Time of retention of current
data
66. Undertaking 15 provides that after 3.5 years
PNR data that have not been manually accessed during that time
will be destroyed. Ms Cecilia Verkleij from Commission DG JLS
explained to us (Q 164) that in the negotiations for the
2004 Agreement the United States started arguing in favour of
retention for 50 years and went down to 7 years; the Commission
wanted one year. Three and a half years was a compromise, chosen
in essence because it was as long as the 2004 Agreement was destined
to last. Undertaking 46 explains that the Undertakings will apply
for 3.5 years, but that "[I]f no mutually acceptable arrangement
can be concluded prior to the expiration of these Undertakings,
the Undertakings will cease to be in effect."
67. The Baker letter suggests that, as a result,
this 3.5 year retention limit has no effect:
"The Agreement will have expired before Paragraph
15 of the Undertakings requires the destruction of any data, and
questions of whether and when to destroy PNR data collected in
accordance with the Undertakings will be addressed by the United
States and the European Union as part of future discussions."
This would be in blatant disregard of the final sentence
of Undertaking 15, which reads:
"With respect to PNR which CBP accesses [or
receives] directly from air carrier reservations systems during
the effective dates of these Undertakings, CBP will abide by the
retention policies set forth in the present paragraph, notwithstanding
the possible expiration of the Undertakings pursuant to paragraph
46 herein." [our italics]
68. This final sentence is an accurate statement
of the law as we understand it. Data transferred on 1 July 2004
were governed by an Undertaking that they would be deleted on
or before 1 January 2008. The fact that, by that date, the Agreement
will no longer be in force does not make the obligations under
that Undertaking any the less binding on the US authorities.
69. There is also an ethical dimension. The suggestion
behind Ms Verkleij's reply is that, so long as the Agreement expired
before the end of the agreed data retention period, the length
of this period was irrelevant because the United States never
had any intention of being bound by this provision. We are reluctant
to believe this of partners who, we are told, have always negotiated
in good faith.
70. This too is a matter we put specifically
to Baroness Ashton. In her letter of 16 February 2007 she stated
categorically that "any data that are or have been transferred
under the original and current Agreements will continue to attract
a data retention period of 3.5 years". In oral evidence we
put to her the apparent conflict between this statement and the
Baker letter, and she repeated four times that the correct period
was 3.5 years, but then appeared to qualify this by saying: "If
the Americans, as part of the negotiations, wish to argue that
data should be retained for a longer time then they will have
to make that case, and that case will then become part of the
balancing between the importance of keeping data for the right
length of time based on experience and knowledge that they will
acquire … versus what seems an inappropriate length of time.
That will be part of the negotiation." (QQ 77-80) It
is not entirely clear to us whether this last reply referred to
retention of data under the 2004 and 2006 Agreements, or under
the new Agreement to be negotiated.
71. For the purposes of the new Agreement being
negotiated we have concluded[36]
that fixing a precise time limit is not the most important aspect
of data retention. We would not therefore be opposed to an Agreement
which provided that data transferred under the 2004 and 2006 Agreements
should be retained for longer than 3.5 years. What we strongly
oppose is the assumption that this can take place simply by a
unilateral abrogation of the Undertaking, without the consent
of the EU expressed in a provision of the new Agreement.
72. The negotiators should as a matter of
principle insist that data transferred under the 2004 and 2006
Agreements must be destroyed no later than 3.5 years after the
transfer, unless a formal Agreement is negotiated allowing these
data to be retained longer.
Consultation
73. We mentioned in paragraph 63 Mr Baker's
statement: "With this letter the US has consulted …
with the EU". In his written evidence the Information Commissioner
wrote:
"The Commissioner and his EU counterparts have
noted with concern that mechanisms provided for at paragraph 7
of the Undertakings for consultation by the US with the EU on
the expansion of the data items appear to have been used in practice
as a basis for unilateral declaration by the US side of their
intention to expand the items. This is not what the Commissioner
and his counterparts envisaged by a consultative arrangement."
74. We wondered whether there had in fact been
any consultation at all prior to the sending of the Baker letter.
Mr Faull assured us that the letter followed extensive discussions
and consultations on the specific issue. (Q 154) We would
have been concerned if there had not been prior consultations,
but we wonder whether consultations which plainly did not include
"the [Information] Commissioner and his EU counterparts"
were of any great value.
Adequacy: our assessment
75. Mr Faull's letter acknowledging the
Baker letter concludes:
"The commitments of DHS to continue to implement
the Undertakings allow the EU to deem that, for the purposes of
the implementation of the Agreement, it ensures an adequate level
of data protection."
In the case of an agreement between the United States
and the EU (rather than the EC), there was no need for a formal
Adequacy Decision, nor indeed any possibility of one. But our
view is that, once the Undertakings were given the interpretation
in the Baker letter, even those who had previously regarded them
as providing an adequate level of data protection might well have
changed their minds.
76. Whatever the justification for extending
data elements, for wider sharing of data, or for using data to
identify possible carriers of dangerous communicable diseases,
there is no justification at all for doing so through a unilateral
declaration by one of the parties to an agreement.
77. An undertaking which includes a provision
allowing the party giving it to amend it virtually at will is
of very limited value, and scarcely deserves the name. No such
provision should be included in any future agreement.
33 OJ C219/1 of 12 September 2006. Back
34
OJ L298/29 of 27 October 2006. Back
35
OJ C259/4 of 27 October 2006. Back
36
Paragraphs 110 to 114. Back
