In a move to fight terrorism, Brussels proposed yesterday (21 September) a set of guidelines on the exchange of passenger data with countries outside the European Union. Meanwhile, the European Parliament has approved a bill that requires airlines to give families prompt information on air crash passengers.
The guidelines, tabled by the European Commission, set the tone for upcoming negotiations on new passenger name record (PNR) sharing agreements with the US, Australia and Canada.
"PNR data has proven to be an important tool in the fight against serious transnational crime and terrorism, but at the same time, it raises important issues about protection of personal data," said EU Home Affairs Commissioner Cecilia Malmström.
The Commission communication sets out general principles that any PNR agreement with a third country should be used exclusively to fight terrorism and serious transnational crime, and should be limited to what is necessary for that purpose. This should be clearly listed in the agreement.
To ensure that privacy is fully respected, the Commission wants passengers to receive clear information about the exchange of PNR data, have the right to see their own PNR data and have the right to effective administrative and judicial redress.
The guidelines spelled out yesterday by the EU executive also envisage that third countries must ensure a high level of data security and effective independent oversight of the authorities that use PNR data. They also foresee limits on who has access to the data gradually during the period of retention.
MEPs back rapid data sharing on air crash passengers
European Union lawmakers approved a bill on Tuesday requiring airline passengers flying from airports in the 27-nation bloc to name a person to be informed in the event of an accident.
The bill, aimed at informing families quickly in case of accidents, said airlines would also have to hand over a passenger list within two hours of an accident being reported.
"EU airlines, as well as non-EU airlines departing from an EU airport, will be obliged to produce a list […] at the latest within two hours of the notification of the occurrence of an accident," the European Parliament said in a statement.
The new rules are part of the bloc's plan to harmonise and strengthen the independence of air accident investigations, making them free of pressure from regulatory or other authorities.
They have to be passed by the EU Council of Ministers before taking effect.
"The new rules will allow us to improve investigations […] they will also establish uniform rules for assisting victims of air accidents and their relatives," said EU Transport Commissioner Siim Kallas.
A new body, the European Network of Civil Aviation Safety Investigation Authorities, will be created to advise the EU institutions and make Europe-wide air safety recommendations.
The new rules oblige air safety investigation authorities to publish final accident reports as quickly as possible – preferably within twelve months of an accident.
After an investigation, safety recommendations will be sent to the airline involved, which will have 90 days to respond.
The Greens criticised the proposals. German Green MEP Jan Philipp Albrecht said:
"Today's proposals show that the Commission has still not fully got the message on passenger data transfer. The proposed mandates fail to provide sufficient guarantees to ensure that EU data protection law will be respected, as demanded by the EU Parliament," he said, adding that the Parliament had made clear that the general transfer and storage of personal data, as well as excessive storage, is simply not acceptable.
"Any data transferred must be immediately deleted if there is no individual suspicion. These red lines must be respected before the Parliament can accept any agreement," he argued.
Liberal MEP Sophie In't Veld who has led the Parliament in the scrutiny of the various air passenger data agreements between the EU and third countries has given cautious welcome to the new package of proposals presented yesterday by Commissioner Malmström.
"The Commission's proposals largely reflect the requirements set out by the European Parliament" she said in an initial reaction. "One of the main demands, namely that the use of passenger data has to be drastically restricted, has been accepted.
The main outstanding point of criticism is that the need for massive storage of data still has not been proven. "It is not enough to say that the collection of data of passengers is 'useful 'or 'valuable'. It must be 'necessary' and 'proportional'." As far as Ms In't Veld is concerned the Commission proposals still need some improvement on these points.
Reacting to the proposal, U.S. Ambassador to the EU, William Kennard, said that Washington is firmly committed to strong privacy protections that govern how it collects, stores, and shares information.
"PNR data is a critical asset not just to secure the travel of U.S. citizens, but to provide for the safety and security of travelers from Europe and the rest of the world," he said, adding that the United States will closely follow the work in the Council of the European Union as it considers the Commission's proposed mandate.
Passenger Name Records (PNR) refer to information provided by passengers and collected by air carriers in order to process reservations and check in passengers. Such data has been used for almost 60 years by customs and law enforcement authorities around the world.
However, only recently has technological development allowed for advance electronic transmission of the data. This makes PNR an even more useful tool to fight serious crime, including terrorism.
Currently the EU has PNR agreements with the US and Australia, which are provisionally applicable.
With the entry into force of the Lisbon Treaty, the European Parliament has to give its consent to these agreements. However, in May 2010, the European Parliament, under the new Treaty rules, postponed a vote on giving its consent to formally concluding the EU-US and EU-Australia PNR agreements.
At the same time, the European Parliament called for the establishment of general standards which third countries requesting PNR from the EU need to respect. It wanted the US and Australia PNR agreements to be re-negotiated on the basis of such general standards.
A PNR agreement with Canada also exists. Due to the expiry, formally, of certain legal commitments on which that agreement is based, this must also be renegotiated.
- European Commission: The Passenger Name Record (PNR) - Frequently Asked Questions
- European Commission:European Commission adopts an EU external strategy on Passenger Name Record (PNR)