that agreement must therefore in my view be based on both Article 16 TFEU and Article 87(2)(a) TFEU.

7. This is also the first time that the Court will be required to rule on the compatibility of a draft international agreement with the fundamental rights enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’), and more particularly with those relating to respect for private and family life, guaranteed by Article 7, and the protection of personal data, guaranteed by Article 8. The examination of that question will thus undoubtedly benefit from the valuable guidance to be derived from the judgments of 8 April 2014, Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2014:238), and of 6 October 2015, Schrems (C‑362/14, EU:C:2015:650). As will be more fully explained, I consider that it is indeed appropriate to follow the route outlined by those judgments and to subject the agreement envisaged to a strict review of compliance with the requirements laid down in Articles 7 and 8 and Article 52(1) of the Charter. Nonetheless, it must be borne in mind that the draft agreement referred to the Court is the outcome of international negotiations with a third country, which, in the absence of a satisfactory agreement, may well decline to conclude the agreement envisaged and prefer, as it does now, to apply its PNR system unilaterally to air carriers established in the EU which provide flights to Canada.

8. That does not mean that the Court must lower the degree of vigilance which it has shown in relation to respect for the fundamental rights protected in EU law. It is necessary that, at a time when modern technology allows the public authorities, in the name of combating terrorism and serious transnational crime, to develop extremely sophisticated methods of monitoring the private life of individuals and analysing their personal data, the Court should ensure that the proposed measures, even when they take the form of international agreements envisaged, reflect a fair balance between the legitimate desire to maintain public security and the equally fundamental right for everyone to be able to enjoy a high level of protection of his private life and his own data.

9. As my subsequent observations will illustrate, it cannot be denied that the contracting parties have attempted, sometimes insufficiently, to strike a balance between those two objectives inseparably pursued by the agreement envisaged. To my mind, that effort must be acknowledged. However, without calling in question either the object of or the need for the agreement envisaged, I consider, as this Opinion will demonstrate, that in order to be compatible with Articles 7 and 8 and Article 52(1) of the Charter, the agreement envisaged will have to be brought up to date and/or some of its present terms will have to be deleted so that it does not exceed what is strictly necessary in order to achieve its security objective.

II – Legal framework

10. Article 16 TFEU provides as follows: ‘1. Everyone has the right to the protection of personal data concerning them. 2. The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities. …’

11. Article 82 TFEU, in Chapter 4, entitled ‘Judicial cooperation in criminal matters’, of Title V of Part Three of that Treaty, provides: ‘1. Judicial cooperation in criminal matters in the Union shall be based on the principle of mutual recognition of judgments and judicial decisions and shall include the approximation of the laws and regulations of the Member States in the areas referred to in paragraph 2 … The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall adopt measures to: … (d) facilitate cooperation between judicial or equivalent authorities of the Member States in relation to proceedings in criminal matters and the enforcement of decisions. …’

12. Article 87 TFEU, which is part of Chapter 5, entitled ‘Police cooperation’, of Title V of Part Three of that Treaty, provides as follows: ‘1. The Union shall establish police cooperation involving all the Member States’ competent authorities, including police, customs and other specialised law enforcement services in relation to the prevention, detection and investigation of criminal offences. 2. For the purposes of paragraph 1, the European Parliament and the Council, acting in accordance with the ordinary legislative procedure, may establish measures concerning: (a) the collection, storage, processing, analysis and exchange of relevant information; …’

13. Article 7 of the Charter states: ‘Everyone has the right to respect for his or her private and family life, home and communications.’

14. Article 8 of the Charter states: ‘1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority.’

15. Article 52 of the Charter, entitled ‘Scope and interpretation of rights and principles’, provides as follows: ‘1. Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others. …’

16. Protocol (No 21) on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice provides as follows, in Articles 1, 3 and 6a: ‘Article 1 Subject to Article 3, the United Kingdom and Ireland shall not take part in the adoption by the Council of proposed measures pursuant to Title V of Part Three of the [TFEU]. The unanimity of the members of the Council, with the exception of the representatives of the governments of the United Kingdom and Ireland, shall be necessary for decisions of the Council which must be adopted unanimously. For the purposes of this Article, a qualified majority shall be defined in accordance with Article 238(3) [TFEU]. … Article 3 1. The United Kingdom or Ireland may notify the President of the Council in writing, within three months after a proposal or initiative has been presented to the Council pursuant to Title V of Part Three of the [TFEU], that it wishes to take part in the adoption and application of any such proposed measure, whereupon that State shall be entitled to do so. … Article 6a The United Kingdom and Ireland shall not be bound by the rules laid down on the basis of Article 16 [TFEU] which relate to the processing of personal data by the Member States when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three of that Treaty where the United Kingdom and Ireland are not bound by the rules governing the forms of judicial cooperation in criminal matters or police cooperation which require compliance with the provisions laid down on the basis of Article 16.’

17. Protocol (No 22) on the position of Denmark provides as follows, in Articles 1, 2 and 2a: ‘Article 1 Denmark shall not take part in the adoption by the Council of proposed measures pursuant to Title V of Part Three of the [TFEU]. The unanimity of the members of the Council, with the exception of the representative of the government of Denmark, shall be necessary for the decisions of the Council which must be adopted unanimously. For the purposes of this Article, a qualified majority shall be defined in accordance with Article 238(3) of the [TFEU]. Article 2 None of the provisions of Title V of Part Three of the [TFEU], no measure adopted pursuant to that Title, no provision of any international agreement concluded by the Union pursuant to that Title, and no decision of the Court of Justice of the European Union interpreting any such provision or measure or any measure amended or amendable pursuant to that Title shall be binding upon or applicable in Denmark; and no such provision, measure or decision shall in any way affect the Community or Union acquis nor form part of Union law as they apply to Denmark. … Article 2a Article 2 of this Protocol shall also apply in respect of those rules laid down on the basis of Article 16 [TFEU] which relate to the processing of personal data by the Member States when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three of that Treaty.’

III – Background to the agreement envisaged

18. On 18 July 2005, the Council approved the Agreement between the European Community and the Government of Canada on the processing of Advance Passenger Information and Passenger Name Record data (‘the 2006 Agreement’). ( 7 )

19. In accordance with the preamble thereto, the 2006 Agreement was concluded having regard to the Government of Canada requirement of air carriers carrying persons to Canada to provide Advance Passenger Information and Passenger Name Record data (‘API/PNR data’) to the Canadian competent authorities, to the extent that it is collected and contained in carriers’ automated reservation systems and departure control systems.

20. According to Article 1 of the 2006 Agreement, the purpose of that agreement was ‘to ensure that API/PNR data of persons on eligible journeys is provided in full respect of fundamental rights and freedoms, in particular the right to privacy’. The competent authority for Canada was, in accordance with Annex I to the 2006 Agreement, ‘the Canada Border Services Agency (CBSA)’.

21. In the light of that commitment, the European Commission, acting on the basis of Article 25(2) of Directive 95/46/EC, ( 8 ) adopted Decision 2006/253/EC, ( 9 ) Article 1 of which provided that the CBSA was to be considered to ensure an adequate level of protection for PNR data transferred from the European Community concerning flights bound for Canada. As Decision 2006/253 expired in September 2009 ( 10 ) and the duration of the 2006 Agreement was linked to the duration of that decision, ( 11 ) that agreement therefore also expired in September 2009.

22. On 5 May 2010, the Parliament adopted a Resolution on the launch of negotiations for Passenger Name Record (PNR) data agreements with the United States, Australia and Canada. ( 12 ) In that resolution, the Parliament called for a coherent approach on the use of PNR data for law enforcement and security purposes, establishing a single set of principles to serve as a basis for agreements with third countries. To that end, it invited the Commission to present a proposal for such a single model and a draft mandate for negotiations with third countries, while setting out the minimum requirements to be met. ( 13 )

23. On 21 September 2010, the Commission adopted three proposals aimed at authorising the initiation of negotiations with the United States, Australia and Canada. ( 14 ) Subsequently, agreements were signed and concluded with the United States and Australia, with the approval of the Parliament. ( 15 ) Those agreements entered into force in 2012.

24. Following the close of the negotiations with Canada, the Commission, on 19 July 2013, adopted proposals for Council decisions relating to the signature and conclusion of the agreement envisaged.

25. The European Data Protection Supervisor (‘the EDPS’) delivered his opinion on those proposals on 30 September 2013. ( 16 ) In that opinion, the EDPS raised a number of questions concerning the necessity and proportionality of PNR schemes and of bulk transfers of PNR data to third countries, cast doubt on the choice of the substantive legal basis and made various observations and proposals concerning the various provisions of the agreement envisaged.

26. On 5 December 2013, the Council adopted a decision on the signature of the agreement envisaged, which had not been amended following the opinion of the EDPS. The agreement envisaged was signed on 25 June 2014, subject to its conclusion at a later date.

