EU: Travel surveillance: PNR by the back door
03 October 2014
Proposed legislation on an EU Passenger Name Record (PNR) system for the surveillance of air travel has been on hold since the Parliament's Civil Liberties Committee rejected it in April 2013, but tens of millions of euros in funding from the European Commission has allowed a number of Member States to establish national PNR systems.
Statewatch reported in January 2013 on the Commission's 2012 announcement that it would provide €50 million in funding to help Member States set up PNR systems and Passenger Information Units (PIUs), [1] allowing law enforcement authorities to process and analyse the data in the name of combating terrorism and crime.
PIUs are the bodies responsible for collecting and analysing PNR data from airlines, which originally collect it from their customers. Data contained in PNR files includes names, flight information, address, travel itinerary, payment information, baggage information and more. [2]
The EU legislation would see the mandatory gathering and analysis of PNR data from flights entering the EU, with states permitted to choose whether or not they gathered data from intra-EU flights. There is the possibility of the scheme being extended in the future to cover rail and sea travel. [3]
Those in favour of establishing PNR systems highlight the benefits for fighting terrorism and crime, although little more than anecdotal evidence has been provided at EU level to justify the claims. Critics say that the monitoring by law enforcement authorities of all air travel is a disproportionate measure, and that the ultimate effect of such widespread surveillance is to turn everyone into a suspect.
The €50 million made available by the Commission came from the 'Prevention of and Fight against Crime' programme, which ran from 2007 to 2013. The funding was split between 14 of the EU's 28 Member States who received amounts ranging from €134,1379 (Romania) to €17,816,245 (France) for a variety of projects aimed at establishing, developing and implementing national PNR systems and PIUs.
The other Member States that received funding were:
Bulgaria: €2,381,578
Estonia: €4,958,341
Spain: €3,954,049
Latvia: €3,671,698
Lithuania: €949,367
Hungary: €5,024,673
Netherlands: €5,704,068
Austria: €308,780
Portugal: €976,290
Slovenia: €800,307
Finland: €2,235,600
Sweden: €1,084,820
A table compiled by Statewatch contains further details. [4]
The home affairs funding programme for the next six years (2014 to 2020) is the Internal Security Fund (ISF). A portion of the €6m budget line for 'law enforcement information exchange' in the 2014 work programme has been set aside for PNR-related projects, specifically those "supporting the exchange of PNR data and of analytical information obtained from PNR data between national Passenger Information Units (PIUs) of different Member States":
"This includes activities such as the setting-up of secure communication channels between PIUs for the exchange of such information, the development of appropriate data formats and the drafting of guidelines for this exchange. This aims at the long-term goal of establishing an information exchange and cooperation network between all PIUs. This includes funding operational meetings, pilot projects and test runs." [5]
Cash and confusion
After the publication of Statewatch's January 2013 article the chairman of the Parliament's Civil Liberties Committee, Juan Fernando López Aguilar MEP, wrote to Home Affairs Commissioner Cecilia Malmström seeking further information on the 2012 call for proposals. She responded by saying that:
"[T]he call for proposals is not directly linked to the on-going negotiations between the European Parliament and the Council on the Commission proposal for an EU PNR system. Unlike the Commission proposal, which would make it obligatory for all Member States to set up a component authority to collect, store and analyse PNR data, the call for proposals aims at supporting individual Member States that voluntarily set up a national PNR system on the basis of national law." [6]
While it may not have been "directly linked" to the proposed EU legislation, the call set out priorities and expected results that were clearly aligned with it, including:
The use of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime;
Storage of data for not longer than five years, and prior to deletion the "depersonalisation" of data stored;
Carrying out risk analysis by comparing PNR data to that held in other databases;
Ensuring cooperation between the Passenger Information Unit and authorities responsible for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.
Furthermore, one of the criteria against which proposals would be judged included "European added value":
"…applicants must look beyond the framework of the project to find the broader European relevance of the issues, the actions and the output of the project. Every project should end, if possible, with a clear indication of how the project can be further developed at EU level, and with a statement of its potential for European debate and action." [7]
The funding was made available by the Commission despite its own proposal for an EU PNR system outlining potential problems if Member States were to set up national systems in the absence of EU-wide rules:
"[U]p to 27 considerably diverging systems could be created. That would result in uneven levels of protection of personal data across the EU, security gaps, increased costs and legal uncertainty for air carriers and passengers alike." [8]
Given the absence of EU rules on PNR systems, "considerably diverging systems" may be exactly what the Commission is funding.
Despite the apparently schizophrenic nature of this activity, it seems likely to work in the favour of EU PNR advocates - the more national PNR systems that are in place, the greater the impetus for a harmonised EU framework to govern them, in order to overcome "uneven levels of protection of personal data… security gaps… and legal uncertainty".
Just to add to the confusion further, the legislative proposal that was rejected by the Civil Liberties Committee states:
"This Directive does not affect the possibility for Member States to provide, under their domestic law, for a system of collection and handling of PNR data for purposes other than those specified in this Directive, or from transportation providers other than those specified in the Directive, provided that such domestic law respects the Union acquis."
The rise of the phenomenon of "foreign fighters" travelling to Syria and Iraq has led to a resurgence of calls for the Parliament and the Council to agree on EU-wide PNR legislation. [9] Whether governed by common EU rules or not, the surveillance of air travel is spreading across Europe - and the Commission is paying for the infrastructure.
Further reading
'G6 meeting leads to renewed calls for travel surveillance'
, Statewatch News Online, August 2014
'"Foreign fighters" phenomenon spurs dozens of new counter-terrorism policies'
, Statewatch News Online, June 2014
'Civil Liberties Committee rejects EU Passenger Name Record proposal'
, European Parliament, 24 April 2013
Footnotes
[1] 'Commission makes €50 million available for the development of "big brother" PNR databases - before legislation has even been agreed', Statewatch News Online, January 2013
[2] See footnote 1 in 'Making fundamental rights flexible', Statewatch Analysis, 2012. An example of a PNR record is available on Edward Hasbrouck's website.
[3] 'UK seeking to extend Commission proposal to cover intra-EU flights from the start', Statewatch News Online, March 2011
[4] 'EU funding for national PNR systems in 2012/13 under the 'Prevention of and Fight against Crime' programme', table compiled by Statewatch from the Commission's official figures.
[5] European Commission, 'Annex to the Commission Implementing Decision concerning the adoption of the work programme for 2014 and the financing for Union actions within the framework of the Internal Security Fund - the instrument for financial support for police cooperation, preventing and combating crime, and crisis management', C(2014) 5651 final, 8 August 2014
[6] Letter from Commissioner Cecilia Malmström to Juan Fernando López Aguilar MEP
, 14 March 2013
[7] European Commission, 'Law enforcement cooperation through measures to set up Passenger Information Units in Member States for the collection, processing, analysis and exchange of Passenger Name Record (PNR) data', 2012
[8] European Commission, 'Proposal for a Directive of the European Parliament and of the Council on the use of Passenger Name Record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime', COM(2011) 32 final, 2 February 2011
[9] Para. 18, 'Special meeting of the European Council (30 August 2014) - Conclusions', EUCO 163/14, 30 August 2014
