PURPOSE : to conclude an agreement with Canada for the processing and transfer of Advanced Passenger Information (API) and Passenger Name Record (PNR) data for journeys by air carriers between the EU and Canada.
PROPOSED ACT : Council Decision.
CONTENT : the background to this proposal is as follows: after September 11 2001, Canada adopted legislation authorising the Canada Border Services Agency to obtain API and PNR data relating to all persons on board flights bound for Canada. CBSA phased in the requirement to provide PNR data relating to persons on board flights bound for Canada between March 2003 and September 2004, and from February 2005 introduced a system of monetary penalties for non-compliance. The EU has a temporary derogation from this requirement until 1 July 2005, in order to allow negotiations on an international agreement with Canada to take place. The Canadian measures potentially conflicted with Community and Member States' legislation on privacy and data protection, and in particular with Directive 95/46/EC. From July 2005, airlines will potentially face sanctions for non-compliance on both sides, without being able to solve the legal problems at stake. A solution is thus urgently required which will avoid legal uncertainty for airlines while ensuring the protection of citizens' personal privacy as well as their physical security.
The Commission has proposed a legal framework based on three elements:
- the Commitments made by CBSA with respect to the additional protection to be afforded to API/PNR data;
- a Commission Decision finding protection adequate under Article 25 paragraph 6 of the Data Protection Directive (95/46/EC), and
- a bilateral agreement between the European Community and Canada.
The proposed agreement provides a legitimate basis for the transfer of data to Canada in accordance with the requirements of Article 7 of Directive 95/46/EC, that is, the creation of a legal obligation within the Community to obey requirements under Canadian law. The application of this legal obligation is subject to the Commission Decision on adequacy being in force, in such a way as to ensure that any persistent non-compliance by Canada with its Commitments would lead to suspension of the Decision and automatically to suspension of the agreement.
The proposed agreement also enshrines the general principles of non-discrimination and reciprocity, and provides for annual joint review of its implementation.
The agreement does not create additional financial burdens for the Community or national governments. The administrative requirement to hold an annual Joint Review of the implementation of the agreement is proportional to its aim of providing for the processing and transfer of API/PNR data consistent with data privacy and security requirements, and will be fulfilled using existing staff resources.