EUROPEAN COMMISSION
Brussels, 13.9.2019
COM(2019) 416 final
2019/0195(NLE)
Proposal for a
COUNCIL DECISION
on the position to be taken on behalf of the European Union in the Council of the International Civil Aviation Organization, in respect of the revision of Chapter 9 of Annex 9 (‘Facilitation’) to the Convention on International Civil Aviation with regard to standards and recommended practices on passenger name record data
EXPLANATORY MEMORANDUM
1.Subject matter of the proposal
This proposal concerns the decision establishing the position to be taken on behalf of the European Union in the International Civil Aviation Organization (ICAO) bodies in connection with envisaged adoption of amendments to Chapter 9 of Annex 9 (‘Facilitation’) of the Convention on International Civil Aviation (the ‘Chicago Convention’) to set out new ICAO standards on Passenger Name Record (PNR) data.
2.Context of the proposal
2.1.The Convention on International Civil Aviation (the ‘Chicago convention’)
The Chicago Convention aims to regulate international air transport. It entered into force on 4 April 1947 and established the International Civil Aviation Organization (ICAO).
All EU Member States are Parties to the Chicago Convention.
2.2.The International Civil Aviation Organization
ICAO is a specialised agency of the United Nations. The objectives of the Organization are to develop the principles and techniques of international air navigation and to foster the planning and development of international air transport.
The ICAO Council is a permanent body of ICAO with a membership of 36 contracting States elected by the ICAO Assembly for a period of three years. For the period of 2016-2019, there are seven EU Member States represented in the ICAO Council.
Mandatory functions of the ICAO Council, listed in Article 54 of the Chicago Convention, include the adoption of international Standards and Recommended Practices (also known as SARPs), designated as Annexes to the Chicago Convention.
The ICAO Council also convenes the Assembly, which is ICAO’s sovereign body. The ICAO Assembly meets at least once every three years and establishes the Organisation’s political direction for the upcoming triennium. The 40th Session of the ICAO Assembly will take place on 24 September-4 October in Montreal, Canada.
2.3. The envisaged act of ICAO
In accordance with Article 54 point (1) of the Chicago Convention, the Council of ICAO shall adopt Standards and Recommended Practices (SARPs). SARPs on PNR are found in Parts A and D of Chapter 9, Annex 9 (‘Facilitation’), to the Chicago Convention. They are complemented by additional guidance, notably ICAO Document 9944 setting out ‘Guidelines on Passenger Name Record (PNR) Data’. PNR data are personal data of passengers collected by airlines for their business purposes, unlike other travel-related data collected on behalf of Governments such as Advance Passenger Information.
The United Nations Security Council Resolution 2396 adopted on 21 December requires UN member States to “develop the capability to collect, process and analyse, in furtherance of ICAO standards and recommended practices, passenger name record (PNR) data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms”. The Resolution also urges ICAO ‘to work with its Member States to establish a standard for the collection, use, processing and protection of PNR data’.
In this context, on 18 July 2019, the Council of the European Union endorsed an Information Paper on ‘Standards and principles on the collection, use, processing and protection of Passenger Name Record (PNR) data’ for submission at the 40th Session of the ICAO Assembly. This information paper has been submitted to the European Civil Aviation Conference (ECAC) for consultation.
In March 2019, the ICAO Air Transport Committee (ATC) set up a Facilitation Panel Task Force to consider proposals for SARPs on the collection, use, processing and protection of PNR data in line with United Nations Security Council resolution 2396 (2017). The Task Force is mandated to: a) review the existing PNR SARPs found in Chapter 9 of Annex 9 to the Chicago Convention; b) determine whether they need to be complemented by additional SARPs and/or guidance material, taking into account the Security Council’s decision and considerations; and c) as required, develop new provisions (Standards, Recommended Practices, and/or guidance materials) for the collection, use, processing and protection of PNR data.
Discussions on the revised ICAO PNR SARPs are still at an early stage. Once adopted the envisaged standards will be binding on all ICAO members, including all EU Member States, in accordance with and within the limits set out in the Chicago Convention. Article 38 of the Chicago Convention requires contracting States to notify ICAO if they intend to deviate from a standard, under the notification of differences mechanism.
