House of Lords - European Union - Twenty-First Report

Select Committee on European Union Twenty-First Report

CHAPTER 6: Negotiations for a new Agreement

78. The interim Agreement expires "in any event no later than 31 July 2007, unless extended by mutual agreement".[37] Negotiations for a new Agreement began early in 2007.

79. Undertaking 48 provides that "The provisions of these Undertakings shall not constitute a precedent for any future discussions with the European Commission, the European Union, any related entity or any third State regarding the transfer of any form of data". The Interim Agreement contains a recital to the same effect. The purpose of these statements is plainly to make clear to the parties (in practice the EU) that there can be no expectation that any Undertakings previously given will be repeated.

Who negotiates for the EU?

80. Article 24(1) of the Treaty on European Union is clear: "When it is necessary to conclude an agreement with one or more States or international organisations in implementation of this title[38] the Council may authorise the Presidency, assisted by the Commission as appropriate, to open negotiations to that effect." The Member States thus decide on a mandate for the negotiations, and authorise the Presidency and the Commission to negotiate on behalf of the EU. The theory is that both the Presidency and the Commission take part in the negotiations. In oral evidence on 22 March 2007 Mr Faull told us that negotiations for the new Agreement were taking place under the German Presidency who were "absolutely" in charge of the negotiations. (Q 158) At a seminar on the PNR Agreement organised by the LIBE Committee of the European Parliament on 26 March 2007 he stated that the Commission was willing to give the Council all the assistance it could in the negotiations.

81. We have mentioned in paragraph 21 the meeting on 5 April 2007 with Mr Michael Chertoff, the United States Secretary of Homeland Security. Both the German Minister of the Interior, Dr Wolfgang Schäuble, and the Minister of Justice, Ms Brigitte Zypries, were present, and PNR was prominent among the topics discussed. But the meeting was described as a Troika, and the third party was the Commission, represented by Vice-President Frattini and Mr Faull. We believe that in practice the Commission plays a pivotal role in the negotiations, nor could it be otherwise, given the transient nature of the Presidency under the present Treaties. The first Agreement was concluded in the first half of 2004 under the Irish Presidency. Austria held the Presidency when the Court gave its judgment on 30 May 2006, and therefore had to begin the process of negotiating a new Agreement, but this was continued and concluded under the Finnish Presidency. Now Germany is formally in the lead, and the negotiations will be continued under the Portuguese Presidency if necessary, though it is not high on their agenda: "They would like to see it out of the way under the German Presidency". (Q 183)

82. When the negotiations for the 2004 Agreement began in 2003, the Joint Statement issued after the talks on 17 and 18 February 2003 made clear that only "senior officials of the European Commission … led by [the then] Director General for External Relations Guy Legras" negotiated on behalf of the EU. The true position is still that the Commission, and now Jonathan Faull in person, is the one fixed point acting on behalf of the EU in these negotiations: "We provide the continuity". (Q 182)

83. The United Kingdom, by reason of its relationship with the United States, might be thought to be in a unique position to influence the negotiations; but while we understand that there is some contact between the authorities of the two countries on this question, it does not appear to influence the negotiations very much. Baroness Ashton told us: "There is no doubt that the UK has a role to play in relation to the US but the negotiations are specifically EU and I think that is right and proper." (Q 71)

Timetable

84. As we have made clear, the Interim Agreement expires on 31 July this year. At the Berlin meeting on 5 April the parties agreed that they must keep to this deadline, and that there was a need by then to negotiate an agreement covering at least the nature of the data transmitted, the purpose for which they were used and the time of retention, rights of access to the data and supervision of the agreement. But they stated that they were aware that the current Interim Agreement could be prolonged beyond 31 July, and the US delegation said that they were satisfied with the Interim Agreement.[39] From this one can deduce that the US delegation have no incentive to negotiate a stricter agreement, or indeed any agreement, by 31 July. It may be that the only result of the negotiations will be an agreement, no doubt reluctant on the part of the EU, to extend the Interim Agreement. This would in our view be the worst of all possible results.

