Can the US authorities require personal information of passengers travelling on flights between Europe and the USA?

Everyone has probably heard that following the terrorist attacks on 11 September 2001 the USA adopted legislation requiring airlines to and from the US territory to give the American authorities electronic access to data contained in their system for controlling and monitoring departures. After the US authorities agreed to offer sufficient level of protection for personal data provided to the US authorities the Commission issued a decision enabling transfer of data from EU airlines to the US authorities. Following this decision the European Parliament asked the ECJ to annul this decision (see cases C-317/04 and C-318/04). At the end of last year the AG Philippe Leger delivered his opinion. The claim was based on two grounds: Firstly, the adequacy decision: the Parliament claims that this decision could not be validly based on Directive 95/46 which is designated to remove obstacles to the free movement of personal data by making the level of protection of rights and freedoms in relation to those data equivalent in the Member States. The AG considers that consultation of air passengers’ data, and those data being put at the disposal of the US authorities, constitutes the processing of personal data concerning public security and the activities of the State in relation to areas of criminal law. Such activity is therefore outside the scope of the directive. As a result, he finds that the directive did not give the Commission the power to adopt decision concerning the appropriate level of protection for personal data transferred in the context of and with a view to processing expressly excluded from the scope of that directive. The AG proposed that the Court should annul this decision. Secondly, the Council decision: the Parliament claims that Art. 95 EC, which concerns the adoption of measures for approximating the legal, regulatory and administrative provisions of MS which have as their object the establishment and functioning of the internal market, is not the appropriate legal basis for the Council’s decision. Examining the aim and the content of the agreement with the US, approved by the Council’s decision, leads the AG to conclude that it simultaneously pursues two objectives: the fight against terrorism and other serious crime and the protection of personal data. He therefore concludes that Art. 95 EC does not constitutes an appropriate legal basis for such a Council decision. Of course, this is not the decision of the ECJ yet. However, if the ECJ accepts the proposed reasoning of the AG (which it in the clear majority of cases does) this would put the passengers travelling to the USA on European airlines in a very difficult position. The worst possible scenario would be that all flights of European airlines bound for the USA would be grounded. This is, however, very unlikely because this would create a massive trade war, and the USA would loose as much as the EU. What is more likely that the Commission and the Council will have to find a new legal basis for the decision. However, this is not likely to be easy – the Legal Service of the Commission has already given its best efforts to find an adequate legal basis. The problem is probably not the work of the Legal Service but the very tricky situation which the EU has been put in by the US decision, which is clearly balancing on the borders of being a violation of human rights. It remains to see what the ECJ actually decides.