CURIA - Documents

Home > Search form > List of results > Documents

Start printing

Language of document : ECLI:EU:C:2017:592

Opinion 1/15

Opinion pursuant to Article 218(11) TFEU

(Opinion pursuant to Article 218(11) TFEU — Draft agreement between Canada and the European Union — Transfer of Passenger Name Record data from the European Union to Canada — Appropriate legal bases — Article 16(2), point (d) of the second subparagraph of Article 82(1) and Article 87(2)(a) TFEU — Compatibility with Articles 7 and 8 and Article 52(1) of the Charter of Fundamental Rights of the European Union)

Summary — Opinion of the Court (Grand Chamber), 26 July 2017

1. International agreements — Conclusion — Prior opinion of the Court — Subject matter — Questions of the substantive or formal validity of an agreement with regard to the Treaty — Whether the agreement is compatible with the Charter of Fundamental Rights of the European Union

(Arts 6(1) TEU, 217 TFEU and 218 TFEU)

2. Acts of the institutions — Choice of legal basis — Criteria — EU measure pursuing a twofold aim or having a twofold component — Reference to the main or predominant aim or component — Inseparable aims or components — Cumulation of legal bases — Limits — Incompatibility of procedures

3. International agreements — European Union agreements — Conclusion — EU-Canada Agreement on the transfer and processing of Passenger Name Record data — Legal basis — Effect of Protocols No 21 and 22 on the position of the United Kingdom, Ireland and Denmark annexed to the EU and FEU Treaties — Inapplicability of the agreement to Denmark

(Arts 16(2) TFEU and 87(2)(a) TFEU; Protocols No 21 and No 22 annexed to the EU and FEU Treaties)

4. International agreements — European Union agreements — Conclusion — EU-Canada Agreement on the transfer and processing of Passenger Name Record data — Agreement seeking to ensure public security as well protect air passengers’ data — Legal basis — Article 16(2) TFEU in conjunction with Article 87(2)(a) TFEU

(Arts 39 TEU, 16(2) TFEU and 87(2)(a) TFEU; Protocols No 21 and No 22 annexed to the EU and FEU Treaties; Declaration No 21 annexed to the EU and FEU Treaties)

5. Fundamental rights — Respect for private life — Protection of personal data — Scope — Processing of Passenger Name Record data carried out under an international agreement concluded between the European Union and a non-member country — Included — Need to ensure a level of protection of fundamental rights and freedoms equivalent to that guaranteed within the European Union — Scope

(Charter of Fundamental Rights of the European Union, Arts 7 and 8; European Parliament and Council Directive 95/46, Art. 25(6))

6. International agreements — European Union agreements — Conclusion — Agreement with a non-Member State on the transfer and processing of Passenger Name Record data — Interference with the rights to respect for private life and to the protection of personal data — Obligation to limit the interference to what is strictly necessary — Scope

(Charter of Fundamental Rights of the European Union, Arts 7 and 8)

7. Fundamental rights — Charter of Fundamental Rights of the European Union — Limitation of the exercise of the rights and freedoms enshrined in the Charter — Conditions — Requirement for the limitation to be included in a law — Scope

(Charter of Fundamental Rights of the European Union, Art. 52(1))

8. Fundamental rights — Protection of personal data — Processing on the basis of the consent of the person concerned or some other legitimate basis laid down by law — Concept of law — Agreement with a non-member country on the transfer and processing of Passenger Name Record data — Included

(Arts 218(6)(a)(v) TFEU and 294 TFEU; Charter of Fundamental Rights of the European Union, Arts 8(2) and 52(1))

9. Fundamental rights — Respect for private life — Protection of personal data –Conclusion by the European Union of an agreement with a non-member country on the transfer and processing of Passenger Name Record data — Interference — Justification — Protection of public security against terrorism and serious transnational crime — Whether permissible

(Charter of Fundamental Rights of the European Union, Arts 7 and 8; European Parliament and Council Directive 2016/681, Arts 6(4), 7(6) and 13(4))

10. Fundamental rights — Respect for private life — Protection of personal data –Conclusion by the European Union of an agreement with a non-member country on the transfer and processing of Passenger Name Record data — Sensitive data — Need for a precise and solid justification, based on grounds other than the protection of public security against terrorism and serious transnational crime

(Charter of Fundamental Rights of the European Union, Arts 7, 8, 21 and 52(1))

