Council Decision 2006/729/CFSP/JHA of 16 October 2006 on the signing, on behalf of the European Union, of an Agreement between the European Union and the United States of America on the processing and transfer of passenger name record (PNR) data by air carriers to the United States Department of Homeland Security
Date: 2006-10-16
Institutions: Council of the European Union
Subjects: European Union, United States, agreement (EU), air transport, data processing, data transmission, personal data, public safety, signature of an agreement

27.10.2006

EN

Official Journal of the European Union

L 298/27

(Acts adopted under Title V of the Treaty on European Union)

COUNCIL DECISION 2006/729/CFSP/JHA

of 16 October 2006

on the signing, on behalf of the European Union, of an Agreement between the European Union
and the United States of America on the processing and transfer of passenger name record (PNR)
data by air carriers to the United States Department of Homeland Security

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on European Union, and in
particular Articles 24 and 38 thereof,

Passenger Name Record (PNR) data by air carriers to the United
States Department of Homeland Security, is hereby approved on
behalf of the European Union, subject to the conclusion of the
said Agreement.

Whereas:

The text of the Agreement is attached to this Decision.

(1)

(2)

(3)

(4)

(5)

On 27 June 2006 the Council decided to authorise the
Presidency, assisted by the Commission, to open nego-
tiations for an Agreement with the United States of
America on the processing and transfer of passenger
name record (PNR) data by air carriers to the United
States Department of Homeland Security (DHS).

In view of the Undertakings issued on 11 May 2004 by
DHS, Bureau of Customs and Border Protection (1), the
United States can be considered as ensuring an adequate
level of protection for PNR data transferred from the
European Union concerning passenger
to or
from the United States.

flights

The competent authorities in Member States may exercise
their existing powers to suspend data flows to DHS in
order to protect individuals with regard to the processing
of their personal data if they consider that the processing
of PNR data is not in accordance with the standards of
protection provided for in the Undertakings given by
DHS, or where a competent United States authority has
determined that DHS is in breach of those standards,
until compliance with those standards is assured.

The Agreement
conclusion at a later date.

should be

signed,

subject

to its

The provisions of the Agreement should be applied on a
provisional basis pending its entry into force,

HAS DECIDED AS FOLLOWS:

Article 1

The signing of the Agreement between the European Union and
the United States of America on the processing and transfer of

(1) OJ L 235, 6.7.2004, p. 15.

Article 2

The President of the Council is hereby authorised to designate
the person(s) empowered to sign the Agreement on behalf of
the European Union, subject to its conclusion.

Article 3

In accordance with point 7 of the Agreement, the provisions of
the Agreement shall be applied on a provisional basis as of the
date of its signature, pending its entry into force.

Article 4

1. Without prejudice to their powers to take action to ensure
compliance with national provisions, the competent authorities
in Member States may exercise their existing powers to suspend
data flows to DHS in order to protect individuals with regard to
the processing of their personal data in the following cases:

(a) where a competent United States authority has determined
the applicable standards of

that DHS is in breach of
protection; or

(b) where there is a substantial

likelihood that the applicable
standards of protection are being infringed,
there are
reasonable grounds for believing that DHS is not taking
or will not take adequate and timely steps to settle the
case at
the continuing transfer would create an
imminent risk of grave harm to data subjects, and the
competent authorities in the Member States concerned
have made reasonable efforts
to
provide DHS with notice and an opportunity to respond.

in the circumstances

issue,

L 298/28

EN

Official Journal of the European Union

27.10.2006

Suspension shall cease as

the standards of
2.
protection are assured and the competent authorities of the
Member States concerned are notified thereof.

soon as

Article 5

1. Member States
Commission without delay when measures
pursuant to Article 4.

inform the Council
are

shall

and the
adopted

If the Council considers that the information collected
3.
pursuant to Article 4 and pursuant to paragraphs 1 and 2 of
this Article provides evidence that the basic principles necessary
for an adequate level of protection for natural persons are no
longer being complied with, or that any body responsible for
ensuring compliance with the applicable standards of protection
by DHS is not effectively fulfilling its role, DHS shall be
informed thereof and the Council shall
take the necessary
action with a view to suspending or terminating the Agreement.

Done at Luxembourg, 16 October 2006.

2.
The Member States and the Commission shall inform each
other within the Council of any changes in the standards of
protection and of cases where the action of bodies responsible
for ensuring compliance with the applicable standards of
protection by DHS fails to secure such compliance.

For the Council
The President

E. TUOMIOJA