Examination of Witnesses (Quesitons 70-79)
2 APRIL 2008
Q70 Chairman: Thank you very much for coming, it is extremely helpful, and also you have brought Linda van Renssen, who I understand is your assistant, is that right?
Ms in 't Veld: Yes.
Q71 Chairman: Welcome. We are on the record and you may have seen some of the questions which we are interested in asking you, so let me begin. As you know, we are doing a short inquiry into the Framework Decision on PNR and we would be most grateful to get your views and comments. The arrangements for the collection and transmission of PNR data are currently in place in the UK, France and Denmark, and other Member States we understand are likely to follow. Is it your view that this whole operation calls for a harmonised approach through EU legislation?
Ms Sophie in 't Veld and Ms Linda van Renssen
Ms in 't Veld: Yes and no. If there is going to be such a thing as an EU PNR scheme then I think it should be a real European scheme, not least because it is an incredible hassle for the carriers to have to deal with 27 different schemes. Besides, that was the whole reasoning behind the proposal, that there are certain countries which are doing this; therefore it would be better if we had something harmonised, but that is not actually what the Commission is proposing. However, before we ask this question I still think we need to ask the key question: is it actually necessary? That question still has not been answered and that is the question that we will keep asking in our discussions with the Commission and the Council. I refuse to get lured into a debate on the details when we have not answered that fundamental question.
Q72 Lord Teverson: Perhaps we could ask Sophie if she could briefly give us the Parliament's view on that broader issue before we get into these questions, and perhaps also how it views the possible transition into co-decision towards the end of the year.
Ms in 't Veld: As you know, the European Parliament was deeply unhappy with the EU/US agreement on the transfer of PNR. Unfortunately, the outcome of the court hearing was such that we basically sidelined ourselves, but I think that many of our fears and suspicions have proved to be true and, inversely, the usefulness of the system has not been proven. We have been asking consistently for evidence of the usefulness (or even the need) for the collection and use of PNR for the stated purpose, because everything always derives from the stated purpose, proportionality and the details of the arrangements. We have not received any evidence. The evidence that is trickling in seems to indicate that the targeted use of PNR, ie, not automated searches but when they are looking for something or someone specific, might be useful in particular for fighting crime, not even necessarily serious crime or organised crime but crime. Fine; we can argue about that, but the stated purpose is always the fight against terrorism and serious crime, so you can only measure the effectiveness against that and the effectiveness of the EU PNR agreement has not been demonstrated in any way. Furthermore, there was a first agreement back in 2004 that was annulled by the court. Then there was another one in 2006 to 2007, an interim one, and there was a final one which was concluded last year. It has not even been ratified yet. The ink on the agreement is not dry yet and the Americans are seeking bilateral arrangements with the Member States. It turns out that the single evaluation that took place, which was very superficial and where most of the work was done by the then Privacy Officer of the Department of Homeland Security, who was very good, seemed to indicate that they were not actually very strict in implementing the agreement. It is formulated in such a way that they can use the data for all sorts of purposes. They are not really bound to it. We have just been discussing it with Baroness Ludford. The legal status of the whole agreement is totally unclear. That is the kind of agreement that we are concluding. We have another agreement with Canada, which is a different one on a different legal basis, which has not been evaluated. We are going to negotiate one with Australia. South Korea started requiring the transfer of PNR data yesterday and there is no legal base, no agreement, no data protection, and the Commission and Council do not want to conclude an agreement. Why? It is a complete mystery to me. They will not answer. There are even rumours that the Chinese might introduce the collection of PNR before the start of the Olympics. There is no strategy, no vision, and again there is no justification. You know that the European Parliament was extremely critical of it. The term that was used in the resolution that we adopted in July last year was that the agreement that was concluded with the US was "substantially flawed". That is very clear, I would say. Of course, we do not have a position yet on the proposals which are on the table now but the questions are essentially the same. As a matter of fact we have moved on since then. We have a bit more information on what we can and cannot expect, and I have to say that as far as I can judge across the political groups there is deep scepticism about all this. Also, you have to see it in the wider context. We tend to focus very much on what is right in front of us and that is the PNR proposals but, if you look at the wider context, let us start with anything to do with travel and passenger movements. We are talking about the collection of fingerprints, not one but ten. We are talking about an entry/exit system. We are talking about an electronic travel authorisation scheme, and for all modes of travel, not just air travel. People are beginning to look at train travel, boats, car. I do not know about the UK but in the Netherlands we are introducing a kind of congestion charge system which will register cars. We have a public transport system which will work with a chip card which will register your movements as well. Then, if you look at all the other sectors, it is not only about PNR because then you will say, "Oh, okay, if it is used for the right purposes ---", but there are telecommunications data, including the contents of our communications, postal data, medical data, bank data, credit card data, there are smart cameras, smart microphones, satellite surveillance, you name it. They are literally working on cameras which can look through walls, so basically they know everything about us. And then you go to back to PNR then and you ask yourself, "Is it actually going to make our lives safer?", because that is the stated purpose. I do not know. Frankly, I am getting the feeling that citizens are increasingly under surveillance and the right to hold the executive to account is being eroded rapidly. Maybe I should conclude on a more philosophical remark, which seems a bit exaggerated but still it makes me think. Everybody is looking at China now. The government of China, as we know, is obliging companies such as Google and Yahoo to submit their customer records to the authorities for national security purposes. We say, "That is outrageous. They are a dictatorship". Western governments are obliging Google and Yahoo to submit their customer records for national security purposes and we can no more hold our governments to account than the Chinese can. We still live in a democracy and I would like to keep it that way.
