Commission Decision of 14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States’ Bureau of Customs and Border Protection (notified under document number C(2004) 1914) (Text with EEA relevance) (2004/535/EC)

42. Additionally, the DHS Privacy Office will address on an expedited basis, complaints referred to it by DPAs in the European Union (EU) Member States on behalf of an EU resident to the extent such resident has authorised the DPA to act on his or her behalf and believes that his or her data-protection complaint regarding PNR has not been satisfactorily dealt with by CBP (as set out in paragraphs 37 to 41 of these Undertakings) or the DHS Privacy Office. The Privacy Office will report its conclusions and advise the DPA or DPAs concerned regarding actions taken, if any. The DHS Chief Privacy Officer will include in her report to Congress issues regarding the number, the substance and the resolution of complaints regarding the handling of personal data, such as PNR(1). U.K.

(1)

Pursuant to section 222 of the Homeland Security Act of 2002 (the Act) (Public Law 107-296, dated 25 November 2002), the Privacy Officer for DHS is charged with conducting a ‘privacy impact assessment’ of proposed rules of the Department on ‘the privacy of personal information, including the type of personal information collected and the number of people affected’ and must report to Congress on an annual basis regarding the ‘activities of the Department that affect privacy ...’. Section 222(5) of the Act also expressly directs the DHS Privacy Officer to hear and report to Congress regarding all ‘complaints of privacy violations’.