CHAPTER 3: current issues
The Government's strategy
31. The Home Office, in their written and their oral evidence, have made no secret of their strategy. The positive obligations of the Framework Decision are for the most part obligations which the Government have already willingly undertaken for the United Kingdom, and which they would be happy to see imposed on other Member States. The result would be that data collected for flights entering, leaving and transiting the EU as a whole, and not merely the United Kingdom, would be collected to help the EU as a whole, and not just the United Kingdom, in the fight against terrorism and organised crime.
32. On the other hand, the Government believe that the limitations and restrictions on the collection and use of PNR data which are contained in the current draft go too far, in particular in the following three respects:
the draft restricts the use of PNR to terrorism and organised crime; the Government would like it to be used for any serious crime, organised or not, and also for immigration control purposes;
the draft covers only air travel; the Government would like to extend it to other forms of travel, or at least to make sure that the draft does not prevent the United Kingdom from doing so;
the draft covers only flights between a Member State and a third country; the Government would like to extend it to intra-EU flights and even domestic flights, or at least to make sure the draft does not prevent the United Kingdom from doing so.[18]
33. As appears from its proposal, the Commission believes that the positive obligations go hand in hand with the limitations and restrictions. It is likely that many, perhaps most, Member States will take the same view. The Government's hopes of eliminating or at least reducing the limitations may therefore not come to fruition.
34. Whatever limitations are ultimately contained in the Framework Decision, the Government have no intention of letting the United Kingdom's freedom of action be constrained by them. Nor do they see any danger of this. As we have said, currently the Framework Decision requires unanimity. Any restrictions which were unacceptable to the United Kingdom would be avoided simply by blocking the draft. This would not be possible after the end of the year, when under the Treaty of Lisbon the applicable procedure becomes co-decision and QMV. At that stage, to avoid constraints, the United Kingdom would have to decline to opt in to the Framework Decision. Mr Tom Dodd, the Director of Border and Visa Policy at the Border and Immigration Agency, put it this way: "Either way, we have a degree of lock on how it would apply to the UK" (Q 13).
35. If a Framework Decision was agreed after the end of this year and the United Kingdom decided not to opt in, the position would be as follows. Within the remaining Member States the Framework Decision would govern the PNR data which could be collected, the purposes for which they could be used, and other limitations on their use; and those Member States would have the duty to give those data to the other Member States bound by the Framework Decision (and hence not the United Kingdom), and the right to receive such data from them. The United Kingdom, meanwhile, would remain free to collect such data as it wished from carriers in relation to incoming flights, and to use them for any purposes permitted under our law, subject only to such safeguards as our law provides (and in particular the Data Protection Act 1998). It would not be required to pass such data to other Member States. Conversely those States would be under no obligation to pass to the United Kingdom data derived from international flights entering their countries.
36. It would be unfortunate not to be part of the EU's own PNR initiative, and not routinely to receive PNR data from other Member States; but, at least in the view of the Government, less unfortunate than having unacceptable constraints on their own freedom of action.
37. We consider in turn the purpose limitation, the limitation to air travel and the geographical scope.
The purpose limitation
38. The purpose or purposes for which PNR data may be collected and used is the most controversial aspect of this proposal, and indeed of any proposal connected with PNR. The combating of terrorism is always given in national and international instruments on the use of PNR as their prime aim. Whether the purpose should go wider than this, and if so how much wider, is the issue on which we have received most evidence. It is, in the Commission's view, "an issue of huge importance" (Q 117). Mr Hustinx, the European Data Protection Supervisor (EDPS), told us that "the purpose specification is the key element in making a particular proposal legitimate under the human rights standards, but is also the pivotal element of any data protection arrangement if you want to make the safeguards appropriate" (Q 168).
