WRITTEN QUESTION P-0871/03

by Bart Staes (Verts/ALE) to the Commission

(13 March 2003)

Subject: Exchanges of personal data between airlines and the CIA

In early March a number of reports appeared in the media to the effect that the European Commission has reached an agreement with the United States on the exchange of airline passengers' personal data. That data covers not only, for example, the name of the person concerned, but also details of the in-flight menu he or she chose. The laconic response of a spokesman for the Commissioner with responsibility for transport, Mrs Loyola de Palacio, to these reports was that the agreement is consistent with European law and that Muslims who do not wish to eat pork need not fly to the United States or should simply order a sandwich.

In an initial reaction, Lodewijk Asscher, a researcher at the Institute for Information Law at the University of Amsterdam, stated that data of this kind was not even exchanged between European states without the knowledge of the person concerned. He also hinted that such data is transmitted to all kinds of computer systems run by other investigative or intelligence services. The various political reactions have shown that the competent ministers in Belgium were not informed of, let alone consulted on, the agreement between the Commission and the CIA.

Why did the Commission negotiate this agreement with the CIA without seeking further information from the Member States and can it confirm that this agreement does indeed cover details such as passengers' in-flight menu choices?

On the basis of what arguments did the Commission decide that this exchange of data with the United States alone is sufficiently important to justify the flouting of Article 8 of the ECHR and the spirit of Directive 95/46/EC(1), clearing the way for a brave decision to provide details of, for example, airline passengers' choice of food?

Has the Commission meanwhile taken action on Article 10 of Regulation (EC) No 2320/2002(2) on civil aviation security in particular with a view to determining whether US airports meet essential security requirements?

(1) OJ L 281, 23.11.1995, p. 31.

(2) OJ L 355, 30.12.2002, p. 1.

Answer given by Mr Bolkestein on behalf of the Commission

(16 April 2003)

As the Honourable Member has been informed orally, the statements quoted in the Written Question and apparently reported by the media were wrongly attributed to Ms de Palacio's spokesman.

The Commission would emphasise first of all that no agreement has been reached at this stage with the US authorities. It has, on the other hand, begun talks with the US customs authorities, which are the recipients of the data transmitted, and not the CIA, as suggested in the question asked. This dialogue has led to the issue of a Joint Statement by the Commission and the US customs and to unilateral commitments by the US customs, including a specific commitment concerning the protection of sensitive data.

This dialogue followed the introduction by the United States of various laws making it compulsory to transmit personal data on passengers and cabin crew. The consequences of not transmitting the data required by the US authorities are far-reaching. They extend from the introduction of additional passenger checks (which could lead to long queues on arrival in the USA) to airlines being fined or even losing their landing rights. A specific deadline which was put back a number of times on direct access by the US authorities to airlines' databases expired at the beginning of March. As the Honourable Member pointed out, the databases concerned can include details on which meal the passenger chose.

The purpose of the dialogue conducted with the US customs was to reach a more definitive solution guaranteeing that the data transmitted are properly protected in the United States, in accordance with the requirements of Directive 95/46/EC and Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms.

In the meantime, the US customs have promised to protect the data transmitted and, in particular, ensure that data regarded as sensitive under Article 8 of Directive 95/46/EC receive greater protection. The type of meal chosen may fall into this category if it helps reveal an individual's racial or ethnic origin or religious beliefs. The US customs have stated that they did not use these data in order to select passengers for further checks and that they did not systematically share these data with other US authorities. They said that other agencies would only be given access on an ad hoc basis and to specific data. They went on to state that they will only authorise such transfers as part of the fight against terrorism and serious crime and subject to compliance with a specific procedure.

The Commission would stress that the independent authorities responsible for data protection in the Member States and the airlines have been kept informed of the steps taken by the Commission.

The Commission would also stress that the data is not transferred without the knowledge of the data subjects concerned. Directive 95/46/EC lays down an obligation that the persons concerned (passengers and cabin crew) must be informed of any processing of their personal data. Regular contact between the Commission and the airlines on this matter has helped make the airlines aware of the need to comply with this obligation. According to the information at the Commission's disposal, the airlines have started to inform their passengers about data transfers to the USA.

With regard to the separate issue of the application of Article 10 of Regulation 2320/2002, which seeks the development of a mechanism to assess whether flights coming from third country airports meet the essential security requirements laid down by EU law, this work is under way. Once this mechanism has been developed with the Member States, it will apply to all flights to the European Community, including those from the USA.