27. By letter dated 7 July 2014, the Council sought the Parliament’s approval of the draft decision relating to the conclusion, on behalf of the Union, of the agreement envisaged. That draft decisions refers, as legal bases, to Article 82(1)(d) TFEU and Article 87(2)(a) TFEU read in conjunction with Article 218(6)(a)(v) TFEU.

28. On 25 November 2014, the Parliament decided to request the Court to provide the present opinion, submitting the questions set out in paragraph 3 of this Opinion.

IV – The procedure before the Court

29. Following the submission of the request by the Parliament, written observations were lodged by the Bulgarian and Estonian Governments, Ireland, the Spanish, French and United Kingdom Governments and by the Council and the Commission.

30. The Court put a number of questions to be answered in writing, concerning, in particular, certain practical and factual aspects of the processing of the PNR data, the legal basis for the agreement envisaged, the scope ratione territoriae of that agreement and the compatibility of its terms with the provisions of the FEU Treaty and the Charter, in the light of the guidance to be derived from the case-law, especially the judgments of 8 April 2014, Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2014:238), and of 6 October 2015, Schrems (C‑362/14, EU:C:2015:650). Furthermore, in application of the second paragraph of Article 24 of the Statute of the Court of Justice of the European Union, the Court requested the EDPS to answer those questions. The EDPS, and also Ireland, the Spanish, French and United Kingdom Governments, the Parliament, the Council and the Commission, answered the questions put to them within the prescribed period.

31. The representatives of the Estonian Government, Ireland, the Spanish, French and United Kingdom Governments, those of the Parliament, the Council and the Commission, and the representative of the EDPS presented oral argument at the hearing on 5 April 2016.

V – The admissibility of the request for an opinion

32. While the Bulgarian and Estonian Governments and the Commission share the Parliament’s view that the request for an opinion is admissible in its entirety, the French Government and the Council question the admissibility of the second question in the Parliament’s request, which deals with the appropriate legal basis for the Council decision concluding the agreement envisaged.

33. In essence, the French Government and the Council claim that that question does not relate to either the power of the European Union to conclude the agreement envisaged or the allocation of powers between the Union and the Member States. In addition, they maintain that the possible incorrect application of Articles 82 and 87 TFEU would have no impact on the procedure to be followed in adopting the Council act concluding the agreement envisaged, as both the application of Article 16 TFEU and the application of Articles 82 and 87 TFEU require compliance with the ordinary legislative procedure, in particular the approval of the Parliament, pursuant to Article 218(6)(a)(v) TFEU.

34. I suggest that the Court should declare the request for an opinion admissible in its entirety.

35. Generally, it should first of all be borne in mind that, in accordance with Article 218(11) TFEU and the case-law of the Court, the opinion of the Court may be sought as to whether an ‘agreement envisaged’ ( 17 ) is compatible with the substantive rules of the Treaties or with those which determine the extent of the powers of the European Union and its institutions, including questions relating to the allocation of powers between the EU and the Member States to conclude a specific agreement with third States, ( 18 ) as confirmed by Article 196(2) of the Rules of Procedure of the Court of Justice.

36. There can thus be no doubt — as, moreover, all the interested parties acknowledge — that in so far as the request for an opinion relates to the compatibility of the agreement envisaged with the substantive provisions of EU primary law, including the provisions of the Charter, which have the same value as the Treaties, it is admissible. ( 19 )

37. I consider that that is also the case of the second question, relating to the determination of the appropriate legal basis for the act whereby the Council concludes the agreement envisaged.

38. Admittedly, as the French Government and the Council have claimed, none of the interested parties has any doubt that, in this instance, the European Union has the power to approve the agreement envisaged, nor is that question the subject matter of the request for an opinion.

39. However, it should be noted that, when examining previous requests for opinions, the Court has already agreed to answer the question of the appropriate legal basis for the act concluding the proposed agreements at issue. ( 20 ) That position was based, in essence, on two essential considerations, which are closely linked.

40. The choice of the appropriate legal basis for the act concluding an international agreement has ‘constitutional significance’ ( 21 ) since the Union has conferred powers only and must therefore be able to tie the international agreements which are deemed to come within its legal order to a Treaty provision which empowers it to approve those acts. The use of an incorrect legal basis is therefore apt to invalidate the act concluding the agreement and thus to vitiate the European Union’s consent to be bound by that agreement. ( 22 )

41. Furthermore, failure to take the opportunity to examine the choice of the appropriate legal basis for the act concluding a draft agreement in the procedure for submitting a prior request to the Court might ultimately lead to complications, both at EU level and in the international legal order, if the act concluding the agreement should subsequently be declared invalid because of the error in the legal basis. In fact, the preventive procedure laid down in Article 218(11) TFEU is specifically designed to ensure that such complications cannot arise, in the interest of the contracting parties. ( 23 )

42. Although they do not deny the existence of that case-law, the French Government and the Council maintain, in essence, that none of the legal complications to which the Court has referred in its previous opinions could arise in the present case. Thus, according to those interested parties, in the present case, the choice of Article 16 TFEU as the substantive legal basis for the agreement envisaged, as defended by the Parliament in its request for an opinion, would not affect the allocation of powers between the Union and the Member States, nor would it lead to a ‘different legislative procedure’ from that followed by the Council and the Commission in the present case, within the meaning of those opinions.

43. That argument lacks conviction.

44. It should be pointed out that the situations to which the Court referred in paragraph 5 of Opinion 2/00 of 6 December 2001 (EU:C:2001:664), and paragraph 110 of Opinion 1/08 of 30 November 2009 (EU:C:2009:739), respectively, are merely examples of situations in which the use of an incorrect legal basis is liable to vitiate the European Union’s consent to be bound by the agreement to which it has subscribed or to entail legal difficulties at internal level or in the Union’s external relations. The two situations referred to in those paragraphs of the two opinions — namely the situation in which the EU has committed itself although the Treaty does not confer on it sufficient power to ratify an agreement in its entirety, which calls for an examination of the allocation of powers between the European Union and the Member States, and the situation in which the appropriate legal basis for the act concluding the agreement provides for a different legislative procedure from that actually followed by the institutions — were introduced by the expression ‘that is so in particular where’. Other situations giving rise to legal difficulties at internal EU level or in the context of international relations cannot therefore be precluded.

45. Next, it must not be forgotten that the opinion procedure is of a non-contentious and preventive nature, ( 24 ) which to my mind justifies a certain flexibility on the part of the Court when it examines the admissibility of a question relating to the appropriate legal basis for the act concluding an agreement envisaged.

46. Thus, at the admissibility stage, I consider that the Court must simply ask whether, if it declines to answer the question referred to it, there will be a serious risk that the act concluding the agreement may subsequently be declared invalid, on the same ground as that raised in the request for an opinion, resulting in a situation giving rise to difficulties at internal EU level or in the context of external relations that the opinion procedure could have prevented.

47. In the present case, I am convinced that such a risk cannot be precluded.

48. In fact, as I shall examine later in the present Opinion, the grounds which the Parliament puts forward in support of the argument that Article 16 TFEU constitutes the appropriate substantive legal basis for the act concluding the agreement envisaged are very serious, to such an extent that I consider them to be well founded in part.

49. Consequently, failure to answer that argument in the present procedure would be apt to lead the Parliament to challenge the validity of the act concluding the agreement or, as the case may be, to lead a national court hearing an action brought by an individual harmed by the transfer of his PNR data to the Canadian competent authority to request the Court to give a preliminary ruling on the validity of the agreement and the act concluding it.

50. Furthermore, to my mind the French Government and the Council are wrong to play down the consequences of a declaration that the act concluding the agreement envisaged is invalid if it should eventually transpire that, following an action for annulment or a request for a preliminary ruling on validity, that act ought to have been adopted, as the Parliament maintains, on the sole legal basis of Article 16 TFEU.

51. In fact — and I shall return to this point later —, and as suggested in certain written observations, if Article 16 TFEU were taken as the sole legal basis of the act concluding the agreement envisaged, that would alter the status of the Kingdom of Denmark, Ireland and the United Kingdom of Great Britain and Northern Ireland, as those Member States would then be directly and automatically bound by the agreement, contrary to Article 29 of the agreement envisaged. As regards the Kingdom of Denmark, in particular, any international commitment that it might have concluded with Canada, alongside the agreement envisaged, would then be unlawful, since that Member State would no longer have the necessary power to give such a commitment.

52. It therefore seems to me that, all things considered, by analogy with the Court’s observation in paragraph 47 of Opinion 1/13 of 14 October 2014 (EU:C:2014:2303), it is particularly appropriate that the Court should answer the second question in the present request for an opinion in order, in particular, to forestall the legal complications that might be caused by situations in which a Member State enters into international commitments without the requisite authorisation when, under EU law, it would no longer have the necessary power to enter into or give effect to such a commitment.

