Joined Cases C-317/04 and C-318/04 | Court of Justice of the European Union | Grand Chamber | 30 May 2006

Practice takeaways: ① The purpose and context of a processing operation can determine which EU legal regime applies. ② Data initially collected by a private company for commercial purposes do not necessarily remain within the same legal framework when later processed for public-security and law-enforcement purposes. ③ Directive 95/46 expressly excluded certain public-security and criminal-law processing from its scope. ④ The Commission therefore could not use the Directive’s third-country adequacy mechanism to authorize the PNR transfers at issue. ⑤ For the same reason, Article 95 EC —now Article 114 TFEU—could not provide the legal basis for the Council to conclude the EU-U.S. PNR Agreement. ⑥ The Court annulled the measures on competence and scope grounds without deciding whether the PNR regime itself violated privacy or proportionality.

Parliament v Council asks a deceptively simple question: does EU data-protection law continue to govern personal data originally collected for a commercial purpose when those same data are later transferred to government authorities for national-security and law-enforcement purposes?

The case arose from the post-9/11 transfer of airline Passenger Name Record—or PNR—data from European airlines to U.S. Customs and Border Protection. Airlines collected those records to book and operate flights. But the United States required access to them to prevent and combat terrorism and other serious crimes.

The Court held that the purpose of the relevant processing changed the legal analysis. Although airlines initially collected PNR data in the course of a commercial activity, the transfer to U.S. authorities was undertaken within a framework concerned with public security and criminal law. That processing therefore fell outside the material scope of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46 or the Data Protection Directive.)

The consequence was significant: neither the Commission’s adequacy decision nor the Council decision approving the EU-U.S. agreement could rest on the legal bases the institutions had chosen. The Court annulled both.

But the judgment is also notable for what it did not decide. The Court did not hold that the United States provided inadequate protection. It did not determine that the transfer was disproportionate. And it did not decide the Parliament’s fundamental-rights challenge. It stopped once it concluded that the institutions had used a data-protection framework that did not legally govern the processing at issue.

The short version

After the terrorist attacks of September 11, 2001, the United States adopted legislation requiring airlines operating flights to, from, or through U.S. territory to provide customs authorities with electronic access to Passenger Name Record (PNR) data contained in airline reservation and departure-control systems. The European Commission warned that those requirements could conflict with European data-protection law, while U.S. authorities maintained the possibility of sanctions against airlines that did not comply. By March 2003, several large European airlines were already providing access. (Judgment, para. 33; Opinion, paras. 4–5.)

The information involved was substantial. The U.S. arrangements covered PNR fields including the passenger’s name and address, reservation information, forms of payment, telephone numbers, email address, travel agency, travel status, seat information, no-show history, general remarks, and collected Advance Passenger Information System information. (Judgment, paras. 25–27.)

The Commission negotiated with U.S. Customs and Border Protection, or CBP, and developed a two-part legal structure. First, the Commission adopted Decision 2004/535, finding under Article 25(6) of Directive 95/46 that CBP provided an adequate level of protection for the relevant PNR data. Second, the Council adopted Decision 2004/496, approving an agreement between the European Community and the United States governing the processing and transfer of those data. (Judgment, paras. 20–32, 34–43.)

The European Parliament challenged both measures. It argued, among other things, that the Commission had acted beyond the powers conferred by Directive 95/46 and that Article 95 EC was not an appropriate legal basis for the Council decision. It also raised fundamental-rights and proportionality objections to the PNR regime. (Judgment, paras. 50, 62.)

The Court joined the two actions and resolved them together.

Why the case matters

Parliament v Council is an important early case about the material scope of EU data-protection law.

Its core lesson is not that airline reservation information somehow ceases to be personal data when government authorities want it. The case proceeds on the premise that PNR information is personal data and that its transfer and use constitute processing.

The critical issue was different: what processing operation was the Court evaluating, and for what purpose was that processing occurring?

