proposed EU passenger name record plan

PNR (passenger name record) scheme proposed to place under surveillance all travel in and out of the EU

- All passengers to be "profiled" and the data kept for 13 years
- EU PNR plan mirrors controversial EU-US PNR scheme
- European Parliament only to be "consulted"
- Data protection fiasco
- "not convinced of the necessity of such a proposal and is therefore opposed to the proposal" (Article 29 Data Protection Working Party)

The European Commission is to put forward, on Tuesday 6 November, a proposal to collect personal data (PNR) on everyone flying in and out of the EU. Full-text of Commission's PNR proposal (pdf).

The data to be collected is almost exactly the same as that being collected under the controversial EU-US PNR scheme. Every passenger's data is to be subject to a "risk assessment" which could lead to questioning or refusal of entry. The data is to be kept for 5 years (EU-US scheme is 7 years) and then for a further 8 years in a "dormant" database (the same as the EU-USA scheme). See: Observatory on the exchange of data on passengers (PNR) with the USA

It also begs the question of why the 2004 EC Directive on the collection of API (Advance Passenger Information), due to be put into effect by all member states by September 2006, is not sufficient and why it appears only one state, Spain, is operating it? [Footnote 1] The API data required is more limited than PNR - it is the data held in the machine readable zone of EU passports (name, nationality, passport number, date of birth plus details of the flight: place of entry into EU, plane code, departure and arrival time, number of passengers and point of embarkation).

As it has not been implemented no data is available as to why this is not sufficient for the purposes of combating terrorism and organised crime. [Footnote 2] See: Observatory: EU surveillance of passengers (PNR) See also Difference between API and PNR

One of the most controversial aspects will be the "profiling" (risk assessment) of all passengers, including visitors from the USA. The "profile" will be updated and held for 13 years. The "profiling" of all passengers raises fundamental questions of privacy, data protection and human rights.

It should be noted that this is a proposal for legislation by the Commission which the Council - in its secret working parties - can change at will (and ignore European Parliament's opinion under "consultation"). So will the scope be extended cover internal EU flights (ie: between EU countries) as well?

Tony Bunyan, Statewatch editor, comments:

"This is yet another measure that places everyone under surveillance and makes everyone a "suspect" without any meaningful right to know how the data is used, how it is further processed and by whom. Moreover, the "profiling" of all airline passengers has no place in a democracy.

We have already got the mandatory taking of fingerprints for passports and ID cards and the mandatory storage of telecommunications data of every communication, now we are to have the mandatory logging of all travel in and out of the EU.

The underlying rationale for each of the measures is the same - all are needed to tackle terrorism. Yet there is little evidence that the gathering of "mountain upon mountain" of data on the activities of every person in the EU makes a significant contribution. On the other hand, the use of this data for other purposes, now or in the future, will make the EU the most surveilled place in the world".

The Commission's rationale

The Commission proposal notes that only "UK, France and Denmark" have enacted legislation for the "capture and use of PNR" - that is, only three member states out of 27 - and because there are "divergences" of standards in these three states harmonisation is needed across the EU. Moreover, as only "a limited number of Member States have adopted legislation" (just three) the "potential benefits" of an EU-PNR scheme is "not fully realised".

The Commission further says that on the basis of the EU-USA PNR agreement it has been able to:

"assess the value of PNR data"

Have they? Even in the USA they have difficulty in providing data to justify the the collection of PNR data. In October 2006 the US Department of Homeland Security said that out of 63 million visitors they had detected:

"1,200 criminals and immigration violators"

Well, that a very small number, and "criminal", how many were suspected terrorists? And what are "immigration violators" and what has this category got to do with terrorism?

The Commission also says it has learnt from:

"the experience of the UK from its pilot projects"

This is a reference to the "Semaphore" project. The long-term objective in the UK is to profile every air passenger travelling inside the UK, to and from the EU and visiting from outside the EU - is the EU going down this road?

The Commission proposes that "decentralised system" is set up, that is, one operated at national level rather than creating an EU-wide centralised system. This lends itself to different standards of data protection, different criteria for assessing risk, different criteria for watch-lists etc.

The reason for the rejection of a centralised collection of data is interesting as this is turned down because there would be: "a high risk of failure because of the vast amounts of data" - which is interesting as the VIS (Visa Information System for those visiting the EU) database is designed to hold 100 million records.

This document COM 654 (2007) is the proposal as put to the full meeting of the Commissioners dated 22 October 2007. With a bit of cleaning up (references) and a new front page it is due to be put out on Tuesday 6 November.

