This document is an excerpt from the EUR-Lex website
Document 52019XX1212(01)
Summary of the Opinion of the European Data Protection Supervisor on the negotiating mandate of an Agreement between the EU and Japan for the transfer and use of Passenger Name Record data (The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)2019/C 419/04
Summary of the Opinion of the European Data Protection Supervisor on the negotiating mandate of an Agreement between the EU and Japan for the transfer and use of Passenger Name Record data (The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)2019/C 419/04
Summary of the Opinion of the European Data Protection Supervisor on the negotiating mandate of an Agreement between the EU and Japan for the transfer and use of Passenger Name Record data (The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)2019/C 419/04
OJ C 419, 12.12.2019, p. 8–10
(BG, ES, CS, DA, DE, ET, EL, EN, FR, HR, IT, LV, LT, HU, MT, NL, PL, RO, SK, SL, FI, SV)
OJ C 419, 12.12.2019, p. 8–11
(PT)
|
12.12.2019 |
EN |
Official Journal of the European Union |
C 419/8 |
Summary of the Opinion of the European Data Protection Supervisor on the negotiating mandate of an Agreement between the EU and Japan for the transfer and use of Passenger Name Record data
(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)
(2019/C 419/04)
On 27 September 2019, the European Commission adopted a Recommendation for a Council Decision to authorise the opening of negotiations for an agreement between the European Union and Japan for the transfer and use of Passenger Name Record (PNR) data to prevent and combat terrorism and other serious transnational crime. The purpose of the envisaged Agreement is to lay down the legal basis and the conditions under which air carriers will be authorised to transfer to Japan the PNR data of passengers flying between the EU and Japan, in compliance with the requirements of the EU law, including the Charter of Fundamental Rights of the EU.
The EDPS welcomes the fact that the negotiation mandate aims at ensuring full respect for fundamental rights and freedoms enshrined in Article 7 and Article 8 of the Charter of Fundamental Rights of the EU, as well as for the principles of necessity and proportionality, as interpreted by the Court of Justice in its Opinion 1/15 on the EU-Canada PNR Agreement.
Given the impact of the envisaged agreement on the fundamental rights of a very large number of individuals not implicated in a criminal activity, the EDPS considers that it should contain all the necessary substantive and procedural safeguards to guarantee the proportionality of the PNR system and to limit the interference with the right to privacy and data protection only to what is strictly necessary and justified by the general interest of the Union. To this end, the EDPS makes a number of recommendations to improve the negotiating directives, such as:
|
— |
a strict approach with regard to the necessity and proportionality of the PNR system; |
|
— |
in line with the principle of purpose limitation, any further use of the transferred PNR data for other purposes should be very well justified, specified in a clear and precise manner and limited to what is strictly necessary; |
|
— |
the Council Decision authorising opening of negotiations should contain a reference not only to the procedural legal basis but also to the substantive legal basis, including Article 16 TFEU; |
|
— |
special attention should be paid to prevent the risk of indirectly revealing special categories of data about air passengers, as well as the risk of re-identification of individuals after the anonymisation of the PNR data relating to them; |
|
— |
the envisaged Agreement should contain clauses allowing for its suspension in case of breaches of its rules, as well as for termination of the Agreement if the non-compliance is serious and persistent. |
Further detailed recommendations by the EDPS are provided in this Opinion.
The EDPS remains at the disposal of the institutions for further advice during the negotiations. He also expects to be consulted at later stages of the finalisation of the draft Agreement in accordance with Article 42 of Regulation (EU) 2018/1725 of the European Parliament and of the Council (1).
