Communication from the Commission to the Council - Termination of the Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection
Date: 2006-06-16
Institutions: European Commission
Subjects: European Community, United States, air transport, data processing, personal data, protection of privacy, withdrawal from an agreement

COMMISSION OF THE EUROPEAN COMMUNITIES 

Brussels, 16.6.2006 
COM(2006) 335 final 

COMMUNICATION FROM THE COMMISSION TO THE COUNCIL 

Termination of the Agreement between the European Community and the United States 
of America on the processing and transfer of PNR data by Air Carriers to the United 
States Department of Homeland Security, Bureau of Customs and Border Protection 

EN 

   EN 

 
 
 
  
COMMUNICATION FROM THE COMMISSION TO THE COUNCIL 

Termination of the Agreement between the European Community and the United States 
of America on the processing and transfer of PNR data by Air Carriers to the United 
States Department of Homeland Security, Bureau of Customs and Border Protection 

Following the terrorist attacks of 11 September 2001, the United States passed legislation in 
November 2001 providing that air carriers operating flights to or from the United States had 
to  provide  the  United  States  Bureau  of  Customs  and  Border  Protection  (hereinafter  'CBP') 
with  electronic  access  to  the  data  contained  in  their  automated  reservation  and  departure 
control  systems,  referred  to  as  ‘Passenger  Name  Records’  (hereinafter  ‘PNR  data’).  While 
acknowledging the legitimacy of the security interests at stake, the Commission informed the 
United  States  authorities,  in  June  2002,  that  those  provisions  could  come  into  conflict  with 
Community  and  Member  State  legislation  on  data  protection.  The  United  States  authorities 
postponed the entry into force of the new provisions but, ultimately, refused to waive the right 
to impose penalties on airlines failing to comply with the legislation on electronic access to 
PNR data after 5 March 2003. Since then, a number of large airlines in the European Union 
have granted the United States authorities access to their PNR data. 

The Commission entered into negotiations with the United States authorities, which gave rise 
to a document containing undertakings on the part of CBP, with a view to the adoption by the 
Commission of a decision on adequacy pursuant to Article 25(6) of Directive 95/46/EC of the 
European Parliament and of the Council of 24 October 1995 on the protection of individuals 
with  regard  to  the  processing  of  personal  data  and  on  the  free  movement  of  such  data  (OJ 
1995 L 281, p. 31). At the same time the Commission negotiated an international agreement 
with  the  United  States  which  was  intended  as  a  companion  to  the  Adequacy  Decision  and 
inter alia contained provisions permitting the US authorities to “pull” PNR data from airline 
reservation  systems  located  in  the  EC,  obliging  airlines  to  transmit  PNR  data  to  the  US 
authorities  in  a  certain  format  and  assuring  a  grounding  in  international  law  of  the  CBP 
commitments. This draft agreement was sent to the Council for approval. On 1 March 2004 
the  Commission  placed  before  the  Parliament  the  draft  decision  on  adequacy  under  Article 
25(6) of the Directive, together with the draft undertakings of CBP. 

On  17  March  2004  the  Commission  submitted  to  the  Parliament,  with  a  view  to  its 
consultation in accordance with the first subparagraph of Article 300(3) EC, a proposal for a 
Council decision concerning the conclusion of an agreement with the United States. 

On  31  March  2004  the  Parliament,  acting  pursuant  to  Article  8  of  Council  Decision 
1999/468/EC of 28 June 1999 laying down the procedures for the exercise of implementing 
powers conferred on the Commission (OJ 1999 L 184, p. 23), adopted a resolution setting out 
a number of reservations of a legal nature regarding the proposal which had been submitted to 
it. In particular, the Parliament considered that the draft decision on adequacy exceeded the 
powers  conferred  on  the  Commission  by  Article  25  of  the  Directive.  It  called  for  the 
conclusion of an appropriate international agreement respecting fundamental rights that would 
cover  a  number  of  points  set  out  in  detail  in  the  resolution,  and  asked  the  Commission  to 
submit a new draft decision to it. It also reserved the right to refer the matter to the Court for 
review  of  the  legality  of  the  projected  international  agreement  and,  in  particular,  of  its 
compatibility with protection of the right to privacy. 

EN 

2 

   EN 

 
On 28 April 2004 the Council, acting on the basis of the first subparagraph of Article 300(3) 
EC, sent a letter to the Parliament asking it to deliver as a matter of urgency its opinion on the 
proposal for a decision relating to the conclusion of the Agreement by 5 May 2004. On 4 May 
2004 the Parliament rejected the Council’s request to it of 28 April for urgent consideration of 
that proposal. 

