Explanatory Memorandum to COM(2019)420 - Authorisation for negotiations with Japan on the transfer and use of Passenger Name Record (PNR) data to prevent and combat terrorism and other serious transnational crime - Main contents
Please note
This page contains a limited version of this dossier in the EU Monitor.
| dossier | COM(2019)420 - Authorisation for negotiations with Japan on the transfer and use of Passenger Name Record (PNR) data to prevent and combat ... |
|---|---|
| source | COM(2019)420  |
| date | 27-09-2019 |
1. PURPOSE
The EU should open negotiations with Japan with the purpose of signing a bilateral Agreement laying down the framework and conditions under which air carriers will be authorised to transfer to Japan the Passenger Name Record (PNR) data of passengers flying between the EU and Japan in a manner that is compliant with the requirements of EU law.
2. CONTEXT OF THE PROPOSAL
PNR is a record of each passenger's travel requirements, which contains all information necessary to enable reservations to be processed by air carriers. As far as the present Recommendation is concerned, PNR data covers data collected and contained in the air carrier's automated reservation and departure control systems.
Within the EU, processing of PNR data constitutes an essential instrument in the common response to terrorism and serious crime and a building block of the Security Union. Identifying and tracing suspicious travel patterns by processing PNR to gather evidence and, where relevant, find perpetrators of serious crime and their associates and unravel criminal networks is proving essential to prevent, detect, investigate and prosecute terrorist and serious crime offences.
On 27 April 2016, the European Parliament and the Council adopted Directive (EU) 2016/681 on the use of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘PNR Directive’) 1 . This Directive enables EU national authorities to gain direct access to crucial information held by airlines, in full regard of data protection rights. It provides all Member States with an important tool for preventing, detecting and investigating terrorism and serious crimes, including drugs and human trafficking and child sexual exploitation. The deadline for the Member States to transpose the PNR Directive into national law was 25 May 2018 2 .
At a global level, the United Nations Security Council Resolution 2396 adopted on 21 December 2017 requires UN Member States to “develop the capability to collect, process and analyse, in furtherance of ICAO standards and recommended practices, passenger name record (PNR) data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms”. The Resolution also urges ICAO ‘to work with its Member States to establish a standard for the collection, use, processing and protection of PNR data’ 3 . In March 2019, the ICAO Air Transport Committee (ATC) set up a Facilitation Panel Task Force to consider proposals for Standards and Recommended Practices (SARPs) on the collection, use, processing and protection of PNR data in line with United Nations Security Council resolution 2396 (2017). The Task Force is mandated to: a) review the existing PNR SARPs found in Chapter 9 of Annex 9 to the Chicago Convention; b) determine whether they need to be complemented by additional SARPs and/or guidance material, taking into account the Security Council’s decision and considerations; and c) as required, develop new provisions (Standards, Recommended Practices, and/or guidance materials) for the collection, use, processing and protection of PNR data.
The transfer of relevant personal data from the EU to a third country may take place only in compliance with the provisions on international transfers laid down in Chapter V of Regulation (EU) 2016/679 (‘the GDPR’) 4 .
There are currently two international agreements in force between the EU and third countries (namely Australia 5 and the United States 6 ) on the processing and transfer of PNR data. On 26 July 2017, the Court of Justice of the EU adopted an Opinion on the envisaged Agreement between the EU and Canada signed on 25 June 2014 7 . The Court decided that the agreement could not be concluded in its intended form because some of its provisions were incompatible with the fundamental rights to privacy and to personal data protection recognised by the EU. In particular, the Court laid down further legal requirements with regard to oversight by an independent authority, sensitive data, automated processing of PNR data, purposes for which PNR data may be processed, and the retention, use, disclosure and further transfer of PNR data. Further to the authorization received by the European Commission from the Council in December 2017, new PNR negotiations with Canada were launched in June 2018. At the 17th EU-Canada Summit in Montreal on 17-18 July 2019, the EU and Canada welcomed that they had concluded these negotiations. While Canada noted its requirement for legal review, the parties committed, subject to that review, to finalise the Agreement as soon as possible, acknowledging the vital role of this Agreement in enhancing security while ensuring privacy and the protection of personal data.
3. OBJECTIVES OF THE PROPOSAL
Japan is a close and strategic partner of the European Union in the fight against terrorism and other serious transnational crime. At the United Nations, the G20, the G7 and other multilateral fora, the European Union and Japan work closely together to improve the global security frameworks and to enhance the security of their citizens.
The EU-Japan Strategic Partnership Agreement signed in July 2018 strengthens the overall partnership and states that ‘Parties shall endeavour to use, to the extent consistent with their respective laws and regulations, available tools, such as passenger name records, to prevent and combat acts of terrorism and serious crimes, while respecting the right to privacy and the protection of personal data’. An EU-Japan PNR agreement would contribute to strengthening the proposed Partnership on Sustainable Connectivity and Quality Infrastructure between the European Union and Japan, notably by enhancing the security of air transport.
