Fourth Report of Session 2019-21 Contents

13Passenger Name Record (PNR) data: updating internationals standards and negotiating an EU/Japan PNR Agreement69

These EU documents are legally and politically important because:

  • they are relevant to the Government’s goal of agreeing a framework for the transfer of Passenger Name Record (PNR) data with EU and other third countries after transition.

Action

Ask the Minister for Security at the Home Office (Rt Hon. James Brokenshire MP) to:

  • clarify the Government’s position on EU competence for the collection, processing, transfer and use of PNR data and explain how it may affect the UK’s ability to negotiate its own PNR agreements with EU and other third countries after transition;
  • indicate whether/how differences in the EU’s and UK’s approaches to PNR data might be a factor in securing a data protection adequacy decision; and
  • explain whether the Government wishes to continue to apply the EU’s PNR agreements with Australia and the US (and any others concluded in the coming months) after transition or to negotiate new terms.

Draw to the attention of the Home Affairs Committee.

Overview

13.1Access to the passenger information held in air carriers’ flight reservation and departure control systems is an important law enforcement tool to support the investigation of terrorism and other serious cross-border crimes. The UK has been at the forefront of efforts to promote the sharing of Passenger Name Record (PNR) data within the EU (a new EU PNR Directive took effect in May 2018)70 and externally through the negotiation of EU PNR agreements with third countries. The UK has also been instrumental in efforts within the United Nations Security Council to agree a Resolution (UNSCR 2396) requiring all UN members to “develop the capability to collect, process and analyse” PNR data and urging the International Civil Aviation Organisation (“the ICAO”) to establish an international standard for the collection, use, processing and protection of PNR data.

International standards on PNR data

13.2The Convention on International Civil Aviation (‘the Chicago Convention’) includes a set of Standards and Recommended Practices (‘SARPs’) on PNR data.71 All EU Member States are parties to the Chicago Convention and seven (including the UK) are currently represented on the ICAO Council, the body empowered to adopt and amend the ICAO’s SARPs.72 In October 2019, our predecessor Committee examined a European Commission proposal for a Council Decision establishing the position to be taken by EU Member States represented in the ICAO Council on possible changes to the ICAO’s SARPS on PNR data. The European Commission considered that a Council Decision was necessary as the changes would be “capable of decisively influencing the content of Union law” enshrined in the EU PNR Directive and in existing and future PNR agreements concluded with third countries and concerned an area of policy in which the EU had exclusive competence to act.73 A difference in the standards applicable at international and EU level would, the Commission said, “compromise the effectiveness of the EU PNR mechanism”. It would therefore be “essential to steer the discussions” on new PNR standards within the ICAO to ensure they were consistent with the EU’s regulatory framework and relevant case law of the Court of Justice on the fundamental right to privacy and data protection.74 An Annex to the proposed Council Decision set out the general principles and orientations on which the EU position would be based.

EU rules on the sharing of PNR data

13.3EU law only allows Member States to share personal data with third countries which ensure a level of protection “essentially equivalent” to that guaranteed within the EU. To provide legal certainty for air carriers that their transfers of PNR data are lawful, the EU has concluded PNR Agreements with Australia and the United States of America and is keen to negotiate agreements with other third countries. Progress has been hampered by a EU Court of Justice ruling—Opinion 1/15—issued in July 2017 which found that some provisions of a proposed PNR Agreement with Canada were incompatible with fundamental rights and contrary to EU law. The Agreement has been renegotiated to address the Court’s concerns but has not been formally concluded. The UK participates in the EU’s PNR Agreements with Australia and the US and also opted into the mandate proposed by the European Commission to renegotiate the Agreement with Canada.

