Policy Sections
Mini Sections
Data-protection practitioners and legal experts have criticised the Commission's lack of standing in negotiations with the US over the advance transfer of personal data concerning airline passengers crossing the Atlantic.
Following the 11 September 2001 terrorist attacks, the United States requested access to the personal information that passengers provide when booking a ticket (Passenger Name Record (PNR)), claiming that this data is necessary for combating terrorism. The US threatened airlines that refused to provide the requested data with a withdrawal of their landing authorisation.
The Commission entered into negotiations with the US and came up with a first agreement
, under which the US could access 34 different kinds of personal information under a so-called pull scheme. This means that the US can access the data stored in airline booking systems directly instead of having the information transferred and possibly filtered, anonymised or pseudonominised (a 'push' scheme). In spite of the concerns of data protection authorities
, the Commission found the agreement adequate
(which means that it expected EU citizen's data to be treated in line with EU data-protection law). The US store the data for 42 months and, in certain cases, much longer. They promised to use it only within the Department of Homeland Security and not to pass it on to other agencies. There is, however, no verification mechanism for this promise, neither is there one for the deletion of the data at the end of the agreed storage period.
The agreement entered into force
on 28 May 2004.
Two years later, it was ruled illegal by the European Court of Justice
. The Court ruled that "neither the Commission decision finding that the data are adequately protected by the United States nor the Council decision approving the conclusion of an agreement on their transfer to that country are founded on an appropriate legal basis".
Since the US maintained its threat to non-compliant airlines, an intermediary scheme entered into force when the first agreement ended at the end of September 2006. This second agreement
, which was under the same terms as the agreement already ruled illegal, will end on 31 July 2007.
Four months prior to that date, the Commission is in secret negotiations on a new agreement. The US has already indicated
that it will not settle for anything less - namely for better privacy standards - than in the previous agreements.
See EurActiv, 01/02/07, 06/10/06, 31/08/06, 31/05/06.
According to airlines, 140 million PNR transactions were made by US authorities from the six largest airlines in 2006 alone.
In a hearing
organised by the European Parliament's Committee on Civil Liberties, Justice and Home Affairs
on 26 March 2007, MEPs, data-protection officers and privacy experts criticised the terms of the first two agreements which the Commission dealt out with the US and expressed concern on a follow-up agreement, which the Commission is currently negotiating in camera with the US side.
Under the terms of the first two agreements, the US could access 34 different kinds of personal information, including credit-card data, phone numbers, frequent-flyer habits, meal preferences and pets taken on board. Data-protection experts said that the data contained in this list does not meet the requirements of the Charter of Fundamental Rights
and of the EU data-protection Directive
.
According to the Charter and the Directive, all data-processing must be for specified, explicit and legitimate purposes only, adequate, relevant and not excessive in relation to those purposes. It must also be accurate and kept for no longer than is necessary for the purposes for which the data were collected.
With respect to the new agreement currently under negotiation, Peter Schaar, chairman of the
Article 29 Working Party
of national data protection commissioners, expressed "concern that also the new agreement will not respect European data protection requirements". He added: "Any new agreement must of course meet legal requirements, but we also have to look at possible technical safeguards, such as anonymising or pseudonominising the data. Wouldn't it be sufficient if the identity of a passenger were revealed to the US authorities only once their screening systems have found indications for a suspect? There must be proof that practices meet the requirements, including the requirement that thy are necessary, not just useful for the US side. The way to ensure this is an independent audit of the practices, to be carried out jointly by both sides and including data- protection authorities."
MEP Stavros Lambrinidis (PES, Greece) said that he was "concerned about the amount of data transferred as well as about the unclear purposes for which the will be used". He said that what concerned him most was the way in which the agreement tore down the separation between private and public data, by using data that passengers provided voluntarily in order to obtain a better service for screening purposes. Lambrinidis said: "The transfer of PNR data has only been scrutinised by the Parliament once, and we were critical about it. We ask to evaluate a future agreement."
Data-protection expert and Commission adviser Professor Spiros Simitis said that the Commission had "clearly breached its obligations" by negotiating agreements that were in breach of EU data-protection laws. As an example he mentioned that under EU law, the purpose for the collection of personal data must be defined in advance. "There can't be such a thing as a data magnet, which collects data without a clear definition of the purpose," adding that the purpose given by the US would be considered insufficient under EU law. "Undefined terms like 'terrorism' and 'public interest' are completely counterproductive and inadmissible for any functioning data- protection rules."
Marc Rotenberg of the
Electronic Privacy Information Center
in Washington, DC, pointed out what he called "a critical shortcoming of the US Privacy Act", namely that it contains "no protection at all for non-US citizens". This data, he stressed, is being used by US authorities for a range of purposes other than the fight against terrorism, including for example immigration control. Rotenberg pointed out that even US government audits
have found flaws in programmes dealing with this data, such as Secure Flight and the Automated Targeting System
(ATS
), which possibly exceeds the terms of the PNR agreement.
Commission Director-General Jonathan Faull replied that "on ATS the situation is clear. I got a letter signed by Stewart Baker (US Department of Homeland Security ) assuring us that the use of ATS in no way violates the PNR agreement."
Gus Hosein of the NGO
Privacy International
said that he was shocked by the confidence that the Commission placed in US assurances of compliance with the terms of the various agreements. He quoted former US defence secretary Donald Rumsfeld, who said: "There are things that we know and things that we don't know, but what concerns us most is the things we know that we don't know."
One such example, Hosein said, is the question of "what is happening to our data once it has been transmitted to US authorities", a question that occurs even more when someone is travelling with a US air carrier, who is subject to different, even more intransparent data-forwarding schemes. On the other hand, Hosein questioned the role of the commission, who, he said knew before the US Congress of the existence of ATS.
(26 March 2007)
(27 March 2007)
[DE]
(95/46/EC; 24 October 1995)
(17 May 2004 )
[FR]
[DE]
(2004/82/EC; 29 April 2004)
(25 June 2003)
(Provides links to key documents) [FR]
[DE]
(21 March 2007)
(21 March 2007)
(21 March 2007)
(9 July 2004)
(Commentary published in the Washington Post newspaper; 29 August 2006)
(22 March 2007)
Background document [FR]
(26 March 2006)
(21 March 2007)
(21 March 2007)
(21 March 2007)
(21 March 2007)
(22 December 2006) 
Bulgaria
Czech Republic
France
Germany
Hungary
Poland
Romania
Slovakia
Turkey
Del.icio.us
Digg It
Technorati
News: 
Europeans challenge Europe
Evropa.dnevnik.bg:
EurActiv.cz:
EurActiv.de:
EurActiv.fr:
EurActiv.hu:
EurActiv.pl:
EurActiv.ro:
EurActiv.sk:
EurActiv.com.tr: