Letter from Ms Meg Hillier MP, Parliamentary Under Secretary of State, Home Office
I welcome the Committee's interest in the proposed EU PNR Framework Decision and its decision to hold a short inquiry, focusing on the key issue of the scope of the proposal. I am pleased to provide the details below, building on the information provided in the Explanatory Memorandum of 7 December, and in advance of my oral evidence session on 19 March. I understand the Committee has expressed a particular interest in matters relating to the collection of PNR data on intra-EU flights and from rail and maritime carriers; the range of PNR data elements included in the scope of the proposal; the UK authorities entitled to receive PNR data; the transfer of PNR data to third countries; and the ability to collect PNR data more than 24 hours in advance of a flight. I have addressed each of these issues in turn below.
As you know, the draft proposal applies to flights between Member States and third countries and would appear to restrict the processing of PNR data to the fight against terrorism and organised crime. As you will be aware from the EM, the Government wishes to use PNR data to combat a range of illicit activities; to obtain PNR data from intra-EU flights; and to collect passenger data from maritime and rail carriers, as well as from airlines.[4] This is because persons of interest do not, of course, restrict their travel to international flights and we believe that a comprehensive approach to border management will deliver the greatest benefits to UK citizens and to those people who travel legitimately to, from or through the UK.
Our approach to handling the geographic and transport aspects of scope differs from the way in which we are negotiating over the purpose limitation. The better approach with regard to the geographic scope and the modes of transport would seem to be to accept the restrictions imposed by the instrument, providing explicit provision is included in the text to allow Member States to legislate domestically to process passenger data on journeys by sea and rail and to process PNR and passenger data in respect of intra-EU journeys should they so wish. It would seem sensible and practical to allow Member States to address their particular needs without compelling others to take exactly the same action. For example, we accept that the ability to process data from maritime passengers is irrelevant to land-locked Member States, but may be of great interest to other Member States with busy ports. The e-Borders legislation which came into force earlier this month provides the relevant UK authorities with the powers to capture passenger data from all carriers entering and leaving the UK on all routes.
By contrast, an attempt to rely on domestic legislation to broaden the purposes for which PNR data may be processed, beyond those set out in the EU legislation, could be perceived as undermining the terms of the EU legislation by weakening the data protection safeguards that the instrument aims to put in place. This may give rise to questions over the principle of loyal cooperation. Furthermore, there may also be issues of exclusive EU competence to consider with regard to extending the permitted purposes through domestic legislation. We therefore believe that this issue should be addressed in the text itself.
Annex A[5] to the Commission's draft proposal sets out the nineteen data elements within the scope of the draft Framework Decision. Subject to further clarification from the Commission, the Government does not wish to add any additional data fields but would wish to obtain the same data in respect of crew members. We will inform you if this position changes. However, item 12 in the list at Annex A notes that the General Remarks should exclude sensitive personal data; by contrast, we would wish that officials in the UK's Passenger Information Unit (PIU) with appropriate training and security clearance might manually access sensitive personal data on a case-by-case basis, in line with specific data protection safeguards. Our experience has shown that sensitive personal data can be extremely helpful in eliminating individuals from further interventions because it can sometimes quickly explain unusual features of PNR which may initially appear to be suspicious.
Relevant data protection safeguards could include a prohibition on automated profiling on the basis of sensitive personal data and restricting access to appropriate officials only after a passenger has been flagged as potentially of higher risk. We simply do not profile on the basis of passengers who have chosen, say, a halal or kosher meal, and it is not technically possible to profile on the basis of sensitive personal data in the free text fields. The General Remarks field can sometimes include health data, for example if a passenger is a wheelchair user or has restricted mobility and requires assistance. Other Member States have expressed support for our position on the limited use of sensitive personal data and the Commission has noted that if such data were to be processed under the instrument, the UK's suggested safeguards would seem to be appropriate.
However, the UK believes that the issue of access to sensitive personal data is currently confused in the draft text and it is not yet clear to us what the reference in the Annex to the exclusion of such data would mean in practice. For example, Articles 3(2) and 6(3) require the immediately deletion of sensitive personal data but Articles 3(3) and 11(3) note that no enforcement action may be taken solely on the basis of sensitive personal data, suggesting that such data may in fact be processed. We are keen to obtain clarity on this important matter and look forward to discussing the relevant articles as negotiations progress.
The authorities entitled to receive PNR data from the PIU will be dependent upon the purposes those data may be used for. As you know, the Government considers the current purpose limitation too narrow and we would wish to see this broadened beyond the combating of terrorism and organised crime. The Government believes that authorities with responsibility for tackling a broader range of activities which are damaging to the security and integrity of the UK's borders should also be entitled to receive and process PNR data. Recent e-borders legislation provides that this data may be used by the UK Border Agencies where it is likely to be of use for immigration, police or Revenue and Customs purposes. We would not want this to be restricted by the Framework Decision.
The Government is concerned that the restrictions in the current draft proposal regarding who may obtain "raw" or unprocessed PNR data are unhelpful and unclear. The police forces in England and Wales are, of course, regional with their own intelligence commands based around the country; our Customs service also operates from regional bases. Our police and Customs officers often need to process raw PNR data in their own intelligence hubs in order to enrich that data with existing intelligence to progress criminal investigations as quickly as possible. We have raised this issue during negotiations and the Commission, Presidency and other Member States have been sympathetic to the need to overcome what is essentially an administrative matter. We have made very clear that the appropriate data protection safeguards must still apply wherever the data processing takes place.
The UK supports the Commission's proposal to share data with third countries in line with appropriate data protection safeguards. However, the UK recognises that PNR data may be helpful in combating illicit activities beyond terrorist-related and organised crime. We would not wish to be prohibited from negotiating bilateral agreements with third country partners to use PNR data more broadly where such data sharing was in our mutual interests.
Article 5(3)(a) of the draft proposal imposes an obligation on carriers to provide PNR data to Member States' Passenger Information Units 24 hours before a flight's scheduled departure time, and again immediately after flight closure. However, the final paragraph of Article 5(3) allows Member States to exercise discretion in requesting PNR data earlier than 24 hours in advance of the scheduled departure time under certain circumstances. The UK would like to increase this flexibility in order that we are able to receive PNR data within a 24-48 hour window to reflect our current operational practice.
I hope this information is helpful to the Committee and I look forward to providing further evidence on this important matter on 19 March.
Meg Hillier MP
Parliamentary Under-Secretary of State Home Office
18 March 2008
4 PNR data is a term specific to the airline industry. Personal data collected by maritime and rail carriers are referred to here simply as "passenger data". Back
5 See Appendix 3 in the report. Back
| 
