Examination of Witnesses (Questions 84-99)
Professor Elspeth Guild and Mr Tony Bunyan
21 MARCH 2007
Q84Chairman: Professor
Guild, Mr Bunyan, thank you very much for coming. It is very nice
to welcome you back to this Committee. As you know, this session
falls into two parts: we want to question you first on the Passenger
Name Record Agreement and then move on to the Prum Treaty.
I believe you have both indicated, very kindly, that you are prepared
to answer questions on both but it is entirely up to you to decide
which, or both, of you will answer the questions. The meeting
is on the record—you are very familiar with our procedures—it
is being broadcast and a note is being taken. You will, of course,
both be sent a transcript in due course to check that you are
correctly quoted. Although you are both very familiar with this
Committee and we are delighted to welcome you both back, some
Members of this Committee have not met you before, so I wonder
whether I could ask you both, perhaps Professor Guild first and
then Mr Bunyan, to introduce yourselves and tell us who you are.
I know it is a rather complicated story in your case!
Professor Guild: Thank you very much, my Lord
Chairman. It is a pleasure to be here and I congratulate you on
two excellent and very timely reports. My name is Elspeth Guild,
I am a Professor of European Migration law at the Radboud University
in Nijmegen in the Netherlands. I am also a solicitor in private
practice in London at Kingsley Napley and I am also a senior research
fellow at the Centre for European Policy Studies in Brussels.
So I have three hats for the evidence which I have sent you here.
It is primarily with the policy hat on that I will speak.
Q85 Chairman: Thank you very much.
Mr Bunyan, can I ask you not only to introduce yourself but also
Statewatch.
Mr Bunyan: I am Tony Bunyan, I am a Director
of Statewatch, which was started in 1991 to look at civil liberties
in the European Union, which meant that our work increasingly
became concerned with the European Union. So, as a journalist,
which I am, I found myself in the early days going to justice
and home affairs councils and getting hold of documents, by the
backdoor very often, and coming back to the Chair of this Committee,
Lord Tordoff, and others, saying: "Look, we need to get this
information out into this Committee". So it has been a long
relationship and I have spent a long time travelling round Europe
speaking at meetings.
Q86 Lord Foulkes of Cumnock: My Lord
Chairman, apropos that, is Statewatch a membership
organisation? Who do you represent?
Mr Bunyan: No. We are a research organisation.
We are a registered charity and we are a research institute.
Q87 Lord Foulkes of Cumnock: Who
are you speaking on behalf of?
Mr Bunyan: Our job is to conduct research, publish
documentation and provide analysis, but we are not a campaigning
group.
Q88 Lord Foulkes of Cumnock: Who
are you funded by?
Mr Bunyan: Rowntree.
Q89 Chairman: Thank you both very
much indeed. We are starting with PNR. Perhaps I could ask the
first question. What is your assessment, both of you, of the necessity,
effectiveness and proportionality of the transfer of PNR data
under the current Agreement with the United States? Does it, in
your view, get the right balance between the rights of travellers
and the use of data to combat terrorism? Perhaps you might add
a word about the agreement with Canada, although that is not,
of course, the subject of our inquiry. Who would like to start?
Mr Bunyan: I think we should deal with Canada.
The Article 29 Working Party has looked at the initial agreement
in the European Union, that is the committee of all the data protection
authorities from the Member States, and it looked at the practice
and, partly because of the number of datasets that Canada was
asking for but, also, because of the protection given to EU citizens
in terms of their rights, declared it was happy with the agreement
with Canada, unlike its view over the agreement with the United
States. On necessity, effectiveness and proportionality, I dug
out some evidence from the United States which is, in a sense,
general evidence, but it makes one wonder. The Acting Director
of the US Visit Programme, which of course records all visitors
going in (and, theoretically, going out), said that they had,
so far, processed 63 million entries and they denied entry to
1,200 "criminals and immigration violators". It seems
quite a small number. We do not know the breakdown of criminals
and immigration violation, but out of 63 million this seems small.
