EU/USA Agreement: use and transfer of passenger name records (PNR) to the US Department of Homeland Security

The Commission presented a report on the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of passenger name records (PNR Agreement) to the United States Department of Homeland Security.

Joint review: the Agreement provides for a first joint review one year after its entry into force and regularly thereafter as jointly agreed. This joint review was carried out on 8 and 9 July 2013 in Washington. Its main focus was the implementation of the Agreement, with particular attention to the method of transmission of passenger name records (PNR) as well as the onward transfer of PNR as set out in the relevant articles of the Agreement, and in accordance with recital No 18 of the Agreement.

One part consisted of a field visit to a Department of Homeland Security (DHS) operation center by the EU team of experts.

State of implementation: the EU team found that DHS implemented the Agreement in line with the conditions set out therein. For example DHS uses effective filters for filtering out data without a U.S. nexus as well as PNR data outside the 19 PNR categories described in the Annex to the Agreement.

The masking and deletion of sensitive data are respected and DHS has stated that it has never accessed sensitive data for operational purposes.

DHS also implements its commitments in relation to passenger rights, in particular as regards providing appropriate information to passengers and implementing the right to access without any exemptions.

Sharing of data with other domestic agencies is handled by DHS in line with the Agreement. Sharing is carried out on a case-by-case basis, logged and takes place on the basis of written understandings. Sharing of data with third countries is also interpreted strictly, and is also in line with the Agreement.

Proposed improvements: despite the implementation of the Agreement, some improvements remain necessary:

1) depersonalisation: in accordance with the Agreement, measures provide for a period of six months for the depersonalization of PNR. Currently the calculation of this period starts only as soon as a PNR is last updated in the DHS Automated Targeting System (ATS) which holds the PNR, not when PNR is loaded in ATS. It is recommended to start applying the six months period as from the day the PNR is loaded in ATS which is the first day the data are stored in ATS, instead of the current practice, which delays applying the six months period (until the last ATS Update of the PNR).

2) ad hoc pull method: particular attention should be paid to the use of the ad hoc “pull” method. It is recommended that DHS, in addition to its current logs, keeps better records of the reasons why the ad hoc “pull” method is applied in each case, which would allow for a better assessment of the proportionality and a more effective auditing of its use, which is meant to be an exception to the rule;

3) reciprocity: DHS is requested to respect its commitment to ensure reciprocity and pro-actively share individual PNRs and analytical information flowing from PNR data with EU Member States and where appropriate with Europol and Eurojust;

4) redress mechanisms: it is advised to provide more transparency on the redress mechanisms available under U.S. law. Such transparency should allow passengers who are not U.S. citizens or legal residents to challenge DHS decisions related to the use of PNR data, in particular when the use of such data may contribute to a recommendation to deny boarding by carriers.

5) targeting scenario rules: the report notes that the DHS also implemented measures that go beyond the Agreements’ requirements. DHS foresees a notification to the European Commission within 48 hours of access to sensitive PNRs. DHS has installed a new procedure to quarterly oversee and review the implementation of the ATS and to review all travel targeting scenarios, analysis and rules to ensure that they are proportionate to minimize the impact on bona fide travellers’ civil rights, civil liberties and privacy, and to avoid discrimination against travellers.

Fight against terrorism: a preliminary assessment of the question whether PNR serves the purpose of supporting the fight against terrorism and other crimes that are transnational in nature showed that PNR provides DHS with the possibility of carrying out pre-departure assessments of all passengers up to 96 hours which gives DHS sufficient time to carry out all the background checks before the arrival of a passenger and prepare its response. This processing also supports DHS when deciding if a passenger should board a plane or not. It also provides DHS with the opportunity to perform risk assessments on the basis of scenario-based targeting rules in order to identify the ‘unknown’ potential high-risk individuals. PNR further provides the possibility to make associations between passengers and identify criminals who belong to the same organised crime group. According to DHS PNR is also successfully used for identifying trends of how criminals tend to behave when they travel, for example by understanding which routes they use.

Commission recommendations: as a general recommendation, it is advised to envisage another internal review of the Agreement by the DHS Privacy Office ahead of the next joint review. The two sides suggest organising the next joint review during the first half of 2015.

It is also recommended to ensure as quickly as possible a full move to the “push” method and in any case by 1 July 2014.

It is further recommended that the U.S. and the EU work together to promote the use of common transmission standards, in particular the PNRGOV standard as developed by IATA, airlines, and government. In this respect it would be welcomed if the discussions in IATA on a common “Push” standard also would lead to a common standard for ad hoc “push”.

Lastly, the Joint Review Report accompanying this Report consists of three Chapters: (i) providing an overview of the background to the review and the purpose and procedural aspects of the exercise; (ii) presenting the main findings of the joint review and the issues to be further addressed by DHS; (iii) presenting the overall conclusions of the exercise. Annex B presents the composition of the EU and U.S. teams that carried out the review exercise.