House of Commons - Forty-eighth Report of Session 2010-12

Forty-eighth Report of Session 2010-12 - European Scrutiny Committee Contents

4 EU PNR Agreement with the United States of America

(a)

(31238)

17697/09

COM(09) 702

(b)

(33437)

17429/11

COM(11) 805

(c)

(33438)

17430/11

COM(11) 807

Draft Council Decision on the conclusion of the Agreement between the European Union and the United States of America on the processing and transfer of passenger name record (PNR) data by air carriers to the United States Department of Homeland Security (DHS) (2007 PNR Agreement)

Draft Council Decision on the signature of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security

Draft Council Decision on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security

Legal base (a)  Articles 82(1)(d), 87(2)(a) and 218(6)(a) TFEU; QMV; consent
(b)  Articles 82(1)(d), 87(2)(a) and 218(5) TFEU; QMV
(c)  Articles 82(1)(d), 87(2)(a) and 218(6)(a) TFEU; QMV; EP consent

Document originated (b) and (c) 23 November 2011

Deposited in Parliament (b) and (c) 28 November 2011

Department Home Office

Basis of consideration Minister's letter of 7 November 2011, EM of 29 November 2011and Home Secretary's letter of 5 December 2011

Previous Committee Report (a)  HC 5-x (2009-10), chapter 4 (9 February 2010)
(b)  and (c) None

To be discussed in Council 13 December 2011

Committee's assessment Legally and politically important

Committee's decision For debate in European Committee B together with the draft Council Decisions relating to the EU-Australia PNR Agreement (decision reported on 29 June 2011)

Background

4.1 Following the terrorist attacks of 11 September 2001, the United States (US) passed legislation requiring air carriers operating flights to, from, or across US territory to provide the US Department of Homeland Security (DHS) and the Bureau of Customs and Border Protection (CBP) with electronic access to passenger name record ("PNR") data held in their reservation and departure control systems.

4.2 Under EU data protection laws, personal data may only be transferred to a third (non-EU) country if that country ensures an adequate level of protection. In 2004, the Commission adopted a Decision,[28] based on a set of undertakings given by the DHS and the CBP, which recognised that the US provided an adequate level of protection for the purpose of transferring PNR data. The Decision meant that Member States could allow EU-based air carriers to transfer PNR data to the US without seeking any additional guarantees. Shortly afterwards, the Council approved an Agreement with the US on the processing and transfer of PNR data ("the 2004 Agreement") which entered into force on 28 May 2004.[29] It allowed the CBP to access electronically PNR data held in air carriers' reservation and departure control systems, in line with the undertakings already given to the Commission.

4.3 The European Parliament successfully challenged the legality of the Council Decision approving the conclusion of the 2004 Agreement, as well as the Commission Decision on adequacy, in an annulment action brought before the Court of Justice. Both Decisions were annulled with effect from 30 September 2006 on the grounds that neither was founded on an appropriate legal base. In light of its ruling on the legal base, the Court did not consider it necessary to consider whether the Decisions also infringed fundamental rights.

4.4 In October 2006, the EU and the US completed negotiations on an interim Agreement which applied provisionally from the date of signature (16 October 2006) and authorised the continuing transfer of PNR data to the DHS on the basis of the undertakings given by the US in 2004. The interim Agreement expired on 31 July 2007. It was replaced by a new Agreement which was signed in July 2007 ("the 2007 Agreement"). The Decision approving signature on behalf of the EU stated that the Agreement would be applied "on a provisional basis in conformity with existing domestic law as of the date of its signature, pending its entry into force."[30]

4.5 The draft Decision to approve the conclusion of the 2007 Agreement — document (a) — was deposited for scrutiny in January 2010.