Another concern over it is the report of the Government Accountability
Office which looked into how this Passenger Name Record data was
being used. In other words, could it lead to errors? They said
that whereas the complaints and the numbers going to them (this
is the central co-ordinating organisation of the United States)
were under control and quite small—in fact, they only had
112 complaints—on the frontline checking and the use of
PNR, which is done by the airlines themselves, in terms of complaints,
there were thousands, they report, and they say that half of the
tens of thousands of potential matches sent to them over December
2005-06 were mis-identifications. I think what this points out
is that it is not just a question of data which is being gathered
and used, but how is it being used? Is it really useful? Is it
proportional to the threat that we are told exists?
Q90 Chairman: Were the complaints
about the information that had been sent, or were they complaints
about misidentification?
Mr Bunyan: It was misidentification in some
cases. In some cases it would be refusal to travel. In other words,
you might get a mis-identification—i.e. you are not the
person you say you are, or they think you are another person because
of the similarity of name, which is the most usual. We had a case
recently where somebody from Belfast was flying to a European
Union country and was refused permission to board by the airline.
They would not tell him why but the next day he booked with another
airline without any problem at all. So that there is a problem
of what identification happens, if you like, which is going to
increasingly happen, by the airlines themselves, because that
is where the first line checks will take place.
Q91 Chairman: Do we have any evidence
that the 1,200 that you referred to—have I got it right?
Mr Bunyan: Twelve hundred out of 63 million.
Q92 Chairman: Do we have any evidence
to, as it were, sub-divide the 1,200 into misidentification or—
Mr Bunyan: These are the numbers actually denied
entry. We do not know. This is the Acting Director of the US Visit
Programme in September of last year, in a speech in Brussels.
Q93 Chairman: That figure is not
broken up into misidentification or otherwise?
Mr Bunyan: It is not, unfortunately, no.
Professor Guild: I find everything that Tony
Bunyan has said very important and very interesting. I would only
add that it would be much easier to make an assessment of necessity,
effectiveness and proportionality if one had access to the report
of the joint review. Without information about how the PNR is
actually taking place it is extremely difficult to assess necessity,
effectiveness and proportionality. We have claims on one side,
but we have no mechanism to assess; we have nothing against which
to judge necessity effectiveness and proportionality.
Q94 Chairman: Just for the record,
could you tell us what the joint review is?
Professor Guild: The joint review was a review
under the initial agreement between the EU and the US to examine
the application of the Agreement in the US, and it was undertaken
in September 2005. The European Data Protection Officer was not
included in the review and its report was not made public. There
have been rumours about what may have come out and what may be
in the joint review, but there is no official information.
Q95 Chairman: I am sorry, I interrupted
you. Do carry on, please.
Professor Guild: I would only add that I think
at the heart of the question is a matter which Professor de Hert
has raised in his written evidence to you, which is the use of
commercial data for law enforcement purposes. You have a mixing
of data which is collected for commercial purposes, which is then
sought to be used for quite different law enforcement purposes.
The quality of data which is collected for commercial purposes,
the standards which are applied, are very different from those
which are required for law enforcement, in particular, where law
enforcement is tied into the whole criminal justice system, and
what you are seeking is information which will lead to criminal
prosecution, we would hope, if there is a genuine threat.
Chairman: Thank you very much.
Q96 Earl of Listowel: The current
Agreement with Canada has 25 data elements. In these negotiations
there are likely to be requests from the US for more than the
current 34 data elements to be made available. What, in your view,
are the main dangers inherent in the collection of more information?
Mr Bunyan: I did compare the PNR data required
by both, and so I marked the ones that the US is asking for which
Canada is not asking for. They are: the address of the person,
the code-shared PNR information, travel status, the email address
and then, of course, the worrying categories, like number 19,
"General Remarks". What does that mean? Then I had to
look up some others because it says: "Received information";
"Historical changes"; "Number of travellers".
