European Parliament recommendation to the Council on the negotiations for an agreement with the United States of America on the use of passenger name records (PNR) data to prevent and combat terrorism and transnational crime, including organised crime (2006/2193(INI))
Date: 2006-09-07
Institutions: Committee on Civil Liberties, Justice and Home Affairs, European Parliament
Subjects: United States, air safety, border control, data protection, disclosure of information, fight against crime, international negotiations, personal data, terrorism

C 305 E/250

Official Journal of the European Union

EN

14.12.2006

Thursday 7 September 2006

Calls on the Council and the Commission to propose suitable procedures so as to enable Parliament to

3.
play its proper role in the context of the Hague Conference on Private International Law;

Instructs its President to forward this resolution to the Council, the Commission and the governments

4.
and parliaments of the Member States.

P6_TA(2006)0354

Agreement with the USA on the use of Passenger Name Record data

European Parliament recommendation to the Council on the negotiations for an agreement with the
United States of America on the use of passenger name records (PNR) data to prevent and combat
terrorism and transnational crime, including organised crime (2006/2193(INI))

The European Parliament,

— having regard to the proposal for a recommendation to the Council by Sophia in 't Veld on behalf of
the ALDE Group on the content of the Agreement with the United States of Amercia on the use of
Passenger Name Records (PNR) data to prevent and combat terrorism and transnational crime, includ-
ing organised crime (B6-0382/2006),

— having regard to Rule 114(3) and Rule 94 of its Rules of Procedure,

— having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A6-0252/

2006),

A.

recalling its previous resolutions on the PNR issue (1), in which Parliament expressed from the outset:

— its readiness to authorise access by public authorities to passengers' personal data for security
purposes when necessary for the purposes of identifying them and cross-checking them against a
‘watch list’ of dangerous persons or known criminals and terrorists (as is done in the EU in con-
nection with Schengen Implementing Convention or under Directive 2004/82/EC (2), which give
access to identification data managed by airlines through the Advanced Passenger Information
System (APIS), and

— its deep concerns about the systematic access by the public authorities to data, such as the credit
card number, the e-mail address, any affiliation to a particular group, frequent-flyer information,
linked to the behaviour of ordinary passengers (i.e. people not recorded in the receiving country as
dangerous or criminal) in order to check only against a theoretical pattern whether such a passen-
ger might constitute a potential threat to the flight, his or her country of destination or a country
through which he or she will transit;

B.

being aware that systematic access to ‘behaviour’ data, even if not acceptable in the EU, is currently
required by countries including the USA, Canada and Australia for the protection of their internal
security, but pointing out that:

— in the case of Canada and Australia, domestic legislation provides for access to data which is
limited in scope and time and as regards the amount of data covered and is under the control of
a judicial authority, on account of which those systems have been considered adequate by Parlia-
ment and by the national data protection authorities in the EU,

(1) Parliament resolutions of 13 March 2003 on transfer of personal data by airlines in the case of transatlantic flights
(OJ C 61 E, 10.3.2004, p. 381), of 9 October 2003 on transfer of personal data by airlines in the case of transatlantic
flights: state of negotiations with the USA (OJ C 81 E, 31.3.2004, p. 105) and of 31 March 2004 on the draft
Commission decision noting the adequate level of protection provided for personal data contained in the Passenger
Name Records (PNRs) transferred to the US Bureau of Customs and Border Protection (OJ C 103 E, 29.4.2004,
p. 665).

(2) Council Directive 2004/82/EC of 29 April 2004 on the obligation of carriers to communicate passenger data

(OJ L 261, 6.8.2004, p. 24).

14.12.2006

EN

Official Journal of the European Union

C 305 E/251

— in the case of the US, even after long negotiations with the Commission and some goodwill stated
in the ‘undertakings’, there is still no legal US data protection in the field of air transport; therefore,
all PNR data can be accessed, with the sole exception of ‘sensitive’ data, and the data can be
retained for years after the security check has been carried out; furthermore, there is no judicial
protection for non-US citizens,

Thursday 7 September 2006

C.