On 23 January 2019, the European Commission adopted an adequacy decision in relation to the transfer of personal data from the EU to Japan between commercial operators. 8 In this context, the European Commission also assessed the conditions and safeguards under which Japanese public authorities, including law enforcement, can access data held by those operators.
Japan has been clear in expressing its interest to the European Commission to enter into negotiations with the aim of concluding a PNR Agreement with the European Union. In particular, more recently, Japan indicated a pressing need to acquire PNR data from EU carriers in view of the 2020 Olympics in their country in order to address an anticipated increase of security risks.
According to the legislation of Japan (Customs Act and Immigration Control and Refugee Recognition Act), airlines are required to transmit Passenger Name Record (PNR) data to the Japan Customs and Tariff Bureau and Immigration Bureau. This legislation aims at enhancing the security of Japan by obtaining PNR data prior to a passenger’s arrival or departure and therefore significantly enhances the ability to conduct efficient and effective advance travel risk assessment of passengers.
Air carriers and their associations have also on several occasions requested the European Commission to ensure legal certainty for air carriers operating flights between the EU and Japan, considering their obligation to provide Japan with PNR data to the extent it is collected and contained in their automated reservation and departure control systems.
A solution is required that will provide a legal basis at EU level for the transfer of PNR data from the EU to Japan as a recognition of the necessity of PNR data in the fight against terrorism and other forms of serious transnational crime. At the same time, a future agreement should provide appropriate data protection safeguards within the meaning of Article 46(2)(a) of the General Data Protection Regulation, including a system of independent oversight. A future agreement should respect fundamental rights and observe the principles recognised by the Charter of Fundamental Rights of the Union, in particular the right to private and family life recognised in Article 7 of the Charter, the right to the protection of personal data recognised in Article 8 of the Charter and the right to effective remedy and fair trial recognised in Article 47 of the Charter.
The transfer of PNR data to Japan would be a means to further foster international law enforcement cooperation with the European Union, including through the provision by Japan of analytical information stemming from PNR data to the competent Member States authorities as well as Europol and/or to Eurojust within their respective mandates.
4. LEGAL ASPECTS OF THE PROPOSAL
This recommendation to open negotiations with Japan on a PNR Agreement takes into consideration the applicable EU legal framework on data protection and PNR, namely Regulation (EU) 2016/679, Directive (EU) 2016/680 9 and Directive (EU) 2016/681, as well as the Treaty and Charter of Fundamental Rights as interpreted in the relevant case law of the Court of Justice of the EU, in particular Opinion 1/15 of the Court.
The recommendation also takes into account the authorization received by the European Commission from the Council in December 2017 for the opening of negotiations of an Agreement between the EU and Canada for the transfers and use of PNR data.
This recommendation is in line with the legal requirements laid down in the Court’s Opinion 1/15. It is based on Article 218 of the Treaty of the Functioning of the EU. In line with Article 218 of the Treaty on the Functioning of the EU, the European Commission shall be nominated as the Union negotiator.
COUNCIL DECISION
to authorise the opening of negotiations for an Agreement between the European Union and Japan for the transfer and use of Passenger Name Record (PNR) data to prevent and combat terrorism and other serious transnational crime
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 218(3) and i thereof,
Having regard to the recommendation from the European Commission,
Whereas:
Negotiations should be opened with a view to concluding an Agreement between the Union and Japan for the transfer and use of Passenger Name Record (PNR) data to prevent and combat terrorism and other serious transnational crime.
The Agreement should respect fundamental rights and observe the principles recognised by the Charter of Fundamental Rights of the Union, in particular the right to private and family life recognised in Article 7 of the Charter, the right to the protection of personal data recognised in Article 8 of the Charter and the right to effective remedy and fair trial recognised in Article 47 of the Charter. The Agreement should be applied in accordance with those rights and principles.
HAS ADOPTED THIS DECISION:
The European Commission is hereby authorised to negotiate, on behalf of the Union, an Agreement between the Union and Japan on the transfer and use of Passenger Name Record (PNR) data to prevent and combat terrorism and other serious transnational crime.
The negotiating directives are set out in the Annex.
The negotiations shall be conducted in consultation with a special committee to be appointed by the Council.
This Decision is addressed to the European Commission.
Done at Brussels,
The President
(1) Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, OJ L 119, 4.5.2016, p. 132–149.
(2) See the Nineteenth Progress Report towards an effective and genuine Security Union (COM(2019) 353 final, 24.7.2019) for the state of implementation of the PNR Directive.
(3) Security Council resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters.
(4) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p.
1).
(5) OJ L 186, 14.7.2012, p. 4–16.
(6) OJ L 215, 11.8.2012, p. 5–14.
(7) Opinion 1/15 of the Court (grand chamber), 26 July 2017, ECLI:EU:C:2017:592.
(8) Commission Implementing Decision (EU) 2019/419 of 23.1.2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information (notified under document C(2019) 304) (OJ L 76, 19.3.2019, p. 1-58).
(9) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).