Weitere Kapitel dieses Buchs durch Wischen aufrufen
On 26 July 2017 the Court of Justice of the European Union issued Opinion 1/15 on the compatibility with EU fundamental rights of the draft agreement between the European Union and Canada on the transfer of Passenger Name Record data. In particular, it is the first ruling concerning the compatibility of a draft international agreement with the EU Charter of Fundamental Rights, notably with its Articles 7 and 8, on the right to respect for private life and the right to the protection of personal data. The Opinion, which found a profound incompatibility between the agreement and the Charter, apparently entails significant consequences for the international relations of the Union and the fate of the EU Passenger Name Record framework as a whole, including the regional scheme recently introduced by Directive 2016/681/UE.
Bitte loggen Sie sich ein, um Zugang zu diesem Inhalt zu erhalten
Sie möchten Zugang zu diesem Inhalt erhalten? Dann informieren Sie sich jetzt über unsere Produkte:
Cf. MacKenzie ( 2012).
See Council Decision 2012/381/EU of 13 December 2011 on the conclusion of the Agreement between the European Union and Australia on the processing and transfer of Passenger Name Record data air carriers to the Australian Customs and Border Protection Service, OJ 2012 L 186/3.
For the first EU-Canada PNR Agreement, expired in September 2009, see Council Decision 2006/230/EC of 18 July 2005 on the conclusion of an Agreement between the European Community and the Government of Canada on the processing of API/Passenger Name Record data, OJ 2006 L 82/14.
See Council Decision 2012/472/EU of 26 April 2012 on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security, OJ 2012 L 215/4.
UN Doc. S/PRST/2014/23, 19 November 2014, para. 16.
It should be underlined that, in terms of legal force, the recalled exhortation, contained in a statement of the President of the United Nations Security Council is different from the obligation provided for in the United Nations Security Council Resolution 2178(2014) (UN Doc. S/RES/2178(2014)) in which Member States are called upon “to require that airlines operating in their territories provide advance passenger information to the appropriate national authorities in order to detect the departure from their territories, or attempted entry into or transit through their territories, by means of civil aircraft”.
See Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ 1995 L 281/31 (Data Protection Directive). See also Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matter, OJ 2008 L350/60 (Framework Decision). The Data Protection Directive has been replaced by the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, OJ 2016 L 119/1 (General Data Protection Directive).
Article 25(4) of the Data Protection Directive.
See, in particular, Communication from the Commission to the Council and the Parliament on transfer of air passenger name record (PNR) data: a global EU approach, COM(2003) 826 final, 16 December 2003, and Communication from the Commission on the global approach to transfers of Passenger Name Record (PNR) data to third countries, COM(2010) 492 final, 21 September 2010.
The Author is aware that the adoption of a dedicated PNR Directive was not envisaged in the Communications recalled previously, see supra footnote No. 10. However, an ex post oversight of the EU strategy on PNR data transfer demonstrates that this global approach has shaped into a twofold result. The adoption of the PNR Directive, and the consequent establishment of an EU PNR system, of course demonstrates the “increasing role of the EU in homeland security, and the influence of the US over the EU” (MacKenzie 2012, p. 104) but, at the same time, it demonstrates at least the willingness (doubts remain on its successfulness, see Sect. 4) to effectively manage the interplay between the respect of human rights and the fight against terrorism and transnational crime. The first proposal of the Commission on a EU PNR Directive was presented in February 2010, rejected three years after by the negative vote of the Civil Liberties, Justice and Home Affairs (LIBE) Committee. Directive 2016/681/UE, as it is today, has been adopted on 27 April 2016, OJ 2016 L 119/132.
See, inter alia, Opinion of the European Union Agency for Fundamental Rights on the Proposal for a Directive on the use of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (COM(2011) 32 final), FRA Opinion 1/2011, 14 June 2011.
