A controversial deal enabling transfer of EU air passenger data to US authorities as part of the global fight against terrorism was finally approved Thursday in the European Parliament.

After two years of wrangling due to privacy concerns, a majority of MEPs gave the deal their green light, with 409 voting in favor, 226 against and 33 abstentions.

The agreement, intended to replace a provisional accord from 2007, sets the legal conditions to transfer air passengers’ personal data to the U.S. Department of Homeland Security.

U.S. ambassador to the European Union, William E. Kennard, lauded the vote, saying it “reaffirms the shared commitment of the United States and the European Union to the security of the traveling public”.

The transfer of so-called Passenger Name Record (PNR) data has aided nearly every high profile recent terrorist investigation in the United States, Kennard said.

He quoted New York subway bomber Najibullah Zazi, Times Square bomber Faisal Shahzad, and David Headley, who was involved in the 2008 Mumbai attack.

PNR information is provided by travelers and collected by air carriers during reservation and check-in procedures.

It includes the name, address, phone number, credit card details, travel agency data and baggage information as well as “sensitive” data ― a religious meal choice or requests for assistance due to a medical condition.

Such data is already transferred to the U.S. authorities under a controversial 2007 accord that was rejected by the European Parliament when it won expanded powers in 2010, forcing Washington and Brussels to renegotiate the deal.

Proponents of the new accord say it provides extra protection for individual freedoms.

“The new agreement is a substantial improvement on the existing agreement from 2007,” said the EU’s Home Affairs Commissioner Cecilia Malmstroem. “It provides stronger protection of EU citizens’ right to privacy and more legal certainty for air carriers.”

The agreement says data will be stored in an active data base for up to five years, though after a first six months the information is “depersonalised” ― the passenger’s name is masked out.

It is then moved to a “dormant” database for up to 10 years, where access to the information by U.S. officials is far stricter.

The deal also provides the right to redress for citizens who believe their data has been misused.

But many leftwing, Greens and centrist parliamentarians remained critical. (AFP)