On 14 May 2004 the Commission adopted the Decision on Adequacy 2004/535/CE pursuant 
to Article 25(6) of Directive 95/46/EC (OJ 2004, L 235, p.11). On 17 May 2004 the Council 
adopted Decision 2004/496/EC on the basis of Article 95 EC Treaty (OJ 2004, L 183, p.83), 
authorising the President of the council to sign the Agreement on behalf of the Community. 
The  Agreement  was  signed  on  28  May  2004  and  entered  into  force  on  the  same  day.  The 
European Parliament sought the annulment of both Commission and Council decisions. The 
Parliament  argued,  amongst  others,  that  the  choice  of  the  legal  basis  for  the  decisions  was 
incorrect. 

On 30 May 2006 the Court of Justice annulled the Commission’s Adequacy Decision of 14 
May  2004.  The  Court  stated  that  there  is  no  competence  for  the  Commission  to  take  the 
Decision, since the transfer of PNR data to CBP constitutes processing operations concerning 
public security and activities of the State in areas of criminal law, which pursuant to Article 3 
of Directive 95/46/EC fall outside its scope and, therefore, cannot be based on Article 95 of 
the  EC  Treaty.  The  Court  also  annulled  the  Council  decision  approving  the  companion 
agreement to the Adequacy Decision because the two were extremely closely linked. Hence, 
according  to  the  Court,  the  Agreement  could  not  be  based  on  Article  95  EC  for  the  same 
reason. 

In  its  judgment  the  Court  explicitly  discussed  the  consequences  of  the  annulment  of  both 
decisions, in particular in the light of the rule of international law that internal law cannot be 
invoked as a reason not to honour one’s international obligations. In this connection the Court 
noted that Article 7 of the Agreement provides that either party may terminate the agreement 
with effect as from 90 days after notification of termination. It is this period of 90 days that 
the  Court  took  as  a  reference  in  determining,  essentially,  that  the  Agreement  and  the 
Adequacy Decision shall not have further legal effect after 30 September 2006. In this respect 
the  Court  has  recognised  the  very  close  link between  the  Adequacy  Decision,  including  the 
Undertakings of CBP, and the Agreement. 

Article  233  of  the  EC  Treaty  states  that  the  institution  or  institutions  whose  act  has  been 
declared void shall be required to take the necessary measures to comply with the judgment of 
the Court of Justice. 

In view of the above the Commission 

RECOMMENDS  that  the  Council  and  the  Commission  act  together  in  order  to  notify  the 
United  States  of  the  denunciation  of  the  Agreement  in  accordance  with  Article  7  thereof. 
Since this is an action in compliance with a Court annulment under Article 233 and the EC 
Treaty  furthermore  does  not  provide  for  specific  rules  for  the  termination  of  international 
agreements, it would seem to be sufficient if the two institutions together address a letter or 
note verbale to the US authorities notifying them of the denunciation. This should mention the 
date of 30 September 2006 as the effective date of the denunciation so as to coincide with the 
date referred to by the Court. A draft text is attached. 

EN 

3 

   EN 

 
DRAFT  

ANNEX 

The Presidency of the Council of the European Union and the European Commission present 
their compliments to …. and have the honour to state the following. 

As  you  are  undoubtedly  aware,  the  Court  of  Justice  of  the  European  Communities  in  its 
Judgment of 30 May 2006 in cases C- 317 and C-318/04 has annulled the Council Decision of 
17  May  2004  approving  the  Agreement  between  the  European  Community  and  the  United 
States of America on the treatment and the transfer of PNR data (complete title), as well as the 
Commission Decision of 14 May 2004 (the so-called Adequacy Decision) which was closely 
linked to that agreement. As you will also be aware, the Court expressed itself explicitly on 
the continued validity under international law of the agreement, effectively prescribing to the 
defending institutions in these court cases that they should avail themselves of the provisions 
of Article 7 of the Agreement. 

In the light of this judgment and the provision of the EC Treaty that enjoins the institutions 
whose  act  has  been  annulled  to  take  all  the  necessary  measures  for  the  execution  of  the 
Court’s judgment, the Council of the European Union and the European Commission hereby, 
pursuant  to  Article  7  denounce  the  Agreement  (full  title)  with  September  30,  2006,  as 
effective date. 

(Diplomatic formula of politeness) 

For the Council of the European Union 

For the European Commission 

Presidency 

EN 

4 

   EN