39. The European Council's invitation to the Commission to bring forward this Framework Decision was made in a Declaration on Combating Terrorism. Unlike many of the expressions used in such instruments, "terrorism" does have a tolerably clear and uniform meaning throughout the EU, since one of the purposes of the Council Framework Decision of 13 June 2002 on combating terrorism[19] is to approximate the definition of terrorist offences in the Member States.[20]
40. As we have said, Article 1 of the PNR Framework Decision provides that PNR data can be made available to the authorities of Member States "for the purpose of preventing and combating terrorist offences and organised crime". Without the last three words, this would impose a limitation on the use of the data which could without much difficulty be uniformly applied across the EU. But the addition of "and organised crime" in our view renders the limitation highly unsatisfactory. Is "organised crime" necessarily serious crime? Is it necessarily transnational? The recitals to the EU/US PNR Agreements refer to "terrorism and related crimes, and other serious crimes that are transnational in nature, including organised crime". This at least makes it clear that, in that context, "organised crime" is both serious and transnational. The only indication that there is to be any common understanding of the meaning of the expression in the Framework Decision is the suggestion in the Impact Assessment[21] that a definition could be taken from another Framework Decision which has yet to be agreed.[22]
41. However the Government see "organised crime", however defined, not as too wide a limitation but as an unacceptably narrow purpose; they would like to be able to use PNR data for any serious crime, organised or not, and also for immigration control purposes.[23] Ms Verkleij told us that the Commission could not at present contemplate dealing in a third pillar instrument with purposes, such as immigration, which are first pillar matters. However the situation would have to be reviewed once the Treaty of Lisbon was in force and had done away with those two pillars. Even at that stage the Commission would have great difficulty in using PNR for immigration, revenue and customs purposes without any limitation. "We are not convinced that PNR data are really made for servicing those purposes, but we also have to bear in mind the issue of proportionality ..." (Q 118).[24]
42. Nevertheless discussions in the Council show that a large majority of Member States to some extent share the views of the United Kingdom Government, and now favour extending the purpose limitation to cover serious crime instead of, or possibly in addition to, organised crime (QQ 124, 118). For a definition of "serious crime" Ms Verkleij thought guidance could be obtained from the list in Article 2(2) of the Framework Decision on the European Arrest Warrant.[25] That list includes "facilitation of unauthorised entry and residence", which in her view could cover immigration offences (though not immigration matters generally) (Q 118). We can see that this long list of crimes may well be of some assistance, but it does also illustrate the problem, since it includes crimes like murder and rape which, though undoubtedly serious, are seldom either organised or cross-border.
43. While the United Kingdom is therefore not alone in wishing to see a wider purpose limitation, it is uncertain whether many would wish to see PNR data used for the full range of purposes advocated by the Government. Ms Hillier's letter of 20 November 2007 to Commission Vice-President Frattini illustrates this (p 7). She sets out to explain the success of the use of PNR by the Home Office pilot for the e-Borders scheme, Project Semaphore. The cases she lists include offences of drug-smuggling and other undoubtedly serious offences; but they also include "two tobacco smugglers". We question whether most people would regard tobacco smuggling as the sort of serious offence which PNR is designed to combat; it is not, on its own, among the "serious offences" to which a European Arrest Warrant applies.
44. Most significant of all, Ms Hillier's letter contains no reference to terrorism, and none of the examples she lists bears any relation to terrorism. Likewise, in oral evidence she was unable to give an example of the successful use of PNR in relation to a terrorist-related offence. She did assert that PNR "has absolutely been a tool in tackling terrorism", and explained the problems of sharing information about this in public (Q 28). However such a statement is unpersuasive when not accompanied by even a claim that PNR has succeeded in preventing, or assisting in the prevention of, a single terrorist attack, or bringing to justice the perpetrators of such an attack. Similarly, Mr Hustinx told us that when the US Secretary of Homeland Security was addressing the European Parliament "he was careful to annex a list of some 20 or so examples to his speech and it was all about drugs and people evading paying taxes and things like that, but there was very little in terms of precision on terrorism" (Q 170).
