29 July 2015

PNR

The European Parliament’s Civil Liberties Committee has approved the EU Passenger Name Record (PNR) Directive, which provides for mandatory provision and retention on a central searchable database of information about passengers booked on flights originating outside the EU or leaving the EU.

The information will only be accessed "if a serious crime is suspected, such as human and drug trafficking, child sexual exploitation or money laundering as well as terrorism". Data will be stored on a central database for 30 days, before deidentification. Data will be retained for up to five years and can be “unmasked” after a request by authorities.

The data collected will be drawn from airline bookings, potentially could include the passenger’s contact information, travel routes, computer IP address, hotel bookings, credit card details and dietary preferences.

The Cameron Government is reported as being keen to extend the Directive to all airline flights within Europe (i.e. domestic travel).

In 2011 the Article 29 Working Party commented [PDF] -
The Working Party considers that the fight against terrorism and organised crime is necessary and legitimate and personal data, and in particular some passenger data, might be valuable in assessing risks and preventing and combating terrorism and organised crime. However, in the case of a European PNR system the limitation of fundamental rights and freedoms has to be well justified and its necessity clearly demonstrated so as to be able to strike the right balance between demands for the protection of public security and the restriction of privacy rights. 
The Working Party has consistently questioned the necessity and proportionality of PNR systems and continues to do so with the 2011 proposal. While we appreciate the extra detail provided in the impact assessment, we consider that it does not provide a proper evaluation of the use of PNR and does not demonstrate the necessity of what is being proposed. The proposal should be clear about whether the aim is to fight serious (transnational) crime, which includes terrorism; or whether the aim is to fight terrorism and terrorism-related crimes only. 
Chapter 3.2 of the impact assessment “Respect of fundamental rights” merely states that the Fundamental Rights Check List has been used, but there is no further information about this assessment to justify its conclusions. In addition, this chapter provides circular reasoning for the interference with privacy rights under Article 8 of the European Convention of Human Rights, and Articles 7 and 8 of the Charter on Fundamental Rights of the European Union. The legal precondition for interfering with these rights is that it is “necessary in the interest of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others” as well as being "necessary in a democratic society” and “subject to the principle of proportionality”. The fact that the purpose of the proposal is the prevention of terrorism and serious crime does not mean it clearly complies with these requirements; the necessity and proportionality have still to be proven. 
The Working Party goes on to comment
Under the proposal, a huge amount of personal in formation on all passengers flying into and out of the EU will be collected, regardless of whether or not they are suspects. Collecting and processing PNR data for the fight against terrorism and serious crime should not enable mass tracking and surveillance of all travellers. The Working Party considers it disproportionate and therefore not in line with Article 8 of the Charter of Fundamental Rights to collect and retain all data on all travellers on all flights. As previously mentioned above, the impact assessment does not include convincing evidence in this respect. EU-level proposals should be specific and targeted to address a particular issue and in this context the focus of any proposal should be on the risks posed by terrorism and serious crime. 
The Working Party has serious doubts about the proportionality of the systematic matching of all passengers against some pre-determined criteria and unspecified “relevant databases”. It is not clear how these pre-determined criteria and relevant databases are to be defined, whether PNR data will be used to create or update the criteria, and to what extent all matches will automatically become subject to additional investigations. The Working Party would also like to recall that in some Member States similar methods of policing are only constitutional and therefore available to the police on judicial approval and under specific circumstances, such as a specific threat. The proposed PNR system would render this exceptional method an ordinary instrument for police work. Measures put in place that cannot provide for the protection of the rights and freedoms of travellers are only proportionate when introduced as a temporary measure for a specific threat, which is not the case for this proposal. The invasion of privacy of travellers must be proportionate to the benefits as regards fighting terrorism and serious crime. The Working Party has yet to see any statistics showing the ratio between the number of innocent travellers whose PNR data was collected to the number of law enforcement outcomes resulting from that PNR data.