Previous scrutiny of the 2007 Agreement — document (a)

4.6 Our predecessors considered the draft Decision to conclude the 2007 Agreement on 9 February 2010. The content of the Agreement, and of an accompanying US letter to the EU attached to it which sets out a number of assurances explaining DHS's policy on safeguarding PNR data, are described in our predecessor's Eleventh Report, 2009-10. The Report's conclusion expressed the then Committee's concerns that:

provisions on the handling, use and storage of PNR data by the DHS were not incorporated in the legally binding Agreement, but took the form of assurances in a non-binding letter attached to the Agreement;
the retention periods for PNR data (seven years in an active file, followed by eight years in a dormant file) were too long; and
there were insufficient safeguards regarding the sharing of PNR data with third countries.

4.7 Our predecessors therefore decided to keep the draft Council Decision under scrutiny and asked for progress reports on negotiations with the European Parliament, since its consent would be required before the Council could formally conclude the Agreement.

4.8 So far, the European Parliament has not given its consent to the 2007 Agreement, which therefore continues to apply on a provisional basis. The European Parliament has pressed the Commission to produce a single model for EU PNR Agreements with third countries, not least to ensure that the EU takes a consistent approach.

4.9 In September 2010, the Commission published a Communication setting out a global approach for the transfer of PNR data to third countries, accompanied by three recommendations which asked the Council to authorise the negotiation of new PNR Agreements with Australia, Canada and the US. The Communication listed the criteria — including a set of basic principles for the protection of personal data — which should guide the EU in negotiating third country PNR Agreements. These are set out in full in our Twelfth Report.[31] The Commission suggested that adherence to these criteria would lead to greater coherence, whilst also ensuring respect for private life and personal data protection.

4.10 In his Written Ministerial Statement of 20 December 2010, the Minister for Immigration (Damian Green) stated the Government's belief that "clear PNR agreements between the EU and third countries play a vital role in removing legal uncertainty for air carriers flying to those countries, and help to ensure that PNR information can be shared quickly and securely with all necessary data protection safeguards in place where appropriate." He added:

"After due consideration of the importance of civil liberties, data protection and security concerns, the Government have decided to opt in to negotiating mandates for three PNR Agreements with Australia, Canada and the US as they believe they will pave the way for EU-third country agreements that strike the right balance between civil liberties, data protection and security of the EU. As these mandates are currently restricted so as to preserve the EU negotiating position they are not therefore depositable within Parliament.

"The Government will work with the Scrutiny Committees when it considers whether to opt in to Council decisions to sign and conclude each third country agreement. I will also in due course update Parliament on the Government's opt-in decisions at these later stages."

4.11 In June 2011, we agreed to waive our scrutiny reserve on two draft Council Decisions to sign and conclude a new EU-Australia PNR Agreement on the grounds that the Government wished to support their adoption and the Agreement appeared to be consistent with the principles set out in the Commission's global approach.[32] We nevertheless retained the draft Decisions under scrutiny as we noted that the Agreement with Australia was likely to be the first in a series of EU PNR Agreements with third countries and that we may therefore wish to consider it alongside proposed EU PNR Agreements with the United States and/or Canada. We also registered our deep dissatisfaction with the timetable proposed by the then Presidency for the adoption of the draft Decisions which precluded any possibility of effective consultation on the content of the Agreement and undermined Parliamentary scrutiny. The draft Decision on signature of the EU-Australia PNR Agreement was adopted by the Justice and Home Affairs Council on 22 September 2011.

The Minister's letter of 7 November 2011

4.12 In July 2011, the Minister for Immigration (Damian Green) sent us a draft copy of the proposed new EU-US PNR Agreement accompanied by an unnumbered Explanatory Memorandum. As the text of the draft Agreement was marked limité, and was not deposited in Parliament, we were unable to disclose its content or prepare a Report to the House. We were, however, aware that the Commission's Legal Service had expressed serious reservations about aspects of the draft Agreement, including:

lack of proportionality as regards the purposes for which PNR data may be used;
lengthy data retention periods;
lack of independent oversight of the Agreement; and
inadequate provision for judicial redress.