13.4In February 2020, the Council adopted a Decision authorising the European Commission to negotiate a PNR Agreement with Japan. The original Commission proposal was not deposited for scrutiny as it was marked “limité”, meaning its contents could not be made public. According to the Council, the agreement will “regulate the transfer and use of PNR data to prevent and fight terrorism and serious transnational crime” and “fully ensure the respect of fundamental rights, in particular, the right to protection of personal data, by setting the necessary safeguards and controls as provided by EU law” (our emphasis).75

The Government’s position

International standards on PNR data

13.5The Government told our predecessor Committee that international standards for the collection, use, processing and protection of PNR data were intended to “help mitigate potential conflicts of national law where airlines would be required by one law to disclose PNR data and by another to protect the same data”.76 It said the proposed Council Decision establishing the EU’s position on possible changes to the ICAO’s SARPS on PNR data was subject to the UK’s Title V (justice and home affairs) opt-in and that the Government would “take and communicate a decision on UK participation” before 31 October 2019, the date on which the UK was (then) expected to leave the EU.

13.6In his letter of 25 March 2020, the Minister for Security (Rt Hon. James Brokenshire MP) informs us of the Government’s decision not to opt in. Despite this, the Council Decision adopted last November (before the UK’s exit from the EU) states that the UK is bound by the Decision.77 This reflects the European Commission’s view, shared by the Council, that rules on the collection, processing, transfer and use of PNR data are an area of exclusive EU competence and that the UK is automatically bound by EU action within this area because it participates in the EU’s 2016 PNR Directive.78 The Minister insists that the opt-in does apply (and that the UK is not therefore bound by the Council Decision during the post-exit transition period provided for in the EU/UK Withdrawal Agreement) and says that the Government’s position has formally been placed on the record.79 The Minister continues:

In accordance with the principle of sincere cooperation, the UK shall refrain, during the transition period, from any action or initiative likely to be prejudicial to the position taken by the Council Decision particularly within ICAO of which the United Kingdom is a contracting party in its own right.

The decision not to opt-in will enable the UK to retain control over our national interests in the development of our independent policy on international transfers of PNR data.

13.7While the Government “does not take issue with the large part” of the Council Decision, which is “in accordance with EU law as interpreted by the relevant case law” of the EU’s Court of Justice, the Minister considers that “some principles […] go beyond that which is necessary in a global context”. He highlights the stipulation that “deletion of PNR data should be ensured in accordance with the legal requirements of the source country”, adding:

The practical effect of this would reflect the CJEU’s Opinion that PNR data should be deleted once individuals leave the territory of that third country, unless there was objective evidence from which it could be inferred that certain air passengers may have links to terrorism or serious crime. This would seriously hinder the operational effectiveness of using PNR data to identify and respond to serious threats, including travelling foreign terrorist fighters and trafficking of vulnerable individuals. We consider this position is unworkable; it would have an adverse impact on national authorities’ processing of PNR data and would not be reflected in EU law. This position also does not consider the consequences when the law of a source country requires deletion of PNR data after a period other than five years as required in EU law.

The proposed EU PNR Agreement with Japan

13.8In a separate letter also dated 25 March 2020, the Minister informs us of the Council Decision authorising the European Commission to open negotiations for a PNR Agreement with Japan. As the proposal was put forward before the UK’s exit from the EU on 31 January 2020, the EU and the UK both agreed that the UK’s Title V (justice and home affairs) opt-in applied. The Government decided not to opt in because it had reservations about some of the safeguards included in the negotiating mandate, particularly those concerning purpose limitation, right to individual notification, retention and onward transfers of PNR data, which reflected the Court of Justice’s Opinion on the EU/Canada PNR Agreement. The Minister tells us:

An opt-in to this Decision would have indicated acceptance of these negotiating directives. By not opting into this Decision, we protect our negotiating position with the EU on our future relationship on the transfer and use of PNR data.

The UK’s exit from the EU means we can determine and pursue our own policy on the international transfer and use of PNR data, with Japan and other partners, which acknowledges the significance of this valuable and unique dataset for countering terrorism and serious crime subject to safeguards ensuring respect for individuals’ fundamental rights.

13.9The Minister indicates in both letters that the Government will publish Written Ministerial Statements “shortly” to inform Parliament of its opt-in decisions.

