Explanatory Memorandum to COM(2019)416 - EU position in ICAO Council, in respect of the revision of Chapter 9 to Convention on International Civil Aviation with regard to standards & recommended practices on PNR-data - Main contents
Please note
This page contains a limited version of this dossier in the EU Monitor.
| dossier | COM(2019)416 - EU position in ICAO Council, in respect of the revision of Chapter 9 to Convention on International Civil Aviation with ... |
|---|---|
| source | COM(2019)416  |
| date | 13-09-2019 |
1. Subject matter of the proposal
This proposal concerns the decision establishing the position to be taken on behalf of the European Union in the International Civil Aviation Organization (ICAO) bodies in connection with envisaged adoption of amendments to Chapter 9 of Annex 9 (‘Facilitation’) of the Convention on International Civil Aviation (the ‘Chicago Convention’) to set out new ICAO standards on Passenger Name Record (PNR) data.
2. Context of the proposal
2.1.The Convention on International Civil Aviation (the ‘Chicago convention’)
The Chicago Convention aims to regulate international air transport. It entered into force on 4 April 1947 and established the International Civil Aviation Organization (ICAO).
All EU Member States are Parties to the Chicago Convention.
2.2.The International Civil Aviation Organization
ICAO is a specialised agency of the United Nations. The objectives of the Organization are to develop the principles and techniques of international air navigation and to foster the planning and development of international air transport.
The ICAO Council is a permanent body of ICAO with a membership of 36 contracting States elected by the ICAO Assembly for a period of three years. For the period of 2016-2019, there are seven EU Member States represented in the ICAO Council.
Mandatory functions of the ICAO Council, listed in Article 54 of the Chicago Convention, include the adoption of international Standards and Recommended Practices (also known as SARPs), designated as Annexes to the Chicago Convention.
The ICAO Council also convenes the Assembly, which is ICAO’s sovereign body. The ICAO Assembly meets at least once every three years and establishes the Organisation’s political direction for the upcoming triennium. The 40th Session of the ICAO Assembly will take place on 24 September-4 October in Montreal, Canada.
2.3. The envisaged act of ICAO
In accordance with Article 54 point (1) of the Chicago Convention, the Council of ICAO shall adopt Standards and Recommended Practices (SARPs). SARPs on PNR are found in Parts A and D of Chapter 9, Annex 9 (‘Facilitation’), to the Chicago Convention. They are complemented by additional guidance, notably ICAO Document 9944 setting out ‘Guidelines on Passenger Name Record (PNR) Data’ 1 . PNR data are personal data of passengers collected by airlines for their business purposes, unlike other travel-related data collected on behalf of Governments such as Advance Passenger Information.
The United Nations Security Council Resolution 2396 adopted on 21 December requires UN member States to “develop the capability to collect, process and analyse, in furtherance of ICAO standards and recommended practices, passenger name record (PNR) data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms”. The Resolution also urges ICAO ‘to work with its Member States to establish a standard for the collection, use, processing and protection of PNR data’ 2 .
In this context, on 18 July 2019, the Council of the European Union endorsed an Information Paper on ‘Standards and principles on the collection, use, processing and protection of Passenger Name Record (PNR) data’ for submission at the 40th Session of the ICAO Assembly. This information paper has been submitted to the European Civil Aviation Conference (ECAC) for consultation.
In March 2019, the ICAO Air Transport Committee (ATC) set up a Facilitation Panel Task Force to consider proposals for SARPs on the collection, use, processing and protection of PNR data in line with United Nations Security Council resolution 2396 (2017). The Task Force is mandated to: a) review the existing PNR SARPs found in Chapter 9 of Annex 9 to the Chicago Convention; b) determine whether they need to be complemented by additional SARPs and/or guidance material, taking into account the Security Council’s decision and considerations; and c) as required, develop new provisions (Standards, Recommended Practices, and/or guidance materials) for the collection, use, processing and protection of PNR data.
Discussions on the revised ICAO PNR SARPs are still at an early stage. Once adopted the envisaged standards will be binding on all ICAO members, including all EU Member States, in accordance with and within the limits set out in the Chicago Convention. Article 38 of the Chicago Convention requires contracting States to notify ICAO if they intend to deviate from a standard, under the notification of differences mechanism.
2.4.EU legal framework
The processing of PNR data constitutes an essential instrument in the EU’s common response to terrorism and serious crime and a building block of the Security Union. Identifying and tracing suspicious travel patterns by processing PNR to gather evidence and, where relevant, find perpetrators of serious crime and their associates and unravel criminal networks is proving essential to prevent, detect, investigate and prosecute terrorist and serious crime offences.
On 27 April 2016, the European Parliament and the Council adopted Directive (EU) 2016/681 on the use of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime 3 . This Directive enables national authorities to gain direct access to crucial information held by airlines, in full regard of data protection rights. It provides all Member States with an important tool for preventing, detecting and investigating terrorism and serious crimes, including drugs and human trafficking and child sexual exploitation. The deadline for the Member States to transpose the PNR Directive into national law was 25 May 2018 4 .
In order to facilitate the process of connecting air carriers to the Member States’ Passenger Information Units – the units responsible for collecting and processing PNR data - the European Commission adopted, on 28 April 2017, an Implementing Decision on the common protocols and data formats to be used by air carriers when transferring PNR data to the Member States 5 . The Implementing Decision became applicable in April 2018.