45. Ms Hillier represents the view that PNR data are but one in an arsenal of weapons which can be used to deal on a day-to-day basis with crimes, not all of which would be regarded as particularly serious, and with combating illegal immigration even when this is unrelated to a criminal offence (QQ 2, 10, 15). Ms Sophie in't Veld MEP put to us the opposite view: that the capture and use of PNR data by the authorities should be used wholly exceptionally, and only where it can be shown to have helped in combating terrorism or other organised crimes of similar gravity.
46. Ms in't Veld looks not just for assertions that PNR data have been of assistance in tackling terrorism, but for evidence of this. So far she has not found it; nor has Mr Hustinx, who described such evidence as there was as "scanty" and "anecdotal" (Q 167). As Ms in't Veld said: "If the people who are proposing this are so convinced that it is useful then I am sure they have all the supporting evidence ... It is just that they have never produced it and every time you get the same argument, 'Oh, no, we cannot tell you that for security purposes' ... All we have asked for, for example, is facts and figures which would not give away any operational details ... all you get are horror stories by Mr Chertoff[26] which impress his audience, but, sorry, we are legislators. If I put my stamp of approval as a Member of Parliament on the law then I want to be absolutely sure that it has a solid justification, and we just never get any proper evidence" (QQ 96-97). Ms Verkleij saw no reason to exclude parliaments from this kind of debate (Q 155).
47. Ms in't Veld accepted, as we do, that PNR data have been shown to have helped in combating and resolving other crimes—though it was not clear that some at least of them could not have been resolved in the absence of PNR data. In recent high profile cases—the murder of Theo van Gogh, 9/11, the Madrid bombings—the necessary information was already available from other sources, and the failure lay in inadequate analysis of it or not making it available to the right people (Q 109). What was needed, and what was lacking, was evidence that PNR data were essential for their stated purpose, the fight against terrorism (Q 73). Citizens had the right to know the purposes for which their data could and could not be used (QQ 75-77).
48. In our earlier report we reluctantly concluded that, having received no evidence to the contrary, we should accept ministerial and other statements that PNR data constituted a valuable weapon in the fight against terrorism. We did however add that it was an important principle of democratic accountability that Parliament should be able to reach its own conclusions, and not rely on statements from the executive.[27]
49. Our scepticism about the value of PNR data in combating terrorism was made clear to the Minister. At a late stage we have received from her further material, including specific examples. We do not print this material with the evidence, but it has sufficed to persuade us of two things. The first is that PNR data on their own are seldom, if ever, likely to prevent terrorist attacks or, subsequently, to identify the perpetrators. But the second is that PNR data, when used in conjunction with data from other sources, can significantly assist in the identification of terrorists, whether before a planned attack or after such an attack.
The purpose limitation: conclusions and recommendations
50. From this evidence on the purpose limitation we draw the following conclusions, and we make the following recommendations.
51. PNR data should be used for law enforcement purposes only in the fight against terrorism and in combating other serious crime. There can be no justification for agreeing legislation which does not set out clearly the purposes for which and the conditions under which the data may be used.
52. Blanket expressions such as "organised crime" or "serious crime" are inadequate. The offences for which PNR data can be used must be defined as clearly as is possible given the differing legal systems involved. If a definition of "serious crime" is possible for the European Arrest Warrant, appropriate definitions can be found for the Framework Decision.
53. The Government should be aware that, by attempting to extend the purposes beyond what is acceptable to other Member States and to the European Parliament, they may be forced to opt out of the Framework Decision. They may then find that, on balance, the ability to use PNR data to assist in the combating of more routine crime, including immigration, revenue and customs offences, is insufficient compensation for an inability to use data collected by other Member States. We hope that the Government will take account of our views in balancing the advantages and disadvantages of participation.