53. I therefore propose that the Court should declare that the second question raised by the Parliament in its request for an opinion is admissible.

54. Furthermore, as that question relates to the procedural validity of the act concluding the agreement and requires an analysis of the objectives and the content of the agreement envisaged, I suggest that it should be dealt with before the question relating to the compatibility of the agreement with the provisions of the FEU Treaty and the rights enshrined in the Charter.

VI – The appropriate legal basis for the act concluding the agreement envisaged (second question)

A – Analysis of the arguments of the Parliament and the other interested parties

55. The Parliament and all the interested parties who have lodged observations are agreed that, in accordance with the case-law of the Court, the choice of the legal basis must be founded on objective criteria amenable to judicial review, and those objective criteria include the purpose and the content of the act at issue.

56. The Parliament emphasises that the agreement envisaged has two purposes, which are set out in Article 1 thereof. However, the main purpose of the agreement envisaged is to ensure the protection of personal data. In the Parliament’s submission, the agreement envisaged has an effect analogous to an ‘adequacy decision’ and its aim is to replace Commission Decision 2006/253, adopted under Article 25(6) of Directive 95/46, in which the Commission established, in the context of the 2006 Agreement, the adequate level of protection of the PNR data transferred to the CBSA. In addition, the agreement envisaged does not seek to create an obligation for air carriers to transfer PNR data to the Canadian or European police authorities, which makes it difficult to justify the choice of Article 82(1)(d) and Article 87(2)(a) TFEU as the substantive legal bases. According to the case-law, those findings justify, in the Parliament’s view, that the agreement envisaged should be founded on the legal basis corresponding to the main purpose of the agreement envisaged, namely, in this instance, Article 16 TFEU. The content of the agreement envisaged confirms that assessment. The Parliament states, last, that Article 16 TFEU permits the adoption of rules on the protection of personal data in all fields of EU law, including the ‘AFSJ’.

57. In answer to a question put at the hearing before the Court, the Parliament stated that, in the event that the Court should consider that the agreement envisaged pursues inseparable purposes, it had no objection to the act concluding the agreement envisaged being based on Article 16, Article 82(1)(d) and Article 87(2)(a) TFEU.

58. With the exception of the Spanish Government and the EDPS and also, in the context of an alternative observation, the French Government, the other interested parties maintain that the purpose of the agreement envisaged is to combat terrorism and serious transnational crime, while data protection constitutes, in essence, only an instrument whereby that purpose may be achieved. In that regard, the Commission observes that, in the judgment of 30 May 2006, Parliament v Council and Commission (C‑317/04 and C‑318/04, EU:C:2006:346, paragraph 56), the Court held that the transfer of PNR data to the United States constituted processing operations concerning public security and the activities of the Member States in areas of criminal law. The choice of the legal basis for the act concluding the agreement envisaged should be made in accordance with that reasoning.

59. The great majority of those interested parties further submit that, if data protection were to be considered to constitute an objective of the agreement envisaged, that objective would be merely incidental to the main purpose and would therefore have no consequence on the actual choice of the legal basis for the act concluding the agreement. In that regard, the Council and the Commission submit that acts having as their purpose the implementation of sectoral policies requiring the processing of personal data should be based on the legal basis corresponding to the policy concerned and not on Article 16 TFEU.

60. As for the possibility of combining Article 16, Article 82(1)(d) and Article 87(2)(a) TFEU as the substantive legal bases of the act concluding the agreement envisaged, the French Government maintains, in the alternative, in its written observations, that such a combination is perfectly conceivable. On the other hand, Ireland and the Council maintain the opposite. At the hearing before the Court, the Council submitted that the voting procedure within the Council, as defined in Protocols (No 21) and (No 22), would preclude such a hypothesis.

B – Assessment

61. According to settled case-law, the choice of the legal basis for a European Union measure, including the measure adopted for the purpose of concluding an international agreement, must rest on objective factors amenable to judicial review, which include the purpose and the content of that measure. If examination of the EU measure reveals that it pursues a twofold purpose or that it has a twofold component, and if one of those is identifiable as the main or predominant purpose or component, whereas the other is merely incidental, the act must be based on a single legal basis, namely, that required by the main or predominant purpose or component. ( 25 )

62. However, the Court accepts, ‘by way of exception’, that an act may be founded on various legal bases corresponding to the number of the objectives or components of that act where those objectives or components are inseparably linked, without one being incidental in relation to the other. ( 26 ) In such a case, the Court further ascertains whether recourse to more than one legal basis might be precluded on the ground that the procedures laid down for the different legal bases are mutually incompatible. ( 27 )

63. It is in the light of that case-law that it must be determined whether, having regard to the purpose and the content of the agreement envisaged, the act concluding that agreement should be based exclusively on Article 82(1)(d) and Article 87(2)(a) TFEU, as substantive legal bases, as the Council’s draft decision indicates and as most of the interested parties maintain, or whether it should be based on Article 16 TFEU, whether exclusively or read in conjunction with those two articles. ( 28 )

64. On the latter point, I would make clear that, contrary to the Council’s contention in its written observations, the Court is in my view perfectly entitled, in the light of the non-contentious and preventive nature of the opinion procedure, to examine the second question submitted by the Parliament from the angle of the combination of substantive legal bases, even though the wording of that question does not envisage it. Furthermore, the interested parties had the opportunity, both during the written procedure and at the hearing, to express their views on that point.

65. That is all the more important because the examination of the purpose and the content of the agreement envisaged must in my view lead to the finding that the agreement pursues two objectives and has two components, although, overall, neither those two objectives nor those different components can be ranked and separated. To my mind, that justifies the act concluding the agreement envisaged taking as its substantive legal bases Article 16 and Article 87(2)(a) TFEU, which means that the procedures referred to in those two articles may co-exist.

1. The purpose and the content of the agreement envisaged

66. It is apparent from the second paragraph of the preamble to the agreement envisaged that the contracting parties recognise ‘the importance of preventing, combating, repressing and eliminating terrorism and terrorist-related offences, as well as other serious transnational crime, while preserving fundamental rights and freedoms, in particular rights to privacy and data protection’, while the fourth paragraph further states that the use of PNR data is a critically important instrument to pursue those goals.

67. The simultaneous pursuit of the objective of combating terrorism and other serious transnational crime and respecting private life and the protection of personal data is confirmed by the fifth and sixth paragraphs of the preamble, which emphasise, respectively, the contracting parties’ desire to ‘safeguard public security’ and the recognition that they ‘share common values with respect to data protection and privacy’.

68. Likewise, it is expressly stated in the 15th paragraph of the preamble that Canada has given a commitment that its competent authority will process ‘PNR data for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious transnational crime in strict compliance with safeguards on privacy and the protection of personal data, as set out in [the agreement envisaged]’.

69. The agreement envisaged is therefore intended to allow Canada to process the PNR data of passengers carried by airlines flying between the European Union and Canada, for the purpose of combating terrorism and other serious transnational crime while safeguarding the right to respect for privacy and the right to protection of personal data under the conditions laid down in the agreement envisaged itself.

70. The need to reconcile those two objectives is confirmed out by Article 1 of the agreement envisaged, which states that the contracting parties are to set out the conditions for the transfer and use of PNR data ‘to ensure the security and safety of the public and prescribe the means by which the data is protected’.

71. It is also clear on examining the content of the agreement envisaged that the means of combating terrorism and other serious transnational crime by the transfer and processing of PNR data is authorised only if the data in question benefits from an adequate level of protection.

72. Thus, in the words of Article 3(1) of the agreement envisaged, Canada is to ensure that the Canadian competent authority processes PNR data received ‘strictly for the purpose of preventing, detecting, investigating or prosecuting terrorist offences or serious transnational crime’, while making clear that that processing must be carried out ‘pursuant to this Agreement’. That means, in particular, that, in application of Article 5 of the agreement envisaged, ‘subject to compliance with [that agreement], the Canadian Competent Authority is deemed to provide an adequate level of protection, within the meaning of relevant European Union data protection law’.

73. Likewise, in the context of the retention of PNR data and the gradual depersonalisation of that data by masking, provided for in Article 16 of the agreement envisaged, paragraph 4 of that article authorises the subsequent unmasking of that data by the Canadian authorities only where, ‘on the basis of available information, it is necessary to carry out investigations under the scope of Article 3’ of the agreement envisaged.

74. In addition, Articles 18(1) and 19(1) of the agreement envisaged authorise the subsequent disclosure of the PNR data to other Canadian government authorities or to government authorities in third countries only in strictly limited circumstances, including where the authorities in question perform ‘functions [which] are directly related to the scope of Article 3 [of the agreement envisaged]’ and where those authorities afford ‘protection equivalent to the safeguards described in [the agreement envisaged]’.

