Proposal for a Council Decision on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection
Date: 2004-03-17
Institutions: European Commission
Subjects: United States, agreement (EU), air transport, data protection, data transmission, fight against crime, information processing

COMMISSION OF THE EUROPEAN COMMUNITIES 

Brussels, 17.03.2004 
COM(2004)190 final 

2004/0064 (CNS) 

Proposal for a 

COUNCIL DECISION 

on the conclusion of an Agreement between the European Community and the United 
States of America on the processing and transfer of PNR data by Air Carriers to the 
United States Department of Homeland Security, Bureau of Customs and Border 
Protection 

(presented by the Commission) 

EN 

   EN 

 
 
 
  
 
EXPLANATORY MEMORANDUM 

Throughout 2003, the Commission has been working with the United States of America to try 
to  put  in  place  a  sound  legal  framework  for  the  transfers  of  PNR  data  to  the  United  States 
Department of Homeland Security, Bureau of Customs and Border Protection (CBP). 

As outlined in the Communication from the Commission to the Council and the Parliament of 
16  December  20031,  this  legal  framework  should  take  the  form  of  a  Decision  (“Adequacy 
Finding”) by the Commission under Article 25 paragraph 6 of the Data Protection Directive 
(95/46/EC),  accompanied  by  an  international  agreement  between  the  European  Community 
and the US. The latter is necessary to deal with such legal problems as are not addressed by 
the adequacy finding. 

On 23rd February 2004, the Council of the European Community authorised the Commission 
to negotiate such an Agreement with the US and issued a series of negotiating guidelines. 

The Commission now calls on the Council to conclude the Agreement reached with the US. It 
thus submits the relevant proposal for a Council Decision. 

1  

COM (2003) 826 final, «Transfer of Air Passenger Name Record (PNR) Data: a Global EU Approach» 

2 

 
 
  
 
                                                 
2004/0064 (CNS) 

Proposal for a 

COUNCIL DECISION 

on the conclusion of an Agreement between the European Community and the United 
States of America on the processing and transfer of PNR data by Air Carriers to the 
United States Department of Homeland Security, Bureau of Customs and Border 
Protection 

THE COUNCIL OF THE EUROPEAN UNION, 

Having regard to the Treaty establishing the European Community, and in particular Article 
95 thereof, in conjunction with the first sentence of the first subparagraph of Article 300 (2) 
thereof, 

Having regard to the proposal from the Commission2, 

Having regard to the opinion of the European Parliament3, 

Whereas on 23 February 2004 the Council authorised the Commission to negotiate, on behalf 
of  the  Community  an  Agreement  with  the  United  States  of  America  on  the  processing  and 
transfer of PNR data by Air Carriers to the United States Department of Homeland Security, 
Bureau of Customs and Border Protection; 

Whereas the Agreement should be approved. 

HAS DECIDED AS FOLLOWS: 

Article 1 

The Agreement between the European Community and the United States of America on the 
processing  and  transfer  of  PNR  data  by  Air  Carriers  to  the  United  States  Department  of 
Homeland Security, Bureau of Customs and Border Protection is hereby approved on behalf 
of the Community. 

The text of the Agreement is attached to this Decision. 

2 
3 

OJ C , , p. . 
OJ C , , p. . 

3 

 
 
  
 
                                                 
Article 2 

The  President  of  the  Council  is  hereby  authorised  to  designate  the  person(s)  empowered  to 
sign the Agreement on behalf of the European Community. 

Done at Brussels,  

For the Council 
The President 

4 

 
 
  
 
 
 
 
 
ANNEX 

Agreement between the European Community and the United States of America on the 
processing and transfer of PNR data by Air Carriers to the United States Department of 
Homeland Security, Bureau of Customs and Border Protection 

THE EUROPEAN COMMUNITY AND THE UNITED STATES OF AMERICA,  

Recognizing the importance of respecting fundamental rights and freedoms, notably privacy, 
and the importance of respecting these values, while preventing and combating terrorism and 
related  crimes  and  other  serious  crimes  that  are  transnational  in  nature,  including  organized 
crime; 