The limitation to air transport, and the geographical scope
54. As we have said, the draft Framework Decision applies only to passengers on international flights; it does not apply to flights between or within Member States, or to other modes of transport. When the Commission was formulating its proposal it consulted all the Member States on these and other matters. Of the six largest Member States, Germany shared the view of the United Kingdom that flights between Member States should be covered, France was doubtful, while Italy, Spain and Poland (and nearly all the smaller States) wanted the Framework Decision restricted to flights to and from third countries. Spain and France wanted, like the United Kingdom, to include both sea and rail transport, while Germany, Italy and nine smaller Member States wanted in due course to include sea transport but not rail. Poland and the remaining Member States which replied wanted the Framework Decision restricted to air travel.[28]
55. It is probably true that if terrorists and other criminals are aware that a PNR system is in force which may identify them on their travels, but that it applies only to certain modes of transport, they will avoid them if there is any alternative. Ms Verkleij, while agreeing, thought this betrayed a misunderstanding of the system. "That takes as a presumption that PNR solves everything, and that is simply not the case. PNR is an additional tool, additional to the API data, to the visa, to other information, the aim of which should be to fit them into a jigsaw puzzle which we then present as tools to law enforcement next to other instruments which should allow law enforcement to look at particular ways of people entering our countries ... [Our proposal aims] to give law enforcement information which it does not have now for particular modes of transport in addition to already existing means" (Q 149).
56. Member States were not asked by the Commission whether they wanted the Framework Decision to apply to road travel. Although the Home Office Explanatory Memorandum refers to "all modes of transport",[29] Ms Hillier in her letter of 18 March 2008 refers to "data from maritime and rail carriers, as well as from airlines", but does not refer to road transport (p 8). We believe this is just as well. Not only is the PNR system dependent on data being routinely collected by the carrier, but as Ms Verkleij pointed out it is also dependent on the data being available some time in advance of travel to allow the authorities access to them (Q 143).
57. In the case of air travel, even if tickets are bought at the last possible moment the data are still available some time before the actual departure of the passenger. This will often also be true of maritime travel. Ms Verkleij told us that, although PNR data could most effectively be collected for air transport, it was arguable that in Southern Europe there was competition between certain maritime links and air routes. If Member States thought there was a real issue, the proposal would allow them to implement domestic measures on sea travel which would take care of their security concerns. However data collection in the maritime sector was at present pretty limited (QQ 140-142).
58. Logically, the same arguments apply to rail transport. However data currently collected from rail travel are even more limited, and where tickets are not bought in advance there is virtually no time to act on the data. Only five Member States are interested in the Framework Decision applying to rail travel. These arguments will be even more valid in the case of road transport.
59. Although we have not received any conclusive evidence on the topic, it seems to us that PNR data could not effectively be collected for rail transport, and that in the case of road transport the data do not exist.
60. Ms Hillier would however like to apply the Framework Decision to travel through the Channel tunnel and to Eurostar (Q 32). We would support this.
61. We are not aware that there is currently any serious discussion in the Council about extending the draft Framework Decision to either sea or rail travel. If it remains restricted to air travel, those Member States which wish to use PNR data from other modes of travel will remain free to do so.
62. In the United Kingdom, the Immigration, Asylum and Nationality Act 2006 allows the use of PNR data from air, sea and rail carriers. The limitations on the use of the data are contained in the Code of Practice on the management of information shared by the Border and Immigration Agency, HMRC and the Police. This Code of Practice has a degree of Parliamentary sanction: it has to be laid before Parliament in draft,[30] and comes into force only by virtue of an Order which is a statutory instrument subject to negative resolution. The Code of Practice is not part of our inquiry. We only observe that Parliament has in fact approved it.[31]
63. Fourteen of the 27 Member States would like to see the Framework Decision apply sooner or later to sea travel. Since one of the purposes of the Framework Decision is to make a single system available for the benefit of States, carriers and passengers, with a single set of safeguards, it seems to us that, if and when negotiations are successfully concluded on a PNR Framework Decision applicable to air travel, work should then begin on extending it to sea travel.
