Protection of personal data contained in the passenger name records (PNRs) transferred to the US Bureau of Customs and Border Protection

PURPOSE: to propose a common European Union approach regarding the transfer of passenger data ('Passenger Name Record' or PNR). CONTENT: In the aftermath of the terrorist attacks of 11 September 2001, the United States passed legislation in November 2001, requiring that air carriers operating flights to, from or through the United States provide the United States' Customs with electronic access to the data contained in their automated reservation and departure control systems, known as Passenger Name Records (PNR). Whilst recognising the legitimate security interests involved, the Commission informed the US authorities as early as in June 2002 that these requirements could conflict with Community and Member States' legislation on data protection and with some provisions of the Regulation on computerised reservation systems (CRSs). The US authorities postponed the entry into force of the new requirements, but finally refused to waive the imposition of penalties on non-complying airlines beyond 5 March 2003. Several major EU airlines have been providing access to their PNR since then. On 18 February 2003, the Commission and the US administration issued a joint statement outlining the first undertakings that US Customs had given regarding data protection and seeking to bring the way the US use and protect PNR data closer to EU standards. In the meantime, other third countries, including Canada and Australia, have requested or are considering requesting access to PNR data. Some Member States are also examining the possibility of using PNR data for aviation and border security purposes. For its part, the European Parliament invited the Commission to take a number of actions with regard to the transfer of PNR data to the US in order to ensure that European data protection concerns are being taken into account. The Commission agrees with European Parliament that a solution of the problems arising from third country and in particular US demands for PNR data is urgently required and this solution must: - be legally sound; - ensure the protection of citizens' personal data and privacy, but also their physical security; - stand four-square with the need to fight terrorism and international organised crime; - end legal uncertainty for airlines - European and non-European, as well as to facilitate legitimate travel. However, the EU's approach cannot be limited to responding to the initiatives of others. For these reasons, in this document, the Commission is proposing a comprehensive and balanced approach to the full range of issues raised in particular by US legislation requiring the transfer of PNR, but also responding to the wider needs outlined above needs to give due weight to all of the following considerations: the fight against terrorism and international crime, the right to privacy and the protection of fundamental civil rights, the need for airlines to be able to comply with diverse legal requirements at an acceptablecost, the broader EU-US relationship, the security and convenience of air travellers, border security concerns, the truly international, indeed world-wide, scope of these issues. Any one-sided approach or any approach that fails to draw all these strands together will be unbalanced and unsustainable. At the same time, the search for a truly comprehensive solution must not delay or stand in the way of finding a legal solution to the problem of current PNR transfers to the US - not to mention growing pressure on those EU airlines not yet giving the US access to their PNR. The Commission's multi-track approach thus consists of the following main components: 1) a legal framework for existing PNR transfers to the US taking the form of a Decision by the Commission under Article 25 paragraph 6 of the Data Protection Directive (95/46/EC) accompanied by a "light" bilateral international agreement. 2) complete, accurate and timely information for passengers. A concerted effort - involving the Commission, airlines, travel agents, CRSs and data protection authorities, and possibly the authorities of the third countries concerned - has been set in hand to ensure that passengers are fully and accurately informed before purchasing their tickets about the uses made of their PNR data and give their consent to its transfer. 3) Replacing "pull" (direct access by US authorities to airlines' databases) with a "push" method of transfer, combined with appropriate filters. The Commission's technical discussions with the industry are well advanced. The Commission will recommend the rapid implementation of a "push system" in a framework of an EU policy. 4) The development of an EU position on the use of travellers' data, including PNR, for aviation and border security. 5) The creation of a multilateral framework for PNR Data Transfer within the International Civil Aviation Organisation (ICAO). Within a short period, the Commission proposes to deliver this legal framework in the form of an adequacy finding in accordance with Article 25(6) of the data protection directive, accompanied by an international agreement with the US on the basis of Article 300(3) first paragraph of the Treaty (see CNS/2004/0064). The European Parliament will be consulted on both elements of this solution. The Commission will also pursue energetically its co-operation with airlines and their representative organisations, as well as with CRSs to ensure that passengers are fully and accurately informed before purchasing their tickets about the uses that are made of their PNR data and are thus able to make an informed choice. The Commission will strongly encourage operators to obtain systematically the consent of passengers to their data being transferred, to the extent practicable, but believes that it is necessary to establish a legal framework which does not rely solely on consent. The Commission recalls its right of initiative to propose the regulation of consent at the EU level if operators fail to implement effective solutions within a reasonable timeframe. It reaffirms its strong support for the swift implementation of "push" technology accompanied by appropriate filters for the transmission of PNR data to third countries. It believesthat a centralised or grouped approach has clear advantages over an airline by airline approach, in terms of both efficiency and costs. It will continue to explore possible options with the industry as a matter of priority. If necessary, it is prepared to take the appropriate initiatives to secure funding from within existing resources of the Community budget to support the development of such a system. The Commission aims to identify the way forward before mid-2004 at the latest. One option for consideration could be to implement a push system within the framework of an EU approach to the use of travellers' data for border and aviation security purposes.