EU: Commission "compromises" and agrees on handing over passenger data to USA

- EU-USA collusion heralds global imposition of the surveillance of travel

- "The EU cannot refuse its ally in the fight against terrorism" (EU Commissioner Bolkestein)

- The EU's Data Protection Article 29 Working Party:
"declined to adopt or approve the text, on the grounds that the transfer of PNR to the US are in any case illegal and nothing should be done to blur that fact"

- EU law enforcement agencies want complete exemption from data protection


Tony Bunyan, Statewatch editor, comments:

"This deal heralds a EU-USA axis initiative seeking to impose the exchange of passenger data globally through the ICAO. This will be the first step to vetting all passengers before they get on a plane, boat or cross-border train - denying boarding to those considered an immigration or security risk. The global surveillance of travel will not be limited to combating terrorism but will extend to "other serious crimes" - which is now defined so broadly as to include everything but very minor offences.

What is quite unforgivable is that the European Commission thinks that the EU-USA deal - with a state which has no data protection laws and no intention of adopting them - is a better basis for a global standard than the EU's data protection laws which have served as a model for many countries around the world.

This is the third EU-USA agreement which fundamentally undermines the 1995 EC Data Protection Directive. It is no wonder that in working parties in Brussels the EU's law enforcement agencies are now calling for a complete exemption from data protection provisions for law and order purposes, and the European Commission agrees with them"


The European Commission agreed on 16 December 2003 that passenger data (PNR, Passenger Name Record) should be handed over by all airlines flying to the USA to the US Customs and security agencies. At the same time the Commission produced a Communication backing a global approach to the exchange of personal passengers through a "multilateral framework for PNR data transfer with the International Civil Aviation Organisation (ICAO)".

The Commission has declared that the privacy protections "guaranteed" by the USA are "adequate" and under Article 25 para 6 of the 1995 EC Data Protection Directive will sign a ""light" international agreement which it expected to complete by March 2004.

The EU's Data Protection Article 29 Working Party:

"declined to adopt or approve the text, on the grounds that the transfer of PNR to the US are in any case illegal and nothing should be done to blur that fact" (footnote 7, page 7 of the Communication)

The Commission and the Article 29 Working Party also disagrees on the issue of consent. Article 26.1.a. says that a passenger must give their "consent unambiguously" cannot be applied to exceptions of "adequate protection". The Commission simply brushes this objection aside and relies on the "conscious decision on the part of passengers" - but what if passenger refuse to assent to their details being passed over, will they be allowed to book a ticket?

Sources in the USA say that despite the European Commission insistance that CAPPS-II (where advanced passenger data allows people to be tracked around the country based on a "a threat rating") will be the subject of separate negotiations a Department of Homeland Security official said at a press briefing in Washington on 16 December that the EC had agreed to use of data from the EU for CAPPS-II tests.

Following discussions with the EU's law enforcement agencies the Commission intends to put forward a Framework Decision on Data Protection and Law Enforcement "by the middle of 2004" to allow "the screening of commercial data for law enforcement purposes".

In the negotiations with the USA the Commission effectively worked out a global plan and it is to put forward a paper to the ICAO "shortly".

There will be three opportunities for civil society to intervene:

1. The agreement announced on 16 December is a "paper" agreement which has no legal standing. The European Parliament has to be "consulted" on the "light" international agreement.

2. The Framework Decision exempting law enforcement agencies from data protection: the European Parliament will have to agree to every dot and comma and national parliaments will be able to exercise their powers of scrutiny.

3. The ICAO global agreement instigated by the USA and the EU: as there are no democratic procedures in place for global policy-making civil society will have to make its views known to this UN body.


1. Communication on Transfer of Air Passenger Name Record (PNR) Data: A Global EU Approach (16.12.03, pdf)
2 Bolkstein speech to the European Parliament on 16 December 2003
3. Statement from US Mission in Brussels: Statement (link)

Independent, 18.12.03

4. EU plan for wholesale security checking of every traveller: Report

5. European airlines are handing PNR data over to US Customs - Evidence from Spain- full documentation of all the data collected and passed over for one return flight by one passenger & full list of the 43 categories of personal data demanded by USA: Report & documents

6. European Parliament report opposes giving passenger data to USA without strict data protection safeguards - and says if these are not met by 1 December all data transfers should stop: Statewatch report

7. 1995 EC Data Protection Directive (link)
8.
1989 Regulation on computerised reservation systems


Statewatch News online | Join Statewatch news e-mail list | Download a free sample issue of Statewatch bulletin

Statewatch does not have a corporate view, nor does it seek to create one, the views expressed are those of the author.
Statewatch is not responsible for the content of external websites and inclusion of a link does not constitute an endorsement.