11. Fundamental rights — Respect for private life — Protection of personal data –Conclusion by the European Union of an agreement with a non-member country on the transfer and processing of Passenger Name Record data — Observance of the principle of proportionality — Automated processing of data — Assessment in relation to the models, criteria and databases used in order to carry out that processing

(Charter of Fundamental Rights of the European Union, Arts 7 and 8)

12. Fundamental rights — Respect for private life — Protection of personal data –Conclusion by the European Union of an agreement with a non-member country on the transfer and processing of Passenger Name Record data — Observance of the principle of proportionality — Processing in accordance with the objectives of the Chicago Convention — Whether permissible

13. Fundamental rights — Respect for private life — Protection of personal data –Conclusion by the European Union of an agreement with a non-member country on the transfer and processing of Passenger Name Record data — Observance of the principle of proportionality — Need to lay down clear and precise rules governing the access to, and use of, data — Scope

(Charter of Fundamental Rights of the European Union, Arts 7 and 8)

14. Fundamental rights — Respect for private life — Protection of personal data –Conclusion by the European Union of an agreement with a non-member country on the transfer and processing of Passenger Name Record data — Observance of the principle of proportionality — Retention and use of the data during the air passengers’ stay in the non-member country — Minimum requirements

(Charter of Fundamental Rights of the European Union, Arts 7 and 8)

15. Fundamental rights — Respect for private life — Protection of personal data –Conclusion by the European Union of an agreement with a non-member country on the transfer and processing of Passenger Name Record data — Observance of the principle of proportionality — Retention of the data after the passengers’ departure from the non-member country — Not permissible — Exception — Passengers presenting a risk as regards terrorism or serious transnational crime

(Charter of Fundamental Rights of the European Union, Arts 7 and 8)

16. Fundamental rights — Respect for private life — Respect in the context of the processing of personal data — Obligation to allow the person concerned access to data concerning him in order to ascertain that it is correct and lawful — Scope — Conclusion by the European Union of an agreement with a non-member country on the transfer and processing of Passenger Name Record data — Need to provide for passengers to be informed about the transfer and processing of their data

(Charter of Fundamental Rights of the European Union, Arts 7 and 47, first para.)

17. Fundamental rights — Protection of personal data — Supervisory authorities — Requirement for independence — Subject matter

(Art. 16(2), TFEU; Charter of Fundamental Rights of the European Union, Art. 8(3))

1. The provisions of an international agreement entered into by the European Union under Articles 217 and 218 TFEU form an integral part of the EU legal system as from the coming into force of that agreement. The provisions of such an agreement must, therefore, be entirely compatible with the Treaties and with the constitutional principles stemming therefrom. In that regard, Article 218(11) TFEU has the aim of forestalling complications which would result from legal disputes concerning the compatibility with the Treaties of international agreements that are binding upon the European Union. A possible decision of the Court of Justice, after the conclusion of an international agreement that is binding upon the European Union, to the effect that such an agreement is, by reason either of its content or of the procedure adopted for its conclusion, incompatible with the provisions of the Treaties would inevitably provoke serious difficulties, not only in the internal EU context, but also in that of international relations, and might give rise to adverse consequences for all interested parties, including non-member countries. Having regard to the function of the procedure provided for in Article 218(11) TFEU, the mere risk of the invalidation of an act concluding an international agreement suffices for the referral to the Court to be allowed.

It must be possible, therefore, for all questions that are liable to give rise to doubts as to the substantive or formal validity of the agreement with regard to the Treaties to be examined in the context of the procedure provided for in Article 218(11) TFEU. A judgment on the compatibility of an agreement with the Treaties may in that regard depend, inter alia, not only on provisions concerning the powers, procedure or organisation of the institutions of the European Union, but also on provisions of substantive law. The same is true of a question relating to the compatibility of an international agreement with Article 6(1) TEU and, consequently, with the guarantees enshrined in the Charter of Fundamental Rights of the European Union (or ‘the Charter’), since that charter has the same legal status as the Treaties.

(see paras 67, 69, 70, 74)

2. See the text of the decision.

(see paras 76-78)

3. Recourse to a dual legal basis is not possible where the procedures laid down for each legal basis are incompatible with each other. In that regard, a difference in the voting rules within the Council may result in the incompatibility of the legal bases in question.

As regards a Council decision on the conclusion of an envisaged international agreement, based on Article 16(2) TFEU and Article 87(2)(a) TFEU, such an incompatibility does not emerge from Protocols No 21, on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, and No 22 on the position of Denmark, annexed to the EU and FEU Treaties. So far as Protocol No 21 is concerned, given that Ireland and the United Kingdom notified their wish to take part in the adoption of that decision, the provisions of that protocol will not affect the voting rules within the Council in the event of recourse to both Article 16(2) TFEU and Article 87(2)(a) TFEU for founding that decision.