4.13 The Minister's letter of 7 November informed us that a number of adjustments had been made to the draft Agreement sent to us in July although he had not, at that stage, seen a revised text and that "a political understanding" had been reached. He described some of the changes which he believed had been made and expressed the UK's support for "the idea of an EU-US Agreement", adding that he considered PNR data to be "an absolutely vital tool in the fight against terrorism and organised crime" and that the "we should continue to cooperate with the US for the security of all our citizens."

Draft Council Decisions to sign and conclude a new EU-US PNR Agreement — documents (b) and (c)

4.14 Document (b) is a draft Council Decision authorising the EU to sign a new PNR Agreement with the US. Once the Agreement has been signed, it then has to be sent to the European Parliament which must consent to its conclusion. If the EP gives its consent, a further draft Council Decision — document (c) — must be adopted to conclude the Agreement. The Agreement is intended to supersede the 2007 EU-US PNR Agreement which is being applied on a provisional basis. The text of the proposed Agreement is attached to both draft Council Decisions.

4.15 Articles 82(1)(d) and 87(2)(a) of the Treaty on the Functioning of the European Union (TFEU) provide the substantive legal bases for both draft Council Decisions. They provide for cooperation between national law enforcement authorities and for the processing, analysis and exchange of information relating to the prevention, detection and investigation of criminal offences. As the legal bases for the draft Council Decisions are to be found in Title V of Part Three of the TFEU, the UK's Title V opt-in applies.

4.16 In its explanatory memorandum accompanying the two draft Council Decisions, the Commission notes that the Agreement was initialled by the Parties on 17 November 2011. It says that the Agreement is needed to provide a legal base for the transfer of PNR data from the EU to the US and to provide legal certainty for air carriers whilst also ensuring that individuals' personal data and physical security are protected. The Commission believes that the content of the Agreement is consistent with the general criteria and principles set out in its Communication on a global approach to PNR transfers to third countries. It highlights the following "important safeguards":

the purposes for which PNR data may be processed are strictly limited to preventing, detecting, investigating and prosecuting terrorist offences and serious transnational crime;
the period during which PNR data may be retained is limited, and the data will be 'depersonalised' after 6 months;
individuals have a right of access to their PNR data, to seek rectification if it is inaccurate, and to obtain effective redress;
transfer of PNR data will be based on the "push method", thus ensuring that air carriers maintain control of the information held in their databases;
the processing of 'sensitive' data (for example, data revealing an individual's racial or ethnic origin or religious or philosophical beliefs) is only permitted in exceptional cases; and
compliance with the rules set out in the Agreement is subject to independent review and oversight by various Department Privacy Officers, the DHS Office of Inspector General, the Government Accountability Office and the US Congress.

THE MAIN ELEMENTS OF THE DRAFT AGREEMENT

Purpose, scope and use of PNR data — Articles 1-4

4.17 The purpose of the Agreement is to "ensure security and to protect the life and safety of the public" by providing for the transfer of EU-sourced PNR data to DHS for the purpose of preventing, detecting, investigating and prosecuting:

terrorist offences and related crimes; and
other transnational crimes which are punishable by a custodial sentence of more than three years.

4.18 PNR data may be used and processed to identify individuals who should be questioned or examined more closely on their arrival in, or departure from, the US. They may also be used and processed on a case by case basis in the following circumstances:

where necessary in view of a serious threat;
for the protection of vital interests of any individual; or
if ordered by a court.

4.19 Moreover, limitations on the use and processing of PNR data are stated to be "without prejudice to domestic law enforcement, judicial powers, or proceedings, where other violations of law or indications thereof are detected in the course of the use and processing of PNR" (Article 4(4)).

