WRITTEN QUESTION P-0871/03 by Bart Staes (Verts/ALE) to the Commission. Exchanges of personal data between airlines and the CIA.
Date: 2003-03-13
Institutions: European Parliament, Provisional data
Subjects: United States, air safety, air transport, cross-frontier data flow, customs cooperation, disclosure of information, personal data, protection of privacy

18.9.2003

EN

Official Journal of the European Union

C 222 E/239

In the absence of measures to protect the thousands of traditional Italian recipes, the average European
consumer is offered no protection when faced with a choice in a restaurant between an authentic and an
inauthentic product.

This is not the case with, for example, French cuisine, which is properly codified thanks to Escoffier.

Can the Commission state:

1. whether it considers that the rules on PDO/PGI products could be extended to cover restaurant signs,

with a view to preventing the abusive employment of such names;

2. whether it believes it possible to introduce an international register which would recognise an

authenticity label to be awarded to Italian restaurants in the EU;

3. what measures it intends to take to deal with the legislative vacuum that now exists, in contravention

of consumer protection and competition law?

Answer given by Mr Bolkestein on behalf of the Commission

(25 April 2003)

The aim of the existing Community rules on the protection of geographical indications and designations of
origin is to provide for the effective and efficient protection of registered names from direct or indirect
misappropriation and improper use.

These rules apply to the commercialisation of products for which the name has actually been registered,
and thus protected. As a result,
it would not seem to be possible to use these rules to prohibit the
improper use of names registered by restaurants.

The Commission has no intention of proposing that these rules be extended to restaurants.

The Commission is aware of the creation of an authenticity label for Italian restaurants which is being
introduced by the Italian authorities and associations concerned by this problem.
It seems that the
intention is to try out this initiative by means of a pilot project in Belgium, and then in the United States
and Japan. This tool could offer an initial answer to the improper use of designations of origin such as
‘Italy’ or of PGI/PDO in restaurants.

Such steps, along with the effective use of other existing national and/or Community provisions to protect
the consumer against the risks of confusion and/or unfair competition, would appear to suffice.

The Commission does not
therefore consider it necessary to compile an international register of
restaurants, but to make effective use of existing tools to prevent certain restaurants from misleading
consumers and misappropriating names which are protected by Community legislation.

(2003/C 222 E/269)

WRITTEN QUESTION P-0871/03

by Bart Staes (Verts/ALE) to the Commission

(13 March 2003)

Subject: Exchanges of personal data between airlines and the CIA

In early March a number of reports appeared in the media to the effect that the European Commission has
reached an agreement with the United States on the exchange of airline passengers’ personal data. That
data covers not only, for example, the name of the person concerned, but also details of the in-flight menu
he or she chose. The laconic response of a spokesman for the Commissioner with responsibility for
transport, Mrs Loyola de Palacio, to these reports was that the agreement is consistent with European law
and that Muslims who do not wish to eat pork ‘need not fly to the United States or should simply order a
sandwich’.

C 222 E/240

Official Journal of the European Union

EN

18.9.2003

In an initial reaction, Lodewijk Asscher, a researcher at the Institute for Information Law at the University
of Amsterdam, stated that data of this kind was not even exchanged between European states without the
knowledge of the person concerned. He also hinted that such data is transmitted to all kinds of computer
systems run by other investigative or intelligence services. The various political reactions have shown that
the competent ministers in Belgium were not informed of, let alone consulted on, the agreement between
the Commission and the CIA.

Why did the Commission negotiate this agreement with the CIA without seeking further information from
the Member States and can it confirm that this agreement does indeed cover details such as passengers’
in-flight menu choices?

On the basis of what arguments did the Commission decide that this exchange of data with the United
States alone is sufficiently important to justify the flouting of Article 8 of the ECHR and the spirit of
Directive 95/46/EC (1), clearing the way for a brave decision to provide details of, for example, airline
passengers’ choice of food?

Has the Commission meanwhile taken action on Article 10 of Regulation (EC) No 2320/2002 (2) on civil
aviation security in particular with a view to determining whether US airports meet ‘essential security
requirements’?

(1) OJ L 281, 23.11.1995, p. 31.
(2) OJ L 355, 30.12.2002, p. 1.

Answer given by Mr Bolkestein on behalf of the Commission

(16 April 2003)

As the Honourable Member has been informed orally, the statements quoted in the Written Question and
apparently reported by the media were wrongly attributed to Ms de Palacio’s spokesman.

The Commission would emphasise first of all that no agreement has been reached at this stage with the US
authorities. It has, on the other hand, begun talks with the US customs authorities, which are the recipients
of the data transmitted, and not the CIA, as suggested in the question asked. This dialogue has led to the
issue of a ‘Joint Statement’ by the Commission and the US customs and to unilateral commitments by the
US customs, including a specific commitment concerning the protection of ‘sensitive’ data.

