February 10, 2012
In the recent weeks Europe was shaken by the signature of ACTA (Anti-Counterfeiting Trade Agreement). While Europe’s eyes are turned upon fighting with copyrights abuses, EU is proceeding with another agreement which might have a negative impact on human rights. On 13 December 2011 the Council has agreed to conclude the EU-US Passenger Name Record Agreement (“PNR”) enabling the transfer of air passengers’ data for flights from the EU to the US. The agreement has been designed in the scope of the EU and US fight against terrorism.
The previous PNR agreement, applied since 2007, was rejected by the European Parliament, which submitted a number of reservations. Serious concerns on the impact of the PNR on data protection are raised by the European Data Protection Supervisor (“EDPS”) and network of NGOs European Digital Rights Initiative. Similarly to works conducted on ACTA, these concerns failed to be taken into consideration during the negotiation process. As results from the report of Sophie In’t Veld, released on 1 February 2012, the new agreement does not meet the requirements presented by the European Parliament.
On 30 December 2010 the EDPS issued an assessment of the communication of the European Commission on the general approach to the transfer of data to third countries concerning the flights of passengers. The transfer of data may provoke a violation of the data processing rules.
The principal concerns which were indicated during the negotiation process were:
- as highlighted by State Watch, the agreement does not contain any benefits for citizens of the EU. It does not guarantee sufficient legal security and sufficient protection of data, according to the Directive 95/46/EC and the Charter of Fundamental Rights. The agreement is cementing the possibility to process passengers sensitive data;
- the PNR agreement prescribe a lengthy period of data retention. It enables the retention of data for an undefined period of time, with the need of data anonymization after 15 years. According to the opinion issued by the EDPS the PNR data should be deleted just after its analysis and maximally after 6 month;
- moreover, according to the EDPS the goal of collecting and processing data has been defined too broadly. The PNR data should only be used in order to combat terrorism and counteract the most serious crimes of international character. The project use unclear notions and leaves a large margin of interpretation;
- the EDPS also criticized the scope of data transmitted to the Department of Internal Affairs of the US as being not enough specific and not proportionate. The scope of transmitted data should be restricted and sensitive data should be excluded from the process;
- EDRI and EDPS also criticized the “push” method of data transfer. The “push” “push” method carriers transmit (push) the required PNR data into the database of the requesting authority. US authorities should not have the possibility of direct access to European data bases, according to the “pull” method, the requesting authority can reach in to the carrier’s reservation system and extract (pull) a copy of the required data into their database. According to the report of Sophie In’t Veld the “pull” method was used by the US in the past in order to extract large amount of data;
- the EDPS in its opinion of 13 December 2010 highlighted that the PNR agreement does not guarantee efficient access to the court. Citizens have no guarantee of access to data collected about them. No mechanisms have been defined for citizens access to information on data gathered;
- the agreement does not define, with enough precision, the possibility of data transfer to third countries. Currently the agreement enables the data transfer, if a third state will assure a similar level of protection. The Department of Interior of US shall have the possibility to transfer data only if the third state will offer the same level of protection;
All these concerns raised by European actors, have not been duly considered in the legislative process. It is another example of legislative initiative, which under the slogan of “fight against terrorism” (or fight with counterfeiting), is impacting basic freedoms of European citizens. PNR is only an example, however, the entirety of EU policies in that respect should be redesigned. On 14 December 2011 the European Parliament called on member states to submit reports on the cost-efficiency of their counter-terrorism measures and their impact on civil liberties. Same instruments should also be applied to EU institutions negotiating international agreements or undertaking new legislative initiatives.
Dominika Bychawska-Siniarska, “Europe of Human Rights”
Author : Europe of Human Rights