The Reach of European Union Data Protection Law in Transatlantic Data Transfers for Counterterrorism Purposes

Abstract

One manifestation of tensions around the reach of EU jurisdiction is the US–EU Passenger Name Record (PNR) Agreement. The PNR Agreement provides guidance on processing and transferring EU individuals’ airline passenger data to the US Department of Homeland Security (DHS) for counterterrorism and security purposes. As the DHS does not apply the equivalent data protection standards to EU individuals’ personal data in the US as in the EU, however, the EU has continually renegotiated the Agreements, thereby increasing the territorial reach of its data protection law to enhance protection. Nonetheless, a territorial link between the EU and its exercise of jurisdiction, as well as a nationality-based link, suggest the EU has the authority to prescribe the law pertaining to its individuals’ PNR data transferred to the DHS. Through the PNR Agreement, the EU has managed to raise protection levels for all PNR data everywhere. EU authorities should push for the US–EU PNR Agreement to better protect its individuals’ data protection rights. If incorporated into the Agreement, this could be seen as a necessary form of legal diffusion of EU data protection standards beyond its borders.