EDPS Opinion 15/2024 on the signing and conclusion of an Agreement between the EU and Canada on the transfer of Passenger Name Record (PNR) data

29 April 2024

Opinion 15/2024

on the signing and conclusion of an Agreement between the EU and Canada on the transfer of Passenger Name Record (PNR) data

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Council Decision on the signing, on behalf of the European Union, of an agreement between Canada and the European Union on the transfer and processing of Passenger Name Record (PNR) data and the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of an agreement between Canada and the European Union on the transfer and processing of Passenger Name Record (PNR) data .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

Executive Summary

On 4 March 2024, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of an Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record (PNR) data.

The European Parliament requested the Opinion of the Court of Justice of the EU on the previous PNR Agreement with Canada from 2014 as to its compatibility with the EU Treaties and the Charter of Fundamental Rights of the European Union. The CJEU delivered Opinion 1/15 on 26 July 2017, in which it found that the envisaged PNR Agreement between Canada and the EU could not be concluded in its form because several of its provisions were incompatible with the fundamental rights recognised by the EU, notably the right to data protection and respect for private life. Moreover, the EDPS recalls that the validity of the Union legal framework on processing of PNR data, namely Directive (EU) 2016/681, has also been challenged before the CJEU in case C-817/19. The Court in its judgment from 2022, while confirming the validity of the PNR Directive, provided important clarifications and added further specific limitations on the processing of personal data to ensure compliance with Articles 7 and 8 of the Charter.

The EDPS considers Opinion 1/15 of the CJEU as the main point of reference for the assessment of the current draft Agreement on the transfer of PNR data from the EU to Canada, and has reached the conclusion that the draft Agreement contains the necessary safeguards required in order for it to be compatible with the Charter of Fundamental Rights.

At the same time, the EDPS makes several specific recommendations with the aim to ensure that the Agreement would be interpreted and applied in compliance with the case law of the CJEU. In particular, the EDPS recommends that the provision of Article 16(3) of the draft Agreement, which allows for the retention of PNR data beyond the passenger’s date of departure in connection with the purposes set out in Article 3, is interpreted strictly and applied in a way that does not lead in practice to the retention in bulk of PNR data of departing passengers. Furthermore, the EDPS clarifies that any use of PNR data for the purposes of security and border control checks should be possible only when those checks pursue one of the purposes laid down in Article 3 of the draft Agreement, namely preventing, detecting, investigation or prosecuting terrorist offences or serious transnational crime, and not for other purposes, such as immigration control. Moreover, the EDPS underlines that access to retained PNR data without a prior review by a court or by an independent administrative body in cases of urgency, as described in Article 17(1)(a) of the draft Agreement, should be allowed only in exceptional and duly justified cases. The EDPS therefore invites the Commission to pay special attention to these aspects, as well as to the exercise of data subject rights, during the joint reviews envisaged in Article 27(3) of the draft Agreement, including by collecting the relevant statistics.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 4 March 2024, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of an Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record (PNR) data (‘the Proposals’).

2. The objective of the Proposals is to sign and conclude an Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record (PNR) data to the Canadian Competent Authority. The collection and analysis of PNR data can provide the authorities with important elements allowing them to detect suspicious travel patterns and identify associates of criminals and terrorists, in particular those previously unknown to law enforcement authorities . The future Agreement should also provide adequate data protection safeguards for the personal data transferred to Canada, in line with EU law, notably Articles 7, 8, 47 and 52 of the Charter of Fundamental Rights of the EU .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 4 March 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Proposals.

2. General remarks

4. PNR data is information provided by passengers, and collected by and held in the air carriers’ reservation and departure control systems for their own commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (the Charter). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards. 4

5. With regard to data protection in general, the EDPS recalls that in 2002 Canada has been recognised as providing an adequate level of protection for personal data transferred from the EU under Directive 95/46/EC . In 2024, after a review, the Commission concluded that Canada continues to provide an adequate level of protection under the GDPR for personal data transferred from the EU to recipients subject to Personal Information Protection and Electronic Documents Act (PIPEDA) .

6. The EDPS also recalls that PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019, called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) from 2020, adopted by means of Amendment 28 to Annex 9 to the Convention on International Civil Aviation (Chicago Convention) . All EU Member States, as well as Canada, are Parties to the Chicago Convention.

