PNR data transfer: EU Parliament gets angry

On 12 September the moratorium expires on the transfer of European
passenger-data to the United States. Already harsh words are being
exchanged between EU institutions, one of the last realms of diplomatic
kindness. “The violation of EU legislation is continuing and with it the
rights of European citizens are being violated.” This judgement from an
official Working Document of the European Parliament is aimed at the
Commission, which, according to the document, “in the 6 months since the
adoption of Parliament’s resolution (on the transfer of Airline
Passenger’s PNR data to U.S. authorities) has made very little progress
with regard to ensuring that EU data protection legislation is observed”.
Still, the EP rapporteur, Dutch Liberal Johanna Boogerd-Quaak, continues,
“Your rapporteur believes that the US commitments do not offer adequate
protection.” “This”, she concludes, “is a flagrant violation of EU data
protection legislation, as laid down in Directive 95/46 EC and Regulation
2299/89.” Members of Parliament are now ready to prepare two oral
questions for the Council and the Commission, and eventually take legal
action before the European Court of Justice.

On 13 March, the Parliament passed a resolution containing criticism of
the Commission’s secretive negotiations with U.S. envoys about the
transfer of airline passenger’s personal data to the United States.
Parliament was angry about the lack of adequate level of data protection.
It urged the Commission to ensure that EU Privacy and Data Protection law
would be respected. Up to the present day that is not the case. The
procedure that might now follow is laid down in Article 232 of the EC
Treaty. First an official warning by the Parliament. Next, action before
the Strasbourg court that could result in the Commission being obliged to
stop the transfer immediately. Already on 2 September, the Chair of the EP
Civil Liberties Committee has taken first steps to prepare such action.

This is also what the Parliament will urge now: a prohibition of all data
transfer on a ‘pull’ basis by 1 October, and an international agreement
that will have to be in accordance with EU data protection law. In her
Working Paper, Mrs. Boogerd-Quaak goes into some detail and exemplifies
minimum requirements any future arrangement should meet to avoid legal
action, such as reducing the storage time from 7 years to the duration of
the passenger’s stay in the U.S. and reconsidering whether PNR transfer is
adequate in the proclaimed fight against terrorism.

On 5 May EDRi launched a campaign against the PNR transfer, with letters
passengers can send to the national Data Protection Authority in their
country to request an investigation of the illegal transfer of their
personal data.

EP draft Oral Question to the Council (02.09.2003)
http://www.europarl.eu.int/meetdocs/committees/libe/20030908/505934en.pdf

Working Document Johanna L.A. Boogerd-Quaak (02.09.2003)
http://www.europarl.eu.int/meetdocs/committees/libe/20030908/506027en.pdf

EP Resolution (Motion 10.03.2003, accepted 13.03.2003)
http://www.europarl.eu.int/meetdocs/committees/libe/20030310/492022EN.pdf

EDRi campaign against the illegal transfer of European travellers’ data to the USA
http://www.edri.org/campaigns/airline

(Contribution by Andreas Dietl, consultant on EU privacy issues)