75. However, although the need to reconcile the two objectives is not affected, some of the terms of the agreement envisaged are more concerned with the aim of combating terrorism and serious transnational crime while others are more concerned with the aim of safeguarding adequate protection of personal data.

76. Thus, as specifically regards the first objective, under Article 6(2) of the agreement envisaged Canada is required to share, in specific cases, and at the request of the European Police Office (Europol), the European Union Judicial Cooperation Unit (Eurojust), within the scope of their respective mandates, or the police or a judicial authority of a Member State of the European Union, PNR data or analytical information containing PNR data obtained under the agreement envisaged ‘to prevent, detect, investigate, or prosecute within the European Union a terrorist offence or serious transnational crime’. Under Article 23(2) of the agreement envisaged, moreover, it is provided that the contracting parties are to cooperate to pursue the coherence of their respective PNR data processing regimes ‘in a manner that further enhances the security of citizens of Canada, the European Union and elsewhere’.

77. As for the terms relating rather to the guarantees afforded by the agreement envisaged concerning data protection, the agreement lays down a number of rules relating to data security and integrity (Article 9 of the agreement envisaged), access, correction and annotation of data for individuals (Articles 12 and 13 of the agreement envisaged), oversight of PNR data processing and administrative and judicial redress for the persons concerned (Articles 10 and 14 of the agreement envisaged).

78. In the light of the aim and the content of the agreement envisaged, that agreement therefore pursues two objectives and has two essential components, as, in fact, most of the interested parties have acknowledged or at least conceded.

79. Contrary to what the interested parties assert in support of opposing arguments, it is indeed difficult, in my view, to determine which of those two objectives prevails over the other.

80. In fact, as the description of the aim and the content of the agreement envisaged tends to show, those two objectives must be pursued simultaneously and in fact appear to be inseparable. As I have emphasised, the transfer to and processing of PNR data by the Canadian competent authority for the purposes set out in Article 3 of the agreement envisaged are authorised only where those operations are accompanied by adequate protection of the data, within the meaning of European Union data protection law, in accordance with Article 5 of the agreement envisaged. In other words, if such protection is not ensured, the transfer of the PNR data provided for in the agreement envisaged cannot be lawfully effected. In addition, the guarantees laid down in the agreement envisaged in terms of protection of personal data are necessary only because the PNR data must be transferred to the Canadian competent authority under the Canadian legislation and the terms of the agreement envisaged. As illustrated by a number of provisions of the agreement envisaged, such as Articles 16, 18 and 19 thereof, the agreement envisaged is therefore designed to reconcile the security objective with the objective of protecting the fundamental rights of the individuals concerned, particularly the right to protection of their personal data.

81. All in all, I consider that those two objectives and those two components of the agreement envisaged are inseparably linked and that neither of them is secondary and indirect by reference to the other.

82. That assessment cannot be undermined by the Commission’s argument, based on paragraph 56 of the judgment of 30 May 2006, Parliament v Council and Commission (C‑317/04 and C‑318/04, EU:C:2006:346), that the Court has held that the transfer of PNR data to the United States constituted processing operations concerning public security and the activities of the Member States in areas of criminal law.

83. First of all, the present opinion procedure has as its subject matter the agreement envisaged with Canada and not the first agreement concluded with the United States in 2004 and the Commission adequacy decision adopted in that year, to which the actions for annulment brought by the Parliament related.

84. Next, and more fundamentally, the Commission is taking out of context the finding made by the Court in paragraph 56 of the judgment of 30 May 2006, Parliament v Council and Commission (C‑317/04 and C‑318/04, EU:C:2006:346), which, it must be recalled, was delivered well before the adoption of the Treaty of Lisbon.

85. The Court was asked by the Parliament to determine, in particular, whether the Commission was authorised to adopt an adequacy decision, based on Article 25 of Directive 95/46 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States, when Article 3(2) of that directive expressly excluded from its scope processing operations concerning, in particular, public security and the activities of the State in areas of criminal law. The Court logically replied in the negative. In fact, the processing of the PNR data in the context of the agreement with the United States could not be associated with the supply of services, but fell within a framework established by the public authorities that related to public security, which did not come within the scope of Directive 95/46. ( 29 )

86. That finding does not mean that the Court made a definitive ruling on the object of PNR agreements, including, for the purpose of the argument, the object of the agreement envisaged or, a fortiori, that it definitively held that the exclusive, principal or predominant objective of those agreements is to combat terrorism or serious transnational crime, as the Commission wrongly implies.

87. Nor, clearly, does the finding of the Court in the judgment of 30 May 2006, Parliament v Council and Commission (C‑317/04 and C‑318/04, EU:C:2006:346) mean that, in ruling on the scope ratione materiae of Directive 95/46, the Court on the same occasion defined in advance the limits of the scope ratione materiae of Article 16 TFEU.

88. In support of the argument that the security objective of the agreement envisaged is predominant and therefore justifies the legal basis chosen, the Commission also attempts to draw an analogy between the present case and the case giving rise to the judgment of 6 May 2014, Commission v Parliament and Council (C‑43/12, EU:C:2014:298).

89. In that case, which concerned the determination of the appropriate legal basis for Directive 2011/82/EU of the European Parliament and of the Council of 25 October 2011 facilitating the cross-border exchange of information on road safety related traffic offences, ( 30 ) the Court, after establishing that the predominant objective of that directive was to improve road safety (and therefore transport safety), held that the information exchange system set up by the directive provides ‘the means of pursuing [that] objective’. ( 31 ) The directive should therefore have been adopted not on the basis of Article 87(2) TFEU (Police Cooperation) but on the basis of Article 91(1)(c) TFEU, under the title on transport policy.

90. While I am prepared to accept that there is a partial analogy between the two situations, that does not alter the conclusion that the agreement envisaged has two objectives and has two inseparable components. Thus, the fact that the transfer of PNR data to the Canadian competent authority may constitute the means whereby the contracting parties pursue the public security objective of the agreement envisaged does not alter the finding that the object of the agreement envisaged, as stated, in particular, in Article 1 of that agreement, is twofold. Moreover, the specific feature of the agreement envisaged, which distinguishes it from Directive 2011/82, relates to the fact that the maximum efficiency sought by the means consisting in the transfer of PNR data in order to achieve the aims set out in Article 3 of the agreement envisaged, must be weighed against the guarantees afforded to the protection of personal data laid down in that agreement, which form part of the second objective pursued by that agreement.

91. Also lacking in conviction are the Parliament’s arguments in support of its position that the ‘centre of gravity’ of the agreement envisaged is predominantly situated in the guarantees which its terms afford to passengers in relation to the protection of their PNR data, which, it claims, means that the decision concluding that act should be based exclusively on Article 16 TFEU.

92. It is incorrect to claim that the agreement envisaged lays down no obligation for the airlines to transfer the PNR data to the Canadian competent authority so that the data can be processed according to the purposes listed in Article 3 of the agreement envisaged. It is true, as the Parliament remarked in its written observations, that Article 4(1) of the agreement envisaged states that the Union is to ensure only that air carriers ‘are not prevented’ from transferring PNR data to the Canadian competent authority. However, it follows from the interpretation of that article, entitled ‘Ensuring PNR data is provided’, in conjunction with that of Articles 5, ( 32 ) 20 ( 33 ) and 21 ( 34 ) of the agreement envisaged, as, moreover, the Parliament acknowledged in answer to a written question put by the Court, that air carriers are entitled and in practice required to provide the Canadian competent authority systematically with access to the PNR data for the purposes defined in Article 3 of the agreement envisaged.

93. Furthermore, the object of the agreement envisaged cannot principally be treated as equivalent to an adequacy decision, comparable to the decision which the Commission had adopted under the 2006 Agreement. ( 35 ) As already stated, both the aim and the content of the agreement envisaged show, on the contrary, that that agreement is intended to reconcile the two objectives which it pursues and that those objectives are inseparably linked.

94. What consequence, therefore, does that assertion have for the determination of the legal basis of the act concluding the agreement envisaged?

2. The appropriate legal basis

95. As already stated, it is common ground that the draft Council decision concluding the agreement envisaged is based on Article 82(1)(d) and Article 87(2)(a) TFEU, both of which come under Title V of Part Three of the FEU Treaty, on the ‘Area of Freedom, Security and Justice’ (‘the AFSJ’).

96. In the light of the two objectives and the two inseparable components of the agreement envisaged described above, those substantive legal bases seem to me to be relevant, at least in part, but insufficient. I consider it appropriate and possible, having regard to the case-law, to base the act concluding the agreement envisaged on the first subparagraph of Article 16(2) TFEU.

(a) The relevance of Article 82(1)(d) and Article 87(2)(a) TFEU

97. As for the first point, namely the relevance of Article 82(1)(d) and Article 87(2)(a) TFEU, it must first of all be agreed that the construction of an AFSJ requires that the Union be able to exercise its external powers.