7. The European Community signed in 2005 an Agreement with Canada on the transfer and processing of PNR data . The Agreement entered into force on 22 March 2006 and included an adequacy decision issued by the European Commission that considered the commitments of the Canada Border Services Agency (CBSA) sufficient to provide an adequate protection of personal data. The Commitments of the CBSA and the adequacy decision expired on 22 September 2009.

8. In 2010, the EU opened negotiations with Canada for the purpose of concluding a new Agreement on the transfer of PNR data of passengers flying between the EU and Canada. The draft Agreement with Canada was signed on 25 June 2014. The EDPS issued an Opinion on the draft Agreement on 30 September 2013 , in which he expressed a series of serious concerns, related, among others, to the transfer of sensitive data of the passengers, the retention period, the categories of PNR data, the redress and the oversight mechanisms and the legal basis of the Agreement.

9. The draft Agreement with Canada was submitted by the Council to the European Parliament for consent in July 2014. On 30 January 2015, the European Parliament requested the Opinion of the Court of Justice of the EU (CJEU) as to whether the envisaged PNR Agreement with Canada was compatible with the Treaties and the Charter of Fundamental Rights of the European Union . 5

10. The CJEU delivered Opinion 1/15 on 26 July 2017, in which it found that the envisaged PNR Agreement between Canada and the EU could not be concluded in its form because several of its provisions were incompatible with the fundamental rights recognised by the EU, notably the right to data protection and respect for private life .

11. The EDPS considers the Opinion 1/15 as the main point of reference for the assessment of current draft Agreement on the transfer of PNR data from the EU to Canada. In this context, the EDPS makes the following specific comments and recommendations.

3. Legal basis

12. The substantive legal basis of the 2014 draft EU-Canada PNR Agreement was Article 87(2)(a) TFEU on police cooperation, in addition to the procedural legal basis of Article 218(5) TFEU. Given the fact that the Agreement was directly linked to the objective pursued by Article 16(2) TFEU, the choice of substantive legal basis was questioned by the EDPS in his 2013 Opinion and subsequently the European Parliament decided to seek the opinion of the CJEU. The CJEU in its Opinion 1/15 ruled that the Council decision on the conclusion of the envisaged agreement must be based jointly on Article 16(2) and Article 87(2)(a) TFEU .

13. In the light of this, the EDPS positively notes that the proposed Council Decisions on the signing and on the conclusion of the current Agreement are based on both Articles 16(2) and Article 87(2)(a) of the TFEU, in conjunction with Article 218(5) thereof.

4. Sensitive data

14. One of the main points of criticism of the 2014 draft EU-Canada PNR Agreement, which led the CJEU to the conclusion that the envisaged agreement was incompatible with Articles 7, 8 and 21 and Article 52(1) of the Charter, was the possibility to transfer sensitive data from the EU to Canada and the subsequent use and retention of that data by the Canadian authorities .

15. The EDPS welcomes that in the current draft Agreement the processing of sensitive data, i.e. any information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or information about a person's health or 6

5. Categories of PNR data

16. The EDPS notes the efforts made to define in a clear a precise manner the PNR data categories to be processed in the Annex to the draft Agreement. The requirement of clarity and precision was set out by the CJEU in its Opinion 1/15 , leading the Court to conclude that headings 5, 7 and 17 of the Annex to the draft 2014 EU-Canada PNR Agreement did not delimit in a sufficiently clear and precise manner the scope of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter .

17. In particular, with regard to heading 17, the EDPS notes that the draft Agreement limits the nature and scope of the information to be provided therein by referring to “Other Supplementary Information (OSI), Special Service Information (SSI) and Special Service Request (SSR)”, instead of referring to “General information, including Other Supplementary Information (OSI)”, Special Service Information (SSI).

6. Automated processing of PNR data

18. Article 15 of the draft Agreement obliges Canada to ensure that any automated processing of PNR data is based on non-discriminatory, specific and reliable pre-established models and criteria. The EDPS recalls that the CJEU in its judgment in Case C-817/19 Ligue des droits humains has clarified that reliance on pre-established criteria precludes the use of artificial intelligence technology in self-learning systems (‘machine learning’), capable of modifying without human intervention or review, the assessment process, the assessment criteria as well as the weighting of those criteria. The Court has expressed concerns that the use of such technology may pose challenges for data subjects in understanding why a given program arrives at a positive match and in challenging the non-discriminatory nature of the results. This is due to the opacity of the way in which artificial intelligence works, which could potentially deprive data subjects of their rights, notably the right to an effective judicial remedy, enshrined in Article 47 of the Charter. 7

19. In addition, in the same judgment , the CJEU further detailed the necessary measures that should be taken to address issues related to the prohibition of direct and indirect discrimination, thus giving practical effect to the requirements set out in Opinion 1/15 .

