EU: US access to flight data unlawful

Guardian Unlimited

The EU's highest court today ruled that it was unlawful to order European airlines to hand over information about transatlantic air passengers to the US government.

The European court of justice ruling said the US did not provide adequate protection for air passengers' privacy.

Under the Passenger Name Records agreement, reached in May 2004, EU airlines have been obliged to give Washington 34 items of information about passengers flying to the US. The details include names, addresses, all forms of payment and contact telephone numbers.

The ruling, which gives the European commission and member states four months to find a solution, maintains the legality of the agreement until September 30 "for reasons of legal certainty".

The court ruled that the decision by the council of ministers - the decision-making body that represents national governments - to sign the agreement had lacked an adequate legal basis.

"Consequently, the court annulled the council decision approving the conclusion of the agreement and did not consider it necessary to consider the other pleas relied on by parliament," a court statement said.

The US and European airlines said the ruling would have no immediate impact on transatlantic air travel and left time to find an agreed solution to the data transfer issue.

US and commission officials said they were confident a fresh agreement could be reached. Stewart Baker, the assistant secretary of state for the Department of Homeland Security, said he expected "a solution that will keep the data flowing and the planes flying".

Franco Frattini, the commissioner with responsibility for security, said the US and EU needed "continuity".

European airlines played down the impact of the ruling, saying there should be no short-term effect on travellers.

US officials insisted that the transfer of personal details was essential in the fight against terror following September 11.

They had warned that failure to agree a deal on passenger data would mean prolonged delays for air passengers from Europe because more processing would be required on their arrival in the US.

The judges today said the agreement had to be annulled because existing EU data protection law only covers commercial data and not that used for security purposes.

Graham Watson, the Liberal Democrat leader in the European parliament, led the campaign against the legislation and welcomed the result.

"Today's judgment vindicates the four-year campaign that I and my colleagues led in the European parliament to protect the privacy of airline passengers," he said.

Stewart Room, the head of data protection at Rowe Cohen solicitors, said there was no authority within EU law for the original deal.

"The starting point is that the European directive on data protection does not extend to matters of public security," he said.

"Consequently, it is unlawful for the commission, or anyone else in the EU, to make the passenger records available to a government under that directive. It had to fail because the commission does not have the legal authority."

Mr Room said bilateral agreements between European governments and the US could be one way to circumnavigate the EU rules - something the Liberal Democrat MEP Sarah Ludford said MEPs would be alert to.

However, he questioned whether the data would be useful and whether there was still the political will to push through more information collection projects.

"Law and order agencies are sucking in more data than they can process," he said. "There may be some quality data within the information, but you end up in a situation where you cannot see the wood for the trees.

"There has to be a real question as to whether the government still has the will to carry this forward in the light of the controversy over other massive data collection projects, such as the introduction of identity cards."

The deal on "processing and transfer of personal data" on transatlantic flights was backed by EU governments and the European commission.

It meant complying with US anti-terrorist legislation requiring that all airlines operating flights to, from or across US territory provide the authorities with electronic access to all passenger data in their reservation and departure control systems.

The verdict could pose a major problem for individual European airlines. They may face the threat of sanctions from Washington if they refuse to cooperate with the US electronic passenger information requirements, or sanctions from their national data protection authorities if they do.