2.4.EU legal framework
The processing of PNR data constitutes an essential instrument in the EU’s common response to terrorism and serious crime and a building block of the Security Union. Identifying and tracing suspicious travel patterns by processing PNR to gather evidence and, where relevant, find perpetrators of serious crime and their associates and unravel criminal networks is proving essential to prevent, detect, investigate and prosecute terrorist and serious crime offences.
On 27 April 2016, the European Parliament and the Council adopted Directive (EU) 2016/681 on the use of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. This Directive enables national authorities to gain direct access to crucial information held by airlines, in full regard of data protection rights. It provides all Member States with an important tool for preventing, detecting and investigating terrorism and serious crimes, including drugs and human trafficking and child sexual exploitation. The deadline for the Member States to transpose the PNR Directive into national law was 25 May 2018.
In order to facilitate the process of connecting air carriers to the Member States’ Passenger Information Units – the units responsible for collecting and processing PNR data - the European Commission adopted, on 28 April 2017, an Implementing Decision on the common protocols and data formats to be used by air carriers when transferring PNR data to the Member States. The Implementing Decision became applicable in April 2018.
There are currently two international agreements in force between the EU and third countries (namely Australia and the United States) on the processing and transfer of PNR data. On 26 July 2017, the Court of Justice of the EU adopted an Opinion on the envisaged Agreement between the EU and Canada signed on 25 June 2014. The Court decided that the agreement could not be concluded in its intended form because some of its provisions were incompatible with the fundamental rights to privacy and to personal data protection recognised by the EU. In particular, the Court laid down further legal requirements with regard to oversight by an independent authority, sensitive data, automated processing of PNR data, purposes for which PNR data may be processed, and the retention, use, disclosure and further transfer of PNR data. Further to the authorization received by the Commission from the Council in December 2017, new PNR negotiations with Canada were launched in June 2018. At the 17th EU-Canada Summit in Montreal on 17-18 July 2019, the EU and Canada welcomed that they had concluded these negotiations. While Canada noted its requirement for legal review, the parties committed, subject to that review, to finalise the Agreement as soon as possible, acknowledging the vital role of this Agreement in enhancing security while ensuring privacy and the protection of personal data.
An increasing number of third countries are collecting PNR data from air carriers and several of them have approached the Commission over the past few years to express their interest in concluding an international agreement on PNR with the EU. In the absence of a legal basis, air carriers are confronted with a situation of conflict of laws and risk fines and other sanctions. At the same time, further to the implementation of the PNR Directive, EU Member States are requesting air carriers from third countries to transfer PNR data to their Passenger Information Units. A number of third countries have refused such transfers – and others have threatened to do so – alleging lack of reciprocity, therefore compromising the effectiveness of the EU PNR mechanism.
According to Article 3(2) TFEU the Union has exclusive competence “for the conclusion of an international agreement ... in so far as its conclusion may affect common rules or alter their scope.” An international agreement may affect common rules or alter their scope where the area covered by the agreement overlaps with Union legislation or is covered to a large extent by Union law. Moreover, to assess whether an area is largely covered by common rules, account must be taken not only of Union law as it currently stands in the area concerned, but also of its future development, in so far as that is foreseeable at the time of that analysis.
In the light of the common rules mentioned above and the upcoming review according to Article 19 of Directive 2016/681, it can be concluded that the matters covered by the propose decision fall under the Union’s exclusive competence.
3.Position to be taken on the Union’s behalf
In view of the importance of this matter for EU internal and external policy and in light of the above, it is necessary to establish a Union position on PNR data transfers for the purposes of the (multilateral) on-going works at the level of ICAO. In particular, the EU should seek that the core principles on the modalities of PNR transmission and processing and on the protection of personal data – to be laid down in the common position - are embedded in new ICAO PNR standards. In this respect, it is essential to steer the discussions on such new PNR standards within ICAO in a manner that is compatible with the EU regulatory framework and the relevant case law of the Court of Justice, in particular concerning the fundamental rights to privacy and data protection.
The Union position, relevant both to the final decision by the ICAO Council and preparatory discussions in other ICAO bodies, is defined in accordance with the applicable EU legal framework on data protection and PNR, namely Regulation (EU) 2016/679, Directive (EU) 2016/680 and Directive (EU) 2016/681, as well as the Treaty and Charter of Fundamental Rights as interpreted in the relevant case law of the Court of Justice of the European Union, in particular Opinion 1/15 of the Court.
