Examination of Witnesses (Quesitons 140-159)
Ms Cecilia Verkleij and Ms Despina Vassiliadou
2 APRIL 2008
Q140 Lord Dear: Because of the USA?
Ms Verkleij: Exactly, and Canada, but also because the information which we receive on a regular basis and which is concerned with security issues indicates to us that the collection of PNR data is most effective for air transport. We had to make a choice. We have to put forward a proposal for 27 Member States where the vast majority for the time being have no experience at all with this; it is new to them. It is new to the European Union to set up such a system, so we want to be both ambitious and moderate, ambitious by proposing a European system and moderate by limiting it to incoming and outbound flights.
Q141 Lord Dear: From outside Schengen?
Ms Verkleij: Incoming and outbound flights, not including intra-EU flights or even domestic flights, and that is because we think the case for PNR can be made for those kinds of flights and where we have a real security problem to face. Having said that, it may well be that some Member States identify that they may have a security problem, let us say, with certain maritime links. In particular in the south of Europe you may argue that there is a competition between certain maritime links and air routes in terms of the choice to be made by a customer. That is very likely also because of the short distance between Europe and North Africa.
Q142 Lord Dear: Morocco to Spain would be an example?
Ms Verkleij: Exactly. You may say it is a choice between taking the boat or taking an aeroplane. If those Member States concerned, one or maybe two or three, think there is a real issue there they can deal with that issue. The proposal would certainly not exclude that and would allow them to implement domestic measures which should take care of security concerns, for example, by asking any maritime operators also to collect this kind of data. For the time being the collection of this kind of data is pretty limited in the maritime sector, which is another reason for us not to go European-wide yet. We can go European-wide with air because the air carriers are already collecting the data, so you feed into current practice but add other purposes for which the data will be used. That is why we have limited ourselves for the time being. That does not exclude at a later stage, if we think there is added value for Europe, taking that further step into maritime and maybe also rail, but it already looks difficult enough to come up with a proposal that will work and be up and running among 27 Member States in the area of air, so we thought it better to limit ourselves to air for the time being.
Q143 Lord Dear: Would that extend to road travel as well? I do not know whether you get much travel, say, from over the Turkish border into Europe, but, assuming one did, the occasional coach party and certainly lots of trucks use it, logically would one extend it to that as well?
Ms Verkleij: That depends, I would say. One of the issues which is extremely important in this whole debate is, do you have a security issue? If you have, what does it look like, because security issues also shift over time so you have to see if these are security issues which are likely to stay with you for, let us say, the coming 10-15 years so is it worth investing in equipment to collect information? The second issue on the table is which kind of information would allow you to tackle those security issues? PNR is certainly one way which is acknowledged to be extremely useful for the airline industry, and maybe also for maritime. I am not so sure whether it would work for road, one of the issues being that you need to collect the data a bit in advance in order to allow law enforcement some time to analyse it. There are a few other issues, such as the quality of the data, which kind of data, the purpose for which they are needed, do I get them well in advance, can I share them, which all enter into the debate and which at the end of the day then define the choice of the data. PNR are important and they are one of the sets of information which law enforcement should have at its disposal. I would not exclude that maybe for road we could identify information which may give the same results or even better results and are maybe less intrusive on privacy but could still give you the tools for the security you need.
Q144 Lord Dear: This is not a question but an observation. If I were seeking to penetrate any country in Europe and I knew that there was for me a difficult hurdle to cross using an airline, I would immediately go to maritime or road. I would search for the weak link.
Ms Verkleij: You have a point. That is exactly why when we limited ourselves to air we wanted to cover all the Member States, because it would not look very clever to have a loophole over there. You are right. The fact that we do not also cover maritime, rail and road does pose security issues. On the other hand, you have to take measures step by step. If we were to go for the big bang we might end up with nothing after five or 10 years' discussion because one could imagine that if you went for a huge project, including these modes of transport, it would pose huge challenges in terms of how to organise that, not least because you have to bear in mind also the impact it may have on installing something that looks like border control but is not and how to organise this in a practical way. I think we would probably over-stretch ourselves. Having said that, PNR is one of the means of allowing law enforcement agencies the necessary information to do their job and they are aware of the fact that if you cover a certain mode of transport with one instrument it may lead to people behaving differently.
