COUNCIL DECISION (EU) 2021/121

of 28 January 2021

on the position to be taken on behalf of the European Union in reply to the State Letter sent by the International Civil Aviation Organization as regards Amendment 28 to Section D of Chapter 9 of Annex 9 to the Convention on International Civil Aviation

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2) and point (a) of Article 87(2), in conjunction with Article 218(9) thereof,

Having regard to the proposal from the European Commission,

Whereas:

(1) The Convention on International Civil Aviation (the ‘Chicago Convention’), which aims to regulate international air transport, entered into force on 4 April 1947. It established the International Civil Aviation Organization (ICAO).

(2) The Member States of the Union are contracting States to the Chicago Convention and members of ICAO, whereas the Union has observer status in certain ICAO bodies.

(3) Pursuant to Article 54 of the Chicago Convention, the ICAO Council is to adopt international standards and recommended practices (‘SARP’s).

(4) On 21 December 2017, the United Nations Security Council (UNSC) decided in its Resolution 2396 (2017) that the UN Member States are to develop the capability to collect, process and analyse, in furtherance of the ICAO SARPs, passenger name record (PNR) data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms for the purpose of preventing, detecting and investigating terrorist offences and related travel.

(5) UNSC Resolution 2396 (2017) also urged ICAO to work with the contracting States to establish a standard for the collection, use, processing and protection of PNR data.

(6) The SARPs on PNR are set out in Section D of Chapter 9 of Annex 9 to the Chicago Convention. Those SARPs are complemented by additional guidance, in particular ICAO Document 9944 setting out guidelines on PNR data.

(7) On 23 June 2020, the ICAO Council adopted Amendment 28 to Section D of Chapter 9 of Annex 9 to the Chicago Convention, setting out a new set of SARPs for the contracting States to develop their capabilities to collect, use, process and protect PNR data for flights to and from their territory (‘Amendment 28’), supported by an appropriate legal and administrative framework.

(8) In accordance with Article 90 of the Chicago Convention, unless a majority of its contracting States register their disapproval, Amendment 28 becomes effective three months after the deadline for registering such disapproval.

(9) In accordance with Article 38 of the Chicago Convention, any contracting State which finds it impracticable to comply in all respects with such international standards or procedures, or to bring its own regulations or practices into full accord with any international standard or procedure after amendment of the latter, or which deems it necessary to adopt regulations or practices differing in any particular respect from those established by an international standard, needs to give immediate notification to ICAO of the differences between its own practice and that established by the international standard. The notification of such differences has an impact on the legal effects of the standards adopted by ICAO. The Union’s position in the matter is therefore to be established in accordance with Article 218(9) of the Treaty on the Functioning of the European Union.

(10) Amendment 28 was notified to the contracting States by way of State Letter EC 6/3-20/71. According to that State Letter, any differences from, or confirmation of compliance with, Amendment 28 are to be notified by 30 January 2021.

(11) The Union adopted common rules on PNR data in Directive (EU) 2016/681 of the European Parliament and of the Council (1), the scope of which overlaps significantly with that of the SARPs, as revised by Amendment 28. Directive (EU) 2016/681 includes, in particular, a comprehensive set of rules to safeguard the fundamental rights to privacy and the protection of personal data in the context of a transfer of PNR data by air carriers to Member States and of the processing of such data for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime.

(12) The Union has also adopted legislative acts on the protection of personal data, namely Regulation (EU) 2016/679 of the European Parliament and of the Council (2) and Directive (EU) 2016/680 of the European Parliament and of the Council (3), applicable to the processing of PNR data by air carriers and other private operators and by authorities competent for the prevention, investigation, detection or prosecution of criminal offences and the execution of criminal penalties, including for the purposes of safeguarding against and preventing threats to public security.

(13) In addition, two international agreements on the processing and transfer of PNR data are currently in force between the Union and third countries, namely Australia (4) and the United States (5). On 26 July 2017, the Court of Justice of the European Union gave Opinion 1/15 on the envisaged agreement between Canada and the European Union on the transfer and processing of PNR data, signed on 25 June 2014 (6) (‘Opinion 1/15’).

(14) The PNR-related aspects of Section D of Chapter 9 of Annex 9 to the Chicago Convention, as revised by Amendment 28, relate to an area for which the Union has exclusive competence pursuant to Article 3(2) of the Treaty on the Functioning of the European Union, as Amendment 28 may affect common rules on protection and processing of PNR data.

(15) Accordingly, the Union position on this matter, for the purposes of the preparation of Amendment 28, was taken in accordance with Council Decision (EU) 2019/2107 (7). That position reflects the requirements of Union law in respect of the protection of personal data and transfers of PNR data to third countries, as established in Regulation (EU) 2016/679 and Directives (EU) 2016/680 and (EU) 2016/681, as well as the requirements resulting from the Charter of Fundamental Rights of the European Union as interpreted by the Court of Justice of the European Union, in particular in Opinion 1/15.

(16) The SARPs, as revised by Amendment 28, largely follow the lines of the Union position established in Decision (EU) 2019/2107 and lay down ambitious safeguards on data protection, in particular on data subject rights, oversight by an independent authority, sensitive data, automated processing of PNR data and non-discrimination, purposes for which PNR data may be processed, and the retention, use, disclosure and further transfer of PNR data.

(17) Therefore, given that Amendment 28 would allow significant progress to be made at international level in relation to the standards for protection of PNR data, no disapproval was notified by Member States of the Union under Article 90 of the Chicago Convention.

(18) However, the requirements resulting from Union law in respect of the transfer and processing of PNR data are more exacting than the SARPs, as revised by Amendment 28.

(19) Standard 9.34(a), as set out in Amendment 28, requires contracting States not to inhibit or prevent the transfer of PNR data to another contracting State that complies with the SARPs. Under Standard 9.34(b), as set out in Amendment 28, contracting States retain the ability to maintain or introduce higher levels of protection in accordance with their domestic legal and administrative framework, and to enter into additional arrangements with other contracting States in order to establish more detailed provisions relating to the transfer of PNR data. However, the current language of Standard 9.34 is, from the perspective of the Union and the Member States, not sufficiently clear in legal terms to ensure that the Member States are not precluded from imposing those more exacting requirements.

(20) In those circumstances, in order to ensure compliance with Union law and with the SARPs, Member States should, in reply to State Letter EC 6/3-20/71, formally notify a difference within the meaning of Article 38 of the Chicago Convention. Such difference should be limited to Standard 9.34 in Section D of Chapter 9 of Annex 9 to the Chicago Convention, as revised by Amendment 28.

(21) It is therefore appropriate to establish the position to be taken on the Union’s behalf.

(22) The Union’s position should be expressed by the Member States.

(23) Ireland is bound by Directive (EU) 2016/681 and is therefore taking part in the adoption of this Decision.

(24) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application,

HAS ADOPTED THIS DECISION:

Article 1

The position to be taken on the Union’s behalf in reply to State Letter EC 6/3-20/71, issued by the International Civil Aviation Organization on 17 July 2020 (8) shall be expressed by the Member States.

Article 2

This Decision shall enter into force on the date of its adoption.

Done at Brussels, 28 January 2021.

For the Council

The President

A. P. ZACARIAS

(1)  Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (

OJ L 119, 4.5.2016, p. 132

).

(2)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (

OJ L 119, 4.5.2016, p. 1

).

(3)  Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (

OJ L 119, 4.5.2016, p. 89

).

(4)  Agreement between the European Union and Australia on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Australian Customs and Border Protection Service (

OJ L 186, 14.7.2012, p. 4

).

(5)  Agreement between the United States of America and the European Union on the use and transfer of passenger name records to the United States Department of Homeland Security (

OJ L 215, 11.8.2012, p. 5

).

(6)  Opinion 1/15 of the Court (Grand Chamber) of 26 July 2017, ECLI:EU:C:2017:592.

(7)  Council Decision (EU) 2019/2107 of 28 November 2019 on the position to be taken on behalf of the European Union within the Council of the International Civil Aviation Organization as regards the revision of Chapter 9 of Annex 9 (Facilitation) to the Convention on International Civil Aviation in respect of standards and recommended practices on passenger name record data (

OJ L 318, 10.12.2019, p. 117

).

(8)  See document ST 5457/21 on http://register.consilium.europa.eu