Joined Cases C-317/04 and C-318/04, Parliament v. Council

The Grand Chamber of the Court of Justice today annuled the Council decision in which it authorized the conclusion of an agreement between the US and the EU on the transfer of personal data.

See yesterday’s post for the facts of these two cases.

Case C-318/04
The Court first of all considered Case C-318/04, which concerned Commission Decision 2004/535/EC of 14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States’ Bureau of Customs and Border Protection.

As mentioned yesterday, Parliament claimed that the decision should be held void because it was adopted ultra vires on the basis of Directive 95/46/EC and infringed the fundamental principles of that Directive, the right to private life and the right to protection of personal data.

The Court agreed that the decision was adopted ultra vires. The Decision was based on Article 3(2) of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

This provision excludes from the Directive’s scope the processing of personal data in the course of an activity which falls outside the scope of Community law, such as activities provided for by Titles V and VI of the Treaty on European Union "and in any case processing operations concerning public security, defence, State security and the activities of the State in areas of criminal law."

The Court held that the transfer of passenger information to the United States’ Bureau of Customs and Border Protection constituted processing operations concerning public security and activities in areas of criminal law.

Referring to Lindqvist, the Court held that “the activities mentioned by way of example in the first indent of Article 3(2) of the Directive are, in any event, activities of the State or of State authorities and unrelated to the fields of activity of individuals. However, this does not mean that, because the [personal] data [of passengers] have been collected by private operators for commercial purposes and it is they who arrange for their transfer to a third country, the transfer in question is not covered by that provision. The transfer falls within a framework established by the public authorities that relates to public security.” (para. 56)

The Commission’s decision for this reason did not fall within the scope of the Directive. It was therefore not necessary to consider the other arguments put forward by the European Parliament.

Case C-317/04
The Court subsequently considered Case C-317/04, which concerned Council Decision 2004/496/EC of 17 May 2004.

By this decision, the Council authorized the conclusion of the Agreement between the European Community and the United States, in which they agreed to share information about trans-Atlantic airline passengers.

Parliament argued that Decision 2004/496 should be held void because it was incorrectly based on Article 95 EC and breached the second subparagraph of Article 300(3) EC, Article 8 of the ECHR, the principle of proportionality, the requirement to state reasons and the principle of cooperation in good faith.

The Court agreed that Article 95 EC could not be used as legal basis for adopting the Decision. It simply argued that “the Agreement relates to the same transfer of data as the decision on adequacy and therefore to data processing operations which, as has been stated above, are excluded from the scope of the Directive.”

Since the Decision for this reason should be annulled, it was again not necessary to consider the other pleas put forward by the European Parliament.

Limitation of the effects of the judgment
Although the Agreement provides that either party can terminate the Agreement at any time and the termination takes effect 90 days from the date of notification of termination to the other party, it also states that the Bureau of Customs and Border Protection’s right of access to the personal data of air passengers exist only for so long as the decision on adequacy is applicable.

The Court argued that: “Given, first, the fact that the Community cannot rely on its own law as justification for not fulfilling the Agreement which remains applicable during the period of 90 days from termination thereof and, second, the close link that exists between the Agreement and the decision on adequacy, it appears justified, for reasons of legal certainty and in order to protect the persons concerned, to preserve the effect of the decision on adequacy during that same period. In addition, account should be taken of the period needed for the adoption of the measures necessary to comply with this judgment.” (para. 73)

Therefore, the Court held that it was therefore appropriate “to preserve the effect of the decision on adequacy until 30 September 2006, but its effect shall not be preserved beyond the date upon which the Agreement comes to an end.” (para. 74).

Text of Judgment

Text of Case C-101/01, Lindqvist