PNR data: EDPS first reaction to the ECJ jugdment

The European Data Protection Supervisor (EDPS) gives his initial reactions to today's judgment of the Court of Justice in the two PNR-cases concerning the transfer of flight passenger's personal data to the US. The EDPS has used, for the first time in these cases, his powers to intervene before the Court in support of the Parliament.

The Court has now decided to annul the decisions of the Council and the Commission on which the access of US authorities to PNR-data of European airlines was based, without entering into the substance of these decisions. Ruling that the wrong legal basis was chosen since the processing operations concern public security and activities of criminal law, the Court states that it is not decisive that the data had originally been collected for commercial purposes (the air transport of the passengers).

Peter Hustinx, EDPS, says: "The judgment seems to have created a loophole in the protection of European citizens whereby their data are used for law enforcement purposes. This makes it all the more important that a comprehensive and consistent legal instrument ensuring the protection of personal data outside of the first pillar is adopted without delay".

The judgment is very important from the perspective of data protection and a careful analysis of its consequences is needed. The initial reaction of the EDPS is that:
• it addresses the scope of the data protection directive (95/46), notably so when it comes to interaction with law enforcement.
• It seems to create a loophole in the protection of the European citizen since it is no longer assured that data collected for commercial purposes but used by police are protected by the data protection directive.

The judgment will take effect after a transition period that expires by 30 September. The EDPS insists that all actors make use of this time to come to a balanced solution. For his part, the EDPS will be available as an advisor to the EU institutions in the proposals for replacing instruments, and he will also work actively with the national data protection authorities of the EU Member States.

http://www.edps.eu.int/Press/EDPS-2006-8-EN_PNR.pdf