As announced in Official Journal C 109 of 16 April 2013, the Commission decided to withdraw this proposal, which had become obsolete.

COM(2009)0701

PURPOSE: to conclude the Agreement between the EU and Australia on the processing and transfer of EU-sourced passenger name record (PNR) data by air carriers to the Australian Customs Service.

PROPOSED ACT: Council Decision.

CONTENT: this proposal aims to conclude, on behalf of the Union, the Agreement between the EU and Australia on the processing and transfer of EU-sourced passenger name record (PNR) data by air carriers to the Australian Customs Service.

The Agreement was signed on 30 June 2008 but it has not yet been formally concluded. For details of the content of the Agreement, please refer to the summary of the document annexed to the procedure of 18/01/2010 (Council document 9946/08).

With the entry into force of the Treaty of Lisbon on 1 December 2009, the procedures to be followed by the Union in order to conclude the Agreement are governed by Article 218 of the Treaty on the Functioning of the European Union (TFEU) which states that the Council shall adopt a decision concluding the agreement, after obtaining the consent of the European Parliament .

Territorial application : i n accordance with the Protocol on the Position of the United Kingdom and Ireland in respect of the Area of Freedom, Security and Justice, annexed to the Treaty on European Union and the Treaty on the Functioning of the European Union, these Member States have notified their wish to take part in the adoption and application of this Decision. Denmark will not be bound by the Agreement.

It should be noted that this Agreement has applied provisionally since the date of its signature (30 June 2008).

05303/2010

This document sets out the Agreement between the EU and Australia on the processing and transfer of European Union-sourced passenger name record (PNR) data by air carriers to the Australian Customs Service.

The Agreement states that information sharing is an essential component of the fight against terrorism and related crimes and other serious crimes, including organised crime, that are transnational in nature, and that in this context, the use of passenger name record (PNR) data is an important tool.

This Agreement lays down rules governing the transfer of passenger name records (PNR) data held by air carriers in the EU to the Australian Customs Service on flights from the EU to Australia. Under the terms of the Agreement the Australian Customs Service (“Customs”) will process PNR data provided by EU carriers for flights 72 hours in advance of the flight.

The main provisions are as follows:

"Passenger Name Record data" (PNR data) means the record of each passenger's travel requirements which contains all information necessary for the processing of reservations and their control by the booking and participating airlines as contained in Air carriers' reservation systems.

Scope : Australia shall ensure that Customs processes EU-sourced PNR data in accordance with this Agreement. In turn, the EU shall ensure that Air carriers are not prevented from complying with Australian law regarding the transfer of EU-sourced PNR data to Customs.

Adequacy: compliance with this Agreement by Customs shall, within the meaning of relevant EU data-protection law, constitute an adequate level of protection for EU-sourced PNR data transferred to Customs for the purpose of this Agreement.

Purpose limitation for EU-sourced PNR data : Customs will process EU-sourced PNR data and other personal information derived therefrom strictly for the purpose of preventing and combating:

terrorism and related crimes; serious crimes, including organised crime, that are transnational in nature; flight from warrants or custody for crimes described above.

EU-sourced PNR data may also be processed on a case-by-case basis where necessary for the protection of the vital interests of the data subject or other persons, in particular as regards the risk of death or serious injury to the data subjects or others, or a significant public health risk, in particular as required by internationally recognised standards, such as the World Health Organisation's International Health Regulations (2005).

In addition, EU-sourced PNR data may also be processed on a case-by-case basis where such processing is specifically required by court order or Australian law for the purpose of supervision and accountability of public administration, including requirements under the Freedom of nformation Act 1982 and other pieces of legislation detailed in the Agreement.

Transfer of EU sourced PNR data : under normal circumstances, Customs shall require an initial transmission of EU-sourced PNR data at 72 hours before scheduled departure and shall require a maximum of only five routine transmissions of EU-sourced PNR data in respect of any particular flight. Irrespective of the 72-hour time frame, Customs may in addition require ad hoc pushes where necessary to assist in responding to specific threats to a flight, set of flights, route or other circumstances associated with the purpose defined in the Agreement. In exercising this discretion, Customs will act judiciously and proportionately.

Protection of personal data of individuals : Australia is obliged, under the Agreement, to provide a system, accessible by individuals regardless of their nationality or country of residence, for seeking access to, and correction of, their own personal information. The protections afforded to EU-sourced PNR data stored by Australian Government agencies under the Privacy Act 1988 (Cth) shall apply regardless of the nationality or country of residence of the individual. Customs shall process EU-sourced PNR data received and treat individuals concerned by such processing strictly in accordance with the data-protection standards set out in this Agreement and applicable Australian laws, without discrimination, in particular on the basis of nationality or country of residence.

Notification to individuals and public : Customs shall make publicly available, including to members of the travelling public, information regarding the processing of PNR data, including general information regarding the authority under which the data will be collected, the purpose of the data's collection, the protection that will be afforded to the data, the manner and extent to which the data may be disclosed, the procedures available for redress and contact information for persons with questions or concerns.

Data retention : Customs shall retain EU-sourced PNR data for no more than three-and-a-half years after the date of receipt of the PNR data by Customs, after which time the data may be archived for two further years. Archived PNR data may be accessed only on a case-by-case basis for investigative purposes.