The airlines initially collected passenger information to provide air-transport services. That was commercial processing. But the Commission’s adequacy decision did not concern the ordinary collection of those records to book a ticket. It concerned making those records available to CBP so that U.S. authorities could use them for terrorism prevention, serious-crime enforcement, and related public-security objectives.

For the Court, those were legally different processing operations.

That distinction drove the result. The fact that data originated in a commercial relationship could not bring a later security and law-enforcement use within a directive that expressly excluded processing in those fields. (Judgment, paras. 54–59.)

The case is therefore useful well beyond PNR.

The history of a dataset does not, by itself, determine the legal characterization of every later use of it. Purpose, recipient, legal authority, and processing context matter.

Key holding

The Court reached two closely connected conclusions.

• First, the Commission’s adequacy decision fell outside Directive 95/46. Article 3(2) excluded processing concerning public security and State activities in areas of criminal law. The PNR transfers to CBP were undertaken precisely for those purposes. Because the relevant processing fell outside the Directive, Article 25(6)—the Directive’s adequacy mechanism—could not serve as the legal basis for the Commission’s decision. The Court annulled Decision 2004/535. (Judgment, paras. 54–61.)
• Second, the Council could not rely on Article 95 EC, read together with Article 25 of Directive 95/46, to approve the international agreement. The agreement concerned the same PNR transfers that the Court had just found outside the scope of the Directive. Article 95 EC therefore could not establish Community competence to conclude that agreement on the theory advanced by the Council. The Court annulled Decision 2004/496 as well. (Judgment, paras. 67–70.)

The Court did not need to address the Parliament’s remaining grounds of challenge.

The legal framework

Directive 95/46 was built around two related objectives: protecting fundamental rights, particularly privacy, and allowing personal data to move within the internal market.

Its definition of processing was deliberately broad, encompassing collection, storage, consultation, use, disclosure by transmission, and otherwise making data available. The Directive also created a third-country transfer regime under Article 25. Personal data covered by the Directive generally could be transferred to a third country only where an adequate level of protection existed, and Article 25(6) empowered the Commission to recognize such adequacy.

But the Directive did not apply to every processing operation.

Article 3(2) excluded processing occurring in activities outside the scope of Community law and, expressly, processing operations concerning public security, defence, State security, and activities of the State in areas of criminal law.

That exclusion became the hinge of the case.

The Court’s analysis

1. The relevant processing was the transfer for security purposes

The airlines initially collected PNR data commercially to sell tickets and provide transportation services. But the adequacy decision concerned a different processing operation: transferring those data to U.S. authorities for security and law-enforcement purposes. The commercial origin of the data therefore did not determine the legal character of their later use. (Judgment, paras. 57–58.)

2. The transfer fell within the Article 3(2) exclusion

CBP obtained PNR data to prevent and combat terrorism, serious transnational crime, and related offenses. The Court therefore characterized the transfer as processing concerning public security and State activities in areas of criminal law—activities expressly excluded from Directive 95/46 by Article 3(2). (Judgment, paras. 54–56.)

3. The airlines’ private status did not change the analysis

Although private airlines collected and transmitted the data, the transfers occurred within a framework established by public authorities and relating to public security. (Judgment, para. 58.)

Advocate General Léger similarly emphasized that compulsory disclosure of commercially collected data for security and law-enforcement purposes was not fundamentally different from a direct exchange between public authorities. (Opinion, paras. 159–160.)

4. The Commission could not rely on the Directive’s adequacy mechanism

Because the PNR transfers fell outside Directive 95/46, the Commission could not use Article 25(6) of that Directive to declare CBP adequate for those transfers. The Court therefore annulled the adequacy decision. (Judgment, paras. 59–61.)

Importantly, the Court did not find that CBP failed the adequacy test. It held that the Directive’s adequacy mechanism did not apply to this processing in the first place.

5. The same problem defeated the Council decision

The Council had relied on Article 95 EC—the internal-market legal basis for Directive 95/46—to approve the EU-U.S. PNR Agreement. But the agreement concerned the same transfers that fell outside the Directive. Article 95 EC, read with Article 25, therefore could not establish Community competence to conclude it. (Judgment, paras. 67–69.)

