Examination of Witnesses (Quesitons 120-139)
Ms Cecilia Verkleij and Ms Despina Vassiliadou
2 APRIL 2008
Q120 Chairman: Can I just follow those answers up a little bit? You sounded to me as though you were giving a green light to Meg Hillier's letter to the Vice-President in that she was sympathetic to it, and you said earlier that the limitation which had been put into Article 1 of the Framework Decision was recognising the differences of opinion. Does that mean that you think you could get a better deal and a better result once the Lisbon Treaty is in effect rather than trying to drive it through between now and the end of the year, say, whereas you might then have the advantage of not having to go to co-decision? I can see that there are quite difficult tactical decisions to take here by the Commission. Do you leave it until next year where you can get a broader and more satisfactory outcome, or do you drive it through so that you can try and do it without having to achieve co-decision with the Parliament? Is that a fair assessment of the tactical options that face you?
Ms Verkleij: There are practical and tactical options which face us, the first one being that in the current situation we do not think it is feasible to rush 27 Member States into this proposal without thinking it through in all its detail. This proposal is quite challenging for the Member States in the sense that it should work operationally. It is very nice to have a proposal which on paper looks like you are providing the right set of data to law enforcement, but if it does not work operationally then we have done the wrong job. One of the issues on the table which has not been discussed yet, because we are only in the first reading, is, how the different law enforcement authorities in the different Member States will exchange information, which information they will exchange and how they will do that. Do we need a central database for this or do we need decentralised databases? These questions can only be answered when you know what kind of purpose the data can serve, and that debate is not finalised yet. My impression is, but, Despina, please tell me if I am wrong, that this may still need some time. We are not afraid of co-decision so we are not rushing anything through because as from 1 January we will have to face the Parliament. On the contrary, we love to have this debate also with the Parliament because, as you yourself already assume, it looks like Lisbon will give us a better deal. If that gives us a better deal why should we rush into something which in our view, and talking also to the operational people in Member States, would probably cause at the end of the day many more problems at the level of implementation because of having it rushed through. What we have already tried to anticipate are possible problems at operational level because it is one thing to legislate; it is another thing to get it implemented in 27 Member States. I do hope that answers your question.
Q121 Chairman: You say you are not afraid of the Parliament.
Ms Verkleij: Oh, no, not at all.
Chairman: If you had been here this morning, from what we heard you would have every reasons to be worried about the Parliament!
Q122 Lord Teverson: I wanted to follow up something you mentioned from Lord Jopling's question. One of the things I do not fundamentally understand here is who does all this data belong to? Does it belong to the Commission, does it belong to individual Member States that have collected it or does it remain with the airline companies? Also, what is envisaged? Is it one big database or is it 27 different ones, and who develops this and who pays for this and who manages this? Of course, when you get to that point you think, well, the legislative process, even if it was a hostile Parliament, would be the easy bit in comparison with the systems development. This Committee, as you know, has looked at Schengen II and Schengen one-for-all and all of those, and the time span tends to be such that maybe we will be in the next Reform Treaty before we have finished this database. I would be interested in your views.
Ms Verkleij: You can have as many Reform Treaties as you want. We can accommodate that.
Q123 Lord Teverson: We are promised this is the last.
Ms Verkleij: I see your point and that is exactly why we think nobody is for rushing this project through by the end of the year. That is not our aim in view of Lisbon. Your question is right. Who owns the data? For the time being, certainly not the Commission. There is no system up and running which is being managed by the Commission and we do not propose that in the proposal either. What we suggest are decentralised databases, which means that the data are owned by the air carriers as from the moment they receive the data from the passenger, so from the moment booking starts up till the moment that the data are transferred, either directly to the authorities of the Member States or via an intermediary. From the moment they are received by the authorities of the Member State the Member State will then become responsible for those data under law enforcement data protection provisions. That is how it will work. One of the issues on the table is, do we provide for a system which is a kind of one-stop shop where an air carrier entering the European territory would send the data to one address, or do we want the air carrier to send the data from a flight from Washington to Paris to the French authorities and from a flight from Washington to Barcelona to the Spanish authorities, and so on? Again, that is a discussion which we will probably only enter into once we have a much better view of what the purpose will be, because the purpose is defined also as how you are going to use the data for the needs of law enforcement. That has not been discussed fully yet and my impression is that it will be one of the most difficult issues to tackle.