D.

considering that since the atrocities of 11 September 2001, a host of single security measures has been
introduced worldwide, which often involve the systematic collection and monitoring of personal data of
all citizens, notably data on money transfers and telecommunications and passenger data; considering
that, in the absence of a coherent EU security policy, the position of the individual citizen vis à vis the
state risks being undermined;

recalling that Parliament brought proceedings before the Court of Justice of the European Communities
seeking the annulment of Council Decision 2004/496/EC (1) on the conclusion of an agreement with
the USA, negotiated on the basis of Commission Decision 2004/535/EC (2), on the grounds that the
decision lacked both a legal basis and legal clarity and because the collection of personal data
authorised under the agreement was excessive when weighed against the need to combat organised
crime and terrorism,

E. welcoming the annulment by the Court of Justice of Council Decision 2004/496/EC and Commission

Decision 2004/535/EC (3),

F.

G.

regretting that the Court of Justice did not respond to Parliament's concerns about the legal structure of
the agreement and the congruency of its content with the data protection principles laid down in
Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms
(ECHR);

taking into account the fact that the Court of Justice held that Council Decision 2004/496/EC could
not be adopted validly on the basis of Article 95 of the EC Treaty in conjunction with Directive
95/46/EC (4), because the transfer to and the use of PNR data by the US Bureau of Customs and Border
Protection (CBP) relates to data processing operations concerning public security and state activities in
areas of criminal law, which fall outside the scope of Directive 95/46/EC and the first pillar;

H.

taking into account the expressed willingness of the Commission and the Council to cooperate closely
with the Parliament in order to ensure full compliance with the Court's judgment; however, regretting
that the Council has failed to involve the Parliament in the ongoing negotiations;

I.

J.

sharing the opinion adopted on 14 June 2006 by the Article 29 Working Party on the necessary follow-
up to the Court's judgment (5),

considering the importance of the issue to be such that the EU should, in any event, come to an
arrangement with the USA on a proper international agreement which, with due respect for fundamen-
tal rights, would lay down:

(a) which data are necessary for identification purposes and should be transferred systematically in an
automated way (APIS) and which data relating to passenger ‘behaviour’ could be transferred on a
case-by-case basis in respect of people recorded on public security ‘watch lists’ as ‘dangerous’ on
account of criminal or terrorist activity,

(1) Council Decision 2004/496/EC of 17 May 2004 on the conclusion of an Agreement between the European Com-
munity and the United States of America on the processing and transfer of PNR data by Air Carriers to the United
States Department of Homeland Security, Bureau of Customs and Border Protection (OJ L 183, 20.5.2004, p. 83).
(2) Commission Decision 2004/535/EC of 14 May 2004 on the adequate protection of personal data contained in the
Passenger Name Record of air passengers transferred to the United States' Bureau of Customs and Border Protection
(OJ L 235, 6.7.2004, p. 11).
Judgment of 30 May 2006 in Joined Cases C-317/04 and C-318/04.

(3)
(4) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of indivi-
duals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995,
p. 31).

(5) Opinion 5/2006 on the ruling by the European Court of Justice of 30 May 2006 in Joined Cases C-317/04 and
C-318/04 on the transmission of Passenger Name Records to the United States (see: http://ec.europa.eu/justice_home/
fsj/privacy/workinggroup/wpdocs/2006_en.htm).

