(Transfer of PNR to the US
1 ; Google Spain
2 ; Schrems
3 ; PNR agreement with
Canada
4 ).
This is also the result of the “constitutionalisation” of data protection which is
expressly affirmed by Articles 7 and 8 of the European Charter of Fundamental
Rights which has the same value as the two Lisbon Treaties (Treaty on the European
Union and Treaty on the Functioning of the European Union).
In May 2018 the General Data Protection Regulation (2016/679)
5 has entered
fully into force, together with Directives 680
6 and 681
7 concerning processing of
personal data for contrast of terrorist and serious criminal activities.
1 CJEU 30 May 2006 in joint Cases C-317/04 and C-318/04, European Parliament v. Council of the
European Union which annuls Council Decision 2004/496/EC of 17 May 2004 on the conclusion
of an Agreement between the European Community and the United States of America on the
processing and transfer of PNR data by Air Carriers to the United States Department of Homeland
Security, Bureau of Customs and Border Protection, and Commission Decision 2004/535/EC of
14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record
of air passengers transferred to the United States Bureau of Customs and Border Protection.
2 CJEU 13 May 2014 in Case C-131/12, Google Spain v. Costeja holding that processing of
personal data is carried out in the context of the activities of an establishment of the controller on
the territory of a Member State, within the meaning of that provision, when the operator of a search
engine sets up in a Member State a branch or subsidiary which is intended to promote and sell
advertising space offered by that engine and which orientates its activity towards the inhabitants of
that Member State.
3 CJEU 6 October 2015 in Case C-362/14, Schrems v. Data Protection Commissioner (Ireland)
holding that the Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46 on
the adequacy of the protection provided by the safe harbour privacy principles and related
frequently asked questions issued by the US Department of Commerce, by which the European
Commission finds that a third country ensures an adequate level of protection, does not prevent a
supervisory authority of a Member State, within the meaning of Article 28 of that directive as
amended, from examining the claim of a person concerning the protection of his rights and
freedoms in regard to the processing of personal data relating to him which has been transferred
from a Member State to that third country when that person contends that the law and practices in
force in the third country do not ensure an adequate level of protection.
4 CJEU 26 July 2017, Opinion in Case 1/15 setting stringent conditions for the compatibility of the
Draft agreement between Canada and the European Union on the Transfer of Passenger Name
Record data from the European Union to Canada with Articles 7 and 8 and Article 52(1) of the
Charter of Fundamental Rights of the European Union.
5 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and the free movement
of such data and repealing Directive 95/46/EC (General Data Protection Regulation). For some of
the many Italian Commentaries on the GDPR, see: Bravo (2018); Califano and Colapietro (2018);
De Franceschi (2017); Di Resta (2018); Finocchiaro (2017); Pizzetti (2016); Riccio et al. (2018).
6 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data by competent authorities
for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, and on the free movement of such data, and repealing Council
Framework Decision 2008/977/JHA.
7 Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the
use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.
244
V. Zeno-Zencovich
1 ; Google Spain
2 ; Schrems
3 ; PNR agreement with
Canada
4 ).
This is also the result of the “constitutionalisation” of data protection which is
expressly affirmed by Articles 7 and 8 of the European Charter of Fundamental
Rights which has the same value as the two Lisbon Treaties (Treaty on the European
Union and Treaty on the Functioning of the European Union).
In May 2018 the General Data Protection Regulation (2016/679)
5 has entered
fully into force, together with Directives 680
6 and 681
7 concerning processing of
personal data for contrast of terrorist and serious criminal activities.
1 CJEU 30 May 2006 in joint Cases C-317/04 and C-318/04, European Parliament v. Council of the
European Union which annuls Council Decision 2004/496/EC of 17 May 2004 on the conclusion
of an Agreement between the European Community and the United States of America on the
processing and transfer of PNR data by Air Carriers to the United States Department of Homeland
Security, Bureau of Customs and Border Protection, and Commission Decision 2004/535/EC of
14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record
of air passengers transferred to the United States Bureau of Customs and Border Protection.
2 CJEU 13 May 2014 in Case C-131/12, Google Spain v. Costeja holding that processing of
personal data is carried out in the context of the activities of an establishment of the controller on
the territory of a Member State, within the meaning of that provision, when the operator of a search
engine sets up in a Member State a branch or subsidiary which is intended to promote and sell
advertising space offered by that engine and which orientates its activity towards the inhabitants of
that Member State.
3 CJEU 6 October 2015 in Case C-362/14, Schrems v. Data Protection Commissioner (Ireland)
holding that the Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46 on
the adequacy of the protection provided by the safe harbour privacy principles and related
frequently asked questions issued by the US Department of Commerce, by which the European
Commission finds that a third country ensures an adequate level of protection, does not prevent a
supervisory authority of a Member State, within the meaning of Article 28 of that directive as
amended, from examining the claim of a person concerning the protection of his rights and
freedoms in regard to the processing of personal data relating to him which has been transferred
from a Member State to that third country when that person contends that the law and practices in
force in the third country do not ensure an adequate level of protection.
4 CJEU 26 July 2017, Opinion in Case 1/15 setting stringent conditions for the compatibility of the
Draft agreement between Canada and the European Union on the Transfer of Passenger Name
Record data from the European Union to Canada with Articles 7 and 8 and Article 52(1) of the
Charter of Fundamental Rights of the European Union.
5 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and the free movement
of such data and repealing Directive 95/46/EC (General Data Protection Regulation). For some of
the many Italian Commentaries on the GDPR, see: Bravo (2018); Califano and Colapietro (2018);
De Franceschi (2017); Di Resta (2018); Finocchiaro (2017); Pizzetti (2016); Riccio et al. (2018).
6 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data by competent authorities
for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, and on the free movement of such data, and repealing Council
Framework Decision 2008/977/JHA.
7 Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the
use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.
244
V. Zeno-Zencovich