I. INTRODUCTION AND BACKGROUND
|
1. |
On 27 September 2019, the European Commission adopted a Recommendation for a Council Decision to authorise the opening of negotiations for an agreement between the European Union (EU) and Japan for the transfer and use of Passenger Name Record (PNR) data to prevent and combat terrorism and other serious transnational crime. The Annex to the Recommendation (hereinafter ‘the Annex’) lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of the negotiations. |
|
2. |
The Recommendation has been adopted on the basis of the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU) for agreements concluded between the EU and third countries. With this Recommendation, the Commission seeks to obtain authorisation from the Council to be appointed as the negotiator on behalf of the EU and to start the negotiations with Japan, in line with the negotiating mandate. Once the negotiations are completed, in order for the agreement to be concluded, the European Parliament will have to give its consent to the text of the agreement negotiated, after which the Council will have to adopt a decision concluding the agreement. |
|
3. |
The legal framework for processing PNR data in the EU is Directive (EU) 2016/681 of the European Parliament and of the Council on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (PNR Directive), adopted on 27 April 2016. Member States were obliged to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by 25 May 2018. The European Commission has to conduct the first review of the PNR Directive by 25 May 2020. |
|
4. |
Currently, there are two international agreements in force between the EU and third countries on the processing and transfer of PNR data — with Australia (2) and with the United States (3), both from 2011. At the request of the European Parliament, pursuant to Article 218(11) TFEU, the Court of Justice of the EU (CJEU) adopted Opinion 1/15 of 26 July 2017 (4) on the envisaged Agreement between the EU and Canada on the transfer and processing of PNR data, signed on 25 June 2014. The Court concluded that the Agreement is incompatible with Articles 7, 8 and 21 and Article 52(1) of the Charter of Fundamental Rights of the EU (Charter) in so far as it does not preclude the transfer of sensitive data from the EU to Canada and the use and retention of that data. Furthermore, the Court laid down a number of conditions and safeguards for lawful processing and transfer of PNR data. Based on Opinion 1/15, new PNR negotiations with Canada have been launched in June 2018, which, according to the Commission, are in their final stage. |
|
5. |
At global level, the issue of PNR data is dealt with by the Convention on International Civil Aviation (the ‘Chicago Convention’) of 1947, which regulates international air transport and has established the International Civil Aviation Organization (ICAO). The Council of ICAO has adopted Standards and Recommended Practices on PNR, which are part of Annex 9 (‘Facilitation’) to the Chicago Convention. They are complemented by additional guidance, notably ICAO Document 9944 setting out ‘Guidelines on Passenger Name Record (PNR) Data’ (5). All EU Member States are Parties to the Chicago Convention. |
|
6. |
Furthermore, the United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, requires UN Member States to ‘develop the capability to collect, process and analyse, in furtherance of ICAO standards and recommended practices, passenger name record (PNR) data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms’, as well as ‘where appropriate, encourages Member States to share PNR data with relevant or concerned Member States to detect foreign terrorist fighters’ (6). |
|
7. |
The EDPS welcomes the fact that he has been consulted following the adoption of the Recommendation by the European Commission and expects that a reference to this Opinion will be included in the preamble of the Council Decision. The present Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information at a later stage. |
V. CONCLUSIONS
|
34. |
The EDPS welcomes the fact that the negotiation mandate aims at ensuring full respect for fundamental rights and freedoms enshrined in Article 7 and Article 8 of the Charter, as well as for the principles of necessity and proportionality, as interpreted by the CJEU in its Opinion 1/15 on the EU-Canada PNR Agreement. |
|
35. |
Given the impact of the envisaged Agreement on the fundamental rights of a very large number of individuals not implicated in a criminal activity, the EDPS considers that the future Agreement should contains all the necessary substantive and procedural safeguards, which, considered in their entirety, would guarantee the proportionality of the PNR system and to limit the interference with the right to privacy and data protection only to what is strictly necessary and justified by the general interest of the EU. |
|
36. |
To this end, as main recommendation, the EDPS stresses the need of a strict approach with regard to the necessity and proportionality of the PNR system. Furthermore, special attention should be given to the practical implementation of the principle of purpose limitation concerning the use of the transferred PNR data. In addition, the EDPS repeats its position from its previous opinions (7) that the Council Decision authorising opening of negotiations pursuant to Article 218 TFEU should contain a reference not only to the procedural legal basis but also to the relevant substantive legal basis, which should include Article 16 TFEU. |
|
37. |
The additional recommendations of the EDPS in the present Opinion relate to the appropriate legal framework for transfer of operational personal data; the need to prevent the risk of indirectly revealing special categories of data about air passengers, as well as the risk of re-identification of individuals after the anonymisation of PNR data relating to them. The EDPS underlines also the need to clarify the independent supervision of PNR data processing by the competent Japanese authorities, which is one of the essential guarantees for the right to data protection. In addition, the EDPS recommends the introduction of clauses allowing for the suspension of the future Agreement in case of breaches of its provisions, as well as for termination of the Agreement if the non-compliance is serious and persistent. |
|
38. |
The EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. To this end, the EDPS expects to be consulted later on the provisions of the draft Agreement before its finalisation. |
Brussels, 25 October 2019.
Wojciech Rafał WIEWIÓROWSKI
European Data Protection Supervisor
(1) OJ L 295, 21.11.2018, p. 39.
(2) OJ L 186, 14.7.2012, p. 4.
(3) OJ L 215, 11.8.2012, p. 5.
(4) Opinion 1/15 of the Court of Justice of 26 July 2017 pursuant to Article 218(11) TFEU on draft Agreement between Canada and the EU on the transfer and processing of PNR data, ECLI:EU:C:2017:592.
(5) ICAO, Doc 9944 Guidelines on Passenger Name Record (PNR) Data, First Edition — 2010.
(6) Security Council resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted by the Security Council at its 8148th meeting, on 21 December 2017, point 12.
(7) See EDPS Opinion 2/2019 on the negotiating mandate of an EU-US agreement on cross-border access to electronic evidence and EDPS Opinion 3/2019 regarding the participation in the negotiations in view of a Second Additional Protocol to the Budapest Cybercrime Convention, available at: https://edps.europa.eu/sites/edp/files/publication/19-04-02_edps_opinion_on_eu_us_agreement_on_e-evidence_en.pdf and
https://edps.europa.eu/sites/edp/files/publication/19-04-02_edps_opinion_budapest_convention_en.pdf.