29.3.2006 Official Journal of the European Union L 91/49 COMMISSION DECISION of 6 September 2005 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the Canada Border Services Agency (notified under document number C(2005) 3248) (Text with EEA relevance) (2006/253EC) THE COMMISSION OF THE EUROPEAN COMMUNITIES, Having regard to the Treaty establishing the European Community, Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1), and in particular Article 25(6) thereof, Whereas: (1) Pursuant to Directive 95/46/EC, Member States are required to provide that the transfer of personal data to a third country may take place only if the third country in question ensures an adequate level of protection and if the Member States’ laws implementing other provisions of the Directive are complied with prior to the transfer. The Commission may find that a third country ensures an adequate level of protection. In that case, personal data may be transferred from the Member States without additional guarantees being necessary. Pursuant to Directive 95/46/EC the level of data protection should be assessed in the light of all the circumstances surrounding a data transfer operation or a set of data transfer operations, particular consideration being given to a number of elements relevant for the transfer and listed in Article 25(2) thereof. In the framework of air transport, the ‘Passenger Name Record’ (PNR) is a record of each passenger’s travel requirements which contains all information necessary to enable reservations to be processed and controlled by the booking and participating airlines (). For the purposes of this Decision, the terms ‘passenger’ and ‘passengers’ include crew members. ‘Booking airline’ means an airline with which the passenger made his original reservations or with which additional reser- vations were made after commencement of the journey. () OJ L 281, 23.11.1995, p. 31. Directive as amended by Regulation (EC) No 1882/2003 (O] L 284, 31.10.2003, p. 1). (3) For the purposes of this Decision, the term PNR’ includes Advance Passenger Information (API) data as provided in section 4 of the Commitments of the CBSA. ‘Participating airlines’ means any airline on which the booking airline has requested space, on one or more of its flights, to be held for a passenger. The Canada Border Services Agency (the CBSA) requires each carrier operating passenger flights bound for Canada to provide it with electronic access to PNR to the extent that PNR is collected and contained in the air carrier’s automated reservation systems and departure control systems. The requirements for personal data contained in the PNR of air passengers to be transferred to the CBSA, are based on section 107.1 of the Customs Act and paragraph 148(d) of the Immigration and Refugee Protection Act and upon implementing regulations adopted under those statutes (3). The Canadian legislation in question concerns the enhancement of security and the conditions under which persons may enter the country, matters on which Canada has the sovereign power to decide within its jurisdiction. The requirements laid down are not, moreover, inconsistent with any international commitments which Canada has undertaken. Canada is a democratic country, governed by the rule of law and with a strong civil liberties tradition. The legitimacy of its law-making process and strength and independence of its judiciary are not in question. Press freedom is a further strong guarantee against the abuse of civil liberties. The Community is fully committed to supporting Canada in the fight against terrorism within the limits imposed by Community law. Community law provides for striking the necessary balances between security concerns and privacy concerns. For example, Article 13 of Directive 95/46/EC provides that Member States may legislate to restrict the scope of certain requirements of that Directive, where it is necessary to do so for reasons of national security, defence, public security and the prevention, investigation, detection and prosecution of criminal offences. (}) Passenger Information (Customs) Regulations and Regulation 269 of the Immigration and Refugee Protection Regulations.