Opinion of the Court (Grand Chamber) of 26 July 2017 — European Parliament
(Opinion 1/15) 1
(Opinion pursuant to Article 218(11) TFEU — Draft agreement between Canada and the European Union — Transfer of Passenger Name Record data from the European Union to Canada — Appropriate legal bases — Article 16(2), point (d) of the second subparagraph of Article 82(1) and Article 87(2)(a) TFEU — Compatibility with Articles 7 and 8 and Article 52(1) of the Charter of Fundamental Rights of the European Union)
Language of the case: all the official languages
Applicant
European Parliament (represented by: F. Drexler, A. Caiola and D. Moore, Agents)
Operative part of the Opinion
The Council Decision on the conclusion, on behalf of the Union, of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data must be based jointly on Article 16(2) TFEU and Article 87(2)(a) TFEU.
The Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data is incompatible with Articles 7, 8 and 21 and Article 52(1) of the Charter of Fundamental Rights of the European Union in so far as it does not preclude the transfer of sensitive data from the European Union to Canada and the use and retention of that data.
The Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data must, in order to be compatible with Articles 7 and 8 and Article 52(1) of the Charter of Fundamental Rights:
(a) determine in a clear and precise manner the PNR data to be transferred from the European Union to Canada;
(b) provide that the models and criteria used in the context of automated processing of PNR data will be specific and reliable and non-discriminatory; provide that the databases used will be limited to those used by Canada in relation to the fight against terrorism and serious transnational crime;
(c) save in the context of verifications in relation to the pre-established models and criteria on which automated processing of Passenger Name Record data is based, make the use of that data by the Canadian Competent Authority during the air passengers’ stay in Canada and after their departure from that country, and any disclosure of that data to other authorities, subject to substantive and procedural conditions based on objective criteria; make that use and that disclosure, except in cases of validly established urgency, subject to a prior review carried out either by a court or by an independent administrative body, the decision of that court or body authorising the use being made following a reasoned request by those authorities, inter alia, within the framework of procedures for the prevention, detection or prosecution of crime;
(d) limit the retention of Passenger Name Record data after the air passengers’ departure to that of passengers in respect of whom there is objective evidence from which it may be inferred that they may present a risk in terms of the fight against terrorism and serious transnational crime;
(e) make the disclosure of Passenger Name Record data by the Canadian Competent Authority to the government authorities of a third country subject to the condition that there be either an agreement between the European Union and that third country equivalent to the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data, or a decision of the European Commission, under Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, covering the authorities to which it is intended that Passenger Name Record data be disclosed;
(f) provide for a right to individual notification for air passengers in the event of use of Passenger Name Record data concerning them during their stay in Canada and after their departure from that country, and in the event of disclosure of that data by the Canadian Competent Authority to other authorities or to individuals; and
(g) guarantee that the oversight of the rules laid down in the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data relating to the protection of air passengers with regard to the processing of Passenger Name Record data concerning them will be carried out by an independent supervisory authority.
____________
1 OJ C 138, 27.4.2015.