C 305 E/252

Official Journal of the European Union

EN

14.12.2006

Thursday 7 September 2006

(b)

the list of serious crimes in respect of which any additional request could be made,

(c)

the list of authorities and agencies that could share the data and the data-protection conditions to
be respected,

(d)

(e)

(f)

the data-retention period for the two kinds of data, it being clear that data relating to the preven-
tion of serious crimes must be exchanged in accordance with the EU-US agreement on mutual
legal assistance (1) and extradition (2),

the role to be played by airlines, the Computerized Reservation Systems or private organisations
(such as the SITA and Amadeus) in transferring passengers' data and the means envisaged (APIS,
PNR, etc.) for public-security purposes,

the guarantees to be afforded to passengers in order to enable them to correct the data relating to
them or to provide an explanation in the event of a discrepancy between the data relating to a
travel contract and the data shown in identity documents, visas, passports and other official docu-
ments,

(g)

the airlines' responsibilities as regards passengers and public authorities in the event of transcrip-
tion or encoding errors and as regards protection of the data processed,

(h)

the right to appeal to an independent authority and redress mechanisms in the event of infringe-
ments of passengers' rights;

(i)

the need to strictly comply with Article 6(d) of Regulation (EEC) No 2299/89 of 24 July 1989 on a
code of conduct for computerized reservation systems (3), which requires the previous consent of
the passenger for any transfer of personal information;

1.

Addresses the following recommendations to the Council:

General principles

(a)

to avoid a legal lacuna at European level from 1 October 2006 for the transfer of passenger data and to
ensure that the rights and freedoms of passengers are protected to an even greater extent than they are
at present under the unilateral undertakings submitted by the US administration;

(b)

to base any new agreements in this field on the EC principles on data protection as drawn from
Article 8 ECHR;

As regards the negotiation procedure:

(c)

to negotiate, subject to calendar constraints,

— a new short-term international agreement to cover the period between 1 October 2006 and
November 2007 (the period originally covered by the US/EC agreement that was the subject of
the Court's judgment),

— for the medium to long term, a more coherent approach at International Civil Aviation Organisa-
tion (ICAO) level towards the exchange of passenger data in order to ensure both air-traffic security
and respect of human rights at global level;

(d)

to mandate the Presidency, assisted by the Commission, to inform Parliament of the negotiations on the
agreement and to involve representatives of the relevant committee as observers in the dialogue with
the US administration;

(1) OJ L 181, 19.7.2003, p. 34.
(2) OJ L 181, 19.7.2003, p. 27.
(3) OJ L 220, 29.7.1989, p. 1.

14.12.2006

EN

Official Journal of the European Union

C 305 E/253

Thursday 7 September 2006

As regards the content of the short-term agreement

(e)

(f)

(g)

to overcome, in the first instance, the shortcomings outlined in the first joint EU/US review of the
agreement (1) and to take into account the recommendations of the European Data Protection Super-
visor and the Article 29 Working Party (2);

to include the content of the undertakings in the body of the agreement so that they may become
legally binding, thereby making it necessary for the two parties to establish or modify any existing
legislation and for the judiciary to protect persons covered by the agreement;

to incorporate immediately, as proof of good faith on the part of the US administration, into the new
agreement the commitments, which are still not fully implemented over two years after the entry into
force of the agreement, as follows:
— the strict purpose limitation, as formerly provided for in Undertaking 3, so that behaviour data
may not be used for checking financial crimes or to prevent avian flu; such a limitation should also
be laid down for the onward transfer of such data;

— the shift to a PUSH system (as provided for in Undertaking 13), as in the case of EC agreements
with Canada and Australia, since all the technical requirements are in place and this is already
done, for instance by SITA;

— provision of information to passengers on the PNR rules, and the introduction of proper judicial
complaint procedures, as provided for in Undertakings 36-42 and by the PNR agreements with
Canada and Australia;

— the need to ensure adequate instructions and training of the staff who handle the data, and the

need to secure the IT systems;

— the annual

joint review, as provided for in Undertaking 43, which should indeed take place
annually, be conducted in cooperation with the national data protection authorities and be pub-
lished in full and must assess not only the implementation of the undertakings but also the results
of the agreement in terms of eliminating terrorism and crime;

As regards the content of the medium-term agreement

(h)

to provide the EU with a clear legal framework, namely by adopting, as a matter of urgency, the Draft
Data Protection Framework Decision;

(i)

