5 EU PNR Agreement with Canada
| (a)
(35226)
12645/13
COM(13) 529
(b)
(35225)
12637/13
COM(13) 528
|
Draft Council Decision on the signature of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name data
Draft Council Decision on the conclusion of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data
|
| Legal base | (a) Articles 82(1)(d), 87(2)(a) and 218(5) TFEU; QMV
(b) Articles 82(1)(d), 87(2)(a) and 218(6)(a) TFEU; QMV; EP consent
|
| Department | Home Office
|
| Basis of consideration | Minister's letter of 14 October 2013
|
| Previous Committee Report | HC 83-xiii (2013-14), chapter 22 (4 September 2013)
|
| Discussion in Council | No date set
|
| Committee's assessment | Politically important
|
| Committee's decision | Not cleared; further information requested
|
Background and previous scrutiny
5.1 In 2010, the Council authorised the Commission to negotiate
new Passenger Name Record (PNR) Agreements with Australia, Canada
and the United States of America (the US). These Agreements provide
for the transfer of PNR data (information on passengers held in
air carriers' reservation and departure control systems) to the
competent national authorities responsible for border control
and security. A formal legal framework is needed because EU data
protection laws prohibit the transfer of personal data to third
countries unless they ensure an adequate level of protection.
The Agreements establish the purposes for which PNR data may
be used — to prevent detect, investigate and prosecute terrorist
offences and serious transnational crime — and the data
protection safeguards that must be applied. They also provide
legal certainty for air carriers by providing the necessary assurance
that PNR data transfers are lawful.
5.2 PNR Agreements are subject to the UK's Title
V (justice and home affairs) opt-in. The UK has already opted
into the Agreements with Australia and the US. The latest draft
Council Decisions would authorise the EU to sign and conclude
a new Agreement with Canada. It would replace an earlier Agreement,
concluded in 2005, and is intended to provide a more comprehensive
framework for PNR data transfers which is consistent with the
principles set out in the Commission's 2010 Communication, On
the global approach to transfers of PNR data to third countries.[6]
Our Thirteenth Report, agreed on 4 September 2013, describes
the main elements of the proposed Agreement with Canada and the
Government's position.
5.3 We noted that there were many similarities between
EU PNR Agreements already concluded with Australia and the US,
and the one proposed with Canada, but that there were also striking
differences in the provisions on data retention and on the processing
of sensitive data. The PNR Agreement with the US allows PNR data
to be held for up to 15 years, whereas the Canada Agreement limits
the data retention period to five years. The PNR Agreement with
Australia prohibits the processing of sensitive data, whereas
the Agreements with Canada and the US authorise it in exceptional
circumstances. We asked the Minister to address these apparent
anomalies, which seemed all the more surprising given that the
purposes for which PNR data may be collected and processed are
broadly the same under all three Agreements.
5.4 We also asked the Minister to set out the
factors which the Government would take into account in determining
whether or not to opt into the EU PNR Agreement with Canada, and
to inform us of the date by which the UK's opt-in decision has
to be notified to the Council Presidency.
The Minister's letter of 14 October 2013
5.5 The Minister for Immigration (Mr Mark Harper)
tells us that the deadline for notifying the Government's opt-in
decision is 26 November 2013. He says that the UK has first-hand
knowledge of the benefits of PNR data, through its e-Borders system,
which have led to the arrest of suspects wanted for serious offences,
such as murder, rape and kidnap. He continues:
"For this reason, the Government remains
committed to the use of PNR as a way of tackling serious crime
and terrorism but not at the expense of data protection and civil
liberties.
"When considering whether to opt into this
Agreement with Canada, the Government will take into consideration
the safeguards that will be afforded to passengers. The Agreement
is clear that Canada must ensure its competent authority processes
PNR data 'strictly' and that it limits the purposes of processing
to the 'legitimate objective' of prevention, detection, investigation
and prosecution of terrorism and other serious crime that is transnational
in nature.
"In addition, we will also consider whether
opting into this proposal will better serve the UK's priorities
by removing legal uncertainty and helping to ensure that, where
appropriate, PNR data can be shared quickly and securely with
all necessary data protection safeguards in place.
"The Agreement makes extensive reference
to data protection and the significant weight placed on this within
the Agreement will also be an important factor when considering
whether to opt in. The data protection provisions are listed
in my earlier Explanatory Memorandum and include measures such
as non-discrimination safeguards, regulatory measures and complaint
mechanisms for passengers who have concerns about the processing
of their data."
5.6 Turning to the differences in data retention
periods and restrictions on the processing of sensitive data in
the EU PNR Agreements with Australia, Canada and the United States
of America, the Minister observes:
"The Agreements were negotiated on behalf
of the European Member States by the Commission based on the mandate
agreed. The UK was therefore not directly involved in the individual
negotiations, however the contents of the individual Agreements
reflect each third country's individual situation including threat
level and how the passenger data is used.
"The retention period for the Canadian Agreement
is five years. This is in line with the United Kingdom's own
assessment of PNR data retention, which has concluded that for
our law enforcement purposes, five years is an appropriate period.
"In relation to the processing of sensitive
data, the Canada Agreement states that it must be masked and only
further processed in exceptional circumstances where the processing
is indispensable because an individual's life is in peril or there
is a risk of serious injury. If these requirements are met, the
processing must still not be carried out without compliance with
the strict procedural measures outlined in Article 8(4). The
EU Agreement with the USA has similar limitations on the use of
sensitive information (Article 6(3) of that Agreement). The Australian
Agreement differs from the American and Canadian Agreements in
that it does not allow for use of PNR in exceptional circumstances
where life is at risk. As stated above, the individual Agreements
were negotiated at a European level and the UK were not party
to individual negotiating discussions; however, the limited use
of sensitive data as described in the Canadian and American Agreements
is in line with the UK's high data protection standards."
Conclusion
5.7 We thank the Minister for his letter and note
his view that the five-year data retention period proposed in
the EU PNR Agreement with Canada, as well as the limitations imposed
on the processing of sensitive data, are in line with UK data
protection standards. We ask the Minister to ensure that we are
informed of the Government's opt-in decision and that the reasons
for its decision are set out clearly in a Written Ministerial
Statement to Parliament. Meanwhile, the draft Decisions on the
signature and conclusion of the EU PNR Agreement with Canada remain
under scrutiny.
6 See Council document (31960) 13954/10: HC 428-xi
(2010-11), chapter 21 (15 December 2010). Back
|