Q145 Lord Dear: Displacement?
Ms Verkleij: Exactly, and that is being monitored. For example, it has been monitored that the extension of Schengen has already led to a change in smuggling routes, and that is only one month after the entry into force of the wider Schengen area, so these issues are being observed because law enforcement agencies know it will have an impact. If, for example, our proposal had an impact on the use of the maritime route of transport and Member States thought that that impact was sufficiently important for the European Union to act, we would certainly be looking into that but they have to make a case.
Q146 Lord Dear: I think I can guess what your answer would be, but I just want to move the focus very slightly onto possibly having the same sorts of controls within Schengen, and even within a Schengen country, not crossing a national border. That is perhaps well into the future but do you have a view about that?
Ms Verkleij: Legally we could do it because we propose is not Schengen related. We are not covering immigration and border control issues. We are looking at data for security issues.
Q147 Lord Dear: It is a form of control though, is it not? It is a form of surveillance.
Ms Verkleij: Yes, it is a form of control, that is true, but it is not border control. You could argue, legally speaking, that we are not installing border controls, so we would not violate Schengen, and Article 21, I think it is, of the Schengen Convention is not applicable to police activities, but in reality what does it look like? That is the problem we are facing. Again, on paper you could argue with everybody that we are not violating any European rules but if you are being stopped somewhere in France and you have to provide a certain set of data, I think that to you it may feel like you have got a border in the middle of nowhere with the aim of controlling you. That is a very difficult debate. We did not want the proposal to wait for that debate because there is a security issue out there and I think we have to tackle that now and not in five or 10 years' time when maybe we have an answer to that issue. Again, this is also something which is very much linked to Lisbon, as you rightly said earlier. I think Lisbon gives us more possibilities to look into the wider issue of using different sets of data for a number of different purposes and how to fit them in. There are discussions not only on API data and PNR data but also with our US colleagues on what we call the electronic travel application. We have visa discussions. There is a lot going on in these areas.
Q148 Lord Marlesford: Can I come in on a supplementary to Lord Dear's question? Given that Schengen came in about 10 years ago or plus, if it did not exist, and given today's climate of crime and terrorism and all that, would you introduce it?
Ms Verkleij: I have not given a thought to a non-Schengen area, frankly speaking. Schengen is so much in our minds, in our thinking, and also having to address many difficult questions in the proposal, frankly speaking, we have not given that much thought to it because we have not much time to dig into all the aspects we would have to look at, but giving a thought to it now, I think I only can say maybe. I cannot say more than that.
Q149 Chairman: I would also like to ask a follow-up to Lord Dear's question, which follows on from our witness this morning whom I referred to. She said, "We have asked the Commission for details of all this. We have asked in particular what is the purpose of this initiative". Perhaps I could put it in a way she might have sympathised with, that here you have a proposal which, as Lord Dear has pointed out, is full of holes; it is like a sieve. If you had a terrorist or a trafficker who made a study of what was going on it would be the simplest thing in the world to circumvent it. You would not use an airline; you would come by car or you would use the train if that were possible. You would not come regularly. You would do it in a cleverly constructed way of avoiding being caught up, and therefore—let me put the question to you—what is the purpose of doing this? It seems to me that anybody with their wits about them can so easily circumvent it and so is it worth the bother and the expense?