As regards Protocol No 22, that protocol seeks to establish a legal framework which allows Member States to pursue the development of their cooperation in the area of freedom, security and justice through the adoption, without the Kingdom of Denmark taking part, of measures which do not bind that Member State, whilst affording that Member State the option of participating in the adoption of measures in that area and of being bound by them under the conditions set out in Article 8 of that protocol. In that regard, since the decision on the conclusion of the envisaged agreement must be based on both Article 16 TFEU and Article 87 TFEU and falls, therefore, within the scope of Chapter 5 of Title V of Part Three of the FEU Treaty in so far as it must be founded on Article 87 TFEU, the Kingdom of Denmark will not be bound, in accordance with Articles 2 and 2a of Protocol No 22, by the provisions of that decision, nor, consequently, by the envisaged agreement. Furthermore, the Kingdom of Denmark will not take part in the adoption of that decision, in accordance with Article 1 of that protocol. Protocol No 22 cannot, therefore, in this instance, result in different voting rules within the Council in the event of recourse to both Article 16(2) TFEU and Article 87(2)(a) TFEU.

(see paras 78, 107, 109-111, 113, 117)

4. Having regard both to its aims and its content, the envisaged agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data has two components, one relating to the necessity of ensuring public security and the other to the protection of Passenger Name Record data. Those two components are inextricably linked and must, therefore, both be considered to be fundamental in nature. The content of the envisaged agreement largely consists of detailed rules to ensure that the transfer of air passenger data to a non-Member State, with a view to its use for the purposes of the protection of public security and safety, takes place under conditions consistent with the protection of personal data.

In those circumstances, the decision on the conclusion of the envisaged agreement relates, in the first place, directly to the objective pursued by Article 16(2) TFEU. That provision constitutes, without prejudice to Article 39 TEU, an appropriate legal basis where the protection of personal data is one of the essential aims or components of the rules adopted by the EU legislature, including those falling within the scope of the adoption of measures covered by the provisions of the FEU Treaty relating to judicial cooperation in criminal matters and police cooperation, as is confirmed by Article 6a of Protocol No 21 and Article 2a of Protocol No 22, and the Declaration on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of Lisbon.

In the second place, that decision must also be based on Article 87(2)(a) TFEU, which states that, for the purposes of Article 87(1) TFEU, according to which the Union is to establish police cooperation involving all the Member States’ competent authorities, the Parliament and the Council may establish measures concerning the collection, storage, processing, analysis and exchange of relevant information. First, that relevant information, within the meaning of Article 87(2)(a) TFEU, in relation to the prevention, detection and investigation of criminal offences, may include personal data and, secondly, the terms ‘processing’ and ‘exchange’ of such data cover both its transfer to the Member States’ competent authorities in this area and its use by those authorities. In that regard, the fact that Passenger Name Record data is initially collected by air carriers for commercial purposes and not by a competent authority in relation to the prevention, detection and investigation of criminal offences does not preclude Article 87(2)(a) TFEU from also constituting an appropriate legal basis for the Council decision on the conclusion of the envisaged agreement.

(see paras 90, 92, 94-96, 98, 99, 101)

5. The various forms of processing to which, under an envisaged international agreement between the European Union and a non-member country, data of air passengers flying between the European Union and that non-member country may be subject — namely its transfer from the European Union to that country, access to that data with a view to its use or indeed its retention — affect the fundamental right to respect for private life, guaranteed in Article 7 of the Charter of Fundamental Rights of the European Union. Indeed, that right concerns any information relating to an identified or identifiable individual. Furthermore, the processing of the Passenger Name Record data also falls within the scope of Article 8 of the Charter because it constitutes the processing of personal data within the meaning of that article and, accordingly, must necessarily satisfy the data protection requirements laid down in that article

In that regard, the right to the protection of personal data requires, inter alia, that the high level of protection of fundamental rights and freedoms conferred by EU law continues where personal data is transferred from the European Union to a non-member country. Even though the means intended to ensure such a level of protection may differ from those employed within the European Union in order to ensure that the requirements stemming from EU law are complied with, those means must nevertheless prove, in practice, effective in order to ensure protection essentially equivalent to that guaranteed within the European Union.

