Data sharing between the EU and
third countries
286. We now consider two particular recent developments
which have caused concern, in which personal data of UK and EU
citizens have been made available to the United States: the Passenger
Name Record agreement and the SWIFT agreement.
287. In the aftermath of the terrorist attacks on
11 September 2001, the US Congress passed a law requiring air
carriers operating passenger flights to or from the United States
to make Passenger Name Record (PNR) information available to the
then Customs Service. PNRs contain a range of personal data about
airline passengers, which can include sensitive data about race,
political opinion, health or sex life of the individual.
288. In May 2004 the EU signed an agreement with
the United States to allow the US authorities access to the airline
PNRs of EU Member States. This allows US Customs to receive a
wide range of personal data of passengers of European airlines
flying to or via the US, including credit card numbers and dietary
requirements. The agreement was made under the first pillar (as
it concerned commercial airlines) but was then the subject of
an European Court of Justice ruling which declared it was a third
pillar competence as the ultimate purpose of the data sharing
was for anti-terrorism measures. The first pillar agreement, concluded
on the basis that the US has an adequate level of data protection,
has now been replaced by a third pillar agreement between the
EU and the US, signed in autumn 2006.
289. A great deal of concern has been expressed about
the PNR agreement. It provided the US with potentially very sensitive
personal data of millions of EU citizens, with limited control
over how the data would subsequently be used. Our witnesses disagreed
over the adequacy of data protection provisions in the agreement.
Officials from the DCA told us that the Commission had considered
the data protection safeguards annexed to the PNR agreement to
be sufficient. These set out what the US was allowed to use the
data for, who they could share it with and how long they could
retain it.[215] However,
Professor Steve Peers cast doubt on the provisions:
The PNR agreement
gives a number of important
data protection safeguards, [but] there are doubts about how well
it is implemented
and it does not set much restriction
on the further transfer of the data to other countries or other
agencies within the United States.[216]
290. One of the MEPs who submitted evidence to us,
Baroness Ludford, criticised Member States' lack of consistency
in being reluctant on the one hand to share information with Europol
and Eurojust, whilst at the same time having "no problem
in exchanging data with the US, such as data related to air passengers
(PNR) or banking information on the SWIFT network".[217]
291. We asked the Government whether the handing
over of personal data of UK citizens to the US through Passenger
Name Records demonstrated a "level of casualness". The
Minister, Ms Ryan, responded, "I do not know that I would
call it 'casualness'
but I think it does flag up issues
that need to be addressed and I think it is important that they
are addressed". When asked what could be done at a national
level to protect UK citizens against their data being shared in
an unjustified way, Ms Ryan replied that the Government would
push for good evaluation and use this to inform future plans because
"these issues are going to become more, not less, important".
Although Ms Ryan agreed that creating a good pan-EU data protection
framework was "very important", she also emphasised
the need for data sharing, commenting that the "exchange
of passenger name records is very important".[218]
292. In a further case in 2006, the non-profit Belgian
international banking co-operative network Society for Worldwide
Interbank Financial Telecommunication (SWIFT) shared sensitive
EU banking records with the US Treasury Department. SWIFT received
a subpoena from the US in the wake of 9/11 ordering it to allow
the US access to search for evidence of terrorism-related activities.
SWIFT allowed the US access to its data on international financial
transfers without informing the EU authorities. EU Working Party
29, a national data-privacy supervisors committee ruled in November
2006 that the access to private transactions granted to the US
was illegal.
293. SWIFT declared in a statement on its website
that US access was only granted "for a limited set of data
and for the exclusive purpose of terrorism investigations and
for no other purpose".[219]
It added that the US was not able to search freely, but could
only see data responsive to specific, targeted searches. However,
the UK's Deputy Information Commissioner, David Smith, raised
with us the question of "whether the US access is proportionate;
that is, whether they wanted far too much information about people
who have no connection with the United States". The civil
liberties organisation Statewatch recently reported on its website
that it had "received complaints from people with online
UK banking accounts informing them that from 14 May 2007 details
of all financial transfers by them through SWIFT will be passed
to US authorities for the purposes of money-laundering, terrorism
and crime in general. They are asked to agree or notand
if not they cannot transfer money".[220]
294. We asked our witnesses whether the UK accepts
lower data protection arrangements with third countries than with
fellow EU Member States. Belinda Lewis of the DCA agreed that
the UK does accept lower standards:
You asked about third countries and whether we accept
lower standards of data protection there. In short, we do. Really
we have to in order to maintain the proper flow of business. We
share data with countries who would not be considered to provide
adequate data protection for purposes such as extradition, also
deportation, also to aid things like murder inquiries of UK citizens.[221]
295. Professor Steve Peers agreed:
We really should be digging our heels in and setting
a reasonable standard as to what we consider adequate data protection
with other countries.