The views of the European Parliament and the data protection authorities

85. As explained above, the European Parliament does not have a legislative (as opposed to a consultative) role to play in the formulation of third pillar law, and hence in the negotiation of the Agreement. The same is true of the EDPS, the national data protection authorities, and the Article 29 Working Party which is composed of them. This does not prevent them having and expressing strong views about the degree to which the privacy rights of individuals are safeguarded, both in the current interim Agreement, and in the Agreement being negotiated.

86. On 11 October 2006 Ms Paula Lehtomäki on behalf of the Finnish Presidency and Vice-President Frattini on behalf of the Commission made a statement to the European Parliament on the outcome of the negotiations with the United States. They regarded the negotiations and the resultant Interim Agreement as a success, but only one of the members who spoke in the debate (Michael Cashman MEP) agreed with them. The rest deplored the terms of the Agreement with varying degrees of emphasis. Sophie in't Veld MEP, the rapporteur of the LIBE Committee on PNR, drew particular attention to the Baker letter: the extension of the purposes to fighting infectious diseases, the sharing of data with other agencies, some unspecified, and the suggestion that the data retention period should be ignored. Many of these points were reiterated in subsequent debates on 31 January and 14 February 2007.

87. On 26 March 2007 two seminars were held at the European Parliament building to discuss the Interim Agreement and the negotiations for the new Agreement.[40] The morning seminar was organised by the Article 29 Working Party, the afternoon seminar by the LIBE Committee. Many of the speakers were the same.[41] Given the constitution and functions of these two Committees, it is not surprising that speakers tended to concentrate on the data protection aspects, and to voice concerns about the privacy of individuals; but there were also speakers from the Association of European Airlines, Amadeus (the body which undertakes the technical side of PNR transfers on behalf of many of the largest airlines), and the Home Office (on the UK e-Borders Programme).

88. Although the breadth of the data elements and the non-binding nature of the Undertakings were prominent in the discussions, the principal cause for concern was again the Baker letter, and the way it had been used to defeat much of the value of the Undertakings.

89. The fact that the European Parliament no longer has a formal role to play is not a reason why the views of its members should be disregarded. On the contrary, in a Union of democracies special attention must be paid to the views of representatives, since they are well placed to balance the public good against private rights.

90. The European Data Protection Supervisor, and national data protection authorities individually and collectively in the Article 29 Working Party, have great experience of the practical working of data protection laws and of non-binding declarations on the handling of personal data. Those negotiating a new agreement should be guided by their opinions.

The EC/Canada PNR Agreement

91. We have already referred to the Agreement of 3 October 2005 with Canada[42] which is the only other PNR Agreement currently in force.[43] The EDPS (p 49) and others of our witnesses suggested that this should be used as a model in the negotiations for the new Agreement with the United States.

92. As in the case of the 2004 Agreement with the United States, the other party to the Canada Agreement is the EC rather than the EU, and that Agreement too is based on a Commission Adequacy Decision. Its legal basis is therefore equally suspect, and if it came to be considered by the ECJ it too would almost certainly be annulled. But since it was regarded by the EDPS,[44] the Article 29 Working Party[45] and the European Parliament as satisfactory it was not the subject of Court proceedings and so has not been annulled. It is therefore still in force. Mr Faull, while emphasising that the two countries did not have the same laws or concerns, thought the Canada Agreement could be "a reference point, a starting point" for negotiations with the United States; we agree.

93. Some of the features which distinguish the Canada Agreement from the US Agreements are the following:

it is concerned not just with PNR but also with Advance Passenger Information (API);
although in fact intended for the transfer of PNR data to Canada, it is drafted in terms which would allow it to be used for the reciprocal transfer of PNR data from Canada to the EU;
there are only 25 data elements, and none of them is equivalent to the general remarks and open fields in the US Agreement;[46]
the Canadian Border Service Agency (CBSA) does not require carriers to collect PNR information that they do not themselves require;
information is from the outset "pushed" by the airlines rather than "pulled" by the CBSA;
the Undertakings are called "Commitments", and do not state that they confer no legal rights or benefits—but nor do they state that they are legally binding;
there is no Commitment equivalent to United States Undertaking 35 which allows a change in the law to be used to amend or nullify other Commitments.

94. These are all features to which we will refer as we come to consider the negotiation of the new agreement with the United States.

Data Elements

95. We considered in Chapter 2 the PNR data elements, and views on their reliability. In Chapter 3 we considered the Undertakings in the 2004 Agreement, and in Chapter 5 the effect on these of the Baker letter. In the light of those conclusions we now look to see what those negotiating the new Agreement on behalf of the EU should be seeking to achieve.

96. As we have explained in paragraph 32, the 34 elements in the current Agreement are a compromise. Mr Faull told us that "[the Americans] may well ask for more information. Our view at the moment is that the 34 PNR items are probably sufficient and may even be excessive in number, and we will certainly at least wish to negotiate very seriously with our American partners about each individual item of information." (Q 145)

97. What seems clear to us is that, if a country like Canada which takes its national security no less seriously than the United States is satisfied with only 25 data items, the United States must be required to produce for each and every additional item that it requires detailed and particular justification for the inclusion of that item. That justification must be made available to those negotiating on behalf of the EU, and we expect them to take a robust attitude in the negotiations before being satisfied that any additional data item is essential and therefore permissible.

98. A number of our witnesses[47] particularly objected to the inclusion in the data elements of open-ended data elements like "general remarks" or "open fields", which merely serve as a means of introducing other data not specifically listed, in particular sensitive data. We share this view. If a data element is essential, it must be possible to define it with sufficient particularity. If that is not possible, it must be excluded.

99. It would be wrong to include among the agreed data elements open-ended data elements like "general remarks" or "open fields", which merely serve as a means of introducing other data elements not specifically listed.

Undertakings

100. An undertaking is more than just a statement of intent: it is, as the Canada Agreement says, a commitment. If the party giving it does not intend to be bound by it, there is no point in negotiating it. We hope therefore that the talks will have started on the basis that the Undertakings being negotiated, unlike the current ones, are legally binding on the United States authorities.

101. In the same way that, in the case of data elements, no "general remarks" must be used to add to the list, in the case of undertakings there is no place for one like the current No 34 which effectively allows data to be passed to persons and bodies for whom they were not intended and used for purposes other than those specified in the Agreement; or like No 35 which allows changes in the law to override them without any further negotiation. What the Undertakings say, and what they mean, must be clear from the four corners of the document. There is no scope for statements which are so unclear that they leave room for unilateral interpretation.

102. All the terms of the Undertakings being negotiated must be specific, unequivocal, contained in the document itself, and not susceptible of amendment without the agreement of all the parties.

103. If any clarification is needed, this is a matter for subsequent open negotiation between the parties. There can be no scope for amendment by unilateral "interpretation" of the Undertakings.

Purpose limitation

104. As we have explained, the wider use of PNR data started after 9/11 as a counter-terrorism exercise. The recitals to the 2004 Agreement state that its purpose is "to prevent and combat terrorism and transnational crime". Undertaking 3 states that it is to prevent and combat "(1) terrorism and related crimes; (2) other serious crimes, including organised crime, that are transnational in nature; (3) flights from warrants or custody for the crimes described above". The prevention of "serious crime" immediately raises the question, how serious must a crime be to fall within this description and so be covered by the PNR Agreement? Few crimes are more serious than the smuggling of children (an example given to us by Baroness Ashton of a crime solved by reference to PNR);[48] most people would agree that the smuggling of tobacco (an example given to us by Ms Ryan)[49] is not in the same league, let alone road traffic offences (Q 57) (which in any event are seldom transnational in nature).

105. We would not attempt to define what is a "serious" crime. Since however the expression is used in the same sentence as "terrorism and related crimes", that is an indication of the severity of the crimes which are contemplated by the Agreement. If it is intended by both parties that PNR data are to be used for dealing with less serious crimes, the new Agreement should say so clearly.

106. Moreover it is now plainly the intention of the United States (as indeed it is of Canada) that PNR data should be used to identify major health risks from serious communicable diseases, and to protect the public against them. This too should be stated unequivocally at the outset. There is no reason why the diseases covered should not be listed, and likewise the persons or bodies to whom information may be passed. We note however that more than half a million persons enter the United States illegally every year across the many thousands of miles of land borders.[50] Since PNR data are derived only from air travel, it seems to us that these data are likely to be of only limited use in preventing the spread of communicable diseases.