Q124 Lord Mawson: Could you summarise the position of Member States on the scope of the Framework Decision and do you believe that extending the permitted purposes through the domestic legislation will give rise to questions over the principle of loyal co-operation? Would it give rise to other legal inconsistencies?
Ms Verkleij: I will leave the first part of your question to Despina who is in the lead in Council on discussing this with Member States.
Ms Vassiliadou: The discussions in Council have indicated that the majority of the Member States would prefer to have a wider purpose and they are talking about substituting "organised crime" with "serious crime" which would cover a larger majority of offences. That being said, I have to note that all Member States for the time being have scrutiny reservations, so one cannot take these initial positions as their final positions.
Ms Verkleij: As I said earlier, we are only at the first reading and we notice that quite a few Member States have made a general scrutiny reservation and are also waiting to get clear instructions from their capitals on some of the issues, including the permitted purposes, but there is certainly a willingness both by Member States and the Commission to dig into that issue because it is essential to what the system at the end of the day can deliver. We are very grateful to the UK for being so involved in that thinking from the beginning. Suppose that we could not accommodate all the UK wishes for this particular proposal, would we then not mind the UK going further domestically? I think we would. I think we would not be very happy if domestically the scope were wider. One has to bear in mind that one of the aims of this proposal is not only to identify and bar high risk passengers from entry into your country, but also to share some information about these people. Sharing information always has the component of trust, that the data you share do not end up somewhere where you do not want them to end up. If we all have the same purpose and if we all have the same set of guarantees that should work. At least you do not have an excuse to say the data I send you may be used for a different purpose or may end up in a database I do not want it to end up in, but if you allow a Member State to go further domestically this will be in the mind of the other Member States who need to share the data amongst themselves and, as I said, we have to bear in mind that this is a project for 27 Member States who may not always necessarily share the same opinion among themselves, particularly on the purpose. For that particular reason we would very much be in favour of ensuring that all Member States could agree on the purpose limitation, which would be a guarantee that would build trust once this system became operational and once they started sharing the data amongst themselves.
Q125 Lord Mawson: Can I ask you another question about this? Often in my experience politicians have all sorts of aspirations about what they would like to happen in the world, but we know from experience in Britain and elsewhere in using IT systems and data systems the realities of what they can and cannot do and how that works in practice can sometimes be altogether different. Who is advising you on the technicalities of what is possible and what is not possible and how it might work in practice, because sometimes the gulf there can be immense?
Ms Verkleij: Thank you for asking that question. We launched last year a request for a study on this issue in particular because we needed guidance not only on the question of the effectiveness of centralised versus decentralised databases but also on what IT can do and what it cannot do. From the operational point of view, so for law enforcement, and also for privacy implications, what can IT do to enhance privacy? Despina was the author of that project.
Ms Vassiliadou: As my colleague explained, we have launched a tender for a study on how technology can help and what it can and cannot do in this field. We have received the tenders. We have chosen one of the bidders and we are hoping to have the study ready within the next six or seven months.
Q126 Lord Mawson: Are the people tendering academics or businesses who run serious databases? Who are these people?
Ms Vassiliadou: The call for tenders was not limited to certain types of field, whether they were academics or businesses, but I can disclose that the bidder that has been chosen comes from the business side. It is a joint venture of companies that already have experience with such processes.
Q127 Lord Marlesford: Can I follow up that earlier question and your answer to it? Presumably there might be both operational and cost benefits in basing the new system on one that already exists, and the only ones I know of, and perhaps you would fill us in about others, are the United States, Australia, France and the UK. Other things being equal, would you prefer to base it so that it is an easy interface and you do not duplicate?
