EU to sign agreement on PNR transfer to the U.S.

With the approval on 17 May 2004 of the transfer of airline passenger’s personal data to the U.S., the Commission and the Council of the European Union have bluntly bypassed the European Parliament and Court of Justice.

Daniel Cohn-Bendit, head of the Green/EFA Group in the European Parliament, said the decision was “ignoring the declared will of the Parliament in an unprecedented way”. Commission and Council agreed on Monday to hand over up to 34 personal data items from the Passenger Name Record (PNR) for every passenger flying to the United States from an EU country. The Council, composed of the EU’s 25 Foreign Affairs ministers, adopted the agreement without debate, only a few hours after the Commission had officially passed a so-called adequacy finding, claiming that the data would find sufficient protection once it has been transferred to the U.S. The agreement will be signed next week in Washington.

“A negotiated solution is never perfect,” said Commissioner Frits Bolkestein, in charge of Data Protection within the European Union. Bolkestein claims that, even though the United States had applied ‘strong political pressure’, the end result is ‘balanced’. Resisting the US demands would according to Bolkestein have resulted in “chaos for EU passengers and airlines.” Bolkestein’s satisfaction is not surprising, since he already tolerated an even more extensive data transfer taking place on an illegal basis and without any guarantees since March 2003.

The data to be transferred include contact details such as addresses, phone numbers and also e-mail addresses, travel companions and credit card details. Other data considered even more sensitive such as meal preferences, allowing conclusions on a person’s ethical and religious background, must be filtered out by the United States.

It is unclear how the filtering will be controlled. In what way the agreed data storing period of 3 years shall be controlled or who should monitor that data are not passed on to any other agencies besides the Department of Homeland Security – in particular to the United States’ influential Secret Service community, remains equally unsolved.

In addition, the U.S. Administration reserves the right to store certain data longer than the three-year period and to pass the data on to third countries, who are not bound by any agreement with the EU and where inspections by independent data protection authorities are even less likely to happen than in the United States. Within the Department of Homeland Security, treatment of data originating from the EU will be subject to annual inspections by EU data protection authorities. The inspections will be announced in advance. If any abuse of the data should take place, it will thus be very simple for the U.S. side to erase the traces in time before the inspection team arrives.

The decision on the agreement creates new facts, which bypass the EU Parliament’s earlier decision to ask an opinion from the European Court of Justice. The Parliament must therefore decide to go to Court again, in order to challenge the already existing agreement with the U.S. The date for the decision was very strategically chosen by Commission and Council: the Parliament is virtually inexistent before the elections to be held in mid-June, and it is not scheduled to meet again before July 19 – two days after the deadline expires for introducing a demand with the Court of Justice. This may be the reason why the Commission’s adequacy finding, which was technically agreed upon on 12 May, was officially signed off five days later. If the adequacy finding had been given right away, it would have been easier for Parliament to go to the Court of Justice in time.

“This is really a cheap trick from the Council and the Commission,” said Johanna Boogerd-Quaak, the Rapporteur on the PNR issue in the European Parliament. However, she took the precaution two weeks ago of asking the President of the European Parliament and of the Parliament’s Legal Affairs Committee to call the Parliament back from the recession for a special sitting if the agreement should be signed. Both Presidents (of the Committee and of the Parliament) reacted positively. “One way or another, this issue will end up before the European Court of Justice,” said Mrs. Boogerd.

Privacy International: Transferring Privacy and Inadequate Adequacy (17.05.2004) http://www.privacyinternational.org/issues/terrorism/rpt/inadequateadequacy.pdf

Statewatch: EU agree US PNR deal (17.05.2004) http://www.poptel.org.uk/statewatch/news/2004/may/10eu-us-pnr-deal.htm

Secretary Ridge statement on European Commission decision (17.05.2004) http://www.whitehouse.gov/news/releases/2004/05/20040517-9.html

Article by Johanna Boogerd (in Dutch, 17.05.2004) http://www.johannaboogerd.nl/artikel.asp?artikelID=193

(Contribution by Andreas Dietl, EDRI EU affairs director)