107. Under the 2004 Agreement the use of PNR data was to be limited to:

the prevention and combating of terrorism and related crimes;
other serious crimes, including organised crime, that are transnational in nature; and
flights from warrants or custody for these crimes.

The negotiators should seek to retain these limitations in the new Agreement.

108. We believe that the use of PNR data for general law enforcement purposes, as opposed to countering terrorism and serious crime, is undesirable and unacceptable.

109. If, contrary to our view, it is agreed that data should be used for other purposes, those purposes must be specifically listed at the outset. Words such as "vital interests of the data subject" are too vague.

Retention of future data

110. Any PNR data which appear to be significant for anti-terrorism or law enforcement purposes, and which have been "manually accessed" for those purposes, can be retained for as long as they are useful. There is in such a case no limit on the retention time, nor should there be. The issue is the length of time for which data which are retained routinely but which do not appear to have any significance should be kept on the basis that they might one day be useful.

111. That period is currently 3.5 years not just in the US Agreement but also in the Canada Agreement.[51] The Baker letter states that "even data that is more than 3.5 years old can be crucial in identifying links between terrorist suspects". Mr Faull explained the value of this in the case of "clean skins"—persons with no police record, not known to the authorities in any way, who suddenly feature in a terrorist attack. At that stage it may prove important to reconstruct a pattern of that person's life: "PNR tells you with whom the named person has been reserving flights, next to whom he or she has been sitting on planes regularly, where they have been flying to and from et cetera." (QQ 165-167, 172)

112. Mr Bayo Delgado told us that in the view of the EDPS 3.5 years was "already excessive", and that there was "an enormous disproportion between the effectiveness of that long period of retention and the results of that retention". (Q 206) But Mr Tony Bunyan, the Director of Statewatch and no friend of the current Agreement, though he would start negotiations on the basis that information should be held for only 24 hours, was not prepared to disagree with the proposition that 3.5 years was too short a period; he did not regard it as being set in stone. (Q 123)

113. It seems to us that the correct period is the shortest reasonable period which will allow law enforcement and counter-terrorism investigators to do their work properly. Fixing a precise time limit seems to us to be less important than ensuring that the data, for so long as they are kept, are kept and handled securely and used only for the permitted purposes, and that an adequate redress mechanism is in place.

114. We are prepared to accept that routine retention of data for longer than 3.5 years may be necessary, and may be acceptable so long as the data are kept and handled securely. What is not acceptable is for these data to be used in that time for purposes other than those strictly permitted under the Agreement.

Data sharing

115. We have explained in paragraphs 61 and 62 how, while Undertakings 28 to 33 allow the sharing of PNR data with other Government authorities (including other components of DHS) only on a case by case basis and subject to stringent limitations, United States law now requires DHS to facilitate the disclosure of such data to any authorities exercising counter-terrorism functions which need such data. The Baker letter states that DHS will not provide "unconditional direct electronic access", but does not state what conditions will apply. We are told that "DHS will ensure that such authorities will respect comparable standards of data protection to that applicable to DHS, in particular in relation to purpose limitation, data retention, further disclosure, [and other matters]."

116. This is an aspect of the Baker letter which causes us great disquiet. Personal and private information which was intended only for CBP within DHS is now being disclosed to the rest of DHS, and by DHS to other authorities, on a bulk basis. We were told by Mr Bunyan that some 1,500 agencies at federal, State and local level might be involved in this work.[52] Once further disclosure is made on the same basis by one authority exercising counter-terrorism functions to another such authority, and perhaps at one or more further removes, it is hard to see what control will be retained by CBP, still less by the EU. This has particular implications for the identification and correction of errors in the data, a matter we consider below.

117. It is vital that the new Agreement should address this issue. There is a world of difference between Undertakings "not impeding" the use or disclosure of PNR data as required by United States law, and Undertakings for practical purposes scarcely applying at all to further data sharing. We are prepared to accept that there will be circumstances where the sharing of such data by CBP with other parts of DHS and with other authorities will be not only desirable but necessary. We have in any case to accept that this is now what United States law requires. What we cannot accept is that CBP, and the EU, should lose all control over such data sharing.

118. If United States government authorities with whom data are shared by CBP believe that other authorities need access to such data, the decision must be for CBP. Access should be subject to the same undertakings as CBP has given. Records of this data sharing should be kept for independent inspection.