As it is well known, under article 218 (11) TFEU, “[a] Member State, the European Parliament, the Council or the Commission may obtain the opinion of the Court of Justice as to whether an agreement envisaged is compatible with the Treaties. Where the opinion of the Court is adverse, the agreement envisaged may not enter into force unless it is amended, or the Treaties are revised”.
Many commentators observed that the Court in this opinion acted as a policy maker; cf. Carpanelli and Lazzerini ( 2017), p. 388.
Opinion 1/15, para. 76.
It should be underlined that the Opinion followed the conclusions reached by the Advocate General (AG) Mengozzi, whose Opinion was delivered on 8 September 2016.
The Opinion of the EDPS was delivered on 30 September 2013.
Article 1 of the envisaged agreement, labelled Purpose of the Agreement, stated that “[i]n this Agreement, the Parties set out the conditions for the transfer and use of Passenger Name Record (PNR) data to ensure the security and safety of the public and prescribe the means by which the data is protected”.
In reality, the reference of the Preamble is more complete, affirming that “[m]indful of the European Union’s commitments pursuant to Article 6 of the Treaty on European Union on respect for fundamental rights, the right to privacy with regard to the processing of personal data as stipulated in Article 16 of the Treaty on the Functioning of the European Union, the principles of proportionality and necessity concerning the right to private and family life, the respect for privacy, and the protection of personal data under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, Council of Europe Convention No 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data [, signed at Strasbourg on 28 January 1981,] and its additional Protocol 181 [, signed at Strasbourg on 8 November 2001]”.
As both Article 16(2) and Article 87(2)(a) TFEU provide for the use of the ordinary legislative procedure, entailing the qualified majority voting in the Council and the Parliament’s full participation, there is no problem in principle using them as legal basis, nor being affected by the Protocols 21 and 22 to the Treaties.
AG Mengozzi went into much detail with respect to Article 16(2) TFEU.
Opinion 1/15, paras. 122 and 123.
Besides, as it has been observed, notwithstanding the separation of the two rights into two different articles, the EUCFR itself encourages a collective reading. The explanations to the Charter concerning Article 7 state that it corresponds to article 8 of the European Convention on the Protection of Human Rights and Fundamental Freedoms (ECHR), which protects both the right to private life and to data protection. Moreover, instruments recalled in the explanations concerning Article 8 EUCFR seem to support the same conclusions. In this sense, see Gonzalez Fuster ( 2014), p. 260.
Cf., Gonzalez Fuster ( 2014), p. 259.
It is the case of Article 8 of the ECHR and of Article 17 of the International Covenant on Civil and Political Rights (ICCPR).
Data protection has been addressed both by the European Court of Human Rights (ECtHR) and the UN Human Rights Committee. The ECtHR clearly dealt with data protection issues in the S. and Marper v. the United Kingdom judgment (Grand Chamber) of 4 December 2008, assessing that “[t]he mere storing of data relating to the private life of an individual amounts to an interference within the meaning of Article 8 […]. The subsequent use of the stored information has no bearing on that finding […]. However, in determining whether the personal information retained by the authorities involves any […] private-life [aspect] […], the Court will have due regard to the specific context in which the information at issue has been recorded and retained, the nature of the records, the way in which these records are used and processed and the results that may be obtained […]”, para. 67. On the other hand, the UN Human Rights Committee in its General Comment No. 16 considered that Article 17 ICCPR should be interpreted as including some data protection guarantees.
See Annex 9 to the Convention on International Civil Aviation (Chicago, 7 December 1944, entered into force on 4 April 1947, 15 U.N.T.S. 295), Recommended Practice 3.49.
Along with heading 5, the problematic headings are the following. Heading 7, using the expression “all available contact information (including originator information)”, does not define in a sufficiently detailed manner neither the scope of the data to be transferred nor the eventual involvement of the contact information of third parties e.g. who made the flight reservation for the air passenger. Heading 17, referring to “general remarks including Other Supplementary Information (OSI), Special Service Information (SSI) and Special Service Request (SSR) information”, seems to be a catch-all category, potentially including all other information not specified in the Annex, even sensitive data. The CJEU in its Opinion made explicit reference to two other headings, specifically headings number 8 and 18, which prima facie can be seen as not sufficiently precise and clear due to their formulation, but thanks to the explanation given by the Commission, both headings may be regarded as meeting the requirements of clarity and precision.
