Data chiefs rein-in America over passenger information

Date: 26/06/03

By Peter Chapman

EU DATA protection watchdogs have called for wholesale changes to a controversial system for the transfer to US authorities of sensitive information about passengers on transatlantic flights.

They were responding to the US Customs and Border Protection Bureau's demand for electronic access to airline's "passenger name record" - a computer database giving detailed information about each passenger on a flight.

The data commissioners from each member state say the system - a response to the 11 September 2001 terrorist attacks on New York and Washington - breaches a 1995 EU data privacy law, because American authorities would have direct access to airline reservation databases.

"While combating terrorism, respect for fundamental rights and freedoms of the individuals, including the right to privacy and data protection, must be ensured," they warn in a report on the issue approved earlier this month.

Moreover, the watchdogs insist that America is asking for too much information and that authorities want to hold it for too long - up to eight years.

Instead, the so-called "Article 29 working party" - chaired by Italian data privacy commissioner Stefano Rodota - said airlines should be responsible for collating the information to prevent US authorities having a free reign over confidential databases.

The US has indicated it would accept such a change, the group notes, adding: "This solution should be substituted for the present mechanism as soon as possible."

The amount of data sent by airlines should also be restricted to the bare minimum necessary while, in most cases, it should only be kept for a few weeks or months.

The verdict adds to concerns voiced by citizens' rights campaigners and MEPs about the system.

The EU's data protection directive says transfers of data outside the Union can only be automatically allowed if the destination puts in place "adequate" protection measures.

The Union's executive, together with the Article 29 working party, has to decide whether this requirement has been met.

Under a stop-gap accord, the US Customs and Border Protection Bureau offered the Commission assurances that EU citizens' data would not be misused and both sides promised to work out a longer-term solution that meets the terms of the directive.

But Commission spokesman Jonathan Todd said the US would soon have to offer solutions if the data flows are to continue.

"The working party highlighted a number of concerns that we are pursuing with the Americans.

"They know that, until they come up with the goods, we will not recognize by a formal decision the adequacy of the arrangements.

"In the absence [of a formal decision] at any time an agency can put a stop to the transfer of data," Todd added.