Judgment_paragraph 33 · European Parliament v Council of the European Union and Commission of the European Communities (C-317/04, C-318/04)

33Following the terrorist attacks of 11 September 2001, the United States passed legislation in November 2001 providing that air carriers operating flights to or from the United States or across United States territory had to provide the United States customs authorities with electronic access to the data contained in their automated reservation and departure control systems, referred to as ‘Passenger Name Records’ (‘PNR data’). While acknowledging the legitimacy of the security interests at stake, the Commission informed the United States authorities, in June 2002, that those provisions could come into conflict with Community and Member State legislation on data protection and with certain provisions of Council Regulation (EEC) No 2299/89 of 24 July 1989 on a code of conduct for computerised reservation systems (OJ 1989 L 220, p. 1), as amended by Council Regulation (EC) No 323/1999 of 8 February 1999 (OJ 1999 L 40, p. 1). The United States authorities postponed the entry into force of the new provisions but, ultimately, refused to waive the right to impose penalties on airlines failing to comply with the legislation on electronic access to PNR data after 5 March 2003. Since then, a number of large airlines in the European Union have granted the United States authorities access to their PNR data.