(j)

to avoid an artificial division between the ‘pillars’ by creating a consistent cross-pillar data protection
framework in the Union by activating the passarelle clause under Article 42 of the Treaty on European
Union in order to ensure that the new agreement is concluded in association with Parliament and is
subject to the scrutiny of the Court of Justice;

to limit the amount of data that may be requested and to filter at source sensitive data as required by
Article 8 of Directive 95/46/EC; notes that carriers are required to submit only the data available to
them, so that, in practice, the CBP rarely receives all 34 categories of data requested; concludes that for
the purposes of the agreement, namely to prevent and combat terrorism and transnational crime,
including organised crime, even APIS data would be sufficient; calls on the Council Presidency and
the Commission to raise this matter in the negotiations;

Reiterates its previous demand that the new agreement should grant to European passengers the same

2.
level of data protection as is enjoyed by US citizens;

3.
Stresses its previous position that the EU should avoid the indirect creation of a European PNR system
through the transfer of the relevant data by the CBP to police and judicial authorities in the Member States;
considers that the systematic collection of the data of ordinary citizens outside the framework of a judicial
procedure or police investigation should remain forbidden in the EU and that data should be exchanged
where necessary in accordance with the existing EU/US agreement on mutual legal assistance and extradi-
tion;

(1)

(2)

Joint Review of the implementation by the US Bureau of Customs and Border Protection of the Undertakings set out
in Commission Decision 2004/535/EC of 14 May 2004 (Redacted version of 12.12.2005).
(see: http://ec.europa.eu/justice_home/fsj/privacy/workinggroup/wpdocs/2006_en.htm).

C 305 E/254

Official Journal of the European Union

EN

14.12.2006

Thursday 7 September 2006

4.
Proposes that a dialogue in which parliamentary representatives would take part be launched before
the end of 2006 between the EU, the US, Canada and Australia with a view to preparing jointly the 2007
review and establishing a global standard for the transmission of PNR, if that is deemed necessary;

5.
Strongly recommends that Parliament organise a joint session in this respect with the US Congress,
being the democratically representative institutions of the citizens concerned, so as to start a dialogue on
the fight against terrorism and its consequences for civil liberties and human rights;

*

*

*

Instructs its President

6.
Commission.

to forward this resolution to the Council and,

for information,

to the

P6_TA(2006)0355

European natural, architectural and cultural heritage in rural and island regions

European Parliament resolution on the protection of the European natural, architectural and
cultural heritage in rural and island regions (2006/2050(INI))

The European Parliament,

— having regard to Article 151 of the EC Treaty,

— having regard to the Unesco Convention of 16 November 1972 concerning the Protection of the World

Cultural and Natural Heritage,

— having regard to the Council of Europe Convention of 3 October 1985 for the Protection of the Archi-

tectural Heritage of Europe (Granada),

— having regard to the Council of Europe Convention of 16 January 1992 on the Protection of the

Archaeological Heritage (Valetta),

— having regard to the European Landscape Convention of 20 October 2000 adopted by the Council of

Europe (Florence),

— having regard to the Council of Europe Framework Convention of 27 October 2005 on the Value of

the Cultural Heritage for Society (Faro),

— having regard to its resolutions of 13 May 1974 on the protection of the European cultural heritage (1),
14 September 1982 on the protection of the European architectural and archaeological heritage (2),
28 October 1988 on the conservation of the Community's architectural and archaeological heritage (3),
12 February 1993 on preserving the architectural heritage and protecting cultural assets (4) and 16 Jan-
uary 2001 on the application of the Convention Concerning the Protection of the World Cultural and
Natural Heritage in the Member States of the European Union (5),

— having regard to Decision 508/2000/EC of the European Parliament and of the Council of 14 February

2000 establishing the Culture 2000 programme (6),

(1) OJ C 62, 30.5.1974, p. 5.
(2) OJ C 267, 11.10.1982, p. 25.
(3) OJ C 309, 5.12.1988, p. 423.
(4) OJ C 72, 15.3.1993, p. 160.
(5) OJ C 262, 18.9.2001, p. 48.
(6) OJ L 63, 10.3.2000, p. 1.