That requirement of a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union applies in the case of the disclosure of Passenger Name Record data by a non-member country to third countries in order to prevent the level of protection provided for in the transfer agreement from being circumvented by transfers of personal data to third countries and to ensure the continuity of the level of protection afforded by EU law. In those circumstances, such disclosure requires the existence of either an agreement between the European Union and the non-member country concerned equivalent to that agreement, or a decision of the Commission, under Article 25(6) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, finding that the third country ensures an adequate level of protection within the meaning of EU law and covering the authorities to which it is intended Passenger Name Record data be transferred.

(see paras 122, 123, 134, 214)

6. The communication of personal data to a third party, such as a public authority, constitutes an interference with the fundamental right enshrined in Article 7 of the Charter of Fundamental Rights of the European Union, whatever the subsequent use of the information communicated. The same is true of the retention of personal data and access to that data with a view to its use by public authorities. In this connection, it does not matter whether the information in question relating to private life is sensitive or whether the persons concerned have been inconvenienced in any way on account of that interference.

Consequently, as regards an international agreement on the transfer of Passenger Name Record data to a non-member country the conclusion of which is envisaged by the European Union, both the transfer of Passenger Name Record data from the European Union to the competent authority of that non-member country and the framework negotiated by the European Union with that non-member country of the conditions concerning the retention of that data, its use and its subsequent transfer to other authorities of that non-member country, Europol, Eurojust, judicial or police authorities of the Member States or indeed to authorities of third countries, constitute interferences with the right guaranteed in Article 7 of the Charter. Those operations also constitute an interference with the fundamental right to the protection of personal data guaranteed in Article 8 of the Charter since they constitute the processing of personal data.

That said, the rights enshrined in Articles 7 and 8 of the Charter are not absolute rights, but must be considered in relation to their function in society. In that regard, the protection of the fundamental right to respect for private life at EU level requires that derogations from and limitations on the protection of personal data should apply only in so far as is strictly necessary. In order to satisfy that requirement, the legislation in question which entails the interference must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, so that the persons whose data has been transferred have sufficient guarantees to protect against the risk of abuse. It must, in particular, indicate in what circumstances and under which conditions a measure providing for the processing of such data may be adopted, thereby ensuring that the interference is limited to what is strictly necessary. The need for such safeguards is all the greater where personal data is subject to automated processing. Those considerations apply particularly where the protection of the particular category of personal data that is sensitive data is at stake.

(see paras 124-126, 136, 140, 141)

7. The requirement laid down in the first sentence of Article 52(1) of the Charter of Fundamental Rights of the European Union that any limitation on the exercise of fundamental rights must be provided for by law implies that the legal basis which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned.

(see para. 139)

8. An international agreement on the transfer of Passenger Name Record data to a non-member country the conclusion of which is envisaged by the European Union falls within the notion of law, within the meaning of Article 8(2) of the Charter of Fundamental Rights of the European Union and, therefore, of Article 52(1) thereof.

Article 218(6) TFEU reflects, externally, the division of powers between the institutions that applies internally and establishes a symmetry between the procedure for adopting EU measures internally and the procedure for adopting international agreements in order to guarantee that the Parliament and the Council enjoy the same powers in relation to a given field, in compliance with the institutional balance provided for by the Treaties. Consequently, the conclusion of international agreements covering fields to which, internally, the ordinary legislative procedure, provided for in Article 294 TFEU, applies requires, under Article 218(6)(a)(v) TFEU, the approval of the Parliament, and therefore such an agreement may be regarded as being the equivalent, externally, of that which is a legislative act internally.

It follows that the transfer of Passenger Name Record data to a non-member country, as envisaged by the integrational agreement in question, is based on some other basis that is laid down by law, within the meaning of Article 8(2) of the Charter.

(see paras 145-147)

9. The interferences with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union entailed by an international agreement on the transfer of Passenger Name Record data to a non-member country, the conclusion of which is envisaged by the European Union, are capable of being justified by an objective of general interest of the European Union and are not liable adversely to affect the essence of those fundamental rights, where the envisaged agreement is intended, inter alia, to ensure public security by means of a transfer of Passenger Name Record data and the use of that data within the framework of the fight against terrorist offences and serious transnational crime. That objective constitutes an objective of general interest of the European Union that is capable of justifying even serious interferences with the fundamental rights enshrined in Articles 7 and 8 of the Charter. Moreover, the protection of public security also contributes to the protection of the rights and freedoms of others. Since the assessment of the risks presented by air passengers by means of analysing that data before their arrival largely facilitates and expedites security and border control checks, the transfer of Passenger Name Record data to a non-member country and subsequent processing of that data may be regarded as being appropriate for the purpose of ensuring that the objective relating to the protection of public security and safety pursued by the envisaged agreement is achieved.