We have to think of wrong identification
and all sorts of other issues that might arise.[222]
296. David Smith, the Deputy Information Commissioner,
emphasised that these data protection problems are international
and made a plea for some unified action: "we need some international
harmonisation".[223]
297. We asked the Government what could be done to
ensure that EU systems are more robust in dealing with data sharing
with third countries. Ms Ryan emphasised the importance of the
draft Framework Decision on Data Protection, but did not specify
how this agreement would impact on agreements with third countries,
but said that a future situation similar to the Passenger Name
Record agreement was "an area that the EU should hopefully
be able to avoid".[224]
She agreed that getting a powerful EU framework in place to block
private sector or EU organisations sharing data with a third country
with inadequate data protection was important:
I think it is crucial in ensuring that data that
is exchanged is properly used and that the people to whom the
data relates can be confident that they are protected.[225]
298. Current debate on the most recent draft of the
Framework Decision on data protection in the third pillar has
picked up on the problems of data protection with third countries
in such cases as PNR and SWIFT. The European Parliament's rapporteur
on the Framework Decision said, in May 2007, that "in view
of the current discussions concerning the exchange of data with
third countries, particularly on Swift and the PNR agreement,
it is necessary to adopt at European level minimum standards of
data protection for these exchanges.
such an exchange will
be efficient and useful only if we establish a high level of data
protection".[226]
The latest draft of the Framework Decision on data protection
provides for a joint supervisory authority to be set up to "combine
the national supervisory authorities and the European Data Protection
Supervisor".[227]
The European Parliament's rapporteur also recommended that "the
joint supervisory authority created in the framework decision
should be able to advise the Council, so as to ensure an appropriate
level of transfer of data to a third country in the light of national
law and international agreements".[228]
299. Both the
Passenger Name Record and SWIFT cases give cause for serious concern.
We consider that the casual use of data about millions of EU citizens,
without adequate safeguards to protect privacy, is an issue of
much greater significance than many of the other EU-related matters
put to the UK Government and Parliament for consideration. We
recommend that the Government and the European Commission should
prioritise the question of provision of personal information to
countries outside the EU as an issue of the greatest practical
concern to its citizens. We repeat our earlier recommendation
that the Government should seek urgent agreement on a comprehensive
EU-wide data protection framework in the third pillar and ensure
that specific minimum standards ensuring adequate data protection
are agreed for data exchange with third countries. We also recommend
that the Government should give due consideration to the proposal
of the European Parliament rapporteur that the joint supervisory
authority advise the Council to ensure an appropriate level of
data transfer with third countries.
34 Q 115 Back
35
Q 119 Back
36
Q 115 Back
37
Q 116 Back
38
Q 116 Back
39
Q 141 Back
40
Q 315-6 Back
41
Ev 175-6 Back
42
Ev 96 Back
43
Ev 97 Back
44
Ev 169 Back
45
Q 121 Back
46
Q 129 Back
47
Europol Convention Article 2.1 Back
48
Europol Convention Article 3.1 Back
49
Article 4 defines the national unit of each Member State, saying
that "Each Member State shall establish or designate a national
unit to carry out the tasks listed in this article" (Europol
Convention Article 4.1) Back
50
Article 8 deals with 'content of the information system', Article
10 with 'collection, processing and utilization of personal data'
and Article 11 with an 'index system'. Back
51
Europol Annual Report 2006 (March 2007), p23-5 Back
52
European Commission press release IP/07/528 (20 April 2007) Back
53
Q 129 Back
54
Q 135 Back
55
Q 122 Back
56
Eurojust figures supplied by UK Revenue and Customs Prosecutions
Office (RCPO). The UK has had 1 JIT (with the Netherlands). Belgium
has had 2 (with France and the Netherlands). Estonia has had 1
(with Finland). France has had 10 (9 with Spain and 1 with Belgium).
