Case C-318/04 concerned the legality of Commission Decision 2004/535/EC on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States Bureau of Customs and Border Protection. The Court held that the Commission Decision was wrongly based on Directive 95/46/EC because the processing of the data put at the disposal of the United States concerned public security and the activities of the state in relation to criminal law and the fight against terrorism. Processing data for such purposes is outside the scope of the protection afforded by Directive 95/46/EC according to its Article 3 § 2. Consequently, the Commission could not lawfully adopt Decision 2004/535/EC on the basis of article 25 § 6 of Directive 95/46/EC. The Court reached that conclusion even though it noted that the data was initially collected by airlines, not governmental agencies. It held that the collection and transfer of the data by the airlines was required by law for reasons of public security unrelated to their provision of transport services to passengers.
Case C-317/04 was about whether Article 95 EC could serve as the legal basis for the adoption by the Council of Council Decision 2004/496/EC of May 17th, 2004 on the conclusion of an Agreement between the European Community and the United States of America on the processing and transfer of PNR data by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection. The Court simply held that, as in Case C-318/04, the processing of data for reasons of public security and in respect of the activities of the state in relation to criminal law and the fight against terrorism, Council Decision 2004/496/EC could not be lawfully based on Article 95 EC.
On reading the judgment, note three things.