98. Except in the case of readmission agreements, provided for in Article 79(3) TFEU, relating to immigration policy and not relevant in the present case, the EU has not been explicitly granted any general external powers in relation to the AFSJ. However, Article 216(1) TFEU permits the Union to conclude international agreements, including in the area of police and/or judicial cooperation in criminal matters, in particular where the conclusion of such agreements is necessary in order to achieve one of the objectives referred to in the Treaties.

99. None of the interested parties questions that possibility. To my mind, however, the Court cannot merely rely on that fact, but should devote argument to that question in the opinion which it is called upon to deliver.

100. If it is to be accepted that the Union has external powers in the sphere of the AFSJ, the exercise of those powers in the sphere of police and judicial cooperation in criminal matters must be firmly fixed in the objectives pursued by the AFSJ.

101. Those objectives are set out in Article 3(2) TEU and Article 67 TFEU. The first of those provisions states that ‘the Union shall offer its citizens an [AFSJ] without internal frontiers, in which the free movement of persons is ensured in conjunction with appropriate measures with respect to external border controls … and the prevention and combating of crime’. Article 67 TFEU, which opens Chapter 1 of Title V of Part Three of the FEU Treaty, provides, in paragraph 3, that the Union ‘shall endeavour to ensure a high level of security through measures to prevent and combat crime, racism and xenophobia, and through measures for coordination and cooperation between police and judicial authorities and other competent authorities …’.

102. As Advocate General Bot correctly argued in his Opinion in Parliament v Council (C‑658/11, EU:C:2014:41, points 111 and 112), the external dimension of the AFSJ is functional and instrumental having regard to the objectives set out in those provisions. Accordingly, while the construction of the AFSJ may require external action on the part of the Union, an agreement must, if it is to be able to be regarded as falling within the AFSJ, have a close link with freedom, security and justice within the union, that is to say, a direct link between the purpose of safeguarding the internal security of the Union and the police and/or judicial cooperation which is developed outside the Union. ( 36 )

103. In a different context, but long the same lines, the Court, interpreting Article 87(2) TFEU in the light of Article 67 TFEU, stated that, in order for an act of the Union, having regard to its purpose and its content, to be able to be based on the first of those articles, it must be directly linked to the objectives set out in Article 67 TFEU. ( 37 )

104. That, in my view, is indeed the case of the agreement envisaged.

105. In the first place, that agreement applies to the transfer, processing and use of PNR data for the purposes of public security and the activities of the State in areas of criminal law, ( 38 ) that is to say, more particularly, the prevention, detection, investigation and prosecution of terrorist offences and serious transnational crime. According to Article 1 of the agreement envisaged, that agreement is intended to ‘ensure the security and safety of the public’, which clearly means the security and safety of citizens of the Union, in particular those flying between Canada and the European Union. ( 39 ) Furthermore, under Article 6(2) of the agreement envisaged Canada is required, at the request of, among others, the police or a judicial authority of a Member State of the Union, to share, in specific cases, PNR data or analytical information containing PNR data obtained under the agreement envisaged in order to prevent or detect ‘within the European Union’ a terrorist offence or serious transnational crime.

106. In the second place, although the collection and initial transfer of the PNR data are carried out by the air carriers, the terms of the agreement envisaged constitute a legal framework established by the public authorities for criminal purposes. ( 40 ) As already stated, the agreement envisaged thus establishes rules on access to PNR data and/or analytical information containing PNR data by the Canadian competent authorities and also the subsequent sharing of such data with, among others, the competent police and judicial authorities of the Union and its Member States and also with those of third countries, in particular for the purposes set out in Article 3 of the agreement envisaged. Furthermore, as was clear from the discussion before the Court, the five-year retention period for the PNR data laid down in Article 16(1) and (5) of the agreement envisaged was set with a view to enabling and facilitating investigations, prosecutions and judicial proceedings relating, in particular, to international serious crime networks. In the light of the very open wording of Article 16(5) of the agreement envisaged, those investigations and prosecutions are perfectly capable of including those carried out by the police and judicial authorities of the Member States of the Union. Such rules fall, in principle, within the sphere covered by police and judicial cooperation in criminal matters. ( 41 )

107. I conclude, first, that in so far as it relates to measures which the Parliament and the Council may establish in connection with ‘the collection, storage, processing, analysis and exchange of relevant information’ for the purposes of police cooperation ‘in relation to the prevention, detection and investigation of criminal offences’ provided for in Article 87(1) TFEU, Article 87(2)(a) TFEU constitutes an appropriate legal basis for the act concluding the agreement envisaged. I would add, for all practical purposes, that that cooperation and those exchanges do not necessarily have to be between authorities who are specifically defined, in national law, as police services in the strict sense. Article 87(1) TFEU associates with police cooperation, in a particularly broad manner, ‘all the Member States’ competent authorities, including police, customs and other … law enforcement services’, ( 42 ) an expression which perfectly authorises, in the context of the external dimension of the AFSJ, cooperation with the CBSA in order to safeguard the internal security of the Union.

108. As regards, second, the ‘judicial cooperation in criminal matters’ aspect of the agreement envisaged, in spite of the matters to which attention was drawn in paragraphs 105 and 106 of this Opinion, I confess to having some hesitation in considering that the agreement envisaged may constitute a measure which contributes directly to ‘facilitat[ing] cooperation between judicial or equivalent authorities of the Member States in relation to proceedings in criminal matters and the enforcement of decisions’, within the meaning of Article 82(1)(d) TFEU. As the United Kingdom Government acknowledged in its reply to one of the written questions put by the Court, it is only in certain cases that the agreement envisaged might promote such cooperation between Member States’ judicial authorities. Such cooperation depends, however, on a number of parameters, both factual and legal, which are outside the terms of the agreement envisaged. Cooperation between the judicial authorities of the Member States therefore appears to be only an indirect consequence of the framework established by the agreement envisaged. Admittedly, the fact that Article 6 of the agreement envisaged places an obligation not only on the Canadian competent authority but, more generally, on ‘Canada’ to share PNR data or analytical information with the judicial authorities of the Member States may be understood as also imposing such an obligation on the judicial authorities of that third State. On the assumption that that interpretation is correct and that an exchange of PNR data between the judicial authorities may be envisaged, the fact nonetheless remains that, as currently drafted, the agreement envisaged does not really seem to contribute to facilitating cooperation between the judicial or equivalent authorities of the Member States. To my mind, it is only if the Court were to adopt a more generous interpretation of Article 82(1)(d) TFEU, together, where appropriate, with Article 67(3) TFEU, which provides that the Union is to ‘endeavour to ensure a high level of security … through measures for coordination and cooperation between police and judicial authorities and other competent authorities’, or if the contracting parties were to amend the terms of the agreement envisaged in such a way that the judicial dimension of the agreement envisaged were taken more directly into account, that Article 82(1)(d) TFEU might genuinely constitute an additional legal basis for the act concluding that agreement.

109. I would add that the conclusion that Article 82(1)(d) TFEU cannot properly serve as a basis for the act concluding the agreement envisaged is not affected by the fact, to which certain of the interested parties refer, that the Council decisions concluding the PNR Agreements with Australia and the United States are based on that provision, read in conjunction with Article 87(2)(a) TFEU. ( 43 ) In fact, it is settled case-law that, in a review of the legal basis for the act concluding the agreement envisaged in the present case, the legal basis used for the adoption of other Union measures that might display similar characteristics is irrelevant. ( 44 )

110. In those circumstances, having regard to way in which the agreement envisaged is currently drafted, I am of the view that Article 87(2)(a) TFEU constitutes an appropriate legal basis for the act concluding the agreement envisaged.

111. Accordingly, that substantive legal basis, properly set out in the draft act concluding the agreement envisaged, seems to me to be insufficient to enable the Union to conclude that agreement.

(b) The need to base the act concluding the agreement envisaged on the first subparagraph of Article 16(2) TFEU

112. As the Parliament correctly maintained in its request, Article 87(2)(a) TFEU and, generally, Title V of Part Three of the FEU Treaty on the AFSJ do not provide for the adoption of rules in the area of personal data protection.

113. As I have shown above, one of the two essential objectives of the agreement envisaged, as stated in Article 1, is specifically to ‘prescribe the means by which the [PNR] data’ of passengers flying between Canada and the European Union ‘is protected’. As already pointed out, the content of the agreement envisaged supports that objective, in particular the terms in the chapter on ‘Safeguards applicable to the processing of PNR data’, consisting of Articles 7 to 21 of the agreement envisaged.

114. In that context, action taken by the Union must necessarily be based, in my view, on the first subparagraph of Article 16(2) TFEU, which, it will be recalled, confers on the Parliament and the Council the task of laying down the rules relating to the protection of individuals with regard to the processing of personal data by, inter alia, the Member States when carrying out activities which fall within the scope of application of EU law and the rules relating to the free movement of such data. Three main principles underlie that approach.