There are currently two international agreements in force between the EU and third countries (namely Australia 6 and the United States 7 ) on the processing and transfer of PNR data. On 26 July 2017, the Court of Justice of the EU adopted an Opinion on the envisaged Agreement between the EU and Canada signed on 25 June 2014 8 . The Court decided that the agreement could not be concluded in its intended form because some of its provisions were incompatible with the fundamental rights to privacy and to personal data protection recognised by the EU. In particular, the Court laid down further legal requirements with regard to oversight by an independent authority, sensitive data, automated processing of PNR data, purposes for which PNR data may be processed, and the retention, use, disclosure and further transfer of PNR data. Further to the authorization received by the Commission from the Council in December 2017, new PNR negotiations with Canada were launched in June 2018. At the 17th EU-Canada Summit in Montreal on 17-18 July 2019, the EU and Canada welcomed that they had concluded these negotiations. While Canada noted its requirement for legal review, the parties committed, subject to that review, to finalise the Agreement as soon as possible, acknowledging the vital role of this Agreement in enhancing security while ensuring privacy and the protection of personal data.
An increasing number of third countries are collecting PNR data from air carriers and several of them have approached the Commission over the past few years to express their interest in concluding an international agreement on PNR with the EU. In the absence of a legal basis, air carriers are confronted with a situation of conflict of laws and risk fines and other sanctions. At the same time, further to the implementation of the PNR Directive, EU Member States are requesting air carriers from third countries to transfer PNR data to their Passenger Information Units. A number of third countries have refused such transfers – and others have threatened to do so – alleging lack of reciprocity, therefore compromising the effectiveness of the EU PNR mechanism.
According to Article 3(2) TFEU the Union has exclusive competence “for the conclusion of an international agreement ... in so far as its conclusion may affect common rules or alter their scope.” An international agreement may affect common rules or alter their scope where the area covered by the agreement overlaps with Union legislation or is covered to a large extent by Union law. Moreover, to assess whether an area is largely covered by common rules, account must be taken not only of Union law as it currently stands in the area concerned, but also of its future development, in so far as that is foreseeable at the time of that analysis.
In the light of the common rules mentioned above and the upcoming review according to Article 19 of Directive 2016/681 9 , it can be concluded that the matters covered by the propose decision fall under the Union’s exclusive competence.
3. Position to be taken on the Union’s behalf
In view of the importance of this matter for EU internal and external policy and in light of the above, it is necessary to establish a Union position on PNR data transfers for the purposes of the (multilateral) on-going works at the level of ICAO. In particular, the EU should seek that the core principles on the modalities of PNR transmission and processing and on the protection of personal data – to be laid down in the common position - are embedded in new ICAO PNR standards. In this respect, it is essential to steer the discussions on such new PNR standards within ICAO in a manner that is compatible with the EU regulatory framework and the relevant case law of the Court of Justice, in particular concerning the fundamental rights to privacy and data protection.
The Union position, relevant both to the final decision by the ICAO Council and preparatory discussions in other ICAO bodies, is defined in accordance with the applicable EU legal framework on data protection and PNR, namely Regulation (EU) 2016/679, Directive (EU) 2016/680 and Directive (EU) 2016/681, as well as the Treaty and Charter of Fundamental Rights as interpreted in the relevant case law of the Court of Justice of the European Union, in particular Opinion 1/15 of the Court.
4. Legal basis
4.1.Procedural legal basis
Contents
Article 218(9) of the Treaty on the Functioning of the European Union (TFEU) provides for decisions establishing “the positions to be adopted on the Union’s behalf in a body set up by an agreement, when that body is called upon to adopt acts having legal effects, with the exception of acts supplementing or amending the institutional framework of the agreement.”
Article 218(9) TFEU applies regardless of whether the Union is a member of the body or a party to the agreement 10 .
The concept of “acts having legal effects” includes acts that have legal effects by virtue of the rules of international law governing the body in question. It also includes instruments that do not have a binding effect under international law, but that are “capable of decisively influencing the content of the legislation adopted by the EU legislature” 11 .
The ICAO Council is a body set up by an agreement, namely the Chicago Convention.
Any amendment to Chapter 9 of Annex 9 of the Chicago Convention adopted by the ICAO Council in accordance with Article 54 point (l) of the Convention will constitute an act having legal effects. Such an amendment is capable of decisively influencing the content of EU legislation, notably Directive (EU) 2016/681 as well as the existing and future international agreements on PNR between the EU and third countries.
The envisaged act does not supplement or amend the institutional framework of the Agreement.
Therefore, the procedural legal basis for the proposed decision is Article 218(9) TFEU.
4.2.Substantive legal basis
The substantive legal basis for a decision under Article 218(9) TFEU depends primarily on the objective and content of the envisaged act in respect of which a position is taken on the Union's behalf. If the envisaged act pursues two aims or has two components and if one of those aims or components is identifiable as the main one, whereas the other is merely incidental, the decision under Article 218(9) TFEU must be founded on a single substantive legal basis, namely that required by the main or predominant aim or component.
With regard to an envisaged act that simultaneously pursues a number of objectives, or that has several components, which are inseparably linked without one being incidental to the other, the substantive legal basis of a decision under Article 218(9) TFEU will have to include, exceptionally, the various corresponding legal bases.
The envisaged act pursues objectives and has components in the areas of data protection and police cooperation. These elements of the envisaged act are inseparably linked without one being incidental to the other.
Therefore, the substantive legal basis of the proposed decision comprises the following provisions: Article 16(2) and point (a) of Article 87(2) TFEU.
4.3.Conclusion
The legal basis of the proposed decision should be Article 16(2) and point (a) of Article 87(2) TFEU, in conjunction with Article 218(9) TFEU.