[Documents/Docheader.htm]

European Union approval for transfer of airline passengers' personal data to the United States
Written question No 451 to the Committee of Ministers

Doc. 10376
15 December 2004

Reply from the Committee of Ministers
adopted at the 908th meeting of the Ministers’ Deputies (7 December 2004)

I. Written Question No 451 by Mr Masson (Doc. 10268)

Mr Masson wishes to point out to the Committee of Ministers that the European Union recently gave its approval for airlines to supply the United States with personal data concerning passengers purchasing a ticket to fly to that country. Staff of the US Bureau of Customs and Border Protection will now have automatic access to passenger data obtained by travel agencies and airlines.  Under an agreement between the United States and the European Union signed in May 2004 transfer of personal data will be systematic for passengers flying from Europe to the US. This enhanced cooperation must be seen against the background of the security hysteria currently prevailing in the United States, in which little store is set by human rights.

The agreement in question shows all the more disregard for personal freedoms in that data collected in a commercial capacity are being used for security purposes, which breaches the principles of the European Convention on Human Rights. The US requirements may admittedly help combat terrorism, but there is considerable risk of abuse. We have already learned this from experience, with the emergence of an area outside the law at GuantanomoBay and the use of torture in Iraq and Afghanistan.

The agreement identifies 34 categories of personal data, transfer of which would seem to break European law. They include details of past air journeys to other countries, dietary preferences (vegetarianism, consumption of pork or alcohol), health problems, address, civil status details, credit card number, names of persons travelling with the passenger and the seats allocated to them on the plane, billing address for the ticket, information that may reveal the passenger's ethnic origin or religion, names of people with whom the passenger is in contact on the ground, a record of changes made to the passenger's file, etc.

Since the Council of Europe's role is to defend freedoms, Mr Masson asks the Committee of Ministers if the matter should not be referred to the European Court of Human Rights for a ruling as to whether the above-mentioned agreement violates the guarantees contained in the European Convention on Human Rights.

II. Reply by the Committee of Ministers

As regards the question asked by the distinguished parliamentarian, which raises complex and important issues, the Committee of Ministers refers to its Guidelines on human rights and the fight against terrorism adopted on 11 July 2002 and in particular to Guideline V on Collection and processing of personal data by any competent authority in the field of State security which states: “Within the context of the fight against terrorism, the collection and the processing of personal data by any competent authority in the field of State security may interfere with the respect for private life only if such collection and processing, in particular:

(i) are governed by appropriate provisions of domestic law;

(ii) are proportionate to the aim for which the collection and the processing were foreseen;

(iii) may be subject to supervision by an external independent authority”.

As to the question whether the matter should be referred to the European Court of Human Rights, the Committee of Ministers notes that the agreement of 28 May 2004 has been reached between the EU and the United States, neither of which is a party to the European Convention on Human Rights. Moreover, the European Parliament has seized the European Court of Justice with the question of the legality of the agreement. The Committee of Ministers therefore considers that it would be inappropriate to request a ruling from the Court at this stage.

The Committee of Ministers would like to refer to Convention ETS 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, the purpose of which is to secure in the territory of each Party for every individual respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him. It has been informed that the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (T-PD) discussed the issue of transfer of airline passengers’ personal data to the United States on several occasions in 2003, but was unable to reach a consensus.

The Committee of Ministers has been informed that the European Union’s Article 29 Data Protection Working Party[1] (composed by data protection commissioners and ombudsmen of the EU member states), has found that among the 34 categories of data transferred under the agreement, only 19 were compatible with European standards on data protection.[2] In the light of this and of the fact that the case brought before the European Court of Justice is still pending, the Committee of Minister is not at this stage able to examine any possible follow-up.

[1] Set up under Article 29 of Directive 95/46/EC on the Protection of Individuals with regard to the Processing of Personal Data.

[2] Opinion No.2/2004 on the adequate protection of personal data contained in the PNR of air passengers to be transferred to the United States’ Bureau of Customs and Border Protection (US CBP).