20. According to the CJEU, to avoid direct or indirect discrimination, the pre-determined criteria must be defined in such a way that “[...] while worded in a neutral fashion, their application does not place persons having the protected characteristics at a particular disadvantage”. Second, to comply with the requirements relating to the targeted, proportionate and specific nature of pre-determined criteria, the said criteria must be determined in such a way as to target specifically individuals who might be reasonably suspected of involvement in terrorist offences or serious crime covered by the Proposal. Third, in order to enhance the reliability and proportionality of the criteria both incriminating and exonerating circumstances should be taken into account. Forth, the predetermined criteria must be reviewed regularly. This review entails updating the criteria in light of the circumstances that warrant their consideration, while also factoring in the experience gained to reduce the occurrence of 'false positives'.

21. The EDPS considers these elements relevant for the implementation of the future Agreement and recommends to take them into account when carrying out the joint reviews referred to in Article 27(3) of the draft Agreement.

7. Retention of PNR data

22. The 2014 draft EU-Canada PNR Agreement provided for a general retention period of five years from the date the Canadian Competent Authority would have received the PNR data. The PNR data would have been depersonalised through masking certain categories of data, some categories already after the expiry of 30 days and some after 2 years. The CJEU, in its Opinion 1/15, when assessing the necessity and proportionality of the retention period, made a distinction between the retention of PNR data before the arrival of air passengers and during their stay in Canada , on the one hand, and after the air passengers’ departure 31 32 from Canada , on the other .

23. While concluding that the five-year retention period does not exceed the limits of what is strictly necessary for the purposes of combating terrorism and serious transnational crime , the CJEU emphasised that the retention of PNR data after the air passengers’ departure should be limited to that of passengers in respect of whom there is objective evidence from which it may be inferred that they may present a risk in terms of the fight against terrorism and serious transnational crime .

24. The EDPS notes that the current draft Agreement in Article 16 maintains the general fiveyear retention period. At the same time, the EDPS positively notes the new obligation of Canada to review the PNR data retention period every two years and determine whether it remains commensurate with the level of risk of terrorism and serious transnational crime originating from and transiting through the EU. Moreover, Canada should provide a classified report to the EU outlining the outcome of the review, including the level of risk identified, factors considered in minimizing the data retention period, and the related retention decision.

25. Regarding the retention of PNR data of departing air passengers, Article 16(3) of the new draft Agreement provides that “PNR data may be retained under this Agreement beyond the passenger’s date of departure, where Canada considers that there is a connection with the purposes set in Article 3, based on objective elements from which it may be inferred that the PNR data might make an effective contribution to address such purposes” (emphasis added). It therefore seems that, in line with Article 3(1), the retention of PNR data beyond the passenger’s date of departure would be allowed: (a) in connection with the purposes of fighting terrorist offences or serious transnational crime, but also (b) in connection with the purposes of overseeing the processing of PNR data within the terms of the Agreement, including for analytical operations.

26. Although the CJEU did not specifically address the purposes mentioned in the paragraph above under (b), the EDPS is of the opinion that same principles should apply in the latter case too. In that regard, the EDPS positively notes that, in line with Art 16(3), retention of PNR data beyond the passenger’s date of departure in connection with the purposes set in Article 3 is only permissible under certain limited circumstances. The EDPS, however, emphasises that, in line with Opinion 1/15 , these circumstances should in no way be interpreted broadly and should not lead in practice to the retention in bulk of PNR data of departed passengers.

8. Purposes and conditions for use of PNR data

27. Purpose limitation is one of the fundamental principles of the EU legal framework on data protection and a key prerequisite for ensuring the proportionality of any interference with the rights enshrined in Articles 7 and 8 of the Charter. It is even more important in the context of PNR which involves processing by law enforcement authorities of personal data of a very large number of individuals not implicated in a criminal activity.

28. The EDPS welcomes that, pursuant to Article 3 of the draft Agreement, PNR data received by the Canadian authorities should only be processed for the purposes of preventing, detecting, investigation or prosecuting terrorist offences or serious transnational crime, and to oversee the processing of PNR data, including for analytical operations.