The Commission's proposal for EU PNR

It is being proposed as a Framework Decision (Art 43.2.b of TEU) which means that the European Parliament is only "consulted" and means that the EP's Opinion can be ignored as they routinely are.

Article 1: Objectives

Making available PNR (passenger name record) data on passengers on "international flights" to "competent authorities" in the EU member states for tackling terrorist offences and organised crime. [Footnote 3]

Article 2: Definitions

Includes: the "pull" system, where data is taken from airline reservation systems (as US does now) and "push" one, where relevant data is sent to agencies by the airlines

Article 3: Passenger Information Units

Each member state is to designate a "competent authority" as a "Passenger Information Unit" (Art 3.1)

PIU's are to collect data related to its own state. The only "good" point is that "special categories" of data like sexlife, trade union membership, political views if obtained are to be deleted "immediately" (Art 3.2)

THE PUI is to analyse the PNR data and reach a "risk assessment" for each passenger" - effectively introducing the "profiling" of all passengers. The criteria of "risk assessment" is to be based on national laws (Art 3.3). So the basis of each "risk assessment" could be different as each member state has different "watch-lists" based on different criteria and different national laws.

We now know that the USA has 755,000 people on its terrorist watchlist. However, it also uses watchlists to apprehend anyone who has broken any US law. How many people are on EU member states' lists? Will names and details be checked against the Schengen Information System (SIS and SIS II) databases whose scope goes well beyond terrorism and organised crime?

Art 3.5: says that risk assessments should:

"identify persons who are or may be involved in a terrorist or organised crime offence, as well as their associates"

The phrase "may be involved" seems very vague as does "associates". Putting the two categories together means that a person who "may be" involved in terrorism (or organised crime) and an unlimited number of "associates" can be added to the file.

Article 4: Competent authorities

Art 4.1 says that each member state shall provide a "list" of:

"competent authorities which shall be entitled to receive PNR data from the Passenger Information Units and to process them"

These PIUs and "competent authorities" in each member state would handle not just nationally gathered data but also that passed to it from other member states.

Under Art 4.2 "competent authorities":

"shall only include law enforcement authorities responsible for the prevention or combating of terrorist offences and organised crime"

But will the data be passed to internal/external security and the military defence agencies? The notion that this measure gives power solely to "law enforcement agencies" is nonsense - they may compile watchlists on organised crime but the one for terrorist suspects will be done by the security and intelligence agencies.

Almost certainly (see data protection implications below).

A key issue raised in the consultation process (see below) was which data should be transferred by the PIUs to other national agencies. Should "non-suspects" be screened out and only those presenting a risk passed to other national agencies? Or should there be the bulk transfer of all the PNR data to say MI5/MI6/GCHQ in the UK?

The Article 29 Data Protection Working Party said:

"Bulk transfer of personal data, which would include unsuspected travellers to other authorities would be disproportionate, as data may only be provided to an authority if necessary for a given purpose. This would automatically entail case-by-case provision only"

The draft Framework Decision is silent on this issue - presumably leaving it uncontrolled and up to national laws (a study of which in the security and law enforcement context has never been produced).

It also leaves quite open the issue of the onward transfer of bulk data to non-EU states such as the USA.

Article 5 : Obligation on carriers

PNR data is to be given by carriers 24 hours before departure and again and after flight boarding closure. They may be "required" to make data available earlier if there is a specific threat.

Art 5.4: Carriers based in EU must use "push" method", those outside EU "push" or "pull"

Article 8: Period of data retention

The Commission's own consultation options observed that a period long than 3.5 years:

"would be seen as excessive and not respecting data protection concerns"

Personal PNR data on every traveller is to be held in an active database for 5 years then a further 8 years in a "dormant" database (the EU-US PNR scheme: data held for 7 years then a further 8 years in "dormant" database).

Data is to be deleted after 5+8, a total of 13 years, except where data is being used for an: "ongoing criminal investigation or intelligence operation"

Why does data on passengers who have been cleared as a "risk" need to be kept for so long? This will involve millions of quite innocent people being kept on record - with the possibility that, in time, the scope of the measure is extend from organised crime, to serious crime then crime in general?

Article 10: Data protection

Art 10.1 says that

"The Council Framework Decision on the protection of data for police and judicial cooperation applies to the processing of data under this measure."

But this measure has not been adopted and is highly controversial having been completely changed by the Council ignoring the Opinions of the European Parliament, the European Data Protection Supervisor, and the EU's Article 29 Data Protection Working (Data Protection Commissioners from all 27 states) Party.

