Battleangel

The European Court of Justice has ruled (C-317/04 / C-318/04) on the matter of passenger data transfer between the EU and the US. The Passenger Name Records (PNR) transfer agreement was not “founded on an appropriate legal basis” (Out-Law | EU Observer). A good move and another important win for the Parliament.

Outline:

In Case C-317/04 Parliament v Council, the action is for annulment of the Council Decision of 17 May 2004 on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection.

In Case C-318/04 Parliament v Commission, the Parliament seeks annulment of the Commission Decision of 14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States Bureau of Customs and Border Protection.

The Court’s ruling in C-317/04 …

1. Annuls Council Decision 2004/496/EC of 17 May 2004 on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection and Commission Decision 2004/535/EC of 14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States Bureau of Customs and Border Protection;

2. Preserves the effect of Decision 2004/535 until 30 September 2006, but not beyond the date upon which that Agreement comes to an end;

Needless to say, the weasels are working to go around the ECJ’s gripes. Another alternative would of course be for individual countries to agree to Washington’s terms. The British Home Office for instance are falling over themselves to come up with ways to comply with the Americans. Passengers could also be forced to sign a waiver. Either way, the cat is out of the bag and the Pandora’s box has been opened. We’ll see how it turns out. But hope for the best and expect the worst is my bet.

See also:

Some history: On the original US demand …

The current regulations were already a result of a compromise between Washington and Brussels. The United States had originally demanded that European airlines provide passenger information such as seat numbers and meal preferences, which could potentially have identified individuals’ religions, but the European Commission found that the transfer of such data violated EU privacy laws. After lengthy negotiations, Washington ultimately agreed to modify the proposal, also reducing the period for which the data would be stored from 50 to 3 and a half years.