29. However, the EDPS notes that the draft Agreement in Article 17, which regulates the conditions for the use of the retained PNR data by the Canadian Competent Authority, provides that ”the Canadian Competent Authority may only use PNR data retained in

accordance with Article 16 for purposes other than security and border control checks

where new circumstances based on objective grounds indicate that the PNR data of one or more passengers might make an effective contribution to the purposes set out in Article 3” (emphasis added).

30. While the EDPS welcomes that the draft Agreement tries to envisage clear conditions for the use of the retained PNR data, he reminds that the purposes of the use of PNR data are clearly circumscribed in Article 3 of the draft Agreement (preventing, detecting, investigating or prosecuting terrorist offences or serious transnational crime and overseeing the processing of PNR data within the terms of the draft Agreement). Having that in mind, the EDPS underlines that PNR data could be used in the context of “security and border control checks” only when those checks pursue one of the purposes laid down in Article 3 of the draft Agreement, and not for other purposes, such as immigration control. This should be assessed specifically by the Commission during the joint review.

31. Further on, the EDPS positively notes that Article 17 subjects any use of PNR data, including any disclosure, to a prior review by a court or by an independent administrative body based on a reasoned request by the competent authorities within the framework of procedures for the prevention, detection or prosecution of crime. This rule has, however, two exceptions, one of them being cases of validly established urgency. While it is customary, due to time constraints, to limit the prior review in situations of valid emergency, the EDPS would like to remind that these kinds of situations should not, in principle, pass entirely without a review, in order to avoid possible abuses. As also clarified by the CJEU in other contexts , even in cases where the prior (judicial) review was not possible ex ante, the review should still take place within a short time.

32. The EDPS therefore recommends that, during the joint reviews, the Parties assure that such urgent access without prior review by a court or by an independent administrative body is indeed performed only in duly justified exceptional cases.

9. Disclosure outside Canada

33. In Opinion 1/15, the CJEU has set out a specific requirement for the Canadian Competent Authority to disclose PNR data to government authorities of a third country. This is subject to the condition that there is either an agreement between the EU and that third country equivalent to the envisaged agreement, or an adequacy decision of the Commission, covering the authorities to which it is intended that PNR data be disclosed .

34. The EDPS positively notes that Article 20 of the current draft Agreement lays down a number of specific conditions concerning disclosure of PNR data by Canada to third countries, including the requirement in Article 20(1)(e) that “the country to which the data is disclosed has either concluded an Agreement with the European Union that provides for the protection of personal data comparable to this Agreement or is subject to a decision of the European Commission pursuant to European Union law, finding that said country ensures an adequate level of data protection within the meaning of European Union law”.

35. The EDPS furthermore notes Article 20(2) of the current draft Agreement provides for an exception to the above-mentioned requirement if “the disclosure is necessary for the prevention or investigation of a serious and imminent threat to public security and if that country provides a written assurance, pursuant to an arrangement, agreement or otherwise that the information will be protected in line with the protections set out in this Agreement”. The EDPS considers that this exception is generally in line with the corresponding provision of the Union legal framework, namely Article 11 “Transfer of data to third countries” of Directive (EU) 2016/681.

10. Access to PNR data by Europol and Eurojust

36. The EDPS notes that according to Article 6 of the draft Agreement, Canada has an obligation to share, subject to certain conditions, (1) proactively ‘analytical information containing PNR data’, and (2) reactively (on request) both PNR data or analytical information containing PNR data, with Europol, Eurojust and/or the police or judicial authorities of Member States.

37. In this context, the EDPS reminds that, in as far as the data concerns extra-EU flights between the EU and Canada, this information is already processed under the EU PNR Directive by the Member States' Passenger Information Units (PIU). The EU PNR Directive does not foresee access to this data for Eurojust, and very strictly defines the conditions under which Europol is able to access it. The EDPS therefore underlines that the EU-Canada PNR Agreement should not lead to situations where Union Agencies request data from Canada which they would not be able to request from an EU Member State, thus circumventing the conditions and the limitations provided for in the EU law.

11. Data subjects rights

38. The EDPS positively notes that the draft Agreement includes provisions that aim to protect the individual rights of air passengers. In particular, Article 11(3) stipulates that Canada is required to inform passengers in writing, individually and within a reasonable timeframe, about the processing of their PNR data by the Canadian Competent Authority and other government authorities whose functions are directly related to the purposes set out in Article 3. This notification must be provided once it no longer poses a risk to the investigations by the relevant government authorities.