Having regard to U.S. statutes and regulations requiring each air carrier operating passenger 
flights in foreign air transportation to or from the United States to provide the Department of 
Homeland  Security  (hereinafter,  "DHS"),  Bureau  of  Customs  and  Border  Protection 
(hereinafter  "CBP")  with  electronic  access  to  Passenger  Name  Record  (hereinafter  "PNR") 
the  air  carrier's  automated 
data 
reservation/departure control systems;  

is  collected  and  contained 

the  extent 

to 

in 

it 

Having  regard  to  Directive  95/46/EC  of  the  European  Parliament  and  of  the  Council  of  24 
October 1995 on the protection of individuals with regard to the processing of personal data 
and on the free movement of such data, and in particular Article 7(c) thereof; 

Having regard to the Undertakings of CBP issued on ... 2004, which will be published in the 
Federal Register (hereinafter "the Undertakings"); 

Having  regard  to  Commission  Decision  …  adopted  on  ….,  pursuant  to  article  25(6)  of 
Directive 95/46/EC, whereby CBP is considered as providing an adequate level of protection 
for  PNR  data  transferred  from  the  European  Community  (hereinafter  "Community") 
concerning  flights  to  or  from  the  U.S.  in  accordance  with  the  Undertakings,  which  are 
annexed thereto (hereinafter “the Decision”); 

Noting that air carriers with reservation/departure control systems located within the territory 
of  the  Member  States  of  the  European  Community  should  arrange  for  transmission  of  PNR 
data  to  CBP  as  soon  as  this  is  technically  feasible  but  that,  until  then,  the  US  authorities 
should  be  allowed  to  access  the  data  directly,  in  accordance  with  the  provisions  of  this 
Agreement; 

Affirming that this Agreement does not constitute a precedent for any future discussions and 
negotiations  between  the  United  States  and  the  European  Community,  or  between  either  of 
the Parties and any State regarding the transfer of any other form of data; 

Having regard to the commitment of both sides to work together to reach an appropriate and 
mutually  satisfactory  solution,  without  delay,  on  the  processing  of  Advance  Passenger 
Information (API) data from the Community to the U.S.; 

5 

 
 
  
 
HAVE AGREED AS FOLLOWS: 

1. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 

CBP may electronically access the PNR data from air carriers’ reservation/departure 
control  systems  (“reservation  systems”)  located  within  the  territory  of  the  Member 
States of the European Community strictly in accordance with the Decision and for 
so long as the Decision is applicable and only until there is a satisfactory system in 
place allowing for transmission of such data by the air carriers. 

Air  carriers  operating  passenger  flights  in  foreign  air  transportation  to  or  from  the 
United  States  shall  process  PNR  data  contained  in  their  automated  reservation 
systems as required by CBP pursuant to US law and strictly in accordance with the 
Decision and for so long as the Decision is applicable. 

CBP takes note of the Decision and states that it is implementing the Undertakings 
annexed thereto. 

CBP  shall  process  PNR  data  received  and  treat  data  subjects  concerned  by  such 
processing in accordance with applicable U.S. laws and constitutional requirements, 
without unlawful discrimination, in particular on the basis of nationality and country 
of residence. 

CBP  and  the  European  Commission  shall  jointly  and  regularly  review  the 
implementation of this Agreement. 

In  the  event  that  an  airline  passenger  identification  system  is  implemented  in  the 
European Union which requires air carriers to provide authorities with access to PNR 
data  for  persons  whose  current  travel  itinerary  includes  a  flight  to  or  from  the 
European  Union,  DHS  shall,  in  so  far  as  practicable  and  strictly  on  the  basis  of 
reciprocity, actively promote the cooperation of airlines within its jurisdiction 

This Agreement shall enter into force upon signature. Either Party may terminate this 
Agreement at any time by notification through diplomatic channels. The termination 
shall take effect ninety (90) days from the date of notification of termination to the 
other  Party.  This  Agreement  may  be  amended  at  any  time  by  mutual  written 
agreement. 

This Agreement is not intended to derogate from or amend legislation of the Parties; 
nor does this Agreement create or confer any right or benefit on any other person or 
entity, private or public. 

Signed at ………………………, on………………………………. 

This Agreement is drawn up in duplicate in the Danish, Dutch, English, Finnish, French, German, Greek, Italian, 
Portuguese,  Spanish  and  Swedish  languages,  each  text  being  equally  authentic.  In  case  of  divergence,  the 
English version shall prevail. 

FOR THE EUROPEAN COMMUNITY 

FOR THE UNITED STATES OF AMERICA 

…………………………………… 
…………………………………… 

Tom Ridge 
Secretary  of  the  United  States  Department  of 
Homeland Security 

6