Opinion data protection authorities on PNR transfer
The Article 29 Working Party that oversees the implementation of the EU privacy directive has released its opinion on the current state of affairs regarding the transfer of passenger data from EU airlines to the U.S. Department of Homeland Security.
The Working Party notes that the Commission failed to take into account previous demands by the Working Party before authorizing its transfer to the U.S., particularly on the scope of the data, the retention period, and the ways in which the data is used. As the European Parliament is pursuing this case in the Courts, the Working Party is calling for some immediate ‘essential’ changes to the current practices to minimize the encroachments on passengers’ rights.
These ‘essential’ changes include:
#Replacing U.S. Customs direct access to reservation systems with a ‘push’ system where carriers send only the required information to the American authorities.
#Better informing passengers regarding the treatment of their personal information.
#Reiterating that carriers are not required to collect additional data; only to disclose data that they otherwise collect in the course of business.
#Moving forward on regular checks of the U.S. treatment of the data.
Surprisingly, the report has strong language regarding the Commission’s failure to adhere to the Working Party’s guidance, but the Working Party’s call for action is very weak. The agreement between the European Commission and the U.S. Department of Homeland Security fails on many data protection grounds, and is a clear case of backroom politics, that the European Parliament is trying to rectify. That the Working Party chose to respond in this manner is disappointing.
Opinion Article 29 Working Party 6.2004 (22.06.2004) http://www.europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2004/wp95en.pdf
A Failure to Negotiate: European Commission Sells Privacy Law to Lowest Bidder http://www.privacyinternational.org/issues/terrorism/rpt/inadequateadequacy.pdf
Transferring Privacy: The Transfer of Passenger Records and the Abdication of Privacy Protection http://www.privacyinternational.org/issues/terrorism/rpt/transferringprivacy.pdf
(Contribution by Gus Hosein, EDRI-member Privacy International)