(a)

considers that the procedure followed for the conclusion of the Agreement lacks democratic legitimacy, as at no stage there was any meaningful democratic scrutiny or Parliamentary approval; notes that the Council routinely chooses this procedure for the conclusion of international agreements that affect the fundamental rights of European Union citizens;

(b)

notes that despite its repeated requests, Parliament has at no point been informed or consulted on the adoption of the mandate, conduct of the negotiations or the conclusion of the Agreement; and accordingly considers that the procedure followed by the Council does not comply with the principles of loyal cooperation;

(c)

notes that national parliamentary approval is required in only ten out of the 27 EU Member States, without there being any possibility of proposing any modifications; considers this procedure to be totally inadequate; and notes that future modifications of the terms of the Agreement will be made without national parliamentary approval;

(d)

remains in doubt as to the legal basis chosen by the Council for an international agreement which is focused purely on the internal security needs of a third State and which has no added value as far as the security of the EU, of its Member States or of EU citizens is concerned; therefore reserves its right to intervene before the Court of Justice of the European Communities in the event of the legitimacy of the Agreement being called into question by a third party;

(e)

calls on the Council and the Commission to fully involve Parliament and national parliaments in the adoption of a mandate for negotiations and the conclusion of any future agreements on the transfer of personal data, particularly the current talks with South Korea on the transfer of PNR data;

(f)

notes that throughout the text of the Agreement a wide range of purposes is mentioned, and different terms are used side by side:

(g)

considers therefore that the purpose limitation is totally inadequate, making it impossible to establish whether the measures are justified and proportional; and that as a result, the Agreement may not conform to EU and international data protection standards, or comply with Article 8 of the ECHR, which requires a precise purpose limitation; considers that this might leave the Agreement open to legal challenge;

(h)

welcomes the fact that the Australian Privacy Act will apply unabridged to EU citizens, but is concerned about any exceptions and exemptions that may leave EU citizens with incomplete legal protection; believes that the Agreement should be fully compliant not only with Australian data protection laws, but also and primarily with EU laws; insists that mere compliance with the Agreement cannot replace a formal adequacy finding, and that it is not sufficient that European Union and Australian data protection laws, policies and principles share a common base;

(i)

welcomes the decision to disclose data in bulk only when anonymised;

(j)

notes, with regard to the rights of the data subjects, that the Agreement provides that Australia shall provide a system, accessible by individuals regardless of their nationality or country of residence, for individuals to exercise their rights; with a view to informing passengers, the willingness of the Australian Customs Service to inform the public regarding the processing of PNR data should be welcome;

(k)

remarks that, unlike the Agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS) (2007 PNR Agreement) (6), in the event of a dispute arising between the parties to the Australian Agreement there is provision for a conflict resolution mechanism, and the EU data protection authorities may exercise their existing powers to suspend data flows to protect individuals with regard to the processing of their personal data where there is a substantial likelihood that the provisions of the Agreement are being infringed;

(l)

welcomes the participation of the data protection authorities in the joint review, but regrets that no firm deadline has been set for such a review; calls on the Commission and the Council to request a review before June 2010, and to present the findings of that review to Parliament;

(m)

welcomes, in relation to onward transfers, the fact that there are limited possibilities for onward transfers, in particular since onward transfers take place only on a case-by-case basis and the Australian Customs Service maintains a log of all disclosures;

(n)

notes that according to Article 2(2) no data will be stored, but that a retention period of 5,5 years is mentioned in the Annex, point 12; though shorter than in the agreements with the US, Parliament considers that the proportionality of a retention period of 5,5 years cannot be established, as the purposes for which passenger data are being stored are insufficiently specified;

(o)

remarks, with regard to sensitive data, that the Australian Customs Service have specifically stated they do not want or need sensitive data, which begs the question of why other jurisdictions such as Canada and US need them and gives greater assurance that the Australian Customs Service will actually filter out and delete any sensitive data which they may receive; however, the fact that the responsibility of the data controller for filtering sensitive EU-sourced data is given to the recipient of the data, i.e. the Australian Customs Service, is consistent with accepted data protection standards, such as those of Convention 108 of 28 January 1981 of the Council of Europe (7) and Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and the free movement of such data (8);

(p)

insists that an exchange of diplomatic notes is an unacceptable method for amending the list of departments and agencies that may have access to PNR data;

(q)

deplores the fact that, taking into account the categories of data transferred to the Australian Customs Service, the data requested are the same categories of data as in the above mentioned 2007 US Agreement (the 34 data fields were grouped in 19 categories of data, giving the impression that the amount of transferable data had been markedly reduced, which was actually not the case); such a wide collection of data is not justified and must be considered disproportionate;