Examination of Witnesses (Quesitons 166-179)
Mr Peter Hustinx, Mr H Hijmans and Mrs A C Lacoste
2 APRIL 2008
Mr Hustinx: Left of me are Mrs Lacoste and Mr Hijmans, both Legal Advisers at the EDPS Secretariat.
Q167 Chairman: You have said in your Opinion that, while the purpose of the draft Framework Decision is clearly limited to preventing and combating terrorism and organised crime, the means used to achieve this purpose "leave room for discussion". Could you tell us what you meant by that?
Mr Hustinx: That latter part was an understatement and the first part was a positive remark that there is no discussion in my mind on, say, combating terrorism and organised crime, although we are used to purposes like this including all other serious crimes and then we end up with a range of purposes. Here we noticed a quite clear focus, but with a purpose only the proposal is not fully satisfactory. We have made this comment in the context of the part which is on legitimacy and there we found quite a lot of unsatisfactory elements. If you analyse the proposal, as you and we have done, the heart of the matter seems to be about collecting as many data about travellers as possible with a view to developing risk assessment. That is an important emphasis, and that is not with a view to combating terrorism, identifying whether this person is on a list and whether this person should fly or not, let alone on a list of wanted terrorists. This is about data concerning all travellers in and out of the EU with a view to risk assessment. The criteria regarding the standards and methods used were unclear and are still unclear, so you will find some reflections on this particular tool. The Opinion says that basically it is a proposal in layers. The purpose is in layers. It is all about this particular tool and it seems to involve a lot of information. All the issues we have raised in that context are about the tool. There is an issue, and maybe we will come to this, as to whether these data may also be used for other purposes, but I have accepted for the time being this particular targeted purpose of combating terrorism and organised crime. What I found worrying was that the evidence to support the need for this particular tool was very scanty; it was anecdotal; it was by reference, and the proposal we looked at—and I want to emphasise that we have analysed the Commission proposal dated 6 November and its related documents, impact assessments and things like that—did not contain a convincing need. The issue of proportionality was dealt with in an unsatisfactory way, so all the usual tests which the case law of the European Court of Human Rights applies to see whether a particular proposal is in line with Article 8 of the European Human Rights Convention were quite unsatisfactory in relation to the purpose specification. Once you go beyond the mere statement that this is for combating terrorism and organised crime, the relation between the means and the purpose, the safeguards and the precise descriptions, is a citizen able to predict what will happen to his data? Not at all at this stage, and so we say leave room for discussion. The Opinion is making that point very clearly.
Q168 Baroness Garden of Frognal: What objections do you see to Member States making use of PNR for wider law enforcement and for immigration purposes and what would the data protection implications of that extension be?
Mr Hustinx: That is an important issue and I see problems if the answers are not satisfactory. It is an important issue because the purpose specification is the key element in making a particular proposal legitimate under the human rights standards, but is also the pivotal element of any data protection arrangement if you want to make the safeguards appropriate. Therefore, if collection of data for a certain purpose is acceptable, it is a separate issue whether these data are then used for other purposes and, if so, whether these purposes are compatible and, if they are incompatible with the original purpose, whether an additional test is fulfilled, a test which is in data protection law and which is an international test, and it is a separate step in the analysis. Let me approach this from the other end: we have the data so we might as well use them and why should we not use them if it is efficient? That is not the kind of thinking which I subscribe to. I can imagine a case for that being made and then my answer would be that under these circumstances we should be paying attention to the criteria under which this kind of efficiency is acceptable under the existing human rights standards, and all that was not in the proposal. In fact, the Commission did not open the box for use for other purposes, although I know the Council is discussing some of this. Under the existing rules (all members of the Council agreeing before there is a decision and in the future a majority agreeing before there is a decision) "used for other purposes" is problematic if it does not fulfil all the requirements. This is all the more relevant if the purpose analysis is part of an invasive technique. If you accept something on, say, an anti-terrorism pretext, the result of these invasions should then not be used lightly for other purposes because we did not lift the bar to that level to make it easy for all other purposes. This is the kind of thinking, not to make it difficult for law enforcement; that is not my intention, but we have been applying the tests to see whether this proposal met the standards which the Commission subscribes to in its official policy and its impact assessments, and this is what the Opinion is doing.