Then, 26 is OSI information, and this is also "General Remarks",
whereas SSI/SSR information are open fields. The one that almost
floored me was the last one, which is "ATFQ fields",
and I thought: "What is `ATFQ fields'"? I used Google,
of course, and "ATFQ fields" means "Answer the
Freaking Question". So they are the categories which are
not in the Canadian one. Clearly, the worrying side for me, from
a data protection point of view, is these "general remarks"
and "open fields". The concern here, of course, is that
what is happening is that they want to create these fields in
order that when that template comes into their systems they can
add data within those fields. It is not that those fields will
necessarily be filled in by the airlines—they may be, they
may have a personal point of view of an individual—but they
can be filled in later. Earlier on, one looked back in the process,
and somebody I know from Spain applied for his data records, and
in fact at that time it was even longer; there were 43 categories
being asked for—just to travel within Europe. I have to
say, I think there is a worrying aspect here. I do not know, because
I was looking at the Home Office Border Programme, what PNR data
the UK Government is using because they are using PNR data as
well as API data. API data is the international standard agreed
by the ICAO, which we can call the basic standard, and that is
simply that the data in the machine-readable zone on the bottom
of your passport page must be transmitted. So we have got standards
which are ICAO standards of API, and then we have got the Canadian
standard 25, the US standard 34, and I do not really know how
many datasets the UK is collecting. It is a question that you
might ask, because it certainly is a concern that even when you
try and book a ticket to travel within the United Kingdom with
British Airways online you cannot book a ticket online for British
Airways unless you agree for your data to be passed to the United
States. That is for internal flights within the United Kingdom.
I do find that extremely strange.
Q97 Chairman: Professor Guild, do
you want to add to that?
Professor Guild: I would just add that a further
concern is that the larger the number of data elements which are
included the greater the risk of inaccuracy. We have a PhD student
at my university who has examined the reports of the Data Protection
Supervisors in three different Member States on data held in the
Schengen system (of course, it is different to this one but comparable)
and according to the Data Protection Supervisors in some of the
Lander in Germany, in France and in the Netherlands,
in up to 40 per cent of random cases examined, the quality of
data in the Schengen Information System, which is data collected
for law enforcement purposes, was either inaccurate or improperly
used.
Chairman: I find that rather surprising
because, surely, in logic, the more information you have the more
likely it is to be a correct identification.
Q98 Baroness D'Souza: Because you
can cross-check all the time.
Professor Guild: There is another problem on
that. The more data you have, if it is very, very carefully controlled
and produced for law enforcement purposes, it may well assist
in identification, but the difficulty is that this is data which
is collected for commercial purposes and the accuracy level diminishes.
So comparing three commons fields—you may get the surname
right, you may get the gender right, you may get the middle name
right, but then mistakes may start to creep in: e.g. address—the
person has moved; credit card—the credit card has changed;
e-mail address, telephone number—a digit is wrong. The more
information you collect the greater the risk of error occurring.
It happens very easily. Anyone who books an airline ticket online
will know how easy it is to get the gender wrong. You have to
book as Mr or Mrs or Miss; it is very easy to click the wrong
box. Do you travel or do you not travel? By and large you do travel.
Nonetheless, you have gone into the PNR system with the wrong
gender, and that is with only a small number of boxes, which are
elements of information which one would have thought would be
very straightforward to collect.
Chairman: Lord Foulkes, apologies, I
think I have shot your fox, but just before you follow up on this,
Lord Harrison.
Q99 Lord Harrison: I did want to
go back to Mr Bunyan because I think you compared, first of all,
the 34 and the 25 of the US and the Canadian data, respectively,
and you then mentioned 43 items from the Spanish colleague for
the EU. I know this is a difference of apples and pears but in
those 43 were there other interesting categories that began to
emerge that the Committee might be interested in?
Mr Bunyan: Not really additional ones. There
were the same problems of the general remarks and open fields.
To add to what Elspeth has said, I think there is a distinction.
When one uses the term "information" (this will crop
up under Prum as well) one really has to distinguish between
hard factual information, and even then there can be mistakes,
and what is called intelligence, which may be hard and may be
pure supposition, maybe reliable, maybe unreliable. I think the
term "data" on its own, or "information" on
its own is not sufficient to tackle problems in this field and,
indeed, the field we are going to discuss later.
|