Data protection safeguards — Articles 5-14

4.20 The draft Agreement includes provisions on data security and integrity, requires all processing of PNR data to be logged or documented, and prohibits US Government authorities from taking any decision based solely on the automated processing and use of PNR data if it would produce "significant adverse actions affecting the legal interests of individuals" (Article 7). DHS must make available to the public information on the use and processing of PNR data, and publicise the means whereby individuals may access their PNR data and, where appropriate, seek rectification or redress. The Agreement also sets out the basis, in accordance with US law, for seeking administrative or judicial redress.

4.21 The Agreement states that compliance with data protection safeguards is subject to "independent review and oversight by Department Privacy Officers, such as the DHS Privacy Officer" and that an additional level of independent review and oversight is provided by the DHS Office of Inspector General, the Government Accountability Office, and the US Congress (Article 14).

Sensitive data — Article 6

4.22 The Agreement allows access to, processing and use of sensitive data "in exceptional circumstances where the life of an individual could be imperilled or seriously impaired." Access in these circumstances requires the approval of a DHS senior manager, on a case by case basis. The data must be permanently deleted within 30 days of receipt by DHS, although a longer retention period may be permitted, in accordance with US law, for the purpose of a specific investigation, prosecution or enforcement action.

Data retention — Article 8

4.23 The Agreement allows the retention of PNR data for up to 15 years. PNR data may be retained in an active database for the first five years, but should be "depersonalised and masked" after six months. After five years, the data shall be transferred to a dormant database for up to ten years. PNR data may be re-personalised during this ten year period in connection with law enforcement operations where there is "an identifiable case, threat or risk", and only within the first five years for serious transnational crime which does not relate to terrorism. After ten years, PNR data must be fully anonymised by deleting all elements which might identify the individuals to whom the data relate.

4.24 The Agreement specifies that the need for a ten-year dormant period of data retention will be subject to review and evaluation with one year of the Agreement's entry into force.

Transmission and sharing of PNR data — Articles 15-18

4.25 The Agreement specifies that the so-called "push method" applies to the transfer of PNR data, but it also contemplates that carriers may be required to give DHS access to their PNR databases in two situations. The first is where carriers are unable, for technical reasons, to respond to a request for PNR data between or after a fixed number of routine and scheduled transfers. The second is where DHS requires access to PNR data "in exceptional circumstances in order to respond to a specific, urgent and serious threat".

4.26 The initial transfer of PNR data should be made 96 hours before the scheduled flight departure time, but the Agreement does not stipulate a maximum number of transfers per flight, leaving these to be determined by DHS.

4.27 The Agreement requires DHS to make available to Member States' police or judicial authorities, and to Europol and Eurojust, any relevant and appropriate analytical information it has obtained as a result of processing PNR data, and these authorities may also request access to US-held PNR data in a specific case. DHS may share PNR data with other US Government authorities, provided that they apply the same or comparable data protection safeguards and only use the data for the purposes specified in the Agreement. Transfers outside the US to third country authorities are permitted if use of the data is consistent with the purposes set out in the Agreement and comparable data protection safeguards apply. If the transfer of PNR data concerns a citizen or resident of an EU Member State, that State must be informed of the transfer.

Final provisions

4.28 The remaining provisions include an Article which makes clear that, by virtue of concluding and implementing the Agreement, DHS will be deemed to provide an adequate level of protection for the processing and use of PNR data, as required by EU law, and that carriers will also be deemed to have complied with EU law. A further Article notes that the establishment of an EU PNR system (currently under consideration) may have a material effect on the EU-US Agreement and requires the Parties to consult with a view to ensuring full reciprocity, particularly as regards applicable data protection standards.

4.29 There is provision for the Agreement to be subject to a joint review within one year of its entry into force, followed by a joint evaluation after four years. An Annex to the Agreement contains a Declaration by the EU indicating that, in the context of the joint review and evaluation, it will seek information from the US on the following:

transfers by the US to third countries of PNR data relating to individuals who are nationals of, or resident in, EU Member States; and
implementation of the conditions governing such transfers.

This information is intended to enable the EU to verify whether third countries receiving PNR data from the US guarantee standards of personal data protection comparable to those required of DHS under the Agreement.