The Netherlands has had 2 (with Belgium and the UK). Slovakia
has had 1 (with Germany). Sweden has had 2 (with Finland). However,
RCPO cautions that the figures may not be completely accurate,
because not all Member States responded to the request for figures,
and there may be some JITs which have not been reported to the
national centres. (Evidence reported to the House but not printed.) Back
57
Council Presidency document 7868/06, p 4 Back
58
Statewatch, The future of Europol (August 2006), at www.statewatch.org Back
59
Q 130 Back
60
European Commission, Proposal for a Council Decision establishing
the Euroopean Police Office (EUROPOL) (COM (2006) 817 final)
(December 2006) Back
61
Q 135; see also Q 136 Back
62
Q 137 Back
63
Information on the LIBE hearing supplied by the UK National Parliament
Office, Brussels Back
64
Ev 92 Back
65
Q 152 Back
66
Q 150 Back
67
Q 153 Back
68
Q 346 Back
69
Q 346 Back
70
Q 129 Back
71
In 2003, Michel Fourniret, 63, was arrested by the Belgian Police
for the murder of six French and one Belgian girl. He had previously
been sentenced in France to seven years imprisonment for rape
and indecent assault on minors in France. The Belgian authorities
were unaware of his previous convictions. It is thought that he
may have murdered up to 40 victims. Back
72
Q 149 Back
73
Report of the Inquiry into the handling by Home Office officials
of notifications, by other European countries, of criminal convictions
for UK citizens, by Dusty Amroliwala OBE (Home Office, February
2007) Back
74
Ibid., paras 1.13, 2,1-27 Back
75
Ibid., section 4 Back
76
Ev 95 Back
77
Ev 96 Back
78
Q 301 Back
79
Q 149 Back
80
Q 149 Back
81
Ev 181 Back
82
Q 299 Back
83
Q 303 Back
84
The Hague Programme, para 2.1 Back
85
COM (2005) 490 final Back
86
Q 129 Back
87
Ev 148 Back
88
Q 74 Back
89
Q 162 Back
90
Q 157 Back
91
Sometimes referred to as the 'Prüm Convention' Back
92
See House of Lords European Union Committee, Eighteenth Report
of Session 2006-07, Prüm: an effective weapon against
terrorism and crime? (HL 90), published 9 May 2007, para 23 Back
93
Ev 94 Back
94
Q 292 Back
95
Ev 94 Back
96
Q 306-309 Back
97
Document 6002/07, Article 18 Back
98
House of Lords European Union Committee, Eighteenth Report of
Session 2006-07, Prüm: an effective weapon against terrorism
and crime? (HL 90), p 11 Back
99
Information in this paragraph is from the European Commission
website: http://ec.europa.eu/justice_home/fsj/intro/fsj_intro_en.htm Back
100
Q 206 Back
101
Further examples are given in Ev 178-180 Back
102
Ev 180 Back
103
Q 327; see also Ev 129 Back
104
Q 83 Back
105
Q 14 Back
106
Q 207 Back
107
Q 207 Back
108
Ev 169 Back
109
Ev 177 Back
110
Ev 99 Back
111
Ev 177 Back
112
Q 209 Back
113
Q 327 Back
114
Ev 128 Back
115
COM (2006) 8 final Back
116
Q 225 Back
117
Q 224 Back
118
Ev 130 Back
119
Q 324-325 Back
120
Q 238 and 239 Back
121
Ev 181 Back
122
Article 2 (1) Back
123
Ev 131 Back
124
Q 323 Back
125
Ev 177 Back
126
Q 5 Back
127
Ev 137 Back
128
Q 177 Back
129
Ev 130-31 Back
130
Ev 131 Back
131
Q 67 Back
132
Q 180 Back
133
European Scrutiny Committee, Ninth Report of Session 2005-06 (HC
34-ix), published 18 November 2005, pp. 11-12 Back
134
Ev 125 Back
135
Q 243-244 Back
136
Ev 170 Back
137
Ev 131 Back
138
Ev 131 Back
139
Ev 103 Back
140
Ev 159 Back
141
Q 80 Back
142
Q 31 Back
143
Q 77 Back
144
Ev 131 Back
145
Ev 108 Back
146
Ev 158 Back
147
Ev 158 Back
148
Ev 132 Back
149
Ev 181-183 Back
150
Q 165 (JUSTICE) Back
151
Q 165 (The Law Society) Back
152
Q 144 Back
153
Ev 176 Back
154
Ev 176. The European Legal Aid Directive and the European
Agreement for the Transmission of Applications for Legal Aid.