Suspension of data flows : the competent authorities in EU Member States may exercise their existing powers to suspend data flows to Customs in order to protect individuals with regard to the processing of their personal data where there is a substantial likelihood that the standards of protection set out in the Agreement are being infringed, there are reasonable grounds for believing that Customs is not taking or will not take adequate and timely steps to settle the case at issue and the continuing transfer would create an imminent risk of grave harm to data subjects.

The competent authorities in EU Member States shall make reasonable efforts in the circumstances to provide Customs with notice and an opportunity to respond, as follows: any suspension shall be preceded by notification which allows a sufficient period of time during which time Customs and the relevant competent authorities in the EU Member States shall endeavour to achieve resolution. The EU must notify Australia of any such resolution. Any suspension shall cease as soon as the standards of protection are assured to the satisfaction of Australia and of the relevant competent authorities in the EU Member States and Australia notifies the EU accordingly.

Disclosure of EU-sourced PNR data : disclosure within the Australian Government: the Annex to the Agreement states that customs shall only disclose EU-sourced PNR data for the purpose stated in the Agreement within Australia to the Australian Government departments and agencies listed in the Schedule to this Annex, the functions of which are directly related to Article 5 (Purpose limitation) of the Agreement. The Schedule may be amended, by exchange of diplomatic notes between the Parties, to include any successor departments or agencies and any new departments and agencies established after the commencement of the Agreement

Disclosure to Third Country Governments : Customs shall disclose EU-sourced PNR data only to specific third country government authorities the functions of which are directly related to the purpose stated in the Agreement. Any such disclosure must be on a case-by-case basis and when necessary for the purpose of preventing or combating the offences listed above.

Types of EU-sourced PNR data collected : the following comprise the types of data: (i) PNR locator code; (ii) date of reservation/ issue of ticket; (iii) date(s) of intended travel; (iv) name(s); (v) available frequent flier and benefit information (i.e., free tickets, upgrades, etc.); (vi) other names on PNR, including number of travellers on PNR; (vii) all available contact information (including originator information); (viii) all available payment/billing information (not including other transaction details linked to a credit card or account and not connected to the travel transaction); (ix) travel itinerary for specific PNR; (x) travel agency/travel agent; (xi) code share information; (xii) split/divided information; (xiii) travel status of passenger (including confirmations and check-in status); (xiv) ticketing information, including ticket number, one way tickets and Automated Ticket Fare Quote; (xv) all Baggage information; (xvi) seat information, including seat number; (xvii) general remarks including Other Supplementary Information (OSI), Special Service Information (SSI) and Special Service Request (SSR) information; (xviii) any collected Advance Passenger Processing (APP) or Advance Passenger Information (API) data;

(xix) all historical changes to the PNR data listed in numbers (i) to (xviii).

Lastly, the Agreement contains clauses on the joint review of implementation, dispute settlement, amendment and review of the Agreement; termination and non-derogation.

09946/2008

PURPOSE: to conclude the Agreement between the EU and Australia on the processing and transfer of EU-sourced passenger name record (PNR) data by air carriers to the Australian Customs Service.

PROPOSED ACT: Council Decision.

BACKGROUND: the Justice and Home Affairs Council of 30 June 2008 authorised the Presidency of the Council of the European Union to sign an agreement between the European Union and Australia on the processing and transfer of European Union-sourced passenger name record (PNR) data by air carriers to the Australian Customs Service. The Agreement was signed by the Parties on 30 June 2008 and is applied provisionally as from that date. - Australian border protection legislation empowers Australian Customs to risk assess international airlines' PNR data prior to passenger arrival in Australia. This legislation aims at enhancing the security of the Australian border and territory and serves in particular to implement the Government's 2001 election programme to increase national security .

CONTENT: the main purpose of the Agreement is to ensure the exchange of European passenger information, known as Passenger Name Record or PNR data with Australian Customs pursuant to which this service assesses the risk a passenger may pose to Australian security.

Within this context, the agreement provides a legal basis for the exchange of law enforcement relevant information between the EU and Australia for the fight against terrorism and related transnational crime, including organised crime, in this case PNR data, thereby providing legal certainty for airlines, passengers and data protection authorities, whilst ensuring the protection of citizens' privacy as well as their physical security. In addition, an EU agreement enables to apply this approach homogeneously throughout the EU in order to ensure respect for individuals' right to privacy and to avoid distortion of competition between airlines.

Respecting Fundamental Rights : the Agreement aims to prevent and combat terrorism while respecting fundamental rights, and notably the protection of personal data. It aims to ensure full respect for fundamental rights enshrined in Article 6 of the Treaty on European Union and for the principles of proportionality and necessity regarding the right to respect for private and family life and the protection of personal data as set out in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.

Territorial application : the UK and Ireland will take part in the adoption of the Decision. Denmark will not be bound by the Agreement.

It should be noted that in accordance with Article 218(6)(a) of the Treaty on the Functioning of the European Union, it is provided that in the case of agreements covering fields to which the ordinary legislative procedure applies, the Council shall adopt a decision concluding the agreement, after obtaining the consent of the European Parliament .

COM(2009)0701
EUR-Lex