Legislative Observatory
European Parliament
Please fill in this field to find a procedure

Use of passenger name record (PNR) for law enforcement purposes

2007/0237(CNS)

OPINION OF THE EUROPEAN DATA PROTECTION SUPERVISOR on the draft Proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes.

The Commission submitted the draft Framework Decision to the EDPS for an opinion. This proposal concerns the processing of PNR data within the EU and is closely related to other schemes of collection and use of passengers' data, in particular the EU-US agreement of July 2007. These schemes are of great interest to the EDPS, which considers that the present opinion should be mentioned in the preamble of the Council Decision.

The EDPS’s opinion studies all aspects of the proposal but concentrates on the following elements which are considered to be fundamental:

  1. legitimacy of the proposed measures: the question of the purpose, necessity and proportionality of the proposal are assessed against the criteria of Article 8 of the Charter of Fundamental Rights of the European Union;
  2. applicable law - exercise of data subject’s rights: the scope of application of the data protection framework decision in relation to the application of first pillar data protection legislation deserves specific attention;
  3. quality of recipients of data at national level: in particular, the quality of Passenger Information Units (PIUs) of intermediaries and of competent authorities designated to perform risk assessment and analyse passenger data raises specific concerns as no precision is given in the proposal in this respect;
  4. conditions of transfer of data to third countries: it is not clear what conditions will apply to such transfers where different sets of rules exist (the conditions of transfer under the present proposal, together with those of the data protection framework decision, and the existing international agreements with the USA and Canada).

With regard to the legitimacy of the proposed measures, the EDPS concludes that building upon different data bases without a global view on the concrete results and shortcomings is contrary to a rational legislative policy and might otherwise lead to a move towards a total surveillance society. Whilst the fight against terrorism can certainly be a legitimate ground to apply exceptions to the fundamental rights to privacy and data protection, the EDPS considers, however, that, to be valid, the necessity of the intrusion must be supported by clear and undeniable elements, and the proportionality of the processing must be demonstrated. This is all the more required in case of extensive intrusion in the privacy of individuals, as foreseen in the proposal. According to the EDPS, such elements of justification are missing in the proposal and that the necessity and proportionality tests are not fulfilled. The EDPS therefore insists on the essential character of the necessity and proportionality of the proposal which represent a condicio sine qua non to its entry into force.

With regard to the issue of the applicable law and the exercise of this law by a person, the EDPS considers that the proposal should make clear what legal regime is applicable at which stage of the processing, and specify vis-à-vis which actor or authority access and redress shall be exercised. He recalls that, according to the Treaty on European Union, provisions on data protection should be appropriate and cover the full range of processing operations established by the proposal. A simple reference to the data protection framework decision is not sufficient, given the limited scope of that framework decision and the restriction of rights it contains.

With regard to the quality of recipients, the EDPS considers that the enforcement of an EU PNR system is rendered even more difficult considering that law enforcement authorities have different competences depending on the national law of the Member States, including or not intelligence, tax, immigration or police. This is however a supplementary reason to recommend that the proposal be much more precise with regard to the quality of the mentioned actors and the guarantees to control the performance of their tasks. Additional provisions should be integrated in the proposal, to specify strictly the competences and the legal obligations of intermediaries, PIUs and other competent authorities.

Lastly, with regard to the conditions of transfer to third countries, the EDPS stresses the need to ensure that an adequate level of protection is provided in the recipient country. He also questions the significance of the ‘reciprocity’ principle mentioned in the proposal, and its application to countries already bound by an agreement with the EU, like Canada or the US. He considers it to be of the utmost importance that the conditions of transfer of PNR data to third countries be coherent and subject to a harmonised level of protection.

The EDPS also draws attention to specific aspects of the proposal that need more precision or a better taking into account of data protection principle (for example, the conditions in which automated decisions can be taken, the quantity of data processed, the method of transfer of data (or “push”), the data retention period, etc.).

Lastly, the EDPS notes that the present proposal is made at a moment when the institutional context of the European Union is about to change fundamentally. The consequences of the Lisbon Treaty in terms of decision making will be fundamental, especially with regard to the role of the Parliament.  Considering the unprecedented impact of the proposal in terms of fundamental rights, the EDPS advises not to adopt it under the present Treaty Framework, but to ensure it follows the co-decision procedure foreseen by the new Treaty.