(see paras 148, 149, 151-153)

10. As regards an international agreement on the transfer of sensitive Passenger Name Record data to a non-member country, the conclusion of which is envisaged by the European Union, any measure based on the premiss that one or more of the characteristics set out in the envisaged agreement — such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or information about a person’s health or sex life — may be relevant, in itself or in themselves and regardless of the individual conduct of the traveller concerned, having regard to the purpose for which Passenger Name Record data is to be processed, would infringe the rights guaranteed in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, read in conjunction with Article 21 thereof. Having regard to the risk of data being processed contrary to Article 21 of the Charter, a transfer of such data to the non-member country concerned requires a precise and particularly solid justification, based on grounds other than the protection of public security against terrorism and serious transnational crime. In the absence of such a justification, Articles 7, 8 and 21 and Article 52(1) of the Charter preclude both the transfer of sensitive data to a non-Member State and the framework negotiated by the European Union with that non-Member State of the conditions concerning the use and retention of such data by the authorities of that non-Member State.

(see paras 164-167)

11. In the case of an international agreement, the conclusion of which is envisaged by the European Union, which relates to the transfer of Passenger Name Record data to a non-member country and provides for automated processing of that data with the objective of protecting public security against terrorism and serious transnational crime, the extent of the interference which automated analyses of Passenger Name Record data entail in respect of the rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union essentially depends on the pre-established models and criteria and on the databases on which that type of data processing is based. Consequently, the pre-established models and criteria must be specific and reliable, making it possible to arrive at results targeting individuals who might be under a reasonable suspicion of participation in terrorist offences or serious transnational crime and should be non-discriminatory. Similarly, the databases with which the Passenger Name Record data is cross-checked must be reliable, up to date and limited to databases used by the non-member country concerned in relation to the fight against terrorism and serious transnational crime.

(see paras 168, 172)

12. An international agreement on the transfer of Passenger Name Record data to a non-member country does not exceed the limits of what is strictly necessary in that it allows the data of all the air passengers to that country to be transferred, since that data, inter alia, facilitates security checks at borders to which, in accordance with Article 13 of the Chicago Convention on International Civil Aviation, all passengers are subject according to the laws and regulations of that non-member country.

(see paras 187-189)

13. In the case of an international agreement on the transfer of Passenger Name Record data to a non-member country, the conclusion of which is envisaged by the European Union, in order to ensure that the retention of the data transferred, the access to that data by the national authorities referred to in the envisaged agreement and the use of that data by those authorities is limited to what is strictly necessary, that agreement must lay down clear and precise rules indicating in what circumstances and under which conditions those authorities may retain, have access to and use such data.

So far as the retention of personal data is concerned, the measure must, inter alia, continue to satisfy objective criteria that establish a connection between the personal data to be retained and the objective pursued. As regards the use, by an authority, of legitimately retained personal data, the measure cannot be limited to requiring that access to such data should be for one of the objectives pursued by that measure, but must also lay down the substantive and procedural conditions governing that use.

(see paras 190-192)

14. In the case of an international agreement providing for the retention of Passenger Name Record data and its use up to the air passengers’ departure from the non-member country concerned, for the purposes, inter alia, of facilitating security checks and border control checks, its retention and use for those purposes may not, on account of its very nature, be restricted to a particular circle of air passengers, nor can it be subject to prior authorisation by a court or by an independent administrative body. Consequently, for as long as the air passengers are in the non-member country concerned or are due to leave that country, the necessary connection between that data and the objective pursued by that agreement exists, and the agreement therefore does not exceed the limits of what is strictly necessary merely because it permits the systematic retention and use of the Passenger Name Record data of all air passengers. Similarly, the systematic use of Passenger Name Record data for the purpose of verifying the reliability and topicality of the pre-established models and criteria on which the automated processing of that data is based or of defining new models and criteria for such processing, is directly related to carrying out the security checks and border control checks, and must, therefore, also be considered not to exceed the limits of what is strictly necessary.

As regards the use of Passenger Name Record data during the air passengers’ stay in the non-member country concerned, this must be based on new circumstances, since the air passengers have been allowed to enter the territory of the non-member country concerned, following verification of their Passenger Name Record data. That use requires rules laying down the substantive and procedural conditions governing that use in order, inter alia, to protect that data against the risk of abuse. Such rules must be based on objective criteria in order to define the circumstances and conditions under which the authorities of the non-member country concerned referred to in the envisaged agreement are authorised to use that data.

