22.2.2014   

EN

Official Journal of the European Union

C 51/12

1.

On 19 July 2013, the European Commission adopted the proposals for Council decisions on the conclusion and the signature of the agreement between Canada and the European Union on the transfer and processing of passenger name record data (1) (hereinafter: ‘the proposals’), which contain the text of the proposed agreement between Canada and the European Union (hereinafter: ‘the agreement’). The proposals were sent to the EDPS on 23 July 2013.

2.

The EDPS also had the opportunity to provide his advice before the adoption of the proposals. The EDPS welcomes this previous consultation. However, as it took place after the closing of the negotiations, the EDPS input could not be taken into account. The present opinion builds on the comments provided at that occasion.

3.

As stated on earlier occasions (2), the EDPS questions the necessity and proportionality of PNR schemes and of bulk transfers of PNR data to third countries. Both are conditions required by the EU Charter and the European Convention of Human Rights for any limitation to fundamental rights, including to the rights respect for private life and the protection of personal data (3). According to the jurisprudence, not only the reasons put forward by the public authority to justify any such restriction should be relevant and sufficient (4), but it should also be demonstrated that other less intrusive methods are not available (5). To date, the EDPS has not seen convincing elements showing the necessity and proportionality of the massive and routine processing of data of non-suspicious passengers for law enforcement purposes.

4.

Nevertheless, the EDPS welcomes the data protection safeguards provided in the agreement, although he regrets the fact that the retention period has been extended in comparison with the previous PNR agreement with Canada.

5.

The EDPS also welcomes the efforts undertaken by the Commission as regards oversight and redress under the constraints entailed by the nature of the agreement. However, he is concerned about the limitations of judicial review and about the fact that administrative redress can be provided in some cases by an internal authority which is not independent. He also questions the appropriateness of an executive agreement to provide adequate and effective rights to data subjects.

6.

The agreement regulates the use by the ‘Canadian competent authority’ of PNR data transferred by EU air carriers and other carriers operating flights from the EU (6). The EDPS recommends requiring confirmation that no other Canadian authority can directly access or request PNR data to those carriers, thus circumventing the agreement.

47.

As previously stated, the EDPS questions the necessity and proportionality of PNR schemes and of the bulk transfers of PNR data to third countries. He also questions the choice of the legal basis and recommends that the proposals be based on Article 16 of the TFEU, in conjunction with Article 218(5) and Article 218(6)(a) of the TFEU.

48.

The EDPS is also concerned about the limited availability of independent administrative redress and full judicial redress for EU citizens not present in Canada and questions the appropriateness of an executive agreement to achieve them. He also recommends requiring confirmation that no other Canadian authority can directly access or request PNR data to the carriers covered by the agreement.

49.

As regards the specific provisions of the agreement, the EDPS welcomes the data protection safeguards included. However, the agreement should:

50.

In addition, the EDPS recommends specifying the following, either in the agreement or in the accompanying documents: