The Convention on International Civil Aviation (the ‘Chicago Convention’), which aims to regulate international air transport, entered into force on 4 April 1947. It established the International Civil Aviation Organization (ICAO).
(2)
The Member States of the Union are contracting States to the Chicago Convention and members of ICAO, whereas the Union has observer status in certain ICAO bodies.
(3)
Pursuant to Article 54 of the Chicago Convention, the ICAO Council is to adopt international standards and recommended practices (‘SARP’s).
(4)
On 21 December 2017, the United Nations Security Council (UNSC) decided in its Resolution 2396 (2017) that the UN Member States are to develop the capability to collect, process and analyse, in furtherance of the ICAO SARPs, passenger name record (PNR) data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms for the purpose of preventing, detecting and investigating terrorist offences and related travel.
(5)
UNSC Resolution 2396 (2017) also urged ICAO to work with the contracting States to establish a standard for the collection, use, processing and protection of PNR data.
(6)
The SARPs on PNR are set out in Section D of Chapter 9 of Annex 9 to the Chicago Convention. Those SARPs are complemented by additional guidance, in particular ICAO Document 9944 setting out guidelines on PNR data.
(7)
On 23 June 2020, the ICAO Council adopted Amendment 28 to Section D of Chapter 9 of Annex 9 to the Chicago Convention, setting out a new set of SARPs for the contracting States to develop their capabilities to collect, use, process and protect PNR data for flights to and from their territory (‘Amendment 28’), supported by an appropriate legal and administrative framework.
(8)
In accordance with Article 90 of the Chicago Convention, unless a majority of its contracting States register their disapproval, Amendment 28 becomes effective three months after the deadline for registering such disapproval.
(9)
In accordance with Article 38 of the Chicago Convention, any contracting State which finds it impracticable to comply in all respects with such international standards or procedures, or to bring its own regulations or practices into full accord with any international standard or procedure after amendment of the latter, or which deems it necessary to adopt regulations or practices differing in any particular respect from those established by an international standard, needs to give immediate notification to ICAO of the differences between its own practice and that established by the international standard. The notification of such differences has an impact on the legal effects of the standards adopted by ICAO. The Union’s position in the matter is therefore to be established in accordance with Article 218(9) of the Treaty on the Functioning of the European Union.
(10)
Amendment 28 was notified to the contracting States by way of State Letter EC 6/3-20/71. According to that State Letter, any differences from, or confirmation of compliance with, Amendment 28 are to be notified by 30 January 2021.
(11)
The Union adopted common rules on PNR data in Directive (EU) 2016/681 of the European Parliament and of the Council (1), the scope of which overlaps significantly with that of the SARPs, as revised by Amendment 28. Directive (EU) 2016/681 includes, in particular, a comprehensive set of rules to safeguard the fundamental rights to privacy and the protection of personal data in the context of a transfer of PNR data by air carriers to Member States and of the processing of such data for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime.
(12)
The Union has also adopted legislative acts on the protection of personal data, namely Regulation (EU) 2016/679 of the European Parliament and of the Council (2) and Directive (EU) 2016/680 of the European Parliament and of the Council (3), applicable to the processing of PNR data by air carriers and other private operators and by authorities competent for the prevention, investigation, detection or prosecution of criminal offences and the execution of criminal penalties, including for the purposes of safeguarding against and preventing threats to public security.
(13)
In addition, two international agreements on the processing and transfer of PNR data are currently in force between the Union and third countries, namely Australia (4) and the United States (5). On 26 July 2017, the Court of Justice of the European Union gave Opinion 1/15 on the envisaged agreement between Canada and the European Union on the transfer and processing of PNR data, signed on 25 June 2014 (6) (‘Opinion 1/15’).
(14)
The PNR-related aspects of Section D of Chapter 9 of Annex 9 to the Chicago Convention, as revised by Amendment 28, relate to an area for which the Union has exclusive competence pursuant to Article 3(2) of the Treaty on the Functioning of the European Union, as Amendment 28 may affect common rules on protection and processing of PNR data.
(15)
Accordingly, the Union position on this matter, for the purposes of the preparation of Amendment 28, was taken in accordance with Council Decision (EU) 2019/2107 (7). That position reflects the requirements of Union law in respect of the protection of personal data and transfers of PNR data to third countries, as established in Regulation (EU) 2016/679 and Directives (EU) 2016/680 and (EU) 2016/681, as well as the requirements resulting from the Charter of Fundamental Rights of the European Union as interpreted by the Court of Justice of the European Union, in particular in Opinion 1/15.
(16)
The SARPs, as revised by Amendment 28, largely follow the lines of the Union position established in Decision (EU) 2019/2107 and lay down ambitious safeguards on data protection, in particular on data subject rights, oversight by an independent authority, sensitive data, automated processing of PNR data and non-discrimination, purposes for which PNR data may be processed, and the retention, use, disclosure and further transfer of PNR data.
(17)
Therefore, given that Amendment 28 would allow significant progress to be made at international level in relation to the standards for protection of PNR data, no disapproval was notified by Member States of the Union under Article 90 of the Chicago Convention.
(18)
However, the requirements resulting from Union law in respect of the transfer and processing of PNR data are more exacting than the SARPs, as revised by Amendment 28.
(19)
Standard 9.34(a), as set out in Amendment 28, requires contracting States not to inhibit or prevent the transfer of PNR data to another contracting State that complies with the SARPs. Under Standard 9.34(b), as set out in Amendment 28, contracting States retain the ability to maintain or introduce higher levels of protection in accordance with their domestic legal and administrative framework, and to enter into additional arrangements with other contracting States in order to establish more detailed provisions relating to the transfer of PNR data. However, the current language of Standard 9.34 is, from the perspective of the Union and the Member States, not sufficiently clear in legal terms to ensure that the Member States are not precluded from imposing those more exacting requirements.
(20)
In those circumstances, in order to ensure compliance with Union law and with the SARPs, Member States should, in reply to State Letter EC 6/3-20/71, formally notify a difference within the meaning of Article 38 of the Chicago Convention. Such difference should be limited to Standard 9.34 in Section D of Chapter 9 of Annex 9 to the Chicago Convention, as revised by Amendment 28.
(21)
It is therefore appropriate to establish the position to be taken on the Union’s behalf.
(22)
The Union’s position should be expressed by the Member States.
(23)
Ireland is bound by Directive (EU) 2016/681 and is therefore taking part in the adoption of this Decision.
(24)
In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application,