Action

13.10Ask the Minister to:

Letter to the Minister for Security (Rt Hon. James Brokenshire MP) at the Home Office

Thank you for your letters dated 25 March 2020, the first relating to a Council Decision establishing the EU position on changes to international (ICAO—International Civil Aviation Organisation) standards on Passenger Name Record (PNR) data, the second a Council Decision authorising the European Commission to negotiate a PNR Agreement with Japan. Both Council Decisions concern opt-in decisions which were taken before the UK left the EU on 31 January 2020.

We are disappointed that it has taken so long to inform us of the Government’s opt-in decisions and to publish Written Ministerial Statements. Although the Government has decided not to opt into either of the Council Decisions, they are both relevant to the goal (set out in the Government’s Command Paper on The UK’s Future Relationship with the European Union) of agreeing a framework for “reciprocal transfers of PNR data to protect the public from serious crime and terrorism”.80 This is why we are asking you to provide some additional information.

The Council Decision establishing the EU position within the ICAO Council

You explain that the UK, on the one hand, and the Council and the European Commission on the other, take a different view on the application of the UK’s justice and home affairs opt-in Protocol to the Council Decision.81 Recitals (11) and (16) of the text formally adopted by the Council last November state that the UK is bound by the Decision because it participates in the 2016 EU PNR Directive and the scope of these common EU rules “overlaps significantly with the area to be covered by the envisaged new SARPs”. We infer from this that the EU considers: (i) that it has exclusive competence to determine the position to be taken by EU Member States in the ICAO Council as changes to the ICAO’s SARPs on PNR data may affect the common rules established by the 2016 PNR Directive;82 and (ii) that the UK cannot simultaneously be bound by the PNR Directive but not by the Council Decision and so has no option but to participate in it.

By contrast, your letter informing us of the Government’s decision not to opt in says that this “will enable the UK to retain control over our national interests in the development of our independent policy on international transfers of PNR data”. The EU and UK positions appear difficult to reconcile. To clarify matters, please tell us:

The Council Decision on the negotiation of a PNR Agreement with Japan

Although we understand that the EU alone has negotiated, signed and concluded previous PNR Agreements with Australia and the US and considers this to be an area of exclusive EU competence, it seems that the EU and UK both agree that the justice and home affairs opt-in Protocol does apply in this case and that it is open to the UK to decide not to participate in the proposed Council Decision.84 We would welcome your analysis of the reasons why the EU considers that the UK is bound to participate in the Council Decision establishing the EU position in the ICAO but not in this Council Decision, based on your understanding of the extent of the EU’s competence for the collection, processing, transfer and use of PNR data.

The Government has said that it wishes to agree a framework for reciprocal transfers of PNR data after transition and that this should be “based on, and in some respects go beyond, precedents for PNR Agreements between the EU and third countries—most recently, the mandate for the EU-Japan Agreement”.85 This suggests that the scope of the agreement the UK is seeking may be broader than existing EU third country precedents or more ambitious than the common rules set out in the 2016 EU PNR Directive. Do you anticipate that the UK will negotiate exclusively with the EU, on the basis that the negotiation will cover an area of exclusive EU competence, or might the agreement also cover areas of Member State competence and require Member State involvement in the negotiation and ratification of the agreement? How might that affect the time taken for the agreement to become operational? Is there any scope for the UK to negotiate bilateral agreements with individual Member States if the Government is unwilling to accept the EU’s terms?

The detailed mandate for the EU’s negotiations with Japan has not been published, but the Council has made clear that it should include all “the necessary safeguards and controls as provided by EU law”.86 We assume that these include the data protection requirements set out in Opinion 1/15 issued by the EU Court of Justice in July 2017 which prompted the EU to renegotiate its PNR agreement with Canada. This raises two concerns. First, that any future PNR agreement between the UK and the EU which does not comply fully with the Opinion will be at risk of legal challenge. Second, that any significant departure from the EU’s PNR framework when negotiating agreements with other (non-EU) countries may well be a factor in obtaining a so-called “adequacy” decision. This is because the mandate agreed by EU Member States for negotiating a future relationship with the UK makes wider criminal justice and law enforcement cooperation conditional on the UK ensuring a level of protection of personal data which is essentially equivalent to EU standards and requirements (the “adequacy” test).87 Does the Government consider that there is scope to diverge from existing EU precedents on PNR without jeopardising the UK’s ability to conclude its own PNR agreement with the EU and to secure a data adequacy decision?

Finally, we ask whether the Government’s policy is to seek to continue to apply the EU’s PNR agreements with Australia and the US (and any others concluded in the coming months) after transition or to negotiate new terms. If new agreements, we would welcome some indication of how they would differ from those concluded by the EU and the timescale you envisage for concluding negotiations and the agreements taking effect.

We ask you to respond within ten working days.


69 Proposal for a Council Decision on the EU’s position within the Council of the International Civil Aviation Organisation with regard to standards and recommended practices on passenger name record data; Council document 12197/19 + ADD 1, COM(19) 416; Legal base — Articles 16(2), 87(2)(a) and 218(9) TFEU, QMV; Dept — Home Office; Devolved Administrations consulted; ESC number 40822.

Council Decision authorising the opening of negotiations with Japan for an agreement between the EU and Japan on the transfer and use of Passenger Name Record (PNR) data to prevent and combat terrorism and serious transnational crime; Council document 5378/20, —; Legal base — Articles 16(2), 87(2)(a) and 218(3) and (4) TFEU, QMV; Dept — Home Office; Devolved Administrations —; ESC number —.

70 See Directive (EU) 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. Member States were required to implement the Directive no later than 25 May 2018.

72 36 countries are represented on the ICAO Council for the 2019–22 term — see the ICAO website.

73 See recital (13) of the proposed Council Decision.

74 See p.4 of the European Commission’s explanatory memorandum accompanying the proposed Council Decision.

75 See the press release issued by the Council on 18 February 2020.

77 See Council Decision (EU) 2019/2107. Recital (16) provides: “The United Kingdom and Ireland are bound by Directive (EU) 2016/681 and are therefore taking part in the adoption of this Decision.”

78 See Directive (EU) 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. Recital (11) of the Council Decision states that the common rules on PNR data set out in the 2016 Directive “overlap significantly with the area to be covered by the envisaged new SARPs”, highlighting in particular “a comprehensive set of rules to safeguard the fundamental rights to privacy and the protection of personal data, in the context of a transfer of PNR data by air carriers to Member States for the purpose of prevention, detection, investigation and prosecution of terrorist offences and serious crime”.

79 See Council document 14008/19 which sets out the UK view that the “Justice and Home Affairs opt-in applies to all proposals for EU legislation which cite a legal base in the Justice and Home Affairs section of the TFEU, and, therefore, to this Council Decision as well”.

80 See the Government’s Command Paper (CP211), The Future Relationship with the European Union: The UK’s Approach to Negotiations, published in February 2020.

81 Protocol No 21 to the EU Treaties.

82 Article 3(2) TFEU provides that the EU has exclusive competence if “necessary to enable the Union to exercise its internal competence, or in so far as its conclusion may affect common rules or alter their scope”.

83 Article 127 states: “Unless otherwise provided in this Agreement, Union law shall be applicable to and in the United Kingdom during the transition period”.

84 This is clear from recital (4) which states that Ireland, like the UK, has chosen not to opt into the Council Decision even though both are bound by the 2016 EU PNR Directive.

85 See Part 2, para 40 of the Government’s Command Paper (CP211), The Future Relationship with the European Union: The UK’s Approach to Negotiations, published in February 2020.

86 See the press release issued by the Council on 18 February 2020.

87 See paragraphs 13, 118 and 119 of the Annex to Council Decision (EU, Euratom) 2020/266.




Published: 29 April 2020