Ms Verkleij: Thank you for the question but that to me begs a counter question, and Sophie is not here. That takes as a presumption that PNR solves everything and that is simply not the case. PNR is an additional tool, additional to the API data, to the visa, to other information, the aim of which should be to fit them into a jigsaw puzzle which we then present as tools to law enforcement next to other instruments which should allow law enforcement to look at particular ways of people entering our countries. We have never claimed, and I am sure that Ms in't Veld would agree with that, that our proposal would solve everything. It is aimed to do what it wants to do and that is to give law enforcement information which it does not have at its disposal now for particular modes of transport in addition to already available data. It is meant to strengthen i.e. fill in existing loopholes, not to create loopholes. It would mean in that kind of thinking that Parliament would very much be in favour of asking PNR data for maritime, for rail, for road, for everything, for having controls everywhere. I am not so sure whether that is in the mind of the Parliament but we are happy to discuss that. Again, we are not starting from scratch. We are not in a world where law enforcement has no information at all and the Commission certainly does not come with a proposal and says, "This is the panacea to all your problems", because it is not. It provides a very precise set of information of which is already known that it fills in a gap in intelligence which law enforcement gets by identifying passengers through passports or through the API data so that when you present yourself at the border they know you are indeed the person you tell them you are, and linking that into your flight arrangements and maybe as a result of looking at additional information, so you have a whole set of information out there. The interesting issue of PNR is that it links, let us say, the API data and other data in a way which certainly then gives a clue to law enforcement, but again it is only a part of a much wider set of information. We are not creating loopholes. We are adding information which at the moment is not at the disposal of law enforcement. I do hope that alleviates a little your concerns about creating loopholes.
Chairman: I see what you mean. Lord Dear, have you completed what you wanted to say in this section?
Lord Dear: Yes. I have got this mental picture of plotting an offence against the Belgian state and how I would do it, and I can see a lot of routes available. Thank you very much.
Q150 Lord Marlesford: Article 3(5) allows data to be used to create risk indicators. To some extent that could be said to involve passenger profiling. Passenger profiling is controversial. To put it very simply, I suppose the argument for it is that with limited resources you focus them on limited law enforcement, and also if you are trying to catch the bad guys you want to do it without hassling the good guys. Against it, of course, there is the suggestion that passenger profiling can create what one might call prejudicial discrimination. First of all, do you agree that the provisions of 3(5) will result in passenger profiling and, secondly, do you have a problem with it?
Ms Verkleij: We have had this discussion to some extent in the LIBE Committee in Parliament with Baroness Ludford, who asked us what the definition of "profiling" was in the European Union, but we do not have one. There is no Commission definition, there is no European definition either of what profiling is. The great advantage of PNR, and our UK colleagues who are responsible for Semaphore, explained that very clearly to us, is that it allows you to move away from looking at somebody at the border and thinking, "He or she may be a threat", and on what basis you define that. They explained to us that in their system each law enforcement authority defines the risk indicators according to the type of crime you are looking at, so each type of crime is based on what you may call certain behaviour, say, paying cash, taking a certain route, travelling together or travelling alone. The more precisely you define these indicators the more targeted you can be because it allows you to feed into the system very refined risk indicators which you then match against PNR and that then allows you to get a view of people. It is true that PNR data to a large extent are behavioural data. You may say that that looks like profiling. For example, a marketing company may look at the way we behave in the sense of do we buy certain products at certain shops at certain times, and how expensive are the shops? That is also a kind of behaviour. You may call that profiling but I do not think that is the issue. The issue to us is, have we identified the right set of data which allows us to identify high risk passengers? These risk indicators, as we call them, being based on intelligence, information, facts, should move you away from looking at the person at the border and saying, "That person looks a bit risky to me". It takes you away at least from profiling not based on underlying factual information, which could be every profile. We ourselves in some instances, travelling through Europe together have been subjected, I would say, to some profiling where at some instances they took a very long look at my colleague and not at all at me, and vice versa, and we said to ourselves, "Both of us could have been equally dangerous". I do not think it gave the guy at the border any clue by just looking at us. That is exactly what we want to avoid, that their decisions are not being taken on the basis of facts which are fed into a system and which help law enforcement and in particular the people at the border to identify the people at whom they should have a closer look, because that is what it is at the end of the day. It does not identify you as somebody who indeed poses a risk but who may pose a risk, and on the basis of additional information they try to find out what kind of person you are and what intentions you may have. I think the proposal itself excludes using data which are based on religion, race and ethnic origin. The proposal expressly excludes that because we do not think that kind of information serves the purposes of the instrument.