Opinion 1/15, paras. 156–161.
Article 21 of the EUCFR is contained in Title III on Equality and it reads as follows: “1. Any discrimination based on any ground such as sex, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation shall be prohibited. 2. Within the scope of application of the Treaties and without prejudice to any of their specific provisions, any discrimination on grounds of nationality shall be prohibited”.
Articles of the PNR Directive prohibiting the processing of sensitive data are Articles 6(4), 7(6) and 13(4).
Opinion 1/15, paras. 164–167.
Point 30 of the EDPS Opinion of 30 September 2013.
Other important provisions of the envisaged agreement specifically apply to the automated processing of data, such as Article 3, defining the purposes for which the Canadian Competent Authority may process that data, and Article 7 of the agreement, containing the non-discrimination clause.
Opinion 1/15, paras. 168–174.
Ibid ., paras. 175–178.
Ibid., para. 180.
Ibid ., paras. 179–181.
Ibid ., para. 197.
Ibid ., paras. 199–203.
In this respect the CJEU observed that “it is not apparent that all air passengers who have travelled to Canada would present, after their departure from that country, a higher risk that other persons who have not travelled to that country during the previous five years and in respect of whom Canada does not therefore hold PNR data”, ibid ., para. 204.
Ibid ., paras. 204–209.
Case C-362/14 Schrems  EU:C:2015:650, paras. 72 and 73.
Disclosure of PNR data is governed by Articles 18 and 19 of the envisaged agreement.
Opinion 1/15, paras 212–214.
Ibid., para 225.
Ibid., para 231.
For a more detailed overview on this point, see Carpanelli and Lazzerini ( 2017).
Article 13(4) PNR Directive.
Articles 6(5), 6(6) and 12(5) PNR Directive.
These circumstances are established by Article 9(2) and, more specifically, by Article 12 PNR Directive.
Cf. Tzanou ( 2015).
Cases C-293/12 and C-594/12 Digital Rights Ireland and Others  EU:C:2014:238.
Case C-131/12 Google Spain  EU:C:2014:317.
Supra footnote No. 45.
Joint cases C-203/15 and C-698/15 Tele2 Sverige and Watson and Others  EU:C:2016:970.
Cf. Zanfir ( 2015).
See for instance: European Commission, STATEMENT/15/5374, ‘Beginning of negotiations between Mexico and the European Union on PNR data transmission’, 14 July 2015.
Bakker, Edwin, and Mark Singleton. 2016. Foreign Fighters in the Syria and Iraq Conflict: Statistics and Characteristics of a Rapidly Growing Phenomenon. In Foreign Fighters Under International Law and Beyond, ed. Andrea de Guttry et al., 9–25. The Hague: T. M. C. Asser Press. CrossRef
Bonfanti, Matteo E. 2016. Collecting and Sharing Intelligence on Foreign Fighters in the EU and Its Member States: Existing Tools, Limitations and Opportunities. In Foreign Fighters Under International Law and Beyond, ed. Andrea de Guttry et al., 333–353. The Hague: T. M. C. Asser Press. CrossRef
Bosson, Raphael. 2017. Passenger Name Records – From Canada Back to the EU. Verfassungsblog. Accessed December 31, 2017. http://verfassungsblog.de/passenger-name-records-from-canada-back-to-the-eu/.
Carpanelli, Elena, and Nicole Lazzerini. 2017. PNR: Passenger Name Record, Problems Not Resolved? The EU PNR Conundrum After Opinion 1/15 of the CJEU. Air & Space Law 42: 377–402.
