|
Matthew Vella
Malta’s Data Protection Commissioner, Paul Mifsud-Cremona, has expressed concerns about the recent agreement reached between the United States and the European Union on the transfer of passenger name record (PNR) data by air carriers to the US Department of Homeland Security, Bureau of Customs and Border Protection.
The European Parliament, staunchly opposed to the agreement, has decided to ask the EU Court of Justice to annul the Council of Ministers’ decision of 17 May 2004 on the conclusion of an agreement to allow the US access to PNR data from airlines.
PNR is the generic name given to the files created by the airlines for each journey any passenger books. Stored in the airlines' databases, PNR allows the airlines, travel agents, carrier and handling agents to access all relevant information related to passengers’ journeys, from personal details to flights they are boarding, as well as the meals they ordered for the flight.
The US Aviation and Security Act was passed by Congress in November 2001 to prevent terrorist acts by detecting potential perpetrators before they enter the country.
On March 5, 2003, the US announced that all international airlines had to provide US customs full electronic access to detailed airline passenger data on all travellers to the US, upon request.
Meeting strong opposition from the European Parliament, negotiations between the US and the EU met a stalemate created by the US when it threatened to impose penalties, including fines and even the withdrawal of landing rights, for airlines which do not comply with its demands.
Since then, the European Parliament has already voted on the issue five times, sending a clear ‘no’ to both Commission and Council on the agreement.
As a member of the European Data Protection Commissioners Article 29 Working Party, the adviser to the Commission on privacy issues, Mifsud-Cremona says the agreement does not yet respect certain important data protection issues.
“Any solution should at least respect [that] the purpose of the data transfer should be limited to fighting acts of terrorism and specific terrorism-related crimes to be defined,” Mifsud-Cremona told MaltaToday.
European airlines and European officials are concerned that providing unfettered access to US authorities would violate their privacy laws. The European Data Protection law allows law enforcement authorities access to passenger data only on a case-by-case basis based upon a particular suspicion. For sensitive data such as religious, ethnic, or political affiliation there are even stricter safeguards.
According to the Working Party, the data shared with other federal agencies carries no guarantee of adequate protection. Mifsud-Cremona says the list of data subjects should not be excessive, but the US-EU agreement demands such PNR categories as "any other data deemed necessary to identify persons” such as religious or ethnic information, the choice of meal on the airline, group affiliation, data relating to place of residence, and medical data amongst others.
The biggest fear is that the technical requirements imposed on airlines by the USA leaves data exposed to non-authorised access by third parties, especially since according to EU law, data can only be transferred to a third country if that country has an adequate level of protection.
The US in fact has no data protection laws, and since 9-11 the push has been towards more security rather than civil liberties. The Aviation and Security Act lays down that data must be available at least 15 minutes before takeoff, whilst the Enhanced Border Security and Visa Reform Act lays down that the US Immigration and Naturalisation Service must also have access to PNR. The US Immigration and Naturalisation Service has the power to demand that a plane leaving the USA has to return up to an hour after its departure.
The European Commission believes it has ensured the protection of both the interests of the aviation industry and preserved the right to privacy, but it has met consistent opposition from the European Parliament.
However it has scorned the European Parliament’s clear ‘no’ to the agreement, especially when the EP’s Legal Affairs Committee had already voiced serious reservations in April about the Commission’s decision to choose consultation with Parliament rather than the assent procedure before going ahead with the agreement.
Pat Cox said the decision to take the matter to the ECJ reflected the “concern felt by a large majority in the European Parliament on the need to defend European citizens' fundamental rights and freedoms. While naturally accepting that the US Administration is perfectly free to exercise its sovereign right to protect its own homeland, both the EU and the US must guard against a new form of creeping extra-territoriality.”
Mifsud-Cremona says it is the right of passengers to have clear, timely and comprehensive information, with sufficient guarantees that they would have access to a truly independent redress mechanism if data is processed incorrectly. In turn, the method of transfer should be a ‘push’ method where data are selected and transferred directly by airlines to US authorities, not a ‘pull’ method where data is pulled by the US authorities from the database of the airlines.
“It is emphasised that much improvement has been registered since the commencement of discussions in early 2003 and the adoption of the agreement will be monitored very closely. The risks relating to data protection principles will still be existent but these have to be taken in the balance with risks that may arise from the threats of terrorist attacks.”
matthew@newsworksltd.com
|