Q151 Lord Marlesford: But when you implied that it would be a substitute, are you suggesting that experienced immigration officials, not unlike experienced customs officials, who do have a sixth sense and can sometimes identify people should then not be allowed to do this, because it seems to me it would be much more sensible to say that the new system would supplement rather than be a replacement for the way they do it now.
Ms Verkleij: I would say it supplements. The US has given a very nice definition of what PNR is. They call it a "decision support tool", and that is exactly what it is. At first instance it allows you to go through a whole list of passengers and say, "Okay, where are the matches against my risk indicators?", and then the human being comes in and looks at those particular cases with his or her experience, asking for additional information, and if that, on the basis of that information, triggers an alert, as Semaphore calls it, then there is the need to talk to that person and have a closer look. But you are right: the human intervention is there and should always be there and it is even a privacy requirement. It is an issue which serves both law enforcement and privacy because, as you say, of course, the trained officer with a sixth sense will also know which questions to ask and which additional information to look for. Privacy tells us that you never should have a system where a decision is taken purely on the basis of what an IT system tells you. The two meet together and I fully agree with you: it allows you to concentrate better on certain passengers and also to concentrate your resources better on who you think should not enter your country.
Q152 Chairman: Can you just go a little further? You talk about indicators. How are they arrived at and who defines them?
Ms Verkleij: They are being defined by the law enforcement authorities and they are being defined on the basis of regular reports they get, and the reports are related to the types of crimes that are committed, so they get reports on drug trafficking, on human trafficking and also trafficking in minors. One of the specific features of our proposal is that we have added six additional PNR data elements to the list, which are to focus on minors travelling without either parents or others, because one of the issues which is of growing concern in Europe is trafficking in minors. It is also a particular concern of Vice-President Frattini, who is focusing his policy also on children's rights, so it is very much at the heart of his policy. These risk indicators are being defined on the basis of what intelligence tells these law enforcement authorities, defined according to the kind of serious crime you are looking at. It is also based on past experience, and the PNR feeds also into the system because the PNR tells you at some point in time certain patterns, be they travel patterns or other ways of behaving. It means that the risk indicators do not stay stable over time. They need to be updated on a very regular basis. I recall going through the transcript of your meeting with your Minister, and she gave the example of a certain type of passport which was being looked at during a couple of weeks on entering a particular country because law enforcement had information that quite a few of those passports had been forged, so you see it means that the risk indicators have to be updated on a very regular basis, showing that indeed these are the issues we should look at.
Q153 Lord Mawson: Do you know whether the profiling of passengers under the Framework Decision would raise constitutional concerns in any Member States?
Ms Vassiliadou: I can say that during the discussions in Council no Member State raised concerns, so we are not aware of and have not been pointed to any such concerns—a short reply.
Chairman: A short reply and very much to the point; thank you.
Q154 Lord Mawson: The UK believes that sensitive personal data are useful and would like the processing of sensitive personal data to be allowed under the Framework Decision, subject to specific data protection safeguards. What is your current position on that and what do you believe should be the specific safeguards in place?
Ms Verkleij: We have been very strict with our proposal. Again, bearing in mind the different sensitivities of different Member States on these issues, we had quite long discussions when we negotiated with different countries on these issues—how far should we go, what should we allow third countries to receive, and in particular sensitive data were part of that discussion. There are a number of Member States which share the opinion of the UK that it may be worthwhile to be given the possibility to use sensitive data. We for the time being still need to be convinced of that. We are open for discussion, for contemplating whether sensitive data could be useful, but there is a case to be made because sensitive data are a particular set of data within privacy and you need to argue your case a bit more strongly compared to other types of information. It cannot be entirely excluded but Member States should tell us precisely why they think they need the data, which kind of data they need, for which very specific purpose and what kind of guarantees they have in mind. That is the kind of debate we are open to, but they need to make a case.
