As we reported in our July 2006 edition of the Privacy & Data Protection Update, the European Court of Justice has, on 30 May 2006, annulled both the Council Decision 2004/496/EC on the conclusion of an agreement between the European Community and the US on the processing and transfer of PNR ("Passenger Name Records") data, and the Commission Decision 2004/535/EC on the adequate protection of data contained in the PNR (the "Adequacy Decision").
The Court also provided when annulling both decisions that the Commission's Adequacy Decision would be preserved until 30 September 2006 for reasons of legal certainty. It seemed that the Court expected the Commission and the Council to have found another co-operation framework by then, within the third pillar, which would enable the US to still use PNR data in view of co-operation for the prevention of terrorism and serious crime.
Since public security falls outside the scope of Community law, the Court of Justice judged that the Adequacy Decision was exceeding the Commission's powers. The Court also found that there was a lack of Community competence to conclude the PNR agreement with the US. On 3 July 2006, the Council and the Commission notified termination of the agreement with effect from 30 September 2006.
On 7 September 2006, the European Parliament adopted a report in which it asked the Council to negotiate - under the Parliament's oversight - an interim agreement, whereby the Parliament wants to ensure that the US offers adequate protection of the passenger data collected and which should provide for a change to the "push"-system (under which US authorities must request specific data which will then be selected and transferred) instead of the present "pull"-system (whereby access is granted to the full database and airline passengers data are directly accessed online by the authorities concerned). In its report, the Parliament further requested joint decision-making rights over the negotiation of the final agreement with the US.
On 6 October 2006, shortly after the Court-set deadline of 30 September, EU negotiators reached an interim agreement with their US counterparts. The conflict of laws situation that existed since 1 October 2006 thereby appears to be, at least temporarily, solved. The interim agreement would ensure a similar level of protection of the PNR data as before and it would also comply with the US request that the PNR data can be more easily distributed between different US agencies. A move from the "pull"-system to the "push"-system should be undertaken at a later date. The nature of PNR data available to US agencies remains unchanged.
The interim agreement will apply from its date of signature, which is due to be completed by 18 October, and will expire no later than 31 July 2007. By this date a new (superseding) agreement should be reached between the parties who meet again in November 2006 to begin discussions on that point.