115. First of all, in line with the reasoning developed above in relation to the external dimension of the AFSJ, the European Union must be considered, in accordance with Article 216(1) TFEU, to be authorised to conclude an international agreement with a third country with the object of laying down rules relating to the protection of personal data where it is necessary to do so in order to achieve one of the objectives referred to in the Treaties, in this instance the objectives of Article 16 TFEU. That applies to the agreement envisaged, one of the essential purposes of which consists, in essence, in prescribing the means of safeguarding the protection of the PNR data of passengers flying between Canada and the European Union. To my mind, moreover, there is no doubt that the terms of the agreement envisaged must be characterised as ‘rules’ relating to the protection of the data of natural persons, within the meaning of the first subparagraph of Article 16(2) TFEU, and intended to bind the contracting parties.

116. Next, and unlike the situation of the former Article 286 EC, the first subparagraph of Article 16(2) TFEU, which is part of Title II of Part One of that Treaty, entitled ‘Provisions having general application’, is intended to constitute the legal basis for all rules adopted at EU level relating to the protection of individuals with regard to the processing of their personal data, including the rules coming within the framework of the adoption of measures relating to the provisions of the FEU Treaty on police and judicial cooperation in criminal matters. As stated in paragraph 2 of that article, only the rules relating to the protection of personal data adopted in the context of the common foreign and security policy must be based on Article 39 TEU. That interpretation of the first subparagraph of Article 16(2) TFEU is confirmed by the omission of any reference to the possible adoption of provisions relating to the protection of personal data on the basis of Article 87(2)(a) TFEU. It should be borne in mind that, before the entry into force of the Treaty of Lisbon, Article 30(1)(b) TEU provided, on the contrary, that common action in the field of police cooperation could cover, inter alia, the processing, analysis and exchange of relevant information, ‘subject to appropriate provisions on the protection of personal data’, which, moreover, authorised the Council to adopt Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters. ( 45 ) Furthermore — and I shall return to this point later — it must be emphasised that the provisions of Protocols (No 21) and (No 22) did indeed envisage the situation in which rules based on the first subparagraph of Article 16(2) TFEU might be adopted in the context of the exercise of activities which fall within the chapters of the FEU Treaty on police and judicial cooperation in criminal matters.

117. It follows, and in order to dispel any doubt as to the ambiguity of the position defended by the Commission in its written observations, that Article 16 TFEU, on the one hand, and Articles 87(2)(a) and 82(1)(d) TFEU, on the other, cannot maintain relationships of a ‘lex generalis — lex specialis’ hierarchical type. As the abovementioned protocols illustrate, the High Contracting Parties envisaged the possibility that a Union act might be based on those three articles at the same time, precisely because those provisions have different and separate scopes.

118. Last, as the Parliament, the Commission and the EDPS, in particular, maintained in their replies to a written question put by the Court, the relevance of Article 16 TFEU as a legal basis for the act concluding the agreement envisaged cannot be put in doubt because the protective measures which can be adopted under that article relate to the processing of data by authorities of the Member States and not, as in this instance, to the transfer of data previously obtained by private entities (the air carriers) to a third country.

119. In fact, to paraphrase Advocate General Léger, the obligation by which an air carrier is bound under Articles 4, 5, 20 and 21 of the agreement envisaged, when read together, is not ‘fundamentally different from a direct exchange of data between public authorities’. ( 46 ) Furthermore, as the Court has confirmed that the definition of ‘data processing’, within the meaning of Directive 95/46, covers the transfer of personal data by a private operator from a Member State to a third country, ( 47 ) to put a strictly literal interpretation on the new legal basis constituted by the first subparagraph of Article 16(2) TFEU would be tantamount to splitting up the system for the protection of personal data. Such an interpretation would run counter to the intention of the High Contracting Parties to create, in principle, a single legal basis expressly authorising the EU to adopt rules relating to the protection of the personal data of natural persons. It would therefore represent a step backwards from the preceding scheme based on the Treaty provisions relating to the internal market, which would be difficult to explain. That strictly literal interpretation of Article 16 TFEU would thus have the consequence of depriving that provision of a large part of its practical effect.

120. Consequently, in the light of the objectives and the components of the agreement envisaged, which are inseparably linked, the act concluding that agreement must in my view be based on the first subparagraph of Article 16(2) TFEU and Article 87(2)(a) TFEU as its substantive legal bases.

121. In accordance with the case-law, when multiple legal bases are used when adopting an act of the Union the procedures referred to in the different legal bases in question must be compatible. ( 48 )

122. In this instance, both the first subparagraph of Article 16(2) and Article 87(2)(a) TFEU provide that, when adopting the measures envisaged by those two articles, the Parliament and the Council are to act in accordance with the ordinary legislative procedure. The same applies, moreover, in the case of the measures based on Article 82(1)(d) TFEU should the Court consider that that article constituted an appropriate substantive legal basis for the act concluding the agreement envisaged.

123. Accordingly, the procedures specifically referred to in those articles are compatible, within the meaning of the case-law. They therefore do not preclude the Court accepting a plurality of legal bases for the act concluding the agreement envisaged.

124. The Council, supported by Ireland, claimed, however, that it is necessary to go further than that finding and to examine the detailed rules governing the participation of the Kingdom of Denmark, Ireland and the United Kingdom, within the Council, as provided for in the provisions of Protocols (No 21) and No 22) respectively. According to those interested parties, those detailed rules preclude the joint application, as substantive legal bases, of Article 16 TFEU and Article 87(2)(a) TFEU. More specifically, the Council explained at the hearing before the Court, not without some contradictions and inconsistencies, ( 49 ) that the provisions of those protocols distinguish the question of the non-binding nature of the rules established on the basis of Article 16 TFEU concerning the processing of personal data in the exercise of activities in connection with police and judicial cooperation in criminal matters from the question of the participation of those three Member States in the vote in the Council when the Council is called upon to adopt such rules. In the Council’s submission, it follows that, while those three Member States would not participate in the adoption of measures falling within the scope of police and judicial cooperation in criminal matters, except where Ireland and the United Kingdom have decided to exercise their right to ‘opt in’, they would still participate in the adoption of the rules which took Article 16 TFEU as their basis, in spite of the fact that, under those protocols, those measures would not be binding on those Member States.

125. That argument merits a certain amount of attention, even though, ultimately, I consider that it should be rejected.

126. It will be recalled that the Court has already held that the two protocols in question are not capable of having ‘any effect whatsoever on the question of the correct legal basis’ for the adoption of an EU measure. ( 50 ) Thus, according to that case-law, if, following the analysis of the objective and the content of the agreement envisaged, and contrary to what I have argued above, the act concluding that agreement had to be based exclusively on the first subparagraph of Article 16(2) TFEU, the two protocols in question, in spite of the wording of Article 29 of the agreement envisaged, could not ‘neutralise’ that situation. In other words, the three Member States in question would have to participate in the act concluding the agreement envisaged and be bound by it.

127. The application of that case-law in a situation in which there are two competing legal bases, which lay down the same adoption procedure (the ordinary legislative procedure and vote by a qualified majority within the Council), but which would affect in a different way the participation, within the Council, of the three Member States concerned in the adoption of the act in question, is more delicate.

128. Since it is a question here of determining the appropriate legal basis for a specific act, namely the act concluding the agreement envisaged, that question does not need to be resolved so far as Ireland and the United Kingdom are concerned. In fact, it is common ground that, in accordance with Article 3 of Protocol (No 21), those two Member States have notified their intention to be bound by the agreement envisaged and will, consequently, participate in the adoption of the act concluding that agreement. No argument of a procedural nature relating to those two Member States therefore precludes the act concluding the agreement envisaged being based jointly on the first subparagraph of Article 16(2) and Article 87(2)(a) TFEU.

129. As for the Kingdom of Denmark’s position, it should be borne in mind that, in accordance with Article 2a of Protocol (No 22), Article 2 of that protocol, which provides, in particular, that no measure or international agreement adopted pursuant to Title V of Part Three of the FEU Treaty is to be binding upon the Kingdom of Denmark, also applies with respect to the rules laid down on the legal basis of Article 16 TFEU which relate to the processing of personal data by the Member States when carrying out activities which fall within the scope of Chapter 4 or Chapter V of Part Three of that Treaty, namely activities which fall within the scope of police and judicial cooperation in criminal matters.

130. The Kingdom of Denmark will therefore not be bound by the terms of the agreement envisaged. However, the Council maintains that, in referring only to Article 2 of Protocol (No 22) and not to Article 1, which states that the Kingdom of Denmark is not to take part in the adoption by the Council of proposed measures pursuant to Title V of Part Three of the FEU Treaty, Article 2a of that protocol implies, conversely, that the Kingdom of Denmark would participate in the adoption of the act concluding the agreement envisaged if that act were to be based on Article 16 TFEU.