64. If, as is likely, the proposal remains for the present limited to flights to and from third countries, there will be no obligation on Member States, whether under the Framework Decision or otherwise, to collect PNR data in relation to flights between Member States. If the United Kingdom collects such data in relation to flights entering the United Kingdom it will be under no obligation to share the data with other States, though there would seem to be nothing to prevent it from doing so, subject to data protection rules. Similarly, if some other Member States collect such data, they could be shared with the United Kingdom, but this would be under informal arrangements.
65. It does not necessarily follow that Member States remain free to seek what PNR data they like for travel between and within Member States. Mr Hustinx pointed out that issues of freedom of movement and proportionality might arise, and other issues within the Schengen States (Q 177). But it is probably true to say that in the case of air travel, where the data are already being collected so that no additional restrictions on freedom of movement are imposed, those Member States which wish to make use of the data for law enforcement purposes will be able to do so.
18 Explanatory Memorandum, paragraphs 33-35 (p 5). Back
19 Framework Decision 2002/475/JHA on combating terrorism, OJ L164/03 of 22 June 2002. Back
20 Ibid., recital (6). Article 1 defines as a terrorist offence one of a list of serious acts defined as offences under national law "which, given their nature or context, may seriously damage a country or an international organisation where committed with the aim of seriously intimidating a population, or unduly compelling a Government or international organisation to perform or abstain from performing any act, or seriously destabilising or destroying the fundamental political, constitutional, economic or social structures of a country or an international organisation". At the Justice and Home Affairs Council on 18 April 2008 agreement was reached on an amending Framework Decision which will add the following crimes to the list: public provocation to commit a terrorist offence, recruitment for terrorism, and training for terrorism. Back
21 Document 14922/07 ADD 1, page 34 Back
22 The Commission proposal for a Framework Decision on the Fight Against Organised Crime, COM(2005)6 final, does not suggest a definition of organised crime as such. However Article 1 would define a criminal organisation as "a structured association, established over a period of time, of more than two persons, acting in concert with a view to committing offences which are punishable by deprivation of liberty or a detention order of a maximum of at least four years or a more serious penalty in order to obtain, directly or indirectly, a financial or other material benefit". It would then be an offence to direct or participate in a criminal organisation. Back
23 France favours using PNR data in the fight against terrorism and illegal immigration, but not for other crimes. Back
24 Proportionality is the principle that action by the Community shall not go beyond what is necessary to achieve the objectives of the Treaty establishing the European Community: TEC Article 5, and Protocol No 30. Back
25 Council Framework Decision of 13 June 2002 on the European arrest warrant and the surrender procedures between Member States (2002/584/JHA) [2002] OJ L 190/1. The Select Committee reported twice during the negotiations on the Framework Decision: Counter Terrorism: the European Arrest Warrant, 6th Report, Session 2001-02, HL Paper 34, and The European Arrest Warrant, 16th Report, Session 2001-02, HL Paper 89, and has since reported again: European Arrest Warrant-recent developments, 30th Report, Session 2005-06, HL Paper 156. Back
26 Mr Michael Chertoff, the United States Secretary for Homeland Security, and as such signatory of the EU/US PNR Agreement of 2007. Back
27 The EU/US Passenger Name Record (PNR) Agreement (21st Report, Session 2006-07, HL Paper 108), paragraphs 22-23. Back
28 Commission Impact Assessment, document 14922/07 ADD 1, Annex B. Finland, Ireland and Malta did not express any views. Back
29 Paragraph 35, p 5. Back
30 Section 37 of the Immigration, Asylum and Nationality Act 2006. Back
31 The Immigration, Asylum and Nationality Act 2006 (Data Sharing Code of Practice) Order 208, S.I. 2008/8, which brought the Code of Practice into force on 1 March 2008. Back
|
