THE COMPLEXITY OF THE LAWS RELATING TO THE EXCHANGE OF E-CUSTOMERS’ PERSONAL DATA – PART 2
1.0 An example of the complexity in the transborder data flows is in the airlines industry. European airlines faced the dilemma of which of these options to choose because of a conflict between the US Aviation and Transportation Security Act of 2001 and the EU Directive.
2.0 The conflict left the European airlines entering the US without recourse. The EU and the US have reached an agreement over this conflict, but that does not mean the underlying issues are finally resolved.[1]
4.0 Following the terrorist attacks of 11 September 2001, the United States passed legislation in November 2001 providing that air carriers operating flights to or from the US or across US territory had to provide the US customs authorities with electronic access to the data contained in their automated reservation and departure control systems, referred to as ‘Passenger Name Records’ (PNR data) (which contains inter alia passenger’s full name, date of birth, citizenship, sex, passport number).
5.0 While acknowledging the legitimacy of the security interest at stake, the Commission informed the US authorities that those provisions could come into conflict with the EU and member state legislation on data protection.
6.0 The problem in Europe is that the EU Directive provides that personal data may only be transferred to third countries if the specific country ensures an adequate level of protection.
7.0 The Commission decides which countries have adequate laws, but, only a few countries, not including the US, have met the criteria.
8.0 Nevertheless, on 14 May 2004, the European Commission adopted the Commission Decision (EC) 2004/535 (on adequate of personal data contained in the PNR of air passengers transferred to the US Bureau of Customs and Border Protection) holding that the US Bureau of Customs and Border Protection offered a sufficient level of protection for personal data transferred from the EU.
9.0 The European Parliament sought the annulment of the Agreement on the basis, inter alia, that the adoption of the decision on adequacy was ultra vires.
10.0 The European Court of Justice held that the EU Directive could not justify Community competence to conclude the Agreement.
11.0 The ECJ found that because the transfer of data was related to national security, public safety or criminal purposes, the Directive did not apply.
12.0 The transfer fell outside the scope of the Directive. Consequently, the Agreement could not have been validly adopted on the basis of the EU Directive.
13.0 The judgment has stripped EU citizens of data protection when it comes to criminal and security matters.
14.0 The ruling had seemed a victory for data protection activists, but the principal legal basis of the decision creates a ‘loophole’ whereby their data are now used for law enforcement purposes.[3]
15.0 Following the decision, the European Commission announced that it will start a new deal with a different legal structure but the same essential content as the Court had not critised the content of the agreement.
[1] Megan Roos, "Safe on the Ground, Exposed in the Sky: The Battle Between the United States and the European Union Over Passenger Name Information" (2005) 14 Transnational Law & Contemporary Problems 1137,online,accessed on June 28th 2006,available at http://web-lexis-nexis.com/universe/document.
[2] European Parliament v European Council [2006] All ER (D) 05 (Jun),online,accessed on June 28th 2006,available at http://web.lexis-nexis.com/universe/document.
[3] OUT-LAW, "Passenger Data Judgment Attacked By Privacy Chief" (2006) OUT-LAW News,online,accessed on June 26th 2006,available at http://www.out-law.com/page-6960.
[4] Europa, "Transfer of Passenger Name Records: The Commission Adopts Two Initiatives to Comply With The Rulling of the European Court of Justice on the Transfer of PNR to the United States of America"(2006),online, accessed on June 26th 2006,available at http://europa.eu.int/rapid/pressReleasesAction.do.
Comments
Post a Comment