119. It may not always be possible for data to be scrutinised on a case by case basis before they are shared with other authorities, but indiscriminate bulk sharing should not be permitted. It must be for CBP to "push" the information to other authorities, not for those authorities to "pull" it from the CBP database.

Rights of redress

120. In Undertaking 36 CBP states that it will inform the travelling public about the uses to which their PNR data are put, the applicable conditions, and the procedures for redress. Such information may be in the small print on a travel agent's conditions, or passengers may have to access CBP's website.

121. Those passengers—the data subjects—who do discover that information about them is held by CBP may if they wish write to CBP in Washington DC asking to see a copy. Under the United States Freedom of Information Act this will be disclosed—unless "in exceptional circumstances" CBP denies or postpones disclosure.

122. Requests for rectification of data, or complaints about the uses to which data are put, may be made to the US authorities; if unresolved, the complaint can be referred to the DHS Chief Privacy Officer. If an EU data subject is supported by the data protection authority of his Member State, there is an expedited procedure. Baroness Ashton told us that there is now an on-line Travel Redress Inquiry Program (TRIP) allowing passengers to ask for their information to be reviewed. (Q 66) But ultimately, the final decision rests with the authorities rather than the courts, because the Privacy Act of 1974 applies only to United States citizens and residents.

123. One of the most frequent complaints is about being on a no-fly list. A would-be passenger will very likely not be aware that he is on a no-fly list unless and until he attempts to fly to the United States. At that stage he will discover that he is on the list, but very likely he will not be aware of the reason. He will be in an unenviable position—a position shared by at least 30,000 other passengers.[53] It is as easy for someone to be placed on a no-fly list as it is difficult to be removed from that list even if the entry can be shown to be unjustified. The negotiators must stress how serious it is for an individual to be wrongly placed on a no-fly list, and must ensure that provision is made for rapid access to an enforceable means of redress.

Pull v Push

124. The 2004 Agreement provides:

"CBP may electronically access the PNR data from air carriers' reservation/departure control systems (reservation systems) located within the territory of the Member States of the European Community … only until there is a satisfactory system in place allowing for the transmission of such data by the air carriers."

In the words of Undertaking 13 "CBP will 'pull' passenger information from air carrier reservation systems until such time as air carriers are able to implement a system to 'push' the data to CBP."

125. It has always been clear that the United States prefers to "pull" data because this gives it control over when and how often it does so. Despite the fact that the airlines are able and willing to "push" the data, the 2006 Agreement in substance repeats the words of the 2004 Agreement, and the Baker letter qualifies this further by stating:

"The push system does not confer on airlines any discretion to decide when, how or what data to push, however. That decision is conferred on DHS by US law."

We note that while United States legislators can confer what duties they please on DHS, it does not follow that they can by law require air carriers outside their jurisdiction to cease to exercise their discretion in deciding what data to "push". But they do have other sanctions at their disposal to enforce their views.

126. In his statement to the European Parliament on 11 October 2006 to which we referred in paragraph 86, Vice-President Frattini said: "It has been agreed that the new ['push'] mechanism … will come into operation no later than December 2006, that is within a month and a half at the latest"—i.e. by the beginning of December. The Information Commissioner told us, in evidence dated 5 March 2007, that the delays in moving to a "push" system were a major concern to the Article 29 Working Party. Baroness Ashton assured us that "[t]he ambition will be, by the time we have finished the negotiations, it will be a Push system." (Q 69)

127. On 22 March 2007 Mr Faull told us that the situation was mixed: some airlines had switched to "push" but there was still some "pulling"; it was a purely technical issue. It seems to us however that there are no longer any technical issues; the issues are whether there are any advantages to airlines in going over to a "push" system if they are going to have to "push" data whenever requested by the US authorities. Under the Canada Agreement the airlines have always operated a "push" system; Canada requires a single "push" of data at departure. This, in the view of Virgin Atlantic, "places far less burden on the airlines than the four pushes required by the US plus a mechanism for obtaining additional ad hoc pushes on request." This was the view of BA:

"BA is concerned about how the ad hoc Push should operate. One option, not preferred by BA, is to provide manpower to manually send PNR data when an ad hoc Pull of PNR data is requested by the authority. BA would prefer to automate the system so that the reservations system automatically generates PNR data on request. BA acknowledges that there is little difference between this and a Pull system."