4.Legal basis
4.1.Procedural legal basis
4.1.1.Principles
Article 218(9) of the Treaty on the Functioning of the European Union (TFEU) provides for decisions establishing “the positions to be adopted on the Union’s behalf in a body set up by an agreement, when that body is called upon to adopt acts having legal effects, with the exception of acts supplementing or amending the institutional framework of the agreement.”
Article 218(9) TFEU applies regardless of whether the Union is a member of the body or a party to the agreement.
The concept of “acts having legal effects” includes acts that have legal effects by virtue of the rules of international law governing the body in question. It also includes instruments that do not have a binding effect under international law, but that are “capable of decisively influencing the content of the legislation adopted by the EU legislature”.
4.1.2.Application to the present case
The ICAO Council is a body set up by an agreement, namely the Chicago Convention.
Any amendment to Chapter 9 of Annex 9 of the Chicago Convention adopted by the ICAO Council in accordance with Article 54 point (l) of the Convention will constitute an act having legal effects. Such an amendment is capable of decisively influencing the content of EU legislation, notably Directive (EU) 2016/681 as well as the existing and future international agreements on PNR between the EU and third countries.
The envisaged act does not supplement or amend the institutional framework of the Agreement.
Therefore, the procedural legal basis for the proposed decision is Article 218(9) TFEU.
4.2.Substantive legal basis
4.2.1.Principles
The substantive legal basis for a decision under Article 218(9) TFEU depends primarily on the objective and content of the envisaged act in respect of which a position is taken on the Union's behalf. If the envisaged act pursues two aims or has two components and if one of those aims or components is identifiable as the main one, whereas the other is merely incidental, the decision under Article 218(9) TFEU must be founded on a single substantive legal basis, namely that required by the main or predominant aim or component.
With regard to an envisaged act that simultaneously pursues a number of objectives, or that has several components, which are inseparably linked without one being incidental to the other, the substantive legal basis of a decision under Article 218(9) TFEU will have to include, exceptionally, the various corresponding legal bases.
4.2.2.Application to the present case
The envisaged act pursues objectives and has components in the areas of data protection and police cooperation. These elements of the envisaged act are inseparably linked without one being incidental to the other.
Therefore, the substantive legal basis of the proposed decision comprises the following provisions: Article 16(2) and point (a) of Article 87(2) TFEU.
4.3.Conclusion
The legal basis of the proposed decision should be Article 16(2) and point (a) of Article 87(2) TFEU, in conjunction with Article 218(9) TFEU.
2019/0195 (NLE)
Proposal for a
COUNCIL DECISION
on the position to be taken on behalf of the European Union in the Council of the International Civil Aviation Organization, in respect of the revision of Chapter 9 of Annex 9 (‘Facilitation’) to the Convention on International Civil Aviation with regard to standards and recommended practices on passenger name record data
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2) and point (a) of Article 87(2), in conjunction with Article 218(9) thereof,
Having regard to the proposal from the European Commission,
Whereas:
(1)The Convention on International Civil Aviation (‘the Chicago Convention’), which regulates international air transport, entered into force on 4 April 1947. It established the International Civil Aviation Organization (‘ICAO’).
(2)The Member States are contracting States of the Chicago Convention and members of ICAO, whereas the Union has observer status in certain ICAO bodies, including in the Assembly and other technical bodies.
(3)Pursuant to point (l) of Article 54 of the Chicago, the ICAO Council can adopt International Standards and Recommended Practices (SARPs).
(4)The United Nations (UN) Security Council decided in its Resolution 2396 (2017), adopted on 21 December 2017, that the UN Member States are to develop the capability to collect, process and analyse, in furtherance of ICAO standards and recommended practices, passenger name record (PNR) data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms for the purpose of preventing, detecting and investigating terrorist offenses and related travel.
(5)Resolution 2396 (2017) also urged ICAO to work with the UN Member States to establish a standard for the collection, use, processing and protection of PNR data.
(6)SARPs on PNR are in Parts A and D of Chapter 9 of Annex 9 (‘Facilitation’) to the Chicago Convention. They are complemented by additional guidance, notably ICAO Document 9944 setting out ‘Guidelines on Passenger Name Record (PNR) Data’.
