The office of the EDPS has said that the judgment has stripped
EU citizens of data protection when it comes to criminal and
security matters. The ruling had seemed a victory for data
protection activists, but the principal legal basis of the decision
creates a "loophole", according to the EDPS.
"The judgment seems to have created a loophole in the protection
of European citizens whereby their data are used for law
enforcement purposes," said European data Protection Supervisor
Peter Hustinx.
In the aftermath of the 11th September 2001 terrorist attacks on
the US, airport security in the US was tightened significantly.
Airlines were required to hand over 34 pieces of data on each
passenger travelling from Europe, initially apparently in breach of
the 1995 EU Data Protection Directive.
In 2004, though, the European Commission agreed a deal that saw
the information pass only to the US Bureau of Customs and Border
Protection, having been satisfied that the 'adequate protection' of
the data demanded by the Directive had been assured.
The ECJ has just ruled that though the Directive does apply to
the transfer of data for commercial reasons, it does not apply to
the transfer in the context of criminal offences or state security.
The agreement, the ECJ ruled, was therefore illegal and must be
re-framed before the end of September.
The EDPS argues that if the Directive does not apply in criminal
or security contexts, then data is currently unprotected when it
comes to police matters.
"It seems to create a loophole in the protection of the European
citizen since it is no longer assured that data collected for
commercial purposes but used by police are protected by the data
protection directive," said an EDPS statement.
"Data is collected from you when buying a plane ticket. If that
data is then passed to the US Bureau of Customs and Border
Protection then the ruling now says that that does not fall within
the protection of the Data Protection Directive," said a source in
the EDPS office.
There is currently a proposal on a Framework for Data Protection
in the Third Pillar, which will deal with justice and home affairs,
but its implementation has not so far been agreed. "We would like
to see it adopted as soon as possible," said the source in the EDPS
office. "But it is not advancing very well in Council."