Ms Verkleij: For the time being we are aware of the US system and the Canadian one, and we are in negotiation with Australia and are trying to understand their system. The difference between the European Union and those countries is that the three all have federal customs which receive the data from inbound and outgoing flights. We do not have federal customs in Europe, so to us there is still a choice to be made between a central database or decentralised databases. In terms of the technology, the US, Canadian and Australian systems are all different, and it never ceases to amaze me how different they all can be. It is a debate which we never really went through in detail because in the negotiations we had with the US and Canada, and also in the current one with Australia, we do not think it is appropriate that we tell them what kind of technology they should choose. That is their choice. We are interested in the purpose for which they want to use the data, the guarantees they want to agree upon and issues like a regular review. Apart from the issue of whether the data should be pulled from a database or be pushed by the air carrier to the law enforcement authorities, we did not really go into very detailed debate on how to build an IT system It is an issue for which we have launched the study in order to get a better picture. It is also an issue for the air carriers, of course, because each time they have to accommodate different systems, so it will become an issue at some point in time. What we try to do is make life for air carriers easier by providing them with the possibility to choose an intermediary. For example, take air carrier A, which already has to send data to, let us say, Canada. In the Canadian case there is already an intermediary which takes up the function of reformatting the data and filtering the data to which Canada should not have access, and they send it in a certain format to the Canadian authorities so that it is easily accessible to the Canadians. The air carrier could use that same provider in order to meet the requirements later on of the European authorities, and that in our view is a way of facilitating and accommodating part of their concerns and also making it less costly. That choice is being provided for in the proposal. Again, that will feed into the debate on the IT system and on a centralised or decentralised database. We try to the greatest extent possible to make the issue as workable and as operational as possible. Of course, we are not IT experts and IT development sometimes goes so fast that if you have identified a certain system it may be outdated in five to 10 years' time, so you have to be very careful, but it will be very much on the agenda at a later stage during the discussions.
Q128 Lord Marlesford: I was not, of course, suggesting that the EU should tell the countries which have already got systems what IT system to use. I was thinking of building on success, if there is success, in those countries and if there is a common factor. Of course, the other country which I am aware of which certainly has had very early on an extremely effective e-border system, not PNR as such, is Hong Kong. Have you had a look at Hong Kong?
Ms Verkleij: We have heard about Hong Kong and I think also Singapore was mentioned at some point in time as being one of the newcomers.
Q129 Lord Marlesford: Hong Kong is not a newcomer. They had a system before the British in 1997.
Ms Verkleij: That is very good to know. We will certainly, when talking to the persons who will provide the study to us, raise these issues to make sure that they look at as many systems as possible that are up and running and that provide what they should provide.
Q130 Lord Mawson: We spent quite a bit of time developing a national IT system, so I am very conscious of the practicalities involved in this, and one very quickly discovered that actually IT is just a tool and behind all that it is ultimately about the relationships between the individual companies and the people who are running a particular aspect of it. That is the key to making it work or not work. I just wonder what you are doing or are going to do to ensure that those sorts of relationships work because that is the thing I would be looking for if I were doing your report.
Ms Verkleij: You are right, and that is why the IT discussions should not be too early in the overall discussion, because you need to find out first about those relationships before you decide on the IT, because the IT is indeed a tool. It is not the solution to the problem in the sense that it provides you with an answer on whether the system should be centralised or decentralised. That is not going to answer those questions. You have to answer the basic questions first before you can design the IT which you think should provide you with the answers to your issues; you are quite right.
Q131 Lord Dear: Before I get to the point I particularly want to raise, can you clear up a point you have already touched on in terms of definition of terms? As I understand it, there is no set definition of, say, terrorism or what is serious organised crime. Am I right in thinking that?
Ms Verkleij: Yes.
Q132 Lord Dear: Different countries could have slightly different terminology?
Ms Verkleij: Yes.
Q133 Lord Dear: And that could lead to whole swathes of criminality and serious offences being included or excluded, depending on how it works?
