Out-Law News 2 min. read

Annul passenger data decisions, says Advocate General


European Commission and Council decisions that led to a controversial agreement permitting the transfer of air passenger data to the US should be annulled because they do not have an adequate legal basis, according to Advocate General Phillipe Léger.

The Advocate General is set to publish his opinion on the decisions today, advising the European Court of Justice on how he feels Europe’s top court should approach the dispute between MEPs, the Commission and the Council.

Background

Airlines operating passenger flights to, from or through the US have been transferring passenger data contained in their reservation and departure control systems to US Customs since March 2003, in order to comply with US anti-terror requirements.

The EU and the US began negotiating to agree matters formally, but faced criticism – not only because the US does not meet general EU data protection requirements, but because the agreement setting out the terms of the transfer was also found wanting.

The problem in Europe is that its Data Protection Directive of 1995 provides that personal data may only be transferred to third countries if the specific country ensures an adequate level of protection. The Commission decides which countries have adequate laws but, to date, only a few countries – not including the US – have met the criteria.

Nevertheless, on 14th May 2004, the Commission adopted a decision (the adequacy decision) holding that the US Bureau of Customs and Border Protection (CBP) offered a sufficient level of protection for personal data transferred from the Community.

But the decision to make this adequacy finding was largely a political one, and civil liberties groups and the European Parliament took issue, arguing that the decision, and the international agreement upon which the finding was made, did not provide sufficient protection, in terms of EU law, for European passengers travelling to the US.

MEPs sought a judicial ruling on the agreement, but before this could be heard, the Council of Ministers adopted a decision approving the conclusion of the agreement with the US. This was signed a few weeks later, rendering the Parliamentary court referral redundant.

MEPs were furious at what they saw as the bypassing of the Parliament, and filed suit against the Council and the Commission, seeking an annulment of both decisions.

Advocate General Léger has now issued his opinion on the decisions. While he did not accept MEPs' arguments about the procedure for consulting the Parliament or infringement of the right to respect for private life, he still found that the decisions should be annulled.

The Advocate General's opinion is highly influential and usually followed by the Court.

The Adequacy Decision

According to the Advocate General, the adequacy decision is not validly based in EU law, because the Commission was not empowered by the Directive on which it was relying – the Data Protection Directive – to make such a decision.

The Data Protection Directive, he says, does not apply to the processing of personal data undertaken in pursuance of activities that do not fall within the scope of Community law, particularly the processing of such data for such matters as public security and the activities of the State in relation to areas of criminal law.

In this case, he says, the consultation of air passengers’ data, and those data being put at the disposal of, and used by, the CBP, constitutes the processing of personal data concerning public security and the activities of the State in relation to areas of criminal law.

Such activity is therefore outside the scope of the Directive

The Council’s decision

The supposed legal basis for the Council decision, says the Advocate General, is Article 95 of the EC Treaty, which concerns the adoption of measures for approximating the legal, regulatory and administrative provisions of Member States which have as their object the establishment and functioning of the internal market.

However, on examining the aim and the content of the agreement with the US, approved by the Council’s decision, the Advocate General concludes that it simultaneously pursues two objectives: the fight against terrorism and other serious crime and the protection of personal data.

He therefore considers that Article 95 of the EC Treaty does not constitute an appropriate legal basis for the Council’s decision and proposes that the Court should annul it.

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.