Q155 Lord Teverson: One of the things that came up in our earlier meeting with Sophie in't Veld that seemed to some of us as also important in relation to the American agreement was how on earth, in a parliamentary democracy (or at least in America's democracy), once these systems arrive, you can evaluate them in terms of cost/benefit, in terms of whether the Member State or the Commission are keeping to the rules with regard to data and whether the results of this in relation to decreasing organised crime or terrorism or whatever are happening. How do you do that because as soon as governments and maybe executives like the Commission have got control of this they naturally do not like being accountable to parliaments and in this area they can say, "Sorry, we cannot give you all that detail because it would prejudice national security"? In terms of safeguards, how do we safeguard democracy and parliamentary accountability for this sort of system within Europe?
Ms Verkleij: I tend to disagree with a position which says that governments or the European Commission are not accountable for this sort of thing. It cannot be the case and it is not the case, and we do see that also in national parliaments. You need special provisions for making sensitive information available to Members of Parliament, so you need special procedures, you need special guarantees. When we discussed with the European Parliament, for example, actual cases which are the result of the use of PNR data, this is law enforcement sensitive information. It should not be withheld from them in discussions but we cannot discuss that out in the open because it may reveal certain information which may make it very useful for those out there who try to circumvent the system. It may be that we still need to work on establishing a closer working relationship with the European Parliament but we have already had meetings with the Parliament. In particular I recall one meeting in June 2005 where Ms in't Veld was present when the then acting Under-Secretary of the US, Randy Beardsworth, came over from the US to show a selected group of the LIBE members actual cases dealt with under the US/EU PNR agreement, and he had with him an assistant who showed us the cases. We could not make copies and we could not keep that kind of information but we were allowed to have a look at that information, and we were allowed to have a wider look at that information a couple of months later when we went to the US for the joint review, so there are ways of organising yourself to get a much better picture of how it actually works. There is a working mechanism of oversight in the different agreements but it has its limits. It has its limits because at the end of the day it contains information which is very law enforcement sensitive, but it does not mean that we cannot talk to our parliaments; it does not mean we cannot talk to the European Parliament. The European Parliament, for example, was given a copy of the full report of the 2005 joint review where we described our findings. The findings are the public part; everybody can read our findings, but the information on which the findings are based is classified information because there you will find details on how the US system functions. There is no reason to exclude parliaments from this kind of debate by saying, "This is very sensitive information", but you need to handle it with care and provide certain guarantees.
Q156 Lord Teverson: Could you identify a best practice worldwide for this at the moment?
Ms Verkleij: I think that would be difficult because we all have our perceptions of what we could and could not say in the public domain. Even within the Union there are differences in terms of how far our transparency regulations should go. It is a bit difficult to identify overall best practice and it may even differ from one kind of information to another. However, I think there is an overall necessity to provide certain guarantees so that there is democratic oversight and also that there is oversight over the programmes in terms of efficiency. This is always a general law enforcement issue because how do you demonstrate the efficiency of your system? How do you demonstrate that because of, for example, a PNR system fewer terrorists are tempted to travel to your country? How do you know? How do you know indeed how many terrorists have any intention to travel to your country? I do find that kind of debate very difficult.
Q157 Lord Teverson: But you have some of the best brains in the world in the Commission. That is what we pay you to do.
Ms Verkleij: I will certainly pass on that compliment to my colleagues. There is one limitation which we face and that is that we are not in intelligence. That is outside the scope of our activities and that means that there is a certain reluctance also within Member States to give us intelligence, but it is part of how the Union is set up. You do get information but we also ourselves have to ask for information and that is what we provided in the agreements with the US and Canada, oversight mechanisms, and we will also provide one in the Australian agreement so that we can go over with a team composed of different people with different expertise and see how it works.
Q158 Lord Teverson: I have forgotten on this particular Framework Decision—is there a mechanism for oversight within this decision at the minute?
Ms Verkleij: Do you mean our own European PNR proposal?
Q159 Lord Teverson: Yes.
Ms Vassiliadou: Yes. There is a review section where the whole proposal will be reviewed in three years from the deadline for its implementation.
Lord Teverson: I will have to re-read it. I apologise that I have forgotten.
|
