Commission plans snooping for all international flights

By David Cronin

Date: 09/02/06

Justice officials in the European Commission are preparing a new plan to oblige airlines to hand over data on their passengers, after the legality of the existing transatlantic accord was called into question.

Under the new scheme, all carriers operating international flights to, from or via EU member states would have to hand over Passenger Name Record (PNR) information to designated authorities as an anti-terrorism measure.

Sources say that work on the proposal by staff in the Commission's directorate-general for justice, freedom and security is at an advanced stage. But the 25 commissioners are unlikely to adopt it formally until after a ruling on the 2004 agreement covering the transfer of PNR from the EU to the US is delivered by the European Court of Justice (ECJ).

The EU-US agreement was challenged at the ECJ by the European Parliament. No date has yet been fixed for the ruling in this case; some EU officials are expecting it this month or in March.

In November, Philippe Léger, an advocate-general at the ECJ, issued an opinion that the existing agreement should be annulled. He argued that the Commission was wrong to invoke a 1995 EU directive on the exchange of personal data when concluding the agreement. Decisions relating to criminal law, he found, were beyond the scope of that directive. He argued also that the Council of Ministers did not conclude the agreement with the US on the right legal basis. An advocate-general's opinion is a significant preliminary step but the court's judges are not bound to follow it in their ruling.

Commission officials say that the draft new proposal will cover international flights only and will not apply to flights within the EU.

Representatives of the air transport industry are perturbed by indications that the new plan could put onerous requirements on carriers.

An industry source said that while the transatlantic accord provides for the data to be sent to a single destination in the US, the new scheme would require the data to be transferred to a different point in each of the 25 EU countries. "This would be extremely unwieldy, extremely bureaucratic and very expensive," the source added.

The source also expressed concern that airline carriers may not be reimbursed for costs incurred in updating their computer systems to honour the obligations imposed by the new scheme.

Swedish Conservative MEP Charlotte Cederschiöld said that the new proposal should contain a guarantee that PNR held by an EU member state would not be given to a third country unless it had a high level of data protection.

Dutch Green Kathalijne Buitenweg said that the new proposal should be based on a 'push' system, where airlines control the transfer of data, rather than a 'pull' system which allowed another country a high degree of access to a database within the EU.

Maurice Wessling from Bits of Freedom, an Amsterdam-based civil liberties organisation, said it was essential to have a mechanism whereby European citizens could complain to an independent body about any suspected misuse of data.

One problem with the transatlantic accord, he said, was that it provided for complaints to be addressed to a privacy officer in America's Department of Homeland Security, rather than a body separate from that collecting the data.

The EU signed a separate deal on exchanging PNR with Canada during 2005.

Peter Hustinx, the EU's data protection supervisor, has sent papers to the ECJ supporting the MEPs' complaint against the EU-US deal. But he has pinpointed "major differences" between it and the agreement with Canada which, he said, benefited from a "much more developed legislative system" of data protection, including oversight of its implementation by a data commissioner.

European Court of Justice: Press Release, No.98, 2005 (22.11.05) http://curia.europa.eu/en/actu/communiques/cp05/aff/cp050098en.pdf

---