After the events of 11 September 2001 the US Government implemented legislation requiring all airlines flying into the US to provide data relating to the passengers and crew. All EU airlines were to provide this data by 5 March 2003, failing which they would face penalties under US law.
This legislation created fundamental difficulties for EU airlines which would have to break EU Data Protection Rules in order to comply. For example, the EU Rules state that data may only be transmitted from the EU to a third country if the third country provides an adequate level of data protection, as approved by the Commission; the US has not been so approved.
Following a meeting on 17/18 February 2003 the European Commission and the US Customs Commission released a Joint Statement on the transfer to US Customs of Passenger Name Record (PNR) data from airlines operating in the EU. The Statement is intended to prevent EU airlines from facing EU sanctions for having complied with the US requirements; in order to obtain the EU Commission's consent to the transfer of PNR data, the US has given various undertakings concerning the use of such data. The Joint Statement has no legal basis, but was intended to be the prelude to a bilateral agreement.
However, on 13 March 2003 the European Parliament considered the Joint Statement and passed a resolution disapproving the actions of the...