Legal base	Articles 82(1)(d), 87(2)(a) and 218(6)(a) TFEU; QMV; consent
Document originated	17 December 2009
Deposited in Parliament	6 January 2010
Department	Home Office
Basis of consideration	EM of 20 January 2010
Previous Committee Report	None
To be discussed in Council	No date set
Committee's assessment	Legally important
Committee's decision	Cleared; further information requested

Background

6.1  The Agreement was signed by the EU and Australia on 30 June 2008 and has been applied provisionally from that date. This proposal for a Council Decision seeks to conclude the Agreement.

6.2  The Council Decision to sign the Agreement[37] was not deposited for scrutiny. The reasons for this were outlined in the letter of the Parliamentary Under-Secretary of State at the Home Office (Meg Hillier) to Lord Roper dated 29 January 2009: policy officials believed that there was an exception in putting third country agreements forward for scrutiny. The Minister's letter accepted the assertion that the Council Decision authorising signature of the Agreement should have been deposited for scrutiny, and apologised that it was not deposited.

6.3  The proposal was published by the Commission on 17 December. The UK has three months from the date of its presentation to the Council to decide whether to opt in. Under the new procedures set out in Article 218 of the Treaty on the Functioning of the European Union (TFEU), the Council must obtain the consent of the European Parliament before the Agreement can be concluded.

The Document

6.4  This short Agreement lays down rules governing the transfer of passenger name records (PNR) data held by air carriers in the EU to the Australian Customs Service on flights from the EU to Australia.  

6.5  Under the terms of the Agreement the Australian Customs Service will process PNR data provided by EU carriers for flights 72 hours in advance of the flight. It is to be processed "strictly" for the purpose of:

i.  terrorism and related crimes;

ii.  serious crimes, including organised crime, that are transnational in nature; and

iii.  flight from warrants or custody for these crimes.

6.6  EU-sourced PNR may also be processed on a case-by-case under Australian law where it is necessary for protection of the vital interests of the data subject or other persons, in particular as regards the risk of death or serious injury to the data subjects or others, or because of a significant public health risk.

6.7  In order to comply with data protection laws the Australian authorities are obliged to provide a system, accessible by individuals regardless of their nationality or country of residence, for seeking access to, and correction of, their own personal information. They are also required to process EU-sourced PNR data received and treat individuals concerned by such processing "strictly in accordance with the data-protection standards set out in this Agreement and applicable Australian laws, without discrimination, in particular on the basis of nationality or country of residence". The period of retention for PNR data is three-and-a-half years after receipt, after which it can be archived for a further two years.

6.8  In addition, the Australian Customs Service are obliged to make publicly available, including to members of the travelling public, information regarding the processing of PNR data, including general information regarding the authority under which the data will be collected, the purpose of the data's collection, the protection that will be afforded to the data, the manner and extent to which the data may be disclosed, the procedures available for redress and contact information for persons with questions or concerns.

6.9  As an ultimate safeguard, authorities in EU Member States may exercise existing powers to suspend data flows to the Australian Customs Service in order to protect individuals with regard to the processing of their personal data where:

i.  there is a substantial likelihood that the standards of protection set out in this Agreement are being infringed;

ii.  there are reasonable grounds for believing that the Australian Customs Service is not taking or will not take adequate and timely steps to settle the case at issue; and

iii.  the continuing transfer would create an imminent risk of grave harm to data subjects.

The Minister's Explanatory Memorandum

6.10  The Parliamentary Under-Secretary of State at the Home Office (Meg Hillier) deposited an Explanatory Memorandum in Parliament on 20 January.

6.11  In overview, the Minister explains that the Government welcomes the proposal to conclude the Agreement with Australia on the processing of PNR data. She says that the UK, in common with other EU Member States, views Australia as a key partner. A clear EU-Australia PNR agreement will play a vital role in removing legal uncertainty for air carriers flying to Australia and will help ensure that, where appropriate, PNR information can be shared quickly and securely with all necessary data protection safeguards in place.

6.12  That said, the terms of the Agreement are not consistent with what the UK would want under an EU PNR proposal (for flights into the EU); the UK would like to have the ability to collect and process PNR data for a range of purposes broader than terrorism and serious crime (for example immigration offences). Council Conclusions agreed at the time of the EU-Australia negotiating mandate explicitly stated that the EU-Australia Agreement did not set a precedent for EU PNR discussions. However, the Minister reports that it has subsequently become clear during EU PNR negotiations that most Member States are hostile to the use of PNR for purposes other than the prevention of terrorism and serious crime. The UK Government is willing to abide by the terms laid down in the scope of this Agreement, as it values the legal protection on PNR data transfer that this Agreement provides, but will continue to lobby for a broader scope during EU PNR negotiations.

6.13  In terms of the impact of the Agreement on national law, the Minister states that:

• the UK has the ability to obtain passenger, crew and service data from carriers in advance of all movements into and out of the UK under the Immigration Act 1971, the Immigration, Asylum and Nationality Act 2006 and the powers of the HMRC Commissioners' Directions under the Customs and Excise Management Act 1979. Section 36 of the Immigration, Asylum and Nationality Act 2006 also creates a duty for the UK Border Agency, the police and HM Revenue and Customs to share that data among themselves where it is likely to be of use for immigration, customs, or police purposes;
• the Immigration and Police (Passenger, Crew and Service Information) Order 2008 (SI 2008/5) specifies the travel-related data that an immigration officer or a police officer can require from ships, aircraft and trains, entering and leaving the United Kingdom. The data are divided into:

a)  mandatory data which includes Advance Passenger Information (API) which must be collected and supplied when requested, and;

b)  additional data which includes PNR and must be supplied only to the extent to which the carrier knows the data.

This Agreement does not therefore have an impact on UK law.

6.14  Concerning fundamental rights, the Minister acknowledges that the Agreement provides for the processing and transfer of personal data and therefore engages Article 8 of the European Convention on Human Rights (right to respect for private and family life). However, any interference with Article 8 rights would be justified under Article 8(2) of the Convention because the Agreement:

• restricts the purposes for which data can be processed to purposes included within Article 8(2) (the prevention of and combating of terrorist offences, serious crime and flight from warrants or custody for such crimes);
• makes express provision for data security in Article 7;
• has been entered into with regard to Article 6(2) of the Treaty on European Union on respect for fundamental rights, and in particular to the fundamental rights to privacy and the protection of personal data; and
• only permits onward data transmission to a third country on a case-by-case basis, and for the purposes of preventing and combating terrorism or serious crime. The data must also not be transmitted further without the permission of the Australian Customs Service.

6.15  The Minister is confident that this is a proper area for Europe-wide action. The legislation will establish the legal principles for processing and transfer of PNR data from the European Union to Australia, and encourage collaboration on the development of PNR systems in individual Member States. It does not therefore infringe the principle of subsidiarity.

6.16  Data protection was a key issue during negotiations. The data protection regime which will apply to PNR data transferred to Australia under the Agreement is considered to be comparable to EU standards i.e. the data protection rules are considered to be "adequate" by the EU.

6.17  On whether the UK will opt-in or not, the Minister states that if the UK opted into this Decision, it would not thereafter be able to conclude any PNR agreement with Australia which would conflict with the terms of the EU-Australia Agreement. The UK is satisfied that this will not have an adverse effect on future relations with Australia.

Conclusion

6.18  We are concerned by the timing of the deposit of the Minister's Explanatory Memorandum. The proposal was published by the Commission on 17 December 2009 and yet the Explanatory Memorandum was deposited only on 20 January 2010. This delay contravenes the undertaking in Baroness Ashton's statement on JHA opt-ins that the Government will place an Explanatory Memorandum before Parliament "as swiftly as possible following publication of the proposal and no later than ten working days after the publication of the proposal". It leaves us with four weeks, rather than the agreed eight weeks, for scrutiny of the opt-in decision. We ask the Minister for an explanation of the delay and an undertaking that it will not be repeated.

6.19  In terms of substance we note that the Agreement will assist with the prevention of international terrorism and serious crime, and that it complies with fundamental rights, particularly in respect to data protection; that it does not apply to sensitive personal data; and that it has relatively short retention periods for PNR data. We also note that the Agreement has been provisionally applied since its signature by the EU and Australia in June 2008, so any comments the Committee might have would have little if any impact on its contents at this late stage.

6.20  Accordingly we clear the draft Council Decision to conclude the Agreement from scrutiny but look forward to an early explanation from the Minister on the delay in deposit.