Back
155
The FCO guide to UK nationals in prison abroad (In Prison Abroad,
www.fco.gov.uk/travel) specifically refers citizens to the charity
'Prisoners Abroad' Back
156
Figures calculated from February 2007 breakdown by country on
the 'Prisoners Abroad' website. Back
157
The Hague Programme 2005/C 53/01, p 13 Back
158
Q 77 Back
159
Together with Cyprus, the Czech Republic, Ireland, Malta and Slovakia. Back
160
See House of Lords European Union Committee, Second Report of
2006-07, Breaking the deadlock: what future for EU procedural
rights? (HL 20), para 3 Back
161
Ibid., paras 8-9 Back
162
Ibid., paras 21-22 Back
163
Ev 129 Back
164
Police and Criminal Evidence Act (1984) 2005 Guidance Code A Back
165
Ibid, Code A Section 4 Back
166
Ibid, Code C Back
167
142, 238,919 euro total budget (as of 2005). Cyprus has a recorded
figure of 207, 576, 557, but the report authors state "we
doubt that this figure is accurate". Taru Spronken and Marelle
Attinger, Procedural Rights in Criminal Proceedings: Existing
Level of Safeguards in the European Union (2005), p 81 Back
168
House of Lords European Union Committee, Second Report of 2006-07,
Breaking the deadlock: what future for EU procedural rights?
(HL 20), paras 25-27 Back
169
Ibid., para 33 Back
170
Ibid., para 55 Back
171
Ibid., para 35 Back
172
Frattini speech to Berlin conference, February 2007 Back
173
Home Affairs Committee, Fifth Report of Session 2005-06, Immigration
Control (HC 775-I), published on 23 July 2006 Back
174
Commission Communication, Policy priorities in the fight against
illegal immigration of third country nationals Back
175
Q 87 Back
176
Ev 133 Back
177
Ev 129 Back
178
Q 86 Back
179
Ev 119 Back
180
Q 343 Back
181
Q 343 Back
182
Ev 133 Back
183
Frontex Annual Report 2006, p 11 Back
184
Ev 120 Back
185
Q 335 Back
186
Q 332 Back
187
Frontex Annual Report in March 2007, and a formal Commission
evaluation later in 2007 Back
188
Q 92 Back
189
Q 337 Back
190
Q 337 Back
191
Q 338 Back
192
Q 331 Back
193
Q 339 Back
194
Q 346 Back
195
Ev 92 Back
196
Q 153 Back
197
Q 154 Back
198
Q 347 Back
199
Home Affairs Committee, Fifth Report of Session 2005-06, Immigration
Control (HC 775-I), published on 23 July 2006; the Government's
Reply was published on 18 September 2006 as Cm 6910. Back
200
Q 253 Back
201
Q 253 Back
202
Q 273 Back
203
Q 274 Back
204
Q 270 Back
205
Q 161 Back
206
Q 272 Back
207
Q 272 Back
208
COM (2005) 475 Final Back
209
For example, JUSTICE Ev 135 and The Law Society Q 172 Back
210
Ev 135 Back
211
Q 255 Back
212
Q 256 Back
213
Q 348 Back
214
PR/665822EN.doc p33 Back
215
Q 289 Back
216
Q 290 Back
217
Ev 144 Back
218
Q 348-49 Back
219
www.swift.com/index.cfm?item_id=60275 Back
220
www.statewatch.org EU-US data protection PNR-SWIFT Back
221
Q 289 Back
222
Q 290 Back
223
Q 291 Back
224
Q 438 Back
225
Q 351 Back
226
PR/665822EN.doc p35 Back
227
Proposal for a Council Framework Decision on the protection of
personal data processed in the framework of police and judicial
co-operation in criminal matters (7315/2007-C6-0115/2007-2005-0202(CNS))
Amendment 7 Recital 18a (new) Back
228
Ibid, p 35 Back