De Kerchove, Gilles, and Christiane Höhn. 2016. The Regional Answers and Governance Structure for Dealing with Foreign Fighters: The Case of the EU. In Foreign Fighters Under International Law and Beyond, ed. Andrea de Guttry et al., 299–331. The Hague: T. M. C. Asser Press. CrossRef
Di Francesco Maesa, Costanza. 2016. Balance Between Security and Fundamental Rights Protection: An Analysis of the Directive 2016/680 for Data Protection in the Police and Justice Sectors and the Directive 2016/681 on the Use of Passenger Name Record (PNR), Eurojus. Accessed December 31, 2017. http://rivista.eurojus.it/balance-between-security-and-fundamental-rights-protection-an-analysis-of-the-directive-2016680-for-data-protection-in-the-police-and-justice-sectors-and-the-directive-2016681-on-the-use-of-passen/?print=pdf.
Gonzalez Fuster, Gloria. 2014. The Emergence of Personal Data Protection as a Fundamental Right of the EU. Cham: Springer. CrossRef
Kuner, Cristopher. 2017. Data Protection, Data Transfers, and International Agreements: The CJEU’s Opinion 1/15. Verfassungsblog. Accessed December 31, 2017. http://verfassungsblog.de/data-protection-data-transfers-and-international-agreements-the-cjeus-opinion-115/.
Lowe, David. 2017. The European Union’s Passenger Name Record Data Directive 2016/681: Is It Fit for Purpose? International Criminal Law Review 17: 78–106. CrossRef
MacKenzie, Alex. 2012. The External Dimension of European Homeland Security. In European Homeland Security: A European Strategy in the Making? ed. Christian Kaunert et al., 101-95-110. London: Routledge.
Nino, Michele. 2010. The Protection of Personal Data in the Fight Against Terrorism. New Perspectives of PNR European Union Instruments in the Light of the Treaty of Lisbon. Utrecht Law Review 6: 62–85. CrossRef
Nucera, Gianfranco Gabriele. 2015. Considerazioni sulle misure adottate dall’Unione europea in materia di combattenti terroristi stranieri. Federalismi.it. Accessed December 31, 2017. http://www.federalismi.it/nv14/articolo-documento.cfm?Artid=30331&content=Considerazioni+sulle+misure+adottate+dall%E2%80%99Unione+europea+in+materia+di+combattenti+terroristi+stranieri&content_author=%3Cb%3EGianfranco+Gabriele+Nucera%3C/b%3E.
Peers, Steven. 2014. The Domino Effect: How Many EU Treaties Violate the Right to Privacy and Data Protection? EU Law Analysis. Accessed December 31, 2017. http://eulawanalysis.blogspot.it/2014/11/the-domino-effect-how-many-eu-treaties.html.
Tzanou, Maria. 2015. The War Against Terror and Transatlantic Information Sharing: Spillovers of Privacy or Spillovers of Security? Utrecht Journal of International & European Law 31: 87–103. CrossRef
Vara, Juan Santos. 2013. The Role of the European Parliament in the Conclusion of the Transatlantic Agreements on the Transfer of Personal Data After Lisbon. CLEER Working Papers 2013/2. Accessed December 31, 2017. http://www.asser.nl/upload/documents/20130226T013310-cleer_13-2_web.pdf.
Woods, Lorna. 2017. Transferring Personal Data Outside the EU: Clarification from the ECJ? EU Law Analysis. Accessed December 31, 2017. http://eulawanalysis.blogspot.it/2017/08/transferring-personal-data-outside-eu.html.
Zanfir, Gabriela. 2015. How CJEU’s “Privacy Spring” Construed the Human Rights Shield in the Digital Age. In European Judicial System as a Challenge for Democracy, ed. Elzbieta Kuzelewska et al., 111–126. Cambridge: Intersentia.
- The Passenger Name Record Case: Profiling Privacy and Data Protection Issues in Light of CJEU’s Opinion 1/15