(7)In March 2019 the ICAO Air Transport Committee (ATC) established a Task Force, consisting of experts from the Member States of the ICAO Facilitation Panel, to consider proposals for new ISARPs on the collection, use, processing and protection of PNR data in line with Resolution 2396 (2017). A number of Member States of the Union are represented in the Task Force. The Commission participates in the Task Force as an observer. The Task Force is expected to present its final report to the ICAO ATC in October 2019.
(8)The 40th Session of the ICAO Assembly will take place on 24 September-4 October 2019. The Assembly will define ICAO’s political direction for the next years, including possibly with respect to the adoption of new SARPs is on PNR.
(9)On 18 July 2019, the Council endorsed an Information Paper on ‘Standards and principles on the collection, use, processing and protection of Passenger Name Record (PNR) data’ for submission at the ICAO Assembly. This information paper has been submitted to the European Civil Aviation Conference (ECAC) for consultation.
(10)The paper sets out the Union’s position on the core principles compliance which would help to ensure respect for the constitutional and regulatory requirements concerning fundamental rights to privacy and data protection when processing PNR data for the purposes of countering terrorism and serious crime. ICAO is invited to include such principles in any future standards on PNR as well as in the (revised) ICAO's Guidelines on PNR (Doc 9944).
(11)The Union has adopted common rules on PNR data, namely Directive (EU) 2016/681, the scope of which overlap largely with the area to be covered by the envisaged SARPs. This includes, in particular, a comprehensive set of rules to safeguard the fundamental rights to privacy and the protection of personal data, in the context of a transfer of PNR data by air carriers to Member States for the purpose of prevention, detection, investigation and prosecution of terrorist offences and serious crime.
(12)There are currently two international agreements in force between the EU and third countries (namely Australia and the United States) on the processing and transfer of PNR data. On 26 July 2017, the Court of Justice of the EU adopted an Opinion on the envisaged Agreement between the EU and Canada signed on 25 June 2014.
(13)It is appropriate to establish the position to be taken on the ion’s behalf in the ICAO Council and preparatory/technical bodies, as any future SARPs in the area of PNR data, in particular amendments to Chapter 9 of Annex 9 (‘Facilitation’) of the Chicago Convention adopted by the ICAO Council will be capable of decisively influencing the content of Union law, namely in particular Directive (EU) 2016/681 and the existing international PNR agreements.
(14)The Union position set out in the Annex is defined in accordance with the applicable Union legal framework on data protection and PNR data, namely Regulation (EU) 2016/679 of the European Parliament and of the Council, Directive (EU) 2016/680 of the European Parliament and of the Council and Directive (EU) 2016/681 of the European Parliament and of the Council, as well as the Treaty and Charter of Fundamental Rights as interpreted in the relevant case law of the Court of Justice of the European Union, in particular Opinion 1/15 of the Court.
(15)The Union's position is to be expressed by the Member States of the Union that are members of the ICAO Council, acting jointly.
(16)[In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, those Member States have notified their wish to take part in the adoption and application of this Decision.]
OR
[In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, those Member States are not taking part in the adoption of this Decision and are not bound by it or subject to its application.]OR[In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, the United Kingdom is not taking part in the adoption of this Decision and is not bound by it or subject to its application.]
In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Ireland has notified (, by letter of ...,) its wish to take part in the adoption and application of this Decision.]
OR
[In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, the United Kingdom has notified (, by letter of ...,) its wish to take part in the adoption and application of this Decision.
In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Decision and is not bound by it or subject to its application.]
(17)In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application,
HAS ADOPTED THIS DECISION:
Article 1
The position to be taken on the Union's behalf in the Council of the International Civil Aviation Organisation (‘ICAO’) in respect of the adoption of Standards and Recommended Practices regarding Passenger Name Record data, in particular through revision of Chapter 9 of Annex 9 (‘Facilitation’) to the Chicago Convention is set out in the Annex.
Article 2
The position referred to in Article 1 shall be expressed by the Member States of the Union that are members of the ICAO Council, acting jointly.
Article 3
This Decision is addressed to the Member States.
Done at Brussels,
For the Council
The President