The Government's view

4.30 The Minister considers that the proposed Agreement is in line with the Commission's 2010 Communication on a global approach to sharing PNR data with third countries for the following reasons:

it limits the purposes for which PNR data may be processed;
it only permits sensitive personal data to be processed in exceptional circumstances;
it secures data against misuse and unlawful access;
it provides an adequate system of access and redress; and
it only permits data to be retained for a limited and proportionate period.

4.31 The Minister highlights a number of provisions which he considers to be an improvement on the current arrangements for PNR transfers which have applied provisionally since July 2007.

Purpose, scope and definitions

4.32 The new Agreement includes a clearer definition of serious transnational crime which specifies a minimum punishment threshold of three years' imprisonment. The Minister notes that this is line with the current version of the draft EU-PNR Directive and believes that it provides "an appropriate limitation" for the use of PNR data for serious crime purposes.[33]

Data retention

4.33 The Minister says that the provisions on data retention are more restrictive than the 2007 Agreement which allows PNR data to be retained in an active database for seven years, and then transferred to a dormant database for a further eight years. Whilst he recognises that the new data retention framework is longer than that in the EU-Australia PNR Agreement (five and a half years) and the draft EU-PNR Directive (five years and 30 days), he believes that it protects the privacy rights of passengers for the following reasons:

"Most users of the DHS PNR database will only be able to view personal information for 6 months. Active retention will be limited to five years and there will be a mandatory evaluation of the dormant retention period. Data may be retained in the dormant database for up to 10 years, but after five years it may only be used for counter terrorism purposes, and not in the fight against serious transnational crime. This regime was adjusted in response to the EU's request for a shorter and more narrowly tailored retention period. US negotiators have provided justification to negotiators from the EU Commission for retaining data for counter-terrorism purposes for up to 15 years, and for the fight against serious transnational crime for up to 10 years."[34]

Sensitive data

4.34 The Minister notes that the arrangements for access to, processing and use of sensitive data are the same as in the 2007 Agreement, but "with the added protection that access is on a case by case basis with the approval of a senior DHS manager."[35]

Oversight of data protection safeguards

4.35 The Minister states that compliance with the data protection safeguards set out in the Agreement will be overseen by Department Privacy Officers, such as the DHS Privacy Officer, "who have a proven record of autonomy and will ensure complaints are investigated."[36]

Compliance with fundamental rights

4.36 The Minister notes that any interference with the right to respect for private and family life and the right to protection of personal data "must be provided for by law and respect the essence of the particular right in question; and the interference must comply with the requirements of necessity and proportionality."[37] He believes that the purpose of the Agreement — to help combat terrorism and other serious transnational crime — constitutes a legitimate objective as "PNR data has a clear value in combating these types of crime, which goes to the necessity of the measure to protect the public."[38] He also highlights a number of data protection safeguards and considers that these "ensure sufficient protection for fundamental rights, while taking account of the particular circumstances of the US."[39]

The UK's opt-in

4.37 The Minister sets out the outcomes which the Government hoped to achieve when it decided to opt into the negotiating mandate for a new EU-US PNR Agreement. These were:

independent data protection oversight;
provision for review of the Agreement within two years;
strict limitations on the transfer of PNR data for the purpose of preventing and combating terrorism and other serious transnational crime;
respect for the principles of necessity and proportionality;
respect for EU law and the EU Treaties; and
an adequate level of personal data protection.

4.38 The Government considers that the proposed Agreement meets these objectives and therefore intends to opt into both draft Council Decisions. The Minister continues:

"The UK has long recognised the value of PNR data in combating a wide range of illicit activity — specifically, the fight against terrorism and serious crime — and we are pleased that the Commission and the US share this view. The UK, in common with other EU Member States, views the US as a key partner. A clear PNR Agreement between the EU and the US will play a vital role in providing legal certainty for air carriers flying to the US and help ensure that, where appropriate, PNR data can be shared quickly and securely with all necessary data protection safeguards in place."[40]

Impact on UK law

4.39 The Minister notes that the UK already has the ability to obtain passenger, crew and service data from carriers in advance of all movements into and out of the UK, and that the data may be shared amongst the UK Border Agency, police and HM Revenue and Customs for immigration, customs or police purposes. He says that the UK's existing legal framework will not need to be amended if the Agreement is adopted.