39. The EDPS acknowledges the efforts made to address one of the key requirements set out by the Court in its Opinion 1/15. Specifically, it is important to ensure that the Agreement provides individuals with the right to be notified individually about the processing of their PNR data by the Canadian Competent Authority as well as by other government authorities or individuals. This is a key prerequisite to ensure that the rights to access to data and to correction (rectification) are complied with in practice.

40. The EDPS therefore recommends that special attention be given to this aspect in the joint reviews referred to in Article 27(3) of the draft Agreement. This includes collecting and sharing relevant statistics.

12. Oversight

41. Under Article 8(3) of the Charter, compliance with the data protection requirements stemming from Article 8(1) and (2) thereof is subject to control by an independent authority. In accordance with the settled case-law of the CJEU, the guarantee of the independence of such a supervisory authority, the establishment of which is also provided for in Article 16(2) TFEU, is intended to ensure the effectiveness and reliability of the monitoring of compliance with the rules concerning protection of individuals with regard to the processing of personal data and must be interpreted in the light of that aim. The establishment of an independent supervisory authority is therefore an essential component of the protection of individuals with regard to the processing of personal data .

42. Furthermore, in its Opinion 1/15, when deciding on the previous draft Agreement, the CJEU stressed that the formulation in that Agreement seemed to permit the oversight to be carried out, partly or wholly, by an authority which does not carry out its tasks with complete independence, but which is subordinate to a further supervisory authority, from which it may receive instructions, and which is therefore not free from any external influence liable to have an effect on its decisions. In those circumstances, Article 10 of the previous draft Agreement did not guarantee in a sufficiently clear and precise manner that the oversight of compliance with the rules laid down in that agreement relating to the protection of individuals with regard to the processing of PNR data would have been carried out by an independent authority, within the meaning of Article 8(3) of the Charter .

43. In that regard, the EDPS welcomes that Article 10 of this draft Agreement lays down that the data protection safeguards for the processing of PNR data under the draft Agreement must be subject to oversight by one or more independent public authorities and that Canada must ensure that these authorities have effective powers to investigate compliance with the rules related to the collection, use, disclosure, retention, or disposal of PNR data.

13. Legal remedies

44. The EDPS welcomes Article 14 of the draft Agreement obliging Canada to ensure that an independent public authority receives, investigates and responds to complaints lodged by an individual concerning their request for access, correction or annotation of their PNR 12 data, as well as effective judicial redress for any individual who is of the view that their rights have been infringed by a decision or action in relation to their PNR data.

45. As already elaborated by the CJEU , this obligation covers all air passengers, regardless of their nationality, their residence, their domicile or their presence in Canada. Furthermore, it must be understood as meaning that air passengers have a legal remedy before a tribunal, as required by the first paragraph of Article 47 of the Charter.

14. Conclusions

46. In light of the above, the EDPS concludes that the draft Agreement between the EU and Canada on the transfer of PNR data contains the necessary safeguards required in order for it to be compatible with the Charter of Fundamental Rights, as specified by CJEU in its Opinion 1/15 of 26 July 2017.

47. The EDPS furthermore makes the following specific recommendations with the aim to ensure that the Agreement would be interpreted and applied in compliance with the requirements of the CJEU: (1) to interpret and apply strictly the provision of Article 16(3) of the draft Agreement, allowing the retention of PNR data beyond the passenger’s date of departure in connection with the purposes set in Article 3, in a way that does not lead in practice to the retention in bulk of PNR data of departing passengers; (2) to use PNR data in the context of “security and border control checks” pursuant to Article 17 of the draft Agreement only when those checks pursue one of the purposes laid down in Article 3, i.e. preventing, detecting, investigation or prosecuting terrorist offences or serious transnational crime, and not for other purposes, such as immigration control; (3) to ensure that in cases of urgency, as described in Article 17(1)(a) of the draft Agreement, access to retained PNR data without a prior review by a court or by an independent administrative body is allowed only in duly justified exceptional cases; (4) to take into account the requirements of the CJEU regarding automated processing of PNR data when carrying out the joint reviews referred to in Art 27(3) of the draft Agreement; (5) to examine during the joint reviews referred to in Art 27(3) also the exercise of data subject rights, including by collecting the relevant statistics. Brussels, 29 April 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI