Intervention by Frits Bolkestein Member of the European Commission in charge of the Internal Market and Taxation Airline passenger data transfers from the EU to the United States (Passenger Name Record) European Parliament's plenary session Strasbourg, 12th March 2003

SPEECH/03/125

Intervention by Frits Bolkestein

Member of the European Commission in charge of the Internal Market and Taxation

Airline passenger data transfers from the EU to the United States (Passenger Na me Record)

European Parliament's plenary session

Strasbourg, 12^th March 2003

Mr President, Honourable Members,

The new US law requiring airlines operating flights to, from and through the US to grant electronic access to their passenger name records (PNR) raises a number of policy issues:

• the fight against terrorism;

• the right to privacy;

• the ability of our airlines to compete;

• the security and convenience of legitimate air travellers; and

• the EU/US relationship in general.

It is necessary to pull all these strands together and to strike an appropriate balance. It is also necessary to be practical and not theoretical.

My first message thus is: let us work together for an outcome that achieves the best possible result responding to the need to combat terrorism while respecting data protection in actual practice, without damaging the commercial interests of our airlines and without inconvenience for legitimate air travellers.

The Commission very much welcomes the opportunity to address the Parliament on this matter. Underlying the technical issues are some fundamental questions about security and civil liberties, which all democracies have to ask themselves. Discussion among elected Parliamentarians on such issues is essential.

The draft resolution before the Parliament criticises the Commission for not informing and consulting the Parliament sooner. The Commission accepts this reprimand. It had of course no intention to conceal. It was more a question of when to bring this to the attention of the Parliament and in what form.

President, we only have a short time and rather than making a lengthy factual statement, I will, with your permission, draw the attention of Parliament to two documents that the Commission has made available:

• the joint statement, which is the agreed account of the outcome of talks between senior officials of the Commission and US Customs on 17-18 February in Brussels; and

• the statement by US Customs of 4 March making undertakings as regards the handling of sensitive data.

It is first necessary to correct a misunderstanding. Many reports referred to an "agreement" or "decision". There is no "agreement" or "decision". It follows that there is no legal base. There have been discussions; the US side have given certain assurances. This is the first step in a process. Both sides are committed to finding a more legally secure solution in due course.

These discussions were necessary. Why ? Because on the basis of information received about new US requirements, the Commission had found it necessary last November to inform EU airlines and the related reservation systems that it was not clear whether they could provide the information required by US law without being in breach of their data protection obligations under EU law.

In order to answer this question, it was necessary to obtain information from the US side: in particular as regards the use of the data, and the conditions under which they would be processed. The US side was very slow to respond to these requests for information. They only started to take our concerns seriously in December 2002.

In the absence of discussions with the US, the airlines would have been left in an impossible situation. They would have faced a whole range of penalties, starting with the practice of secondary inspections of arriving passengers. This had indeed already started. It means very long delays at arrival points for hundreds of legitimate travellers. This is an option, but is it what we really want? It is certainly not what the airlines wanted and there was every likelihood, therefore, that they would have complied with the US requirements anyway.

I strongly agree with Members who expressed the view in the Citizens Freedoms Committee on Monday that the US' way of proceeding by unilateral action and threats of penalties is unacceptable. But not having discussions with the American side would have left them with the data and no means for the EU side to influence their handling of it. It would have left the airlines open to either US or Member State enforcement action, when they are the wrong "target". If we want to bring pressure to bear it should be on those who can deliver a solution. Our aim has thus been to open up a process of dialogue through which we can influence US practices and obtain assurances from them that will ensure that data is adequately protected.

The Commission considers that the outcome of the February talks was positive for data protection, for the following reasons:

• First, we secured US agreement on the further steps to be taken to reach a mutually satisfactory solution that can provide legal certainty to all concerned;

• Second, the US made a number of significant unilateral undertakings of immediate application. For example, they made undertakings on what data they would not use, and how they would handle the data they do use. They confirmed in particular that their data gathering would be limited to flights to, from and through the US.

Clearly, we need more time and information from the US before we can say that we have a solution. We can only be satisfied when we have an arrangement which provides a maximum amount of legal security for all concerned.

Are transfers legal in the meantime? Only the Courts can answer this question in a definitive way, but two points can be made:

• First, the airlines have to meet their obligations as data controllers. They must in particular inform passengers fully in line with Article 10 of the Directive and obtain their consent for the processing of sensitive data in line with Article 8.

• Second, legality has to be examined from the angle of the need for adequate protection for data that is transferred to a third country. Transfers may however benefit from one of the exceptions in Article 26 paragraph 1 of the Directive. For example, certain transfers may be "necessary in order to fulfil a contract with the data subject" in other words the contract to fly the passenger to the US. But since such an exception could be challenged, this solution lacks legal security. Moreover, though exceptions may be legal for specific transfers, they offer no guarantees that the data will subsequently be protected.

Article 25, paragraph 6 of the Directive, on the other hand, allows the Commission to make a finding that a third country provides "adequate protection" for the purposes of transfers of personal data from the EU. An Article 25.6 decision by the Commission is therefore much to be preferred to relying on the exceptions to the adequacy rule, because it means that the data go on being protected.

The prospect of such a decision and the legal security that it brings allow the Commission to engage the third country concerned in discussions about the protections provided and hold them to a good standard.

Moreover, Article 25.6 decisions always contain safeguard clauses which can be triggered if protection does not in practice match up to the standards expected. They can also be unilaterally abrogated if necessary.

Finally, an Article 25.6 decision is a Community procedure producing a result which is binding on all the Member States. This is very much to be preferred to leaving the Member States to act in dispersed order. It is worth mentioning that one or two Member States have or are planning measures very similar to those now in place in the US.

Thus, Mr President and Honourable Members, I invite the House to take a positive view of the Commission's action on 17 and 18 February. The US side has committed itself to a process which recognises our legitimate interest in their data protection practices for PNR data and under which they subject their arrangements to our scrutiny according to our standards. This is a major step forward. Of course, the US still must provide the elements necessary for the Commission to make an adequacy finding. As a comitology decision, an adequacy finding under Article 25.6 is always brought to Parliament before being finalised, and I look forward to discussing this further with Honourable Members on that occasion.