Q73 Lord Marlesford: Can I follow up your earlier point about the usefulness of PNR not yet being evaluated as far as we in Europe are concerned, and ask first of all whether the Commission are asking the United States Government (which presumably means the Department of Homeland Security) for an evaluation of the usefulness of PNR, and, secondly, whether the United States Government are indicating they are going to answer or whether they are being obstructive and saying it is too secret to answer or what? In other words, are you satisfied as the European Parliament that the Commission—presumably it is the Commission—is interrogating the US Government on the matters that you need to know about?
Ms in 't Veld: The Commission is not asking such questions. We have asked the Commission repeatedly to carry out the evaluation in such a manner, but there has only been one single evaluation since it entered into force in 2004, and that evaluation looked exclusively at the implementation of the agreement, in other words, were they indeed protecting our data as they had promised? The conclusion was no, or they had only started to implement it during the evaluation but they did not look at the usefulness. The report was not made public initially, and then it was but not the annexes, which contain the interesting bits, and the annexes gave the first indications of what the data are being used for, which was for all sorts of purposes, including, indeed, fighting small-time drug smugglers or other very valid purposes. I am not saying those are not valid purposes but the stated purpose was the fight against terrorism, and no, it is not evaluated against that stated purpose. All the information that we get we get from the other side of the ocean because the Americans are much better at holding their Government to account than we are, and they are asking much more critical questions about these things, so there are, let us say, internal reports.
Q74 Lord Marlesford: "They" meaning Congress?
Ms in 't Veld: The Americans. For example, there is something called the Government Accountability Office, which is a government agency which assesses policies and which is very good. Some of their reports are very alarming and if you read how effective—or, rather, ineffective—anti-terrorism measures are there will be ample reasons for asking very critical questions. Just yesterday I was reading a report that was done by the Inspector-General of the Department of Justice on how the FBI is managing the terrorist watch lists. It is a shambles, basically, and very sloppy. Those are not the terms that the Inspector-General uses but read the report. It is very interesting. That is the kind of information that we get. Then we got from this side of the ocean the report from your own Government on the use of PNR, which basically says the same. It says, "It is very useful because we are catching all these criminals". That is very good; criminals should be behind bars, but that is not the stated purpose. Again, the stated purpose can be defined in terms of the subject: is it terrorism or the fight against crime or against infectious disease (which is another one which is now in the agreement with the US), or is it other things? Also, what is the kind of use they are making of the data? Is this for targeted, very concrete investigations into known suspects or known cases or groups of suspects? Are they actually looking for something or do they use the data for random, automated searches such as profiling and data mining? I always come back to purpose. If they say, "We need to violate your privacy for this particular purpose", then you can only measure the effectiveness against that. If they say, "We need these data in order to prevent terrorist attacks", they seem to suggest that by profiling and data mining they can prevent terrorist attacks. I am not a security expert but I have seen no evidence of that. For example, a couple of weeks ago we had somebody from the security of Schiphol Airport (which has its own security issues) and he said that PNR is useful for catching petty criminals and for very targeted specific searches. If you see someone and you think, "Hmm, there's something fishy here", then you may have access to their data, but that is a traditional method of investigation. Why would they need unlimited access to the whole database, data mining, profiling? For what outcome? Why do these data need to be stored for 13 years?
Q75 Chairman: We shall come to that. Before we get to it I think you talked about the UK Government and I think you were perhaps referring to a letter which was written to Mr Frattini by Meg Hillier. We will come to that in a moment, but, just going back a little, you made the point a second ago that Articles 1 and 11 limit the application of this proposal to combating terrorist offences and organised crime. Is it your view that it would be a mistake to use this information for wider law enforcement as well as immigration purposes, or do you think it ought to be confined, if it is to go ahead, to the business of terrorism and organised crime?
Ms in 't Veld: Let me make one thing clear for starters. Nobody in the European Parliament that I know is against the use of personal data for all sorts of security purposes, so using the data for those purposes in principle is okay, but it has to be clear from the very start what the data can and cannot be used for. The thing is that the proposal of Frattini very innocently says, "This is for the fight against terrorism and serious crime", which is already fairly broad, because we always think it is pretty obvious what that is, but it is not necessarily obvious. If you look, for example, at the definition of "serious crime" in Germany, it is very wide. It includes things that we would not consider to be serious crime. Terrorism as well: does that go as far as a terrorist act? It is using all sorts of different terms that might in some countries include, for example,—what do you call it, Sarah? Apologies—is that what you call it?
Q76 Baroness Ludford: We normally use "glorification of terrorism". It is very controversial, the definition of a terrorist act.