Timetable

4.40 Following publication of the draft Council Decisions on 23 November, the Government expects the Presidency to press for the adoption of document (b) — the draft Council Decision on signature — at the Justice and Home Affairs Council on 13 December. The Minister notes that the short time frame between publication and adoption precludes consultation of outside bodies, notably the UK's Information Commissioner and the EU's Article 29 Data Protection Working Party of which he is a member. He adds, however, that the Government is unaware of any issues arising from the transfer of PNR data to the US under the 2007 Agreement which is provisionally in force.

4.41 Finally, the Minister states that, in light of the expedited timetable and the importance of the Agreement to the UK, the Government intends to inform the Presidency "that it will waive its Treaty rights to three months' opt-in consideration on this occasion in order to allow the Agreement to proceed."[41]

The Home Secretary's letter of 5 December 2011

4.42 The Home Secretary's (Mrs Theresa May) letter notes that the Presidency plans to secure agreement to adopt the Council Decision to sign the EU-US PNR Agreement at the Justice and Home Affairs Council on 13 December. She continues:

"We believe they will have sufficient votes to secure that outcome, although this remains subject to confirmation. As you can see, this gives us just under three weeks for the UK to make an opt-in decision rather than the three months to which we are entitled.

"In spite of the representations that I have made at the highest level about our entitlement to a three month opt-in period, it seems that both the Presidency and US are determined to adopt the Agreement within this expedited timetable. I am equally determined that the Scrutiny Committees should be given as much opportunity as possible to consider the text. This is why an earlier version of the text was deposited with an unnumbered Explanatory Memorandum back in July."

4.43 The Home Secretary asks us to consider the draft Council Decisions forthwith as she would "value the views of the Committee in advance of the Council." She adds:

"Ireland have informed the Presidency that they are prepared to waive their 3 month opt-in period on this occasion and opt in post-adoption."

Conclusion

4.44 In our Thirty-fifth Report, which included a chapter on the EU-Australia PNR Agreement, we expressed our deep dissatisfaction that there were only 20 days between publication of the Agreement and the date initially proposed by the Presidency for the adoption of the draft Council Decision to approve its signature.[42] Although the timetable slipped, the Home Secretary told us then that "the UK was very clear that, under the Treaty, we should be allowed to exercise our option to allow Parliament to scrutinise the Agreement within our 3 month window for opting in."[43] Regrettably, we find ourselves in the same position again, but without a similar assurance from the Government that we should have sufficient time to scrutinise the Agreement effectively. Although the Home Secretary expresses her determination that we should be given as much opportunity as possible to consider the draft Agreement, the Explanatory Memorandum provided by the Minister for Immigration states categorically that the UK will "waive its Treaty rights to three months' opt-in consideration on this occasion in order to allow the Agreement to proceed." We do not see how a unilateral waiver of the UK's Treaty rights can be reconciled with a commitment to ensuring proper Parliamentary scrutiny.

4.45 All the reasons set out in our Thirty-fifth Report for considering the expedited timetable to be objectionable apply with even greater force in this case. These were:

the importance of allowing sufficient time to consult experts, notably the Information Commissioner, the Article 29 Data Protection Working Party and the European Data Protection Supervisor, as well as law enforcement bodies and carriers;
the Government's commitment, in accordance with the Ashton undertakings, to allow Parliament an eight-week scrutiny period before notifying the Council Presidency of its opt-in decision, except where an earlier opt-in decision is 'necessary' or 'essential'; and
respect for the procedures set out in Protocol 21 (the UK's opt-in Protocol) which give the UK three months in which to decide whether to opt into an international agreement concluded pursuant to Title V of Part Three of the TFEU.

