Observatory: EU surveillance of passengers (PNR)

...EU-PNR: EU endorses idea of collecting air passenger data (euobserver, link). EU Justice and Home Affairs Ministers say they have "reached an agreement on the principle of the European PNR". In fact, they have abandoned discussions on the Commission's proposal for an EU-PNR scheme and are going to start again drawing up their own proposal because a number of EU governments want to go much further. With the UK in the lead a number of member states want:

- the system to cover not just flights in and out of the EU but also flights between EU countries plus all flights within each country;
- the system to cover not just all flights but all sea and land travel as well;
-  the data and information gathered to be used not just for entry-exit but also for any law enforcement purpose.

See: Note from the Austrian delegation: EU doc no: 11724/08 Council Presidency Note: EU do no: 11281/08 and Council Presidency Note: 11772/09 plus penultimate draft of the proposal during discussions in the Council's Multidisciplinary group on organised crime: EU doc no: 7656/08 Rev 2

EU-PNR: Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes - State of play (pdf)

EU-PNR: UK House of Lords' European Union Committee: The Passenger Name Record (PNR) Framework Decision (89 pages, pdf). A very useful report which considers amongst other issues the scope of the proposed EU-PNR Framework Decision which primarily rests on tackling terrorism:.

"Most significant of all, Ms Hillier's [Home Office Minister] letter contains no reference to terrorism, and none of the examples she lists bears any relation to terrorism.

Likewise, in oral evidence she was unable to give an example of the successful use of PNR in relation to a terrorist-related offence. She did assert that PNR “has absolutely been a tool in tackling terrorism”, and explained the problems of sharing information about this in public (Q 28). However such a statement is unpersuasive when not accompanied by even a claim that PNR has succeeded in preventing, or assisting in the prevention of, a single terrorist attack, or bringing to justice the perpetrators of such an attack.

Similarly, Mr Hustinx told us that when the US Secretary of Homeland Security was addressing the European Parliament “he was careful to annex a list of some 20 or so examples to his speech and it was all about drugs and people evading paying taxes and things like that, but there was very little in terms of precision on terrorism” "

In this context it is interesting to note that in the UK Border & Immigration Agency: e-Borders: Friends of Presidency Group meeting presentation, Brussels, 27 March 2008 (pdf) it is stated that:

"The UK does not profile terrorists using PNR. In that respect we believe we are different to other governments who do use profiling techniques..." (emphasis added)

EU-UK: UK Border & Immigration Agency: e-Borders: Friends of Presidency Group meeting, Brussels, 27 March 2008 (pdf) This presentation took place as discussions are underway on a proposal to set up an EU-PNR scheme (see story below). It describes the UK timetable for checking all airline passengers against watchlists to "identify known persons of interest" and that it will eventually cover "all routes in/out on all modes of transport" (air, sea and land). See also: UK: Code of practice of practice on the management of information shared by the Border and Immigration Agency, Revenue and Customs and the Police (March 2008, pdf); Draft Regulatory Impact Assessment: Police and Justice Bill: Data Capture (pdf) and Police and Justice Act 2006 extends data gathering to passengers travelling inside the UK (pdf)

EU-PNR: Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes (EU doc no: 7656/2/08, pdf) and later Discussion of the Council's position on EU-PNR (EU doc no: 9514/08). The Council is driving a "coach and horses" through the original proposal including increasing its scope beyond terrorism and organised crime. Although "Passenger Information Units" (PIUs) who will vet passengers are to some extent limited in their use of data national "competent authorities", to whom all the data can be passed, are to be allowed to further process the data if they come across "other offences" (ie: any crime, see Article 4.5). European Data Protection Supervisor: EDPS expresses serious concerns about EU PNR proposal (Press release and Opinion, pdf)

EU-PNR: Reactions: European Airline body dismayed at proposal for EU-PNR system (Association of European Arlines, press release, pdf) Ulrich Schulte-Strathaus, Secretary General of the Association of European Airlines said:

"Commissioner Frattini's proposed decentralised system means that our carriers will have to comply with 27 different national data collection systems. We are talking about an operational and technical nightmare – and the Commission totally ignores the financial implications for the airline industry, which we haven't even started assessing yet."

The Association is also calling for the EU-PNR system to be "applied to all transport modes, so as to avoid discrimination and comptetitive distortions" (that is, to sea, rail and land travel).

Green group in the European Parliament: Civil liberties: New anti-terror measures seem unnecessary and incoherent (link) Dutch Green and civil liberties spokesperson Kathalijne Buitenweg said the:

"proposal on the retention of air passenger data in the EU seems unnecessary and incoherent. The Commission has made no attempt to justify why these measures are necessary and why the existing legislation is not sufficient - an existing Directive on passenger data from 2004 has yet to be fully implemented! (1) It is also incoherent to propose a European-level decision on data storage, while leaving the issues of data protection and how the data should be processed fully to national legislators."

ALDE (liberal group) in European Parliament: New EU anti-terrorism measures will further erode our civil liberties (link) Sophie In't Veld (D66, Netherlands) and EP rapporteur on PNR issues for the committee on Justice and Civil Liberties said:

" We should not be compounding the mistakes of the July PNR agreement with the US by introducing our own - at least until there is serious and irrefutable proof that such mass exchange of personal data is resulting in the arrest of terrorists.I remain adamant that PNR data should not be used as an indiscriminate form of data profiling."

EU-PNR: Tony Bunyan, Statewatch editor, comments:

"Unless stopped in its tracks it is just a question of time before the scope of the EU-PNR scheme is extended to cover all crime, flights inside and between Member States and sea, land and rail travel as well."

European Commission PNR proposal: Summary of impact assessment (SEC 1422) (pdf) The EU-PNR scheme plans for the personal data of all travellers by air in and out of the EU to be checked against "watchlists". The terminology in this Impact Assessment at times refers to "terrorism and organised crime" and at other times to "terrorists and criminals" suggesting that the intended scope of the measure may be changed in the near future. This impression is confirmed when the assessment speaks of:

" a wider application at a later stage. It should be left to member states to extend the scope of the proposal to other modes of transport at this point.... the majority of consulted parties agree the scope of the proposal should be limited to air transport as a first step, with the possibility of extending it to other forms of transport at a later stage...At this stage, it is thought disproportionate to extend the scope of the proposal to flights from one Member State to another Member State and to internal flights within a Member State"

On data protection the assessment is equally confused. First, it refers to the draft Framework Decision on personal data in police and judicial matters which has yet to be agreed but which offers little or no protection - and anyway, only covers the transfer of data between member states not national laws. The assessment goes on to states that member states should:

"the Convention 108 for the Protection of Individuals with Regard to Automatic Processing of Personal Data of the Council of Europe. In practice, all Member States should also already have national legislation in place to cover data processing by law enforcement authorities."

The term "should" tells us that the Commission does not know. Moreover, the failure to fully incorporate of Council of Europe's Convention 108 of 1981 plus Recommendation 15 of 1987 and its two Additional Protocols in the proposed Framework Decision is highlighted by EU Data Protection Commissioners...

~ more... ~