Last week, DG HOME of the European Commission internally distributed a copy of the upcoming Passenger Name Record(PNR) agreement with the United States. The purpose of the text is to agree terms for sending air traveller data to the USA for the purpose of profiling citizens as a method of fighting crime.
DG HOME presented the current text (not yet public) as almost final and explained that this far-reaching document will soon be given to the Member States and European Parliament on a “take it or take it” basis.
However, the European Commission appears to have forgotten that any agreement that it signs must respect existing obligations on fundamental rights. In this case, the privacy rights in the European Convention on Human Rights and the Treaty on the Functioning of the European Union must be respected. It appears almost certain that the Agreement fails to meet minimum standards for fundamental rights.
*Purpose limitation – According to the agreement, the data would be used for investigation of crimes requiring imprisonment of one year. However, the current proposed EU PNR Directive sets a limit for crimes that require three years imprisonment while the EU/Australia agreement proposes four years. If the Commission felt that 3 years was the limit of proportionality a few weeks ago, how could one year be proportionate today, in exactly the same circumstances?
*Legal basis for data use – In Article 4.2 of the proposal, data can be used for any purpose if ordered by a court – which is weaker than the EU Charter’s requirement for restrictions on rights and freedoms to be based on law and for the use must be foreseeable. Both of these safeguards appear not to be respected in the current text.
*“Border security” – This weakening of safeguards continues in Article 4.3, which refers to using PNR to ensure border security – totally de-linking the data processing from the requirement that it could only be used for “serious crime”.
*Retention period – Similar to the first point above, the proposed retention period of 15 years bears no relationship with the proposed EU PNR Directive (retention for five years and one month) and is equal to the retention period already rejected by the European Parliament. More damningly still, the Council legal service in an internal document, has already advised that a period of more than two years is likely to be illegal.
*Judicial redress – All judicial redress is to be administered under US law, meaning that this cannot be guaranteed by the EU.
*Judicial oversight – The degree of judicial oversight proposed again corresponds neither to the EU PNR proposal nor the EU/Australia agreement.
The future of this flawed proposed agreement represents a major test for the political will of the European Commission to effectively defend the European Charter of Fundamental Rights and European Convention on Human Rights.