128. The British Air Transport Association (BATA), the trade association for UK-registered airlines, summarised the position as follows:

"The US wish to retain their current mechanism for obtaining data (a data 'pull'). However, the EU feel that this does not afford adequate protection as data is freely available, is not filtered and is not restricted to relevant flights. This means that we are trying to implement a solution that the US does not really want, and hence it is difficult to progress with clarity on how this should work. Any new Agreement needs to clearly resolve these issues and provide adequate time for compliance." (p 54)[54]

129. The US authorities seem to us to be regretting their Undertaking, given three years ago, to change from a "pull" to a "push" system as soon as the airlines were technically ready, and are doing all they can to ensure that they retain the ability to access the databases of airlines whenever and as often as they like. In doing so they are placing an unacceptable burden on the airlines, which bear the full cost of the exercise. We see no reason why they should not, like the Canadians, be satisfied with a single "push" of data at the time of departure.

130. The negotiators should ensure that the United States honours the commitment given three years ago to move to a system allowing the airlines to "push" the data to them, and should insist on a single "push" of data at the time of departure.

Review of the working of the Agreement

131. The 2004 Agreement provides that CBP and the Commission will "jointly and regularly" review the implementation of the Agreement. Undertaking 43 is more detailed:

"CBP, in conjunction with DHS, undertakes to conduct once a year, or more often if agreed by the parties, a joint review with the European Commission assisted as appropriate by representatives of European law-enforcement authorities and/or authorities of Member States of the European Union on the implementation of these Undertakings …"

132. There has been one such review, in September 2005. The planned 2006 review was cancelled because of the negotiations on the Interim Agreement. The Baker letter simply states, without apology, that "the question of how and whether to conduct a joint review in 2007 will be addressed during the discussions regarding a future agreement."

133. The report of the 2005 Review which was published is singularly uninformative because the US authorities insisted that it should be very heavily "redacted". Much that might have been of interest was blanked out, down to the names of those taking part. Access by the high-level EU officials to a number of records was limited, and they were required to sign confidentiality agreements exposing them to criminal sanctions for any breach. We agree with Mr Bunyan that this is not the way in which two equal partners should work. (Q 127)

134. Mr Faull told us that "the Americans found the Joint Review useful, important, but also extremely cumbersome. It occupied a lot of their time, and I would not be surprised if they sought in the negotiations a somewhat lighter form of review in a new Agreement". (Q 141) Reading between the lines, this no doubt is what they had already requested: that, or no review at all. If this is the case, it will be contrary to the views of all our witnesses.

135. Baroness Ashton said: "Yes, it [the review] is an important mechanism; yes, I think it has worked well; yes, I think it should be part of the next stage." (Q 65) The Assistant EDPS told us that "The fact that a mechanism of revision has to take place is fundamental … the mechanism has to be there, it is crucial." (Q 212) The Information Commissioner believes that "the continuation of the annual joint review mechanism is an essential safeguard that will help ensure compliance with restrictions such as those on wider use." (p 57) The importance of a regular independent audit was also stressed by Mr Schaar at the Brussels seminars on 26 March 2007.

136. The view of Professor Elspeth Guild was:

"There must be a full review of the application of the agreement; any issues in respect of differences in interpretation on the meaning of the agreement and the application of the agreement need to be specified … the report … needs to be published, it needs to be timely and it needs to provide an opportunity for additional opinions by those who have been responsible for carrying out the review." (Q 129)

We agree. We would in particular like to see reports setting out in detail the degree to which data are shared by CBP with other US authorities, and the conditions applying to such data sharing.

137. The new Agreement must provide for thorough annual reviews of the working of the PNR Agreement, and the parties must ensure that they take place as intended. The EDPS and national data protection authorities must take part. The EU team must be allowed the fullest access to data to enable it to assess the value of PNR data in the fight against terrorism.

138. This is an Agreement between equal parties. The EU team should not have to sign general non-disclosure agreements, even though there will of course be matters which they will agree not to disclose.