The result was the same at both levels: the Commission could not authorize the transfers through an adequacy decision, and the Council could not approve the corresponding international agreement on the Directive’s internal-market legal foundation.

The Advocate General’s Opinion

Advocate General Philippe Léger reached the same conclusion on the central scope issue. Article 25’s third-country transfer regime could apply only where the underlying processing itself fell within Directive 95/46. Because the PNR transfers concerned public security and State activities in criminal law, they fell outside the Directive. The airlines’ original commercial collection of the data did not change the purpose of the later processing. (Opinion, paras. 83–105.)

Léger went further than the Court by addressing the Parliament’s privacy and proportionality arguments. He considered the PNR regime an interference with private life under Article 8 ECHR and emphasized that seemingly innocuous data could become revealing when combined to construct individual profiles. (Opinion, paras. 211–214.)

He nevertheless considered the interference justified by the objectives of combating terrorism and serious crime and found the safeguards and retention arrangements within the institutions’ discretion. That included general availability of PNR data for three years and six months and longer retention of certain manually accessed records. (Opinion, paras. 214–246.)

The Court did not reach those privacy and proportionality questions, resolving the case instead on the Directive’s scope and the resulting lack of a proper legal basis.

The personal-data dimension

Parliament v Council illustrates an important distinction between the nature of data and the legal context of processing.

Nothing in the judgment suggests that passenger names, addresses, payment details, contact information, itineraries, seat assignments, or other PNR fields stopped being information relating to identifiable individuals.

What changed was the processing operation.

An airline might collect a passenger’s address and credit-card information because it needs to sell and administer a ticket. A government authority might subsequently obtain the same fields to identify patterns, assess risk, investigate terrorism, or enforce criminal law.

The bytes may be the same. The legal purpose is not.

That distinction explains why the Court refused to reason backward from the commercial collection of the data. The question was not simply, “Why did the airline collect this information?” It was also, “Why is this information now being transferred and processed?”

For modern data-governance programs, that remains an important analytical habit. A dataset should not be classified once and assumed to remain legally unchanged through every downstream use. New purposes, recipients, governmental mandates, and processing contexts can trigger a different legal analysis.

What the Court did—and did not—decide

The Court did decide that:

• transferring PNR data to CBP for terrorism prevention, serious-crime enforcement, and related security purposes constituted processing concerning public security and State activities in criminal law;
• the fact that airlines originally collected those data commercially did not bring that later processing within Directive 95/46;
• Commission Decision 2004/535 therefore could not lawfully rest on Article 25(6) of the Directive;
• Article 95 EC, read together with the Directive, likewise could not support the Council’s approval of the EU-U.S. PNR Agreement; and
• both measures had to be annulled. (Judgment, paras. 54–70.)

The Court did not decide that:

• PNR data were not personal data;
• transfers of PNR data for security purposes were categorically unlawful under EU law;
• the United States failed to provide adequate substantive privacy protections;
• the amount of PNR information transferred was disproportionate;
• the applicable retention periods violated the right to privacy; or
• the entire PNR regime violated Article 8 ECHR.

Those issues were unnecessary to the judgment once the Court concluded that the institutions had relied on legal bases incapable of supporting the measures.

That limitation is essential to reading the case correctly.

The remedy: annulment without an immediate regulatory vacuum

The Court annulled both contested decisions, but it did not allow the adequacy decision to disappear immediately.

The EU-U.S. Agreement provided that termination would take effect 90 days after notification. The Court reasoned that the Community could not rely on its own law to excuse nonperformance of an international agreement during that period. Given the close relationship between the agreement and the adequacy decision, legal certainty and protection of the persons concerned justified temporarily preserving the effects of the adequacy decision. (Judgment, paras. 71–74.)

The Court therefore preserved those effects until 30 September 2006, but not beyond the date on which the agreement itself ended.

That remedial choice is another reminder that annulment in EU law does not always mean instantaneous disappearance of every legal effect.

