COUNCIL DECISION (EU) 2022/2574

of 19 December 2022

on the position to be taken on behalf of the Union within the Partnership Council established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, as regards the extension of the interim period referred to in Article 552(11) of that Agreement during which the United Kingdom may derogate from the obligation to delete Passenger Name Record data of passengers after their departure from the United Kingdom

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2) and Article 87(2)(a), in conjunction with Article 218(9) thereof,

Having regard to Council Decision (EU) 2021/689 of 29 April 2021 on the conclusion, on behalf of the Union, of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, and of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland concerning security procedures for exchanging and protecting classified information (1),

Having regard to the proposal from the European Commission,

Whereas:

(1) Pursuant to Article 542 of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (2) (‘the TCA’), Title III of Part Three (LAW ENFORCEMENT AND JUDICIAL COOPERATION IN CRIMINAL MATTERS) of the TCA lays down rules under which passenger name record (‘PNR’) data may be transferred to, processed and used by the United Kingdom competent authority for flights between the Union and the United Kingdom, and establishes specific safeguards in that regard.

(2) Article 552(4) of the TCA provides that the United Kingdom is to delete the PNR data of passengers after their departure from the country unless a risk assessment indicates the need to retain such PNR data.

(3) Article 552(11) of the TCA provides that the United Kingdom may derogate from paragraph 4 of that Article on a temporary basis for an interim period, pending the implementation by the United Kingdom of technical adjustments as soon as possible. During that interim period, the United Kingdom competent authority is to prevent the use of the PNR data that is to be deleted in accordance with Article 552(4) of the TCA by applying the additional safeguards to that PNR data listed in Article 552(11), points (a) to (d) of the TCA.

(4) In accordance with Article 552(12)(a) of the TCA, the independent administrative body referred to in Article 552(7) of the TCA is to report on, and the United Kingdom supervisory authority for data protection referred to in Article 525(3) of the TCA is to provide an opinion on, whether the additional safeguards have been effectively applied.

(5) Article 552(10) of the TCA provides that Article 552(11) of the TCA applies due to the special circumstances that prevent the United Kingdom from making the technical adjustments necessary to transform the PNR processing systems which the United Kingdom operated whilst Union law applied to it into systems which would enable PNR data to be deleted in accordance with Article 552(4) of the TCA.

(6) Article 552(13) of the TCA provides that where the special circumstances referred to in Article 552(10) of the TCA persist, the Partnership Council is to extend the interim period referred to in Article 552(11) of the TCA for one year. A decision to that effect was taken by the Partnership Council on 21 December 2021, thereby extending the interim period until 31 December 2022 (3).

(7) Under the same conditions and, in addition, if the United Kingdom demonstrates that it has made substantial progress to transform its PNR processing systems into systems which would enable PNR data to be deleted in accordance with Article 552(4) of the TCA, although it has not yet been possible to transform them fully to that effect, the Partnership Council is to extend the interim period for one further and final year, that is until 31 December 2023.

(8) Directive (EU) 2016/681 of the European Parliament and of the Council (4) on the use of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime applies within the Union in accordance with the Treaties.

(9) On 29 September 2022, the United Kingdom submitted to the Specialised Committee on Law Enforcement and Judicial Cooperation established by the TCA (‘the Specialised Committee’) an assessment pursuant to Article 552(12)(b) of the TCA.

(10) In its assessment, the United Kingdom concluded that the special circumstances referred to in Article 552(10) of the TCA persist, and that substantial progress to transform its PNR processing systems into systems which would enable PNR data to be deleted in accordance with Article 552(4) of the TCA has been made, although it has not yet been possible to transform them fully to that effect. The United Kingdom noted that it designed and built a capability to delete PNR data in compliance with Article 552(4) of the TCA and that this capability was now in beta testing phase. The United Kingdom also stated that it was developing an automated risk-assessment process based on objective evidence to determine the PNR data to be retained after the passengers’ departure from the United Kingdom. Pursuant to Article 552(13) of the TCA, the Specialised Committee considered the United Kingdom’s assessment on 13 October 2022.

(11) On 29 September 2022, the United Kingdom also submitted to the Specialised Committee a report, pursuant to Article 552(12)(a) of the TCA, from the independent administrative body referred to in Article 552(7) of the TCA, including an opinion by the United Kingdom supervisory authority for data protection referred to in Article 525(3) of the TCA, outlining the effective application of the safeguards provided for in Article 552(11) of the TCA.

(12) Pursuant to Article 552(13) of the TCA, the Specialised Committee considered the United Kingdom’s report on 13 October 2022. On that occasion, the United Kingdom answered a number of questions from the Union and provided additional information on the application of the data protection safeguards, which it agreed to subsequently make available in writing.

(13) On 21 November 2022, the United Kingdom submitted that additional information in writing. It is therefore considered that the special circumstances referred to in Article 552(10) of the TCA persist, and that the United Kingdom has demonstrated that it has made substantial progress to transform its PNR processing systems into systems which would enable PNR data to be deleted in accordance with Article 552(4) of the TCA, although it has not yet been possible to transform them fully to that effect. Therefore, pursuant to Article 552(13) of the TCA, the Partnership Council should extend the interim period referred to in Article 552(11) of the TCA by one final year, until 31 December 2023.

(14) The Specialised Committee is the competent body to monitor and review the implementation of Part Three of the TCA including the annual assessment of the United Kingdom independent administrative body, pursuant to Article 552(7) of the TCA, on the approach applied by the United Kingdom competent authority as regards the need to retain PNR data pursuant to Article 552(4). It is expected that by 31 December 2023 the United Kingdom will have finalised all technical adjustments necessary to enable its PNR processing systems to delete PNR data in accordance with Article 552(4) of the TCA and will inform the Specialised Committee thereof.

(15) The TCA is binding on all the Member States by virtue of Decision (EU) 2021/689, which is based on Article 217 of the Treaty on the Functioning of the European Union as its substantive legal basis.

(16) Denmark and Ireland are bound by Part Three of the TCA by virtue of Decision (EU) 2021/689 and are therefore taking part in the adoption and application of this Decision which implements the TCA,

HAS ADOPTED THIS DECISION:

Article 1

The position to be taken on the Union’s behalf in the Partnership Council established by Article 7(1) of the TCA shall be to agree to a second and final extension, until 31 December 2023, of the interim period during which the United Kingdom may derogate from the obligation to delete passenger name record data of passengers after their departure from the United Kingdom pursuant to Article 552(13) of the TCA.

Article 2

The Decision of the Partnership Council shall be published in

the Official Journal of the European Union.

Article 3

This Decision shall enter into force on the date of its adoption.

Done at Brussels, 19 December 2022.

For the Council

The President

J. SÍKELA

(1)  

OJ L 149, 30.4.2021, p. 2

.

(2)  

OJ L 149, 30.4.2021, p. 10

.

(3)  Decision No 2/2021 of the Partnership Council established by the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, of 21 December 2021 as regards the extension of the interim period during which the United Kingdom may derogate from the obligation to delete Passenger Name Record data of passengers after their departure from the United Kingdom (

OJ L 467, 29.12.2021, p. 6

).

(4)  Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (

OJ L 119, 4.5.2016, p. 132

).