131. That line of reasoning fails to convince me or, at least, does not have the consequences which the Council ascribes to it as regards the choice of the legal basis for the act concluding the agreement envisaged.

132. In fact, I do not think that it was the intention of the High Contracting Parties to allow the Kingdom of Denmark not to be bound by an act having as its legal basis both Article 16 TFEU and one of the provisions of the FEU Treaty relating to police and judicial cooperation in criminal matters, but to participate in the adoption of that act, with the inherent risk that the Kingdom of Denmark might join a group of Member States opposed to the actual adoption of that act, and thereby prevent a qualified majority from being formed within the Council. That seems to me to be contrary to the object of Protocol (No 22), which is to seek a balance between the need to manage the Kingdom of Denmark’s specific position and the need to allow the other Member States (including, where appropriate, Ireland and the United Kingdom) to pursue their cooperation within the sphere of the AFSJ.

133. The objection might be raised, admittedly, that, according to the preamble to Protocol (No 22), the High Contracting Parties note that the Kingdom of Denmark will not prevent the other Member States from further developing their cooperation with respect to measures not binding on that Member State. Thus, according to that argument, although it would be authorised to take part in the adoption of acts falling under Article 2a of that protocol which are not binding on it, the Kingdom of Denmark has undertaken never to oppose their adoption.

134. If that were the correct interpretation of the relevant provisions of Protocol (No 22), the consequence would be that the act concluding the agreement envisaged could not be based on Article 16 TFEU in conjunction with Article 87(2)(a) TFEU, on the ground of an alleged incompatibility between the procedures leading to the adoption of that act, for the simple reason that the Kingdom of Denmark would participate in a purely formal sense in the adoption of that act. Consequently, that purely formal participation by the Kingdom of Denmark in the adoption of the act concluding the agreement envisaged would ‘neutralise’ the objective analysis of the legal basis for that act, an analysis which, it will be recalled, is based on an examination of the purposes and the components of that agreement. That consequence would clearly run counter to the case-law according to which it is not the procedure that defines the legal basis for an act, but the legal basis for an act that determines the procedure to be followed when adopting it. ( 51 ) In my view, that case-law applies a fortiori where the procedure that it was claimed had to be followed would entail, within the Council, a purely formal participation by the Kingdom of Denmark in the adoption of an act in respect of which that Member State will not in any way be bound.

135. In the light of the all of the foregoing considerations, I propose that the Court should answer the second question submitted by the Parliament by stating that the act concluding the agreement envisaged, in the light of the objectives and the components of that agreement, which are inseparably linked, without some of them being incidental by comparison with the others, must be based on the first subparagraph of Article 16(2) TFEU and Article 87(2)(a) TFEU, read in conjunction with Article 218(6)(a)(v) TFEU. ( 52 )

VII – The compatibility of the agreement envisaged with the provisions of the FEU Treaty and the Charter (first question)

A – Analysis of the Parliament’s request and observations and also of the observations of the other interested parties

1. Analysis of the Parliament’s request and observations

136. The Parliament maintains that, in the light, in particular, of the Court’s case-law, there is legal uncertainty as to whether the agreement envisaged is compatible with Article 16 TFEU and Articles 7 and 8 and Article 52(1) of the Charter.

137. In the Parliament’s submission, it is clear that the collection, transfer, analysis, retention and subsequent transfer of PNR data provided for in the agreement envisaged constitute different forms of ‘processing’ and different forms of interference with the fundamental rights guaranteed in Articles 7 and 8 of the Charter. In its various forms, that interference is far-reaching and particularly serious. ( 53 )

138. The Parliament emphasises that, in accordance with Article 52(1) of the Charter, such an interference could be justified only if it is ‘provided for by law’ and is necessary and proportionate to an objective of general interest recognised by the Union.

139. As for the first point, the Parliament asks, in essence, whether an international agreement constitutes a ‘law’ within the meaning of that provision and whether it may place limitations on the exercise of the rights guaranteed by Articles 7 and 8 of the Charter. It observes that, according to the case-law of the European Court of Human Rights (‘ECtHR’) on the expression ‘provided for by law’ in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘ECHR’), any interference should have a basis ‘in domestic law’. Because the Treaty of Lisbon profoundly changed the Union legal order by introducing the concept of ‘legislative act’, the expression ‘provided for by law’ coincides, in EU law, with the concept of ‘legislative act’. In the Parliament’s view, an international agreement does not meet that description.

140. As regards the second point, namely the necessity for the interference, the Parliament maintains that it is for the Council and the Commission to demonstrate, on the basis of objective factors, that the conclusion of the agreement envisaged is actually necessary within the meaning of Article 52(1) of the Charter. In its submission, it appears that such factors are absent.

141. Last, as for the third point, concerning the proportionality of the interference provided for in the agreement envisaged, the Parliament maintains that the discretion of the EU legislature is reduced, with the consequence that it is appropriate to carry out a strict review of the requirements laid down in the Charter, including the context in which an international agreement is concluded. In that regard, the agreement envisaged comes within the category of ‘generalised “strategic monitoring”‘, within the meaning of the case-law of the ECtHR, ( 54 ) and the reasoning followed by the Court in the judgment of 8 April 2014, Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2014:238) is also applicable in the present case.

142. First, in the Parliament’s view, the agreement envisaged concerns, generally, persons travelling to Canada, without there being any connection between the persons concerned, their PNR data and a threat to public security.

143. Second, the Parliament is uncertain as to whether the agreement envisaged lays down objective criteria that make it possible to restrict the Canadian authorities’ access to the PNR data and the subsequent use of that data for the purposes of preventing, detecting or prosecuting criminal offences which might themselves be regarded as sufficiently serious. However, the criteria listed in the draft agreement are vague. Thus, the Parliament observes that the agreement envisaged does not define the ‘Canadian competent authority’ with access to the data and Article 3(2) of the agreement envisaged refers, with respect to the expression ‘serious crime’, to the Canadian legislation without any limits recognised by EU law and without any identification of the offences covered by that expression. Likewise, Article 3(5) of the agreement envisaged allows the PNR data to be processed by ‘Canada’ in areas other than criminal law and might allow the transfer of PNR data by ‘the Canadian Competent Authority’ to other Canadian authorities, or even to individuals. Furthermore, Article 16(2) of the agreement envisaged does not specify the number of persons with access to the PNR data, while access to that data by the Canadian authorities is not subject to any prior control by a court or by an independent administrative authority.

144. Third, the Parliament asks the Court to declare that the five-year period for the retention of the PNR data laid down in Article 16(5) of the agreement envisaged is not justified. That period is not based on objective criteria and no justification has been provided. That period, moreover, was extended by reference to the period provided for under the 2006 Agreement, and no explanation was provided.

145. Fourth, the Parliament submits that the agreement envisaged does not require that the PNR data be retained within the Union. Thus, control of compliance with the requirements of protection and security, by an independent authority, expressly required by Article 8(3) of the Charter and Article 16(2) TFEU, is not fully guaranteed. In that context, there are serious doubts as to whether the measures to be taken by the Canadian authorities satisfy the essential requirements of those articles. In particular, Article 10 of the agreement envisaged does not guarantee control by an independent Canadian authority and does not specify to the requisite legal standard the powers, including the power to undertake a review in advance, which that authority has in order to verify whether those powers are ‘adequate’ within the meaning of EU law.

146. In answer to the written questions put by the Court, the Parliament stated, in particular, that the guidance to be derived from the judgment of 6 October 2015, Schrems (C‑362/14, EU:C:2015:650) apply mutatis mutandis to the assessment of the compatibility of the agreement envisaged. It further states that actual compliance with the substantive and procedural conditions relating to initial access to the personal data should also apply to the subsequent transfer of that data and to access to it by other Canadian authorities or the authorities of third States. In its submission, that is not the case of the conditions laid down in Articles 18 and 19 of the agreement envisaged. Furthermore, in the Parliament’s view, the wording of Article 14(2) of the agreement envisaged is ambiguous.

2. Analysis of the observations of the other interested parties

147. As regards the other interested parties, while, in essence, the EDPS, in his replies to the written questions put by the Court and his oral observations, shares the doubts and concerns expressed by the Parliament, the governments which have participated in the present proceedings and the Council and the Commission maintain that the agreement envisaged is compatible with Article 16 TFEU and Articles 7 and 8 and Article 52(1) of the Charter. Their observations relate essentially to the interference represented by the rules laid down in the agreement envisaged with the fundamental right of persons to the protection of their personal data and to compliance with the criteria laid down in Article 52(1) of the Charter (an interference ‘provided for by law’, with the aim of meeting an objective of general interest recognised by the Union and which is necessary and proportionate in order to meet that objective).