Parliament v Council under today’s EU data-protection framework

The legal framework has changed substantially since 2006. Directive 95/46 has been replaced by the GDPR, while processing by competent authorities for criminal-law purposes is governed separately by the Law Enforcement Directive (Directive (EU) 2016/680).

PNR processing now also has a dedicated framework. Directive (EU) 2016/681 (the PNR Directive) governs airline PNR data used by Member States for preventing, detecting, investigating, and prosecuting terrorism and serious crime.

These developments reinforce rather than diminish the judgment’s institutional lesson: the legal framework must fit the processing activity. A data-protection directive could not supply authority for security and law-enforcement processing that its own scope expressly excluded.

In that sense, Parliament v Council remains as much a case about legal architecture as about privacy.

Conclusion

Parliament v Council did not invalidate the PNR regime because passenger data were too sensitive to transfer to the United States. The Court never reached that question.

Instead, the institutions had relied on Directive 95/46 to govern security and law-enforcement processing that the Directive itself excluded. The airlines’ original commercial collection of the data did not change the character of their later governmental use.

The enduring lesson is simple: follow the processing, not merely the data.

When purpose, recipient, and legal context change, the applicable legal framework may change too.

Sources and Additional Resources

Sources

CJEU judgments, Advocate General opinions, procedural notices, summaries, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database. The InfoCuria case record confirms that C-317/04 was joined with C-318/04 and identifies the Grand Chamber judgment of 30 May 2006 and Advocate General Léger’s Opinion of 22 November 2005.

Search Joined Cases C-317/04 and C-318/04 on InfoCuria

• Court of Justice of the European Union, Grand Chamber, Joined Cases C-317/04 and C-318/04, European Parliament v Council of the European Union and European Parliament v Commission of the European Communities, Judgment of 30 May 2006, ECLI:EU:C:2006:346.
• Advocate General Philippe Léger, Opinion in Joined Cases C-317/04 and C-318/04, delivered 22 November 2005, ECLI:EU:C:2005:710.

Additional resources

• Directive 95/46/EC. The Data Protection Directive supplied both the adequacy mechanism invoked by the Commission and, through Article 3(2), the material-scope exclusion that ultimately defeated that approach. Read the Directive.
• Directive (EU) 2016/680 — Law Enforcement Directive. The modern EU framework governing processing by competent authorities for criminal-law and related public-security purposes. Read the Directive.
• Directive (EU) 2016/681 — PNR Directive. The later EU legislation specifically governing airline PNR transfers and processing for terrorism and serious-crime purposes. Read the Directive.
• Treaty Establishing the European Community (TEC) (Nice consolidated version), Article 95, 2002 O.J. (C 325) 33 (now Article 114 TFEU). Read Article 95 EC

Related reading from The de la Torre Review

• “Lindqvist: When a Parish Website Became Data Processing.” Lindqvist addressed the material scope of Directive 95/46 and explained the exclusion for activities falling outside Community law. Parliament v Council later applied that distinction in the very different context of compulsory transfers of commercially collected passenger information for public-security and law-enforcement purposes. Read the Article.
• “Ireland v. Parliament: The EU Had Power to Require Data Retention—But That Wasn’t the End of the Story.” Ireland later expressly distinguished Parliament v Council when upholding the legal basis of the Data Retention Directive. Unlike the PNR framework, which concerned transfers to public authorities for security and law-enforcement purposes, the Data Retention Directive regulated providers’ retention obligations and stopped short of governing law-enforcement access or use. The comparison helps define the boundary the Court drew between private-sector retention obligations and governmental processing for security purposes. Read the Article.
• “Digital Rights Ireland: Why Communications Metadata Can Reveal a Life.” A closer look at the Court’s later treatment of large-scale government access to communications data, including the privacy implications of collecting and retaining metadata for public-security and law-enforcement purposes. It provides a natural bridge from the early PNR dispute in Parliament v Council to the Court’s developing jurisprudence on government access to personal data. Read the article