Ms in 't Veld: The thing is that if the data should be used for other purposes that should be said from the start, and if Frattini presents a proposal and says, "Don't you worry. We're not like the Bush Government. We will only use this for terrorism and serious crime". He really tried to reassure the Parliament, but fortunately minutes of secret meetings tend to fall off the photocopier. The first exchange of views that the representatives of the Member States had on the subject immediately opened up Pandora's box. They said, "We should retain the possibility of using it for all sorts of other purposes. We do not want to be limited to the defined storage periods. We do want to have access to sensitive data". There is also the matter of trust, I think. It is like the agreement with the Americans. I did not much like the substance of the agreement but, okay, at some point you can say we have at least agreed on something and they will stick to it and we can trust our allies or our governments to stick to it, but then every time you turn round they do something else. With governments too, if we are ever to adopt such a scheme and, to be perfectly honest, I am still not convinced that we should, the purpose has to be very clear from the start. Otherwise, if a citizen has a problem and wants to go to court, and he says, for example, "My personal data have been used for the wrong purpose", the purpose has to be clear; otherwise he does not have a case and governments will have complete freedom to arbitrarily use the data for all sorts of purposes.
Chairman: Let us talk about the UK experience.
Q77 Baroness Garden of Frognal: You have already alluded, I think, to the UK running Project Semaphore for three years, an e-Border system capturing PNR data. The data that they have captured on over 50 million passenger movements have generated over 21,000 alerts and contributed to over 1,700 arrests for serious crimes amongst others. I can pre-empt your reply, I think, but do you consider that this provides any justification for having more data captured than in the API system?
Ms in 't Veld: First of all, because I also read the report of the meeting you had with Ms Hillier and Mr Dodd and Mr Norris, I think we have to be very clear what we are talking about. I also met Ms Hillier two months ago, I think. There is still a lack of understanding of what you can and cannot do with PNR. If we catch criminals, yes, that is of course a very valid purpose, but again it has to be very clear from the start what you can and cannot do with personal data. In a democracy citizens have rights and they have a right to know what the government can do to them and what the government cannot do, and unless the purpose is defined in great detail from the start you have no means by which to hold government to account or to complain or whatever. Ms Hillier said at some point when we met, "But it is very useful. On the basis of PNR we have identified a murderer", or a rapist or something, "and he is now behind bars". That is not possible. On the basis of PNR data you cannot identify a person. You identify a person on the basis of API data, and I see in the report of this meeting too that all the categories or data are mixed up. People are not clear about what they actually are. API data are the information contained in your passport and some basic travel information possibly. PNR data collected by the carriers for the purpose of organising travel you cannot use for identification. In many cases, incidentally, they do not even have this information; they only have the information that people have volunteered. I think in the agreement with the Americans we initially had a set of 34 different data which were then merged into 19 but they were still the same data, but on average a PNR file will only contain about ten of those data. For example, if you have no special requests, if you do not pay by credit card, that is all not contained in the file, so they will simply not have that information. It is simply not true that you can identify somebody on the basis of PNR. I do not know about this particular case that she gave me but it shows that they are catching people on the basis of other indications, and that is also what she said in the hearing. The thing is, they have information on somebody or on the actions or movements of groups of people and then they can use PNR data to support their case, but that is a traditional method of investigation. There is no need to set up a massive database of the data of all citizens; there is just no need. Even security people agree on that. I have spoken to public prosecutors in various countries who say the same thing. As somebody put it, "It makes our lives more difficult because if you are looking for a needle in a haystack the last thing you should do is make the haystack bigger". For a targeted search, where other sources of information are also used, that is one thing and that can be extremely useful in seeking out the bad guys, but this massive, indiscriminate collection and use of data of all people and using methods such as profiling and data mining, no.
Q78 Lord Dear: I would like to pick up on that last point. The only justification, it seems to me, for huge data banks is that you can then go in and mine or data-profile, because if you are not doing that you are just holding the material and not using it.
Ms in 't Veld: Exactly.
Q79 Lord Dear: Thank you for coming. I am sure that everyone agrees with me that your views are tremendously refreshing and not altogether unexpected, and I think I know the answer to the question I am going to pose to you anyway. It is really about motor transport and the difference between air transport and road transport and rail and maritime. There is a suggestion that the UK wants to extend the proposal to allow the collection of all modes of transport, maybe excluding road but perhaps you would comment on that as well. I wondered if you could reinforce the views, and I know you have given them already, that if you only leave it with aircraft and do not apply it to all the other modes of transport it would not be effective and would not be proportionate. You have covered that in generality already.
Ms in 't Veld: Again, I am not a technical expert but the proposal for an EU PNR applies only to the regular flights, not to charters, for example, so there are already exceptions built into the proposal. That means that there are already holes in this security measure (or they pretend it is), and yes, there are all these other modes of transport. You could even quite literally follow every single move of people by using satellite surveillance. Google Earth is available to everybody. It is not science fiction; it can be done, but then you really have to ask yourself: what is the purpose? Does it bring what we expect it to bring? That is always the question. I will never take any principle positions but we have to look at what it is that we want to achieve and whether this is the right instrument. I do not think this is the right instrument, for the reasons that you have just stated.
|