This Data Protection Framework Decision offers little or no "protection" to the individual and allows the unhindered exchange of personal data with third states like the USA. See: Statewatch's Observatory on data protection in the EU

Most crucially this Framework Decision only applies to the exchange of data between EU member states and not the collection and processing of data at national level (which the PNR proposal is based on).

No reference is made to the main 1995 EC Directive on data protection which cover the collection of PNR data by the airlines in the first place. Thus the data provided by the passenger to the airlines for the purpose of buying a ticket to travel is then to be used for an entirely different purpose - to vet people suspected of involvement in terrorism or organised crime.

To summarise:

- passenger data is collected by airlines under the national laws in place in every country on data protection under the "first pillar" (1995 EC Directive)

- this data is then access by Passenger Information Units in each state where data protection is said to come from the yet-to-be-adopted Framework Decision on data protection in police and judicial cooperation (under the "third pillar") which only regulates the exchange of data between member states - not the national laws of member states. In effect there will be no data protection law regulating the national collection and processing of data.

- internal security and intelligence agencies are expressly precluded from this proposed Framework Decision

ANNEX 1

Categories of data - EU copies US list

During the negotiations on the new EU-US PNR agreement the number of categories of data to be transferred was reduced from 34 to 19. However, the 19 items included all the data from the 34 items.

The EU is set to adopt almost exactly the same 19 sets of PNR data to be accessed - which have been criticised by the Article 29 Data Protection Working Party on more than one occasion. [Footnote 4]

Consultation process - EU Article 29 Data Protection Working Party "opposed"

In the run-up to this proposal the Commission put out a consultation document listing options. The EU's Article 29 Data Protection Working Party in response was not convinced of the necessity of the measure and concluded that it:

"have not seen any information presented by the Commission that would substantiate the pressing need to process PNR data for the purpose of preventing and fighting terrorism and related crimes or law enforcement"

It further concluded:

"Evaluation of the necessity and proportionality of the measures can only be based on the experiences with the US PNR framework. A lack of available information in this context makes it problematic to assess the necessity, effectiveness and proportionality. Anecdotal information on the processing of API and PNR data by US authorities however concerns mainly passengers incorrectly identified as a risk to air security." and

"For the reasons mentioned above, and until the Working Party is provided with clarification on these fundamental points, the Article 29 Working Party cannot conclude that the establishment of an EU PNR regime is necessary. Therefore, under these circumstances, the Working Party would be opposed to its development."

Their submission further states that:

"To the extent that measures to be developed, be they at EU level or at national level, entail a breach of Article 6 of Directive 95\46\EC and limitation to the right to private life, they should in any case respect the limits of Article 13 of Directive 95\46\EC and Article 8 of the European Convention on Human ~rights.

The Commission will have to substantiate the pressing need for the processing of PNR data' in particular in light of the following:

· The operational need and purpose of collecting PNR data at the entrance of the European Union Territory.

· The added value of collecting PNR data in light of the already existing control measures at the entrance of the EU for security purposes, such as the Schengen system, the Visa Information System, and the API system.

· The relationship with Directive 2004/82/EC. Does the Commission already have information on the implementation of this directive and its effects?

· The added value of the processing of PNR data over the processing of API data.

· The use that is foreseen for PNR data. For identifying individuals in order to ensure air security? For identifying who comes into the territory of the EU? For general negative or positive profiling of passengers? Is there an interest in specific PNR fields for specific purposes of investigating and fighting particular crimes? Would PNR data be the most adequate data for these purposes?"

Footnotes

1: Spain requires API data for flight inside the EU as well as those arriving from external destinations.

2: The 2004 Directive on the collection of API data on every travellers covers flight into the EU under border controls provisions. The new proposal covers flights in and out of the EU under police cooperation legislative powers.

3: The definition of "terrorism" is to be taken from Articles 1-4 of the Framework Decision 2002/475. The definition of "organised crime" from the, as yet not adopted, Framework Decision on the fight against organised crime - indeed, the discussions in the Council on this measure have stalled since a "general agreement" was reached in April 2006, over 18 months ago.

4: The exception being that under "General remarks" any "sensitive data" accessed is to be deleted.

Sources

- Commission proposal on the use of Passenger Name Record (PNR) for law enforcement purposes

- Observatory on the exchange of data on passengers (PNR) with the USA

- Observatory: EU surveillance of passengers (PNR)

- Difference between API and PNR

- Commission: Transfer of Air Passenger Name Record (PNR) Data: A Global EU Approach (COM 826, December 2003)

~ link ~