Ms Verkleij: You have touched upon the central point. In a couple of our instruments we talk about terrorist offences or serious crimes, for example. One of the things we try to aim for is at least to make Member States aware of what I mentioned earlier, this list of serious crimes in the European arrest warrant, because that gives us a very clear picture of what we all understand as serious crimes. When you look at that list it starts with what you would normally refer to as organised crimes—human trafficking, drug trafficking and so on, but often, the Union being what it is, the actual definition of a serious crime is left to the Member States. We have such an example in the Data Retention Directive where telecom data retained for use by law enforcement agencies is related to prosecuting serious crime, "serious crime" defined by each Member State. You are right; we do have instruments, as I said, in the European arrest warrant, where we have a list, but it is not exhaustive and it is not binding, which does not make our lives easier. In particular it does not make life easier, certainly not for law enforcement, when you look at cross-border exchanges of information.
Q134 Lord Dear: The Council puts an obligation on carriers, as we all know, to send information through. That has been in force for a year and a half by and large. Have you had any assessment at all on the use of API data to combat illegal activity that would substantiate the need for additional data?
Ms Verkleij: As you rightly mention in your question, that instrument is related to what we call API data, and API data are a particular set of data. We normally refer to them as passport data because those are the data that are requested to be collected by air carriers. In addition, there are a number of data about the crew and about the flight but those are data which they normally request not from the passengers but from the airlines. In the directive, as you may recall, the set of data are listed and also the purposes for which they are being requested. The deadline for implementation was 5 September 2006. Not all Member States have implemented the directive and their failing to do so means that we do not have a clear view yet of how the data are being used by Member States and how efficient and useful they are for the purposes for which they are being collected. It is unfortunately too early to say yet how Member States are using these data. Our colleagues who are responsible for this directive are looking into this and are identifying the Member States who are late and who have already been given a warning that they should speed up their domestic procedures.
Q135 Baroness Garden of Frognal: You have already answered the question on whether all Member States have implemented the directive, and you have said no, they have not done that and you were following that up. Has the Commission taken action against any Member States?
Ms Verkleij: We always take action. The first action we take is when Member States have not notified the national measures to the Commission. As from the date of expiry of the deadline an infringement letter is sent to the Member State reminding them of their obligation under the directive to notify national measures, and that is always a moment in time where Member States tell us either they have forgotten and they promise to send the national measures as soon as possible or that they are in the process of doing it, and some also inform us why they are late and that the proposal is standing before parliament and that a couple of procedures will have to be dealt with before the measures can be adopted. It varies according to the Member State but that is a standard procedure which we always start, I think, one month after the deadline has expired. That is then followed up with the Member State. Depending on what they have told us, if they are pretty well advanced in the proceedings before the national parliament we may not always consider it necessary to go for infringement proceedings but instead encourage the Member State to make sure the national measures are being implemented as quickly as possible. It also allows us to identify with Member States whether there may be common problems. It may well be that there is a particular issue on the table which we have not addressed at an earlier stage and which merits a meeting with Member States to guide them through that process.
Q136 Chairman: With a month's grace and six months that takes us to today, near enough. How many states have you written infringement letters to and who are they?
Ms Verkleij: I shall have to ask my colleagues but I can provide you with that information.
Q137 Chairman: Can we have that please?
Ms Verkleij: Yes.
Q138 Chairman: How many, roughly?
Ms Vassiliadou: The large majority of Member States have already enacted legislation domestically for the collection of data.
Ms Verkleij: Two-thirds?
Ms Vassiliadou: It is more than two-thirds. I think it is only two or three Member States that have not yet enacted legislation but most of the systems are not operational yet. This is something else. It is the second stage that we are looking into.
Q139 Lord Dear: Can I change the focus to PNR information? As we all know, that is very much in the frame for air travel, but I wondered if you had any views about its extension to other forms of travel, particularly maritime and rail, and whether, if it were left just with air travel, that would be proportionate and proper.
Ms Verkleij: We have proceeded with an impact assessment which has preceded the proposal, and one of the questions on the table was exactly the scope of the proposal in terms of the different means of transport. We have chosen air deliberately, first of all because we have some experience with that.
| 