In this connection, where there is objective evidence from which it may be inferred that the Passenger Name Record data of one or more air passengers might make an effective contribution to combating terrorist offences and serious transnational crime, the use of that data does not exceed the limits of what is strictly necessary. In order to ensure that, in practice, those conditions are fully respected, it is essential that the use of retained Passenger Name Record data, during the air passengers’ stay in the non-member country concerned, should, as a general rule, except in cases of validly established urgency, be subject to a prior review carried out either by a court, or by an independent administrative body, and that the decision of that court or body be made following a reasoned request by the competent authorities submitted, inter alia, within the framework of procedures for the prevention, detection or prosecution of crime

(see paras 197-202)

15. In the case of an international agreement the conclusion of which is envisaged by the European Union, which relates to the transfer of Passenger Name Record data to a non-member country and provides for the retention of that data after the air passengers’ departure from that country with the objective of protecting public security against terrorism and serious transnational crime, as regards air passengers in respect of whom no risk as regards terrorism or serious transnational crime has been identified on their arrival in that non-member country and up to their departure from that country, there would not appear to be, once they have left, a connection — even a merely indirect connection — between their Passenger Name Record data and the objective pursued by the envisaged agreement which would justify that data being retained. The continued storage of the Passenger Name Record data of all air passengers after their departure from the non-member country concerned is not therefore limited to what is strictly necessary. However, in so far as, in specific cases, objective evidence is identified from which it may be inferred that certain air passengers may present a risk in terms of the fight against terrorism and serious transnational crime even after their departure from the non-member country concerned, it seems permissible to store the Passenger Name Record data concerning them beyond their stay in that non-member country. The use of Passenger Name Record data so stored should be based on objective criteria in order to define the circumstances and conditions under which the non-member country’s authorities referred to in the envisaged agreement may have access to that data. Similarly, that use should, except in cases of validly established urgency, be subject to a prior review carried out either by a court, or by an independent administrative body; the decision of that court or body authorising the use being made following a reasoned request by those authorities submitted, inter alia, within the framework of procedures for the prevention, detection or prosecution of crime. As regards the period during which that data may be retained, a five-year retention period does not exceed the limits of what is strictly necessary for the purposes of combating terrorism and serious transnational crime.

(see paras 205-209)

16. The fundamental right to respect for private life, enshrined in Article 7 of the Charter of Fundamental Rights of the European Union, means that the person concerned may be certain that his personal data are processed in a correct and lawful manner. In order to carry out the necessary checks, that person must have a right of access to the data relating to him which is being processed.

In that regard, in the case of an international agreement on the transfer of Passenger Name Record data to a non-member country the conclusion of which is envisaged by the European Union, air passengers must be notified of the transfer of their Passenger Name Record data to the non-member country concerned and of its use as soon as that information is no longer liable to jeopardise the investigations being carried out by the government authorities referred to in the envisaged agreement. That information is, in fact, necessary to enable the air passengers to exercise their rights to request access to Passenger Name Record data concerning them and, if appropriate, rectification of that data, and, in accordance with the first paragraph of Article 47 of the Charter, to an effective remedy before a tribunal.

Consequently, in the situations in which there is objective evidence justifying the use of Passenger Name Record data in order to combat terrorism and serious transnational crime and necessitating the prior authorisation of a judicial authority or an independent administrative body, it is necessary to notify air passengers individually. The same is true in the cases in which air passengers’ Passenger Name Record data is disclosed to other government authorities or to individuals. However, such information must be provided only once it is no longer liable to jeopardise the investigations being carried out by the government authorities referred to in the envisaged agreement.

(see paras 219, 220, 223, 224)

17. Under Article 8(3) of the Charter of Fundamental Rights of the European Union, compliance with the requirements regarding the processing of personal data stemming from Article 8(1) and (2) thereof is subject to control by an independent authority. The guarantee of the independence of such a supervisory authority, the establishment of which is also provided for in Article 16(2) TFEU, is intended to ensure the effectiveness and reliability of the monitoring of compliance with the rules concerning protection of individuals with regard to the processing of personal data and must be interpreted in the light of that aim. The establishment of an independent supervisory authority is therefore an essential component of the protection of individuals with regard to the processing of personal data.

(see paras 228, 229)