148. In the first place, the Estonian and French Governments expressly acknowledge that the terms of the agreement envisaged constitute an interference with the fundamental right to protection of personal data, guaranteed by Article 8 of the Charter. The French Government states, however, that the obligation placed on air carriers to transfer the PNR data does not constitute such an interference since it is provided for not by the agreement envisaged but by the Canadian legislation. The Court cannot be requested to deliver an opinion on the compatibility of the legislation of a third State with the Treaties. In addition, the French Government maintains that the interferences contained in the agreement envisaged are less far-reaching than those at the origin of the case giving rise to the judgment of 8 April 2014, Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2014:238). Thus, in the French Government’s submission, less data would be transferred and fewer persons would be concerned by the agreement envisaged than by the directive at issue in that judgment. In addition, the PNR data does not allow very precise conclusions concerning the private life of passengers to be drawn. Last, the agreement envisaged imposes, in Article 11, an obligation of transparency, and it cannot therefore be concluded that the collection of the PNR data and its subsequent use is apt to give rise in the minds of the persons concerned to the feeling that their private life is under constant surveillance.

149. In the second place, as regards the question of the legal source of such an interference, the Estonian Government, Ireland, the French and United Kingdom Governments and the Council and the Commission maintain that that interference meets the condition of being ‘provided for by law’ within the meaning of Article 52(1) of the Charter.

150. In the third place, as regards the objective pursued by that interference, the Bulgarian and Estonian Governments, Ireland, the Spanish and French Governments and the Council and the Commission claim that the transfer and subsequent use of the PNR data is aimed in particular at combating terrorism and thus meets an objective of general interest.

151. In the fourth place, as regards the necessity for such an interference, the French and United Kingdom Governments and the Council and the Commission maintain, first of all, that there is an increasing demand from third countries which consider that the transfer of PNR data is necessary for public security purposes. The Commission accepts that there are no precise statistics indicating the contribution which PNR data makes to the prevention and detection of crime and terrorism, and to the investigation and prosecution of offences of those types. However, the essential use of the PNR data is confirmed by information from third countries and from Member States which already use such data for law enforcement purposes. The experience acquired in those countries shows that the use of PNR data has enabled significant progress to be made in combating drug trafficking, people trafficking and terrorism and leads to a better understanding of the composition and functioning of terrorist networks and other criminal networks. The United Kingdom Government and the Commission further observe that the information supplied by the CBSA shows that the PNR data has made a decisive contribution to the ability to locate and identify persons potentially suspected of being involved in terrorist acts or serious transnational crime.

152. In the fifth place, as regards the proportionality of the interference at issue, the Estonian Government, the Council and the Commission refer, first, to the requirements arising from the case-law of the Court, in particular those referred to in the judgment of 8 April 2014, Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2014:238). In particular, the Estonian Government is of the view that the guidance that can be derived from that judgment concerning the extent of the discretion of the legislature and of the judicial control of the limits of that discretion is applicable in the present case. Ireland, on the other hand, claims that it is necessary to take account of the international and negotiated nature of the act at issue, while the French Government maintains that the discretion of the EU legislature cannot be excessively restricted, having regard to the fact that the interference at issue in the present case is not particularly serious. The United Kingdom Government maintains that public security and safety by their nature raise questions in respect of which the legislature must be recognised as having a ‘reasonable margin of discretion’ in order to determine whether a measure is manifestly inappropriate. The agreement envisaged cannot be characterised as a ‘general surveillance mechanism’, but relates rather to normal border control procedures.

153. Second, the Bulgarian and Estonian Governments, Ireland and the Spanish, French and United Kingdom Governments, and the Council and the Commission maintain that the agreement envisaged complies with the principle of proportionality. The United Kingdom Government claims, first of all, that in the absence of the agreement envisaged, measures taken in relation to passengers arriving from the European Union would be at risk of being less targeted and more intrusive. The PNR data allows ‘persons of interest’ travelling to particular events or places to be targeted more effectively, thus reducing security checks and delays for other passengers. Next, those governments and those institutions are, in essence, of the view that the agreement envisaged can be distinguished from the directive at the origin of the case of Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2014:238). In particular, unlike that directive, the agreement envisaged contains strict rules on the conditions for access to and the use of the data and rules on data security and monitoring by an independent authority. In addition, the agreement envisaged makes provision for control of compliance with those rules, for the persons concerned to be informed about the transfer and processing of their data, a procedure for access to and correction of the data and also for administrative and judicial remedies in order to ensure that those rights are guaranteed.

154. As regards the Parliament’s argument that the agreement envisaged requires no connection between the PNR data and a threat to public security, the Estonian, French and United Kingdom Governments and the Commission claim, in essence, that the use of the PNR data is designed to identify persons hitherto unknown to the competent services as presenting a potential risk to security, while persons known to present such a risk can be identified on the basis of advance passenger information (API). The objective of prevention could thus not be achieved if only the PNR data of persons already suspected were transferred.

155. Third, according to those interested parties, the criticisms made by the Parliament and by the EDPS concerning the redaction and omissions from the agreement envisaged should also be rejected.

156. Thus, according to the Council and the Commission, the fact that Article 3(3) of the agreement envisaged refers to Canadian law does not permit the conclusion that it is too vague. It is difficult to include in an international agreement a definition of an act that might be characterised as ‘serious crime’, which is provided for only in EU law. Likewise, as regards Article 3(5)(b) of the agreement envisaged, the Council and the Commission observe that that provision reflects the obligation which the Canadian Constitution imposes on all Canadian public authorities to comply with a court order. In addition, the possibility of access to the PNR data would, in such a case, have been examined by the judicial authority in the light of the criteria of necessity and proportionality and the reasons would be set out in the order of the court.

157. In addition, as regards the limits concerning the authorities and individuals having access to the PNR data, the Council and the Commission maintain that the failure to identify the Canadian competent authority in the agreement envisaged is a procedural issue which has no impact on the principle of proportionality. In any event, the Canadian competent authority, within the meaning of Article 2(d) of the agreement envisaged, was notified to the Commission in June 2014. That authority is the CBSA, which alone is authorised to receive and process the PNR data. The ‘limited number of officials specifically authorised’ in that respect referred to in Article 16(2) of the agreement envisaged means that the officials concerned must be officials of the CBSA and that they must be authorised to process the PNR data. Additional guarantees are set out in Article 9(2)(a) and (b), (4) and (5) of the agreement envisaged.

158. Furthermore, as regards the absence of prior control of access to the PNR data, the Commission observes that the very object of the agreement envisaged is to permit the PNR data to be transferred to the CBSA for the purpose of access to that data and that such prior control would alter that object. Ireland adds that such prior control is not necessary, since the agreement envisaged provides that the number of persons authorised to access the data and use it is to be limited to what is strictly necessary and lays down a range of additional guarantees in Articles 11 to 14, 16, 18 and 20.

159. In addition, as regards the question of the retention of the PNR data, Ireland first of all observed that, in the light of the fact that, in accordance with Article 5 of the agreement envisaged, the Canadian competent authority is to be deemed to provide an adequate level of protection of the PNR data, and that there is surveillance by an independent authority, there is no need, unlike in the situation applicable to the directive at the origin of the judgment in Digital Rights Ireland and Others (C‑293/12 and C‑594/12, EU:C:2014:238), for the data to be kept within the European Union. Next, according to the Council and the Commission, the five-year retention period laid down in Article 16 of the agreement envisaged does not go beyond what is strictly necessary in the light of the public security objective pursued and cannot therefore be evaluated in the abstract. The period of three and a half years laid down in the 2006 Agreement significantly prevented the Canadian authorities from using the PNR data effectively in order to detect cases presenting a high risk of terrorism or organised crime since the relevant investigations take time. Furthermore, in the Council’s submission, the period during which the PNR data is to be retained was fixed by reference to the average duration of criminal investigations, the average lifetime of serious crime networks and the fact that terrorist cells may be dormant for a number of years. The Estonian Government, Ireland and the French Government add that, given the complexity and difficulty of investigations of offences involving terrorism and serious transnational crime, the period that elapses between the time of travel and the time when the law enforcement authorities need to have access to the PNR data in order to detect, investigate and prosecute such offences may sometimes be several years. In their respective replies to the written questions put by the Court, the Spanish and French Governments also provide a number of specific examples in which the process of checking and cross-checking information has taken around five years and for which the PNR data was or might have been of great use. The Estonian Government, Ireland and the French Government and the Council and the Commission, also maintain, in essence, that Article 16 of the agreement envisaged contains strict rules on the masking (or depersonalisation) and unmasking of the data, which are aimed at providing more protection for the personal data of airline passengers.

160. Last, as regards the control of compliance with the rules on data protection by an independent authority, required by Article 8(3) of the Charter and Article 16(2) TFEU, the Council and the Commission maintain that the fact that the agreement envisaged does not identify the Canadian competent authority does not undermine the adequacy of the measures to be taken by Canada. The identity of the competent authorities for the purposes of Articles 10 and 14 of the agreement envisaged has been communicat