4.46 We acknowledge that the Government has done its best to keep us informed of the progress of negotiations and to submit a detailed Explanatory Memorandum within days of publication of the initialled Agreement. We understand the reasons why the Government, as the foremost advocate of an EU PNR system, would wish to associate itself with the signature and conclusion of a new Agreement with the US. However, whilst we recognise that there may be exceptional circumstances which justify an early opt-in decision so that draft EU legislation may be adopted quickly, the need for haste in this case is unclear. First, the 2007 EU PNR Agreement with the US will continue to apply on a provisional basis pending its conclusion or replacement by a successor Agreement. Second, compliance with the eight week scrutiny period for opt-in decisions would not prejudice UK participation in the proposed new Agreement, since the Government would still be able to opt in, at a later stage, to the draft Decision to conclude the Agreement or to exercise its right to request to opt in post-adoption. Indeed, these possibilities are reflected in the final provisions of the Agreement in Article 27.

4.47 We consider, moreover, that there is a wider principle at stake. It is precisely situations such as this one which test the strength of the Government's commitment to enhanced Parliamentary scrutiny of the UK's opt-in. We agreed to waive our scrutiny reserve for the EU-Australia PNR Agreement on the strength of assurances that it contained adequate safeguards for the protection of personal data, in line with the Commission's global approach to transfers of PNR data to third countries. We question whether this is the case for some of the provisions in the proposed EU-US Agreement. For example, we question whether Articles 4(2) and (3) which provide for the use and processing of PNR data "if ordered by a court", or to identify individuals to be questioned or examined on arrival or departure from the US, constitute a meaningful purpose limitation. We note that the proposed data retention limit greatly exceeds the limits set out in the EU-Australia PNR Agreement and the draft EU PNR Directive. Article 13 does not appear to confer a right to effective judicial redress, merely the possibility to "seek" it, and oversight of privacy safeguards by Departmental Privacy Officers lacks the appearance of independence.

4.48 The proposed Agreement may, as the Minister's Explanatory Memorandum hints, be the best that can be negotiated with the US and the Government may, notwithstanding the concerns highlighted in the preceding paragraph, be right in its belief that the collective security benefits outweigh any interference with individual privacy rights. We nevertheless consider that a debate is merited for two reasons. First, to register in the strongest terms our dissatisfaction with the way in which the PNR Agreements with Australia and the US have been negotiated and approved, with minimal opportunity for effective Parliamentary scrutiny. Second, to draw attention to elements of the draft Agreement with the US which raise doubts as to whether an appropriate balance has been struck between civil liberties, data protection and security. We therefore recommend that the draft Council Decisions concerning the proposed new EU-US PNR Agreement, as well as those concerning the EU-Australia PNR Agreement, should be debated in European Committee B.

28 Commission Decision of 14 May 2004, OJ L 235, 06.07.2004, p. 11. Back

29 Council Decision of 17 May 2004, OJ L 183, 20.05.2004, p. 83. Back

30 See Council Decision 2007/551/CFSP/JHA of 23 July 2007, OJ L 204, 04.08.2007, p. 16. Back

31 See HC 428-xi (2010-11), chapter 21 (15 December 2010). Back

32 See HC 428-xxxi (2010-12), chapter 2 (29 June 2011). Back

33 See para 49 of the Minister's Explanatory Memorandum. Back

34 See para 50 of the Minister's Explanatory Memorandum. Back

35 See para 51 of the Minister's Explanatory Memorandum. Back

36 See para 14 of the Minister's Explanatory Memorandum. Back

37 See para 39 of the Minister's Explanatory Memorandum. Back

38 See para 40 of the Minister's Explanatory Memorandum. Back

39 See para 42 of the Minister's Explanatory Memorandum. Back