This dialogue followed the introduction by the United States of various laws making it compulsory to
transmit personal data on passengers and cabin crew. The consequences of not transmitting the data
required by the US authorities are far-reaching. They extend from the introduction of additional passenger
checks (which could lead to long queues on arrival in the USA) to airlines being fined or even losing their
landing rights. A specific deadline (cid:1) which was put back a number of times (cid:1) on direct access by the US
authorities to airlines’ databases expired at the beginning of March. As the Honourable Member pointed
out, the databases concerned can include details on which meal the passenger chose.

The purpose of the dialogue conducted with the US customs was to reach a more definitive solution
guaranteeing that the data transmitted are properly protected in the United States, in accordance with the
requirements of Directive 95/46/EC and Article 8 of the European Convention for the Protection of Human
Rights and Fundamental Freedoms.

In the meantime, the US customs have promised to protect the data transmitted and, in particular, ensure
that data regarded as ‘sensitive’ under Article 8 of Directive 95/46/EC receive greater protection. The type
of meal chosen may fall into this category if it helps reveal an individual’s racial or ethnic origin or
religious beliefs. The US customs have stated that they did not use these data in order to select passengers
for further checks and that they did not systematically share these data with other US authorities. They
said that other agencies would only be given access on an ad hoc basis and to specific data. They went on
to state that they will only authorise such transfers as part of the fight against terrorism and serious crime
and subject to compliance with a specific procedure.

18.9.2003

EN

Official Journal of the European Union

C 222 E/241

The Commission would stress that the independent authorities responsible for data protection in the
Member States and the airlines have been kept informed of the steps taken by the Commission.

The Commission would also stress that the data is not transferred without the knowledge of the data
subjects concerned. Directive 95/46/EC lays down an obligation that the persons concerned (passengers
and cabin crew) must be informed of any processing of their personal data. Regular contact between the
Commission and the airlines on this matter has helped make the airlines aware of the need to comply with
this obligation. According to the information at the Commission’s disposal, the airlines have started to
inform their passengers about data transfers to the USA.

With regard to the separate issue of the application of Article 10 of Regulation 2320/2002, which seeks
the development of ‘a mechanism to assess whether flights coming from third country airports meet the
essential security requirements’ laid down by EU law, this work is under way. Once this mechanism has
been developed with the Member States, it will apply to all flights to the European Community, including
those from the USA.

(2003/C 222 E/270)

WRITTEN QUESTION E-0899/03

by Bart Staes (Verts/ALE) to the Commission

(21 March 2003)

Subject: Compatibility of the Belgian ‘fan card’ system with Directive 95/46/EC

In its answer to Written Question E-3103/02 (1), the Commission indicates that, in any verification to
ensure that the Belgian ‘fan card’ system for football supporters is compatible with Directive 95/46/EC (2),
consideration must be given, inter alia, to the relevance of the data processed, starting from the purpose
for which such data was compiled and subsequently processed and the limits on the use of the data: data
must be used only for the purpose for which it was compiled.

Article 10(5) of the Belgian Safety at Football Matches Act (published in the Belgian Official Gazette of
3 February 1999) lays down that the organisers of a football match at national or international level must
take at least the following measures: (5) be responsible for the management of tickets which, at all events,
includes: the printing of tickets, the distribution thereof, control of access to and monitoring of the validity
and proper possession of the tickets.

The Belgian Football Association tinkered with that legislation and devised a system of ‘fan cards’. Any
person wishing to purchase a ticket for a Jupiler League match must possess a ‘fan card’. Any person
wishing to acquire a ‘fan card’ must supply certain personal details: name and address, telephone number,
sex, language, identity card number, etc. The application form notes that the personal data will be entered
in a central file held by the Professional Football League in order to guarantee safety inside football
grounds and supervision of supporters. Unless otherwise stated, it may be processed for the provision of
information and, by the League’s partners, for the commercial promotion of their products.

On the reverse side of the ‘fan card’ is the logo of the ‘Go4Fun Club’, membership of which entitles
cardholders to receive a discount when purchasing products manufactured by the Belgian FA’s commercial
partners. That is all covered under the slogan: Football ‘fan card’ holder and automatic member of the
Go4Fun Club.

On the basis of the foregoing, can the Commission indicate whether this procedure is in conformity with
Directive 95/46/EC and, in particular, with Articles 6 and 7 thereof? In other words, is the data actually
being used for the purpose for which it was compiled? Alternatively, can data compiled with a view to
ensuring safety at football grounds be used ‘automatically’ (sic) for the compilation of a commercial data
file?

(1) OJ C 110 E, 8.5.2003, p. 165.
(2) OJ L 281, 23.11.1995, p. 31.