Airline security: Give us those data

June 2, 2006
The ruling that the transfer of airline data is unlawful was based on a legal technicality that is likely to be circumvented by a new agreement.

A transatlantic deal on information transfer is struck down

WHOOPS of joy from civil libertarians greeted the European Court of Justice's decision this week that a deal between Europe and America on the transfer of airline passenger data is unlawful. But their victory may be short-lived. Contrary to many reports, the court's ruling did not even broach the issue of passengers' privacy rights. It was instead based on a legal technicality that is likely to be circumvented by a new agreement.

After the terrorist attacks of September 11th 2001, Washington passed a law requiring airlines operating flights to or from the United States--or even across its territory--to provide American customs authorities with electronic access to the data contained in the airlines' automated reservation and departure control systems, including passengers' names, addresses, credit card numbers, on-flight meal preferences, and American contact details. Washington threatened airlines who refused to supply such data with fines and the withdrawal of landing rights.

Europeans are by far the biggest group of foreigners flying to the United States. In 2004, 9.6m EU citizens entered the United States by air, representing 48% of all foreign air travellers coming to America.

While accepting the legitimacy of American security interests, the EU made clear that any such arrangement with European airlines had to be compatible with European law, notably its data protection directive. After 18 months of negotiations, a deal was reached in May 2004, which appeared to satisfy those concerns. But it was blasted by European civil-liberty groups. The European Parliament promptly lodged an appeal with the European Court on the grounds that the agreement infringed privacy rights and lacked an adequate legal basis.

In its ruling on May 30th, the court upheld the second of those challenges. Because the information contained in passenger records was collected by airlines for their own commercial use, the EU could not legally agree to provide that data to the American authorities, it said. The EU's data-protection directive concerned essentially the processing of data by law enforcement authorities. The EU's agreement with the United States therefore fell outside its scope and should be annulled.

This does not mean, as some reports have suggested, that transatlantic air travel will now be thrown into chaos. The court gave the United States and the EU until the end of September to thrash out an alternative legal grounding for their data-transfer agreement. Until then, the present arrangements will continue to apply and passengers will be able to travel to and from the United States as before.

Having decided that the agreement was not valid, the court decided it was not necessary for it to consider the European Parliament's other challenges, notably its privacy plea. So although the parliament may claim a victory, it is likely to be a pyrrhic one. It is now calling for any renegotiated agreement to contain "water-tight guarantees on civil liberties". But parliament has no say over international treaties and agreements.

A spokesman for America's Department of Homeland Security, for which the passenger data is collected, said that privacy was anyway not really the issue, because his department could obtain the same information by questioning passengers on arrival. But security was strengthened by having it provided in advance. "For now, the planes will continue to fly and security data will continue to be exchanged. There won't be any lowering of the data-protection standards or disruption to air traffic in the near term."

Despite the ruling's inscrutability, many regard it as important, especially in the light of a number of decisions on data protection soon to be made by European lawmakers, "I see the judgment as a shot across the bows," Chris Pounder, a data-protection expert with Pinsent Masons, declared: "Security and privacy have to be balanced, which most reasonable people will accept. There must be independent supervision of the whole process so that those who use powers to obtain personal data do not exceed those powers."

SOURCE: The Economist