COUNCIL DECISION (EU) 2019/2107

of 28 November 2019

on the position to be taken on behalf of the European Union within the Council of the International Civil Aviation Organization as regards the revision of Chapter 9 of Annex 9 (Facilitation) to the Convention on International Civil Aviation in respect of standards and recommended practices on passenger name record data

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2) and point (a) of Article 87(2), in conjunction with Article 218(9) thereof,

Having regard to the proposal from the European Commission,

Whereas:

(1) The Convention on International Civil Aviation (the ‘Chicago Convention’), which regulates international air transport, entered into force on 4 April 1947. It established the International Civil Aviation Organization (ICAO).

(2) The Member States of the Union are contracting parties to the Chicago Convention and ICAO Member States, whereas the Union has observer status in certain ICAO bodies, including in the Assembly and other technical bodies.

(3) Pursuant to point (l) of Article 54 of the Chicago Convention, the ICAO Council is to adopt international standards and recommended practices (‘SARP’s).

(4) The United Nations (UN) Security Council decided in its resolution 2396 (2017) of 21 December 2017 (‘UNSCR 2396 (2017)’) that the UN Member States are to develop the capability to collect, process and analyse, in furtherance of ICAO SARPs, passenger name record (PNR) data and to ensure PNR data is used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms for the purpose of preventing, detecting and investigating terrorist offences and related travel.

(5) UNSCR 2396 (2017) also urged the ICAO to work with the UN Member States to establish a standard for the collection, use, processing and protection of PNR data.

(6) SARPs on PNR are set out in Parts A and D of Chapter 9 of Annex 9 (Facilitation) to the Chicago Convention. Those SARPs are complemented by additional guidance, in particular ICAO Document 9944 setting out guidelines on PNR data.

(7) In March 2019, the ICAO Air Transport Committee (ATC) established a task force, consisting of experts from those ICAO Member States participating in the ICAO Facilitation Panel, to consider proposals for new SARPs on the collection, use, processing and protection of PNR data in line with UNSCR 2396 (2017) (the ‘Task Force’). A number of Member States of the Union are represented in the Task Force. The Commission participates in the Task Force as an observer.

(8) The 40th session of the ICAO Assembly took place from 24 September to 4 October 2019. The results of the ICAO Assembly will define the ICAO’s political direction for the coming years, including with respect to the adoption of new SARPs on PNR.

(9) On 16 September 2019, the Council endorsed an information paper on standards and principles on the collection, use, processing and protection of PNR data for submission to the 40th session of the ICAO Assembly (the ‘information paper’). The information paper was submitted to the ICAO Assembly by Finland on behalf of the Union and its Member States and the other Member States of the European Civil Aviation Conference.

(10) The information paper sets out the position of the Union on the core principles for compliance which would help to ensure respect for the constitutional and regulatory requirements concerning fundamental rights to privacy and data protection when processing PNR data for the purposes of countering terrorism and serious crime. The ICAO was invited to include such principles in any future standards on PNR as well as in the ICAO’s revised Guidelines on PNR data (Doc 9944).

(11) The Union has adopted common rules on PNR data in the form of Directive (EU) 2016/681 of the European Parliament and of the Council (1), the scope of which overlaps significantly with the area to be covered by the envisaged new SARPs. Directive (EU) 2016/681 includes, in particular, a comprehensive set of rules to safeguard the fundamental rights to privacy and the protection of personal data, in the context of a transfer of PNR data by air carriers to Member States for the purpose of prevention, detection, investigation and prosecution of terrorist offences and serious crime.

(12) Two international agreements on the processing and transfer of PNR data are currently in force between the Union and third countries, namely Australia (2) and the United States (3). On 26 July 2017, the Court of Justice of the European Union gave an Opinion on the envisaged agreement between the Union and Canada, signed on 25 June 2014 (4) (‘Opinion 1/15’).

(13) It is appropriate to establish the position to be taken on behalf of the Union within the ICAO Council as any future SARPs in the area of PNR data, in particular amendments to Chapter 9 of Annex 9 (Facilitation) to the Chicago Convention, will decisively influence the content of Union law, namely Directive (EU) 2016/681 and the existing international agreements on PNR data. In accordance with the duty of sincere cooperation, Member States of the Union are to defend this position throughout the work in the ICAO to elaborate the SARPs.

(14) The position of the Union, as set out in the Annex, is established in accordance with the applicable Union legal framework on data protection and PNR data, namely Regulation (EU) 2016/679 of the European Parliament and of the Council (5), Directive (EU) 2016/680 of the European Parliament and of the Council (6) and Directive (EU) 2016/681, as well as the Treaty and the Charter of Fundamental Rights of the European Union as interpreted in the relevant case law of the Court of Justice of the European Union, in particular Opinion 1/15.

(15) The position of the Union should be expressed by its Member States that are members of the ICAO Council, acting jointly.

(16) The United Kingdom and Ireland are bound by Directive (EU) 2016/681 and are therefore taking part in the adoption of this Decision.

(17) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application,

HAS ADOPTED THIS DECISION:

Article 1

The position to be taken on behalf of the Union within the Council of the International Civil Aviation Organization (ICAO) as regards the revision of Chapter 9 of Annex 9 (Facilitation) to the Convention on International Civil Aviation in respect of standards and recommended practices on passenger name record data shall be as set out in the Annex to this Decision.

Article 2

The position referred to in Article 1 shall be expressed by the Member States of the Union that are members of the ICAO Council, acting jointly.

Article 3

This Decision shall enter into force on the date of its adoption.

Done at Brussels, 28 November 2019.

For the Council

The President

T. HARAKKA

(1) Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (

OJ L 119, 4.5.2016, p. 132

(2)

OJ L 186, 14.7.2012, p. 4

(3)

OJ L 215, 11.8.2012, p. 5

(4) Opinion 1/15 of the Court (Grand Chamber) of 26 July 2017, ECLI:EU:C:2017:592.

(5) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (

OJ L 119, 4.5.2016, p. 1

(6) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (

OJ L 119, 4.5.2016, p. 89

ANNEX

POSITION TO BE TAKEN ON BEHALF OF THE EUROPEAN UNION WITHIN THE COUNCIL OF THE INTERNATIONAL CIVIL AVIATION ORGANIZATION AS REGARDS THE REVISION OF CHAPTER 9 OF ANNEX 9 (FACILITATION) TO THE CONVENTION ON INTERNATIONAL CIVIL AVIATION IN RESPECT OF STANDARDS AND RECOMMENDED PRACTICES ON PASSENGER NAME RECORD DATA

General principles

Within the framework of the activities of the International Civil Aviation Organization (ICAO) in respect of the revision of Chapter 9 of Annex 9 (Facilitation) to the Chicago Convention concerning the development of standards and recommended practices (SARPs) on passenger name record (PNR) data, the Member States of the Union, acting jointly in the interests of the Union, shall:

(a) act in accordance with the objectives pursued by the Union within the framework of its PNR policy, in particular to ensure security, to protect the life and safety of persons, and to ensure full respect for fundamental rights, in particular the rights to privacy and the protection of personal data;

(b) raise awareness, among all ICAO Member States, of the Union standards and principles related to the transfer of PNR data, as resulting from the relevant Union law and the case law of the Court of Justice of the European Union;

(c) promote the development of multilateral solutions compliant with fundamental rights concerning the transfer of PNR data by airlines to law enforcement authorities, in the interest of providing legal certainty and respect for fundamental rights and to streamline the obligations imposed on air carriers;

(d) promote the exchange of PNR data and the results of processing those data among the ICAO Member States, where that is deemed necessary for the prevention, detection, investigation or prosecution of terrorist offences or serious crime, in full respect of fundamental rights and freedoms;

(e) continue to support the development by the ICAO of standards for the collection, use, processing and protection of PNR data, in line with UNSCR 2396 (2017);

(f) continue to support the development, in all ICAO Member States, of the capability to collect, process and analyse, in furtherance of ICAO SARPs, PNR data and to ensure PNR data are used by and shared with all competent national authorities of ICAO Member States, with full respect for human rights and fundamental freedoms for the purpose of preventing, detecting and investigating terrorist offences and related travel, as required by UNSCR 2396 (2017);

(g) use as background information the information paper on standards and principles on the collection, use, processing and protection of PNR data (Doc A40-WP/530), submitted to the 40th session of the ICAO Assembly by Finland on behalf of the European Union and its Member States and the other Member States of the European Civil Aviation Conference;

(h) promote the development of an environment in which international air transport may develop in an open, liberalised and global market and continue to grow without compromising security, while ensuring the introduction of relevant safeguards.

Orientations

The Member States of the Union, acting jointly in the interests of the Union, shall support the inclusion of the following standards and principles in any future ICAO SARPs on PNR data:

Concerning the modalities of PNR transmission:

(a) Method of transmission: in order to protect the personal data that are contained in the air carriers’ systems and to ensure that they remain in control of those systems, data should be transmitted using the ‘push’ system exclusively.

(b) Transmission protocols: the use of suitable, secure and open standard protocols as part of internationally accepted reference protocols for the transmission of PNR data should be encouraged with the aim of gradually increasing their uptake and eventually replacing proprietary standards.

(c) Frequency of transmission: the frequency and the timing of PNR data transmissions should not create an unreasonable burden on air carriers and should be limited to what is strictly necessary for the purpose of law enforcement and border security to fight terrorism and serious crime.

(d) No obligation on the air carriers to collect additional data: air carriers should not be required to collect additional PNR data compared to what they already do or to collect certain types of data, but only to transmit what they already collect as part of their business.

Concerning the modalities of PNR processing:

(a) Timing of transmission and processing: subject to the appropriate guarantees for the protection of privacy of the persons concerned, PNR data can be made available well in advance of a flight’s arrival or departure, and hence provide authorities with more time for processing and analysing the data, and potentially taking action.

(b) Comparison against pre-determined criteria and databases: the authorities should process PNR data using evidence-based criteria and databases that are relevant for the fight against terrorism and serious crime.

Concerning the protection of personal data:

(a) Lawfulness, fairness and transparency of processing: there needs to be a lawful basis for the processing of personal data, in order to make individuals aware of the risks, safeguards and rights in relation to the processing of their personal data and of how to exercise their rights in relation to the processing.

(b) Purpose limitation: the purposes for which PNR data may be used by authorities should be clearly set and should be no wider than what is necessary in view of the aims to be achieved, in particular for law enforcement and border security purposes to fight terrorism and serious crime.

(c) Scope of PNR data: the PNR data elements to be transferred by airlines should be clearly identified and exhaustively listed. This list should be standardised to ensure that such data is kept to the minimum, while preventing the processing of sensitive data, including data revealing a person’s racial or ethnic origins, political opinions or religious or philosophical beliefs, trade union membership, health, sexual life or sexual orientation.

(d) Use of PNR data: the further processing of the PNR data should be limited to the purposes of the original transfer, based on objective criteria and subject to substantive and procedural conditions in line with the requirements applicable to the transfers of personal data.

(e) Automated processing of PNR data: automated processing should be based on objective, non-discriminatory and reliable, pre-established criteria and should not be used as the sole basis for any decisions with adverse legal effects or seriously affecting a person.

(f) Data retention: the period of retention of the PNR data should be restricted and not be longer than necessary for the original objective pursued. Deletion of the data should be ensured in accordance with the legal requirements of the source country. At the end of the retention period, the PNR data should be deleted or anonymised.

(g) Disclosure of PNR data to authorised authorities: the further disclosure of PNR data to other government authorities within the same State or to other ICAO Member States on a case-by-case basis may only take place if the recipient authority exercises functions related to the fight against terrorism or serious transnational crime and ensures the same protection as that afforded by the disclosing authority.

(h) Data security: appropriate measures must be taken to protect the security, confidentiality and integrity of the PNR data.

(i) Transparency and notice: subject to necessary and proportionate restrictions, individuals should be notified of the processing of their PNR data and be informed about the rights and means of redress afforded to them.

(j) Access, rectification and deletion: subject to necessary and proportionate restrictions, individuals should have the right to get access to, and the right to rectification of, their PNR data.

(k) Redress: individuals should have the right to effective administrative and judicial redress in case they consider that their rights to privacy and data protection have been infringed.

(l) Oversight and accountability: the authorities using PNR data should be accountable to and supervised by an independent public authority with effective powers of investigation and enforcement that should be in a position to execute its tasks free from any influence, in particular from law enforcement authorities.

Concerning PNR information sharing among the law enforcement authorities:

(a) Promotion of information sharing: case-by-case exchanges of PNR data among the law enforcement authorities of different ICAO Member States should be promoted in order to improve international cooperation on the prevention, detection, investigation and prosecution of terrorism and serious crime.

(b) Security of information exchange: information sharing should take place through appropriate channels ensuring adequate data security and be fully compliant with international and national legal frameworks for the protection of personal data.