The deal was struck after the US introduced more stringent
airport security measures following the attacks on the US on 11th
September 2001. The US threatened airlines who refused to supply
the data with fines and with a withdrawal of landing
permission.
The transfer agreement was made between the European Commission
and the US Bureau of Customs and Border Protection and applied from
May 2004 onwards, but the European Parliament took the Commission
to the European Court of Justice (ECJ) and argued that this
agreement itself was unlawful.
Today's judgment is a victory for the Parliament's position.
"The Court annulled the Council decision approving the conclusion
of the agreement," said an ECJ statement. "Neither the Commission
decision nor the Council decision are founded on an appropriate
legal basis."
The decision hinged on the European Commission's claim that the
US provided an 'adequate level of protection' for the personal
data, as required by the European Data Protection Directive of
1995.
The ECJ found that because the transfer of data was for related
to national security, public safety or criminal purposes, the
Directive did not apply. The transfer fell outside the scope of the
Directive, the court judgment argued.
The ECJ has given the Commission and the US until the end of
September to find an alternative legal grounding for their
agreement.
A US official said: "We are working with the Commission and we
will make the best efforts to find an agreed interim approach to
data transfers which fully respect the ruling."
The Commission made an agreement that information would only be
passed to the US Bureau of Customs and Border Protection in what
the Commission described as an exercising of its 'political
judgement'. With a number of outstanding decisions on data
protection soon to be made by European law makers, the ECJ decision
outlawing the Commission agreement is being seen as particularly
important.
"I see the judgment as a shot across the bows," said Dr Chris
Pounder, a data protection expert with Pinsent Masons, the law firm
behind OUT-LAW.COM. "Security and privacy have to be balanced,
which most reasonable people will accept, and there must be
independent supervision of the whole process so that those who use
powers to obtain personal data do not exceed those powers."
The UK could circumvent the ECJ ruling and could agree a
bilateral deal with the US on airline passenger information. "From
the UK perspective there is a flexibility in the Data Protection
Act for the Home Secretary to determine by order that these
transfers should occur," said Pounder. However, he added, "It is
not clear whether or not the US administration will seek to pursue
bilateral agreements or come to a fresh agreement with the European
Commission or indeed indvidual airlines".
A Home Office spokeswoman said that the department was still
considering the judgment. "We will need to study the judgment
carefully to determine what, if anything, needs to be done to
ensure that transfers of passenger name record data to the US
authorities can continue to be made lawfully," said a Home Office
statement.