Q169 Baroness Garden of Frognal: Could I draw you specifically on the letter from the UK Home Office Minister to Vice-President Frattini where she argues the case that Project Semaphore actually produced results and therefore it was a useful use of PNR for other purposes? Does that in any way influence your argument?
Mr Hustinx: With your permission, my Lord Chairman, I think we are at a point in the discussion where I have to make you aware of some of the limits. First, I do not have the letter; it has not been sent to us, although if it is an interesting letter I would love to read it.
Q170 Chairman: Do you want to adjourn for two minutes to read it?
Mr Hustinx: No. I think I can comment without reading the letter. Maybe that is even better. I can imagine a stakeholder of PNR arrangements (and it is your responsibility to see whether you find them appropriate) writing a letter with flying colours to convince not only the Commission but all other governments represented in Council, so I would rather be struck by a lack of evidence than by the glowing language being used in it. If I were to analyse that, I would say how precise is the language, so maybe you should ask how precise is the language? Is it, "We find it very useful"? We are struck by one element, a lack of precision when it comes to combating terrorism and how effective this means is in terms of terrorism, and this applies to the US experience and the Secretary of Homeland Security has been speaking on this in the European Parliament. He was careful to annex a list of some 20 or so examples to his speech and it was all about drugs and people evading paying taxes and things like that, but there was very little in terms of precision on terrorism. Maybe that is not possible in this area but, of course, it complicates matters if you want to build a focused tool and measure whether this is legitimate, so I am afraid we are left with exactly this point. We have the Advance Passenger Information system. That is identification information, basically, but the key issue is whether the additional invasion from a wide-scale PNR system is appropriate and necessary. I think Member States represented in Council will also find that puzzling, some more than others, and there is an ongoing discussion on this. I think that is appropriate and it should proceed, but so far I have not been presented with convincing evidence that such a system is necessary, and if we look, for instance, at the report of the US GAO, the research bureau of Congress, that also raises issues which we find quite worrying.
Q171 Chairman: Can I try and sum that up by asking you whether, in terms of your current attitude about this proposal being unsatisfactory and unclear, this is typical of proposals put up by the Commission or the Council, that after its first form as an embryo, if you put it that way, as it goes through its development and discussion it becomes less unsatisfactory and more clear? Is this a typical situation with a new proposal as far as you are concerned?
Mr Hustinx: No, I do not think it is typical, but it happens and it might have happened in this case. It may happen in this case. It is not typical because we are at the stage when a proposal is sent for official comment. We get proposals for informal comment and that is part of the thinking process. Some are more convincing than others, but this proposal, which was exceptional and very atypical, generated my first Opinion which was plain negative. The others have been critical but this was very negative. The language was non sic, not in this way. The legitimacy is, in the end, with some room for discretion, a political question in the purest sense of the word. This is why the Opinion moves beyond that point and says, "If you think all these questions have been answered satisfactorily, you should provide verifications on applicable law, more precision and more safeguards". I can imagine a scenario where, if the Council were convinced on the first issue, progress could be reached by adding more specificity to the proposal, but under current rules that happens by unanimity; otherwise there is no decision. This is difficult to predict but my sense is that this will take more time. This is a proposal which eventually needs to pass the test to convince both Council and Parliament, and from my point of view I welcome that because usually co-decision, with all the consequences, is a safeguard for better decision-making with Parliament as a strong stakeholder of fundamental rights protection, but the Committee of Civil Liberties, Justice and Home Affairs is also very much aware of the need for law enforcement. This is just a hypothesis and it may well be that in the course of time things will go better, but I still find it worrying that we have not heard a convincing story yet about why it is so useful.
Q172 Chairman: What efforts have been made by the various parties of the Commission and the Council to enter into discussions with you to try and clarify the situation and, bearing in mind that this issue looks as though it is going to go to co-decision, have you started having discussions with the Parliament about it?
Mr Hustinx: It is normal that EDPS opinions are presented in Parliament. I take part in discussions in the LIBE Committee. This Opinion will not be an exception, I think. The Parliament will have a hearing soon, so that process is ongoing. As for the Council, I had the pleasure to be able to present this Opinion last week to the working party in charge, and we then also observed part of the following discussions in a more limited group where the evidence and the experience were being shared, and up to now the information we have is that discussion is taking place. My impression is that some scope for improvement is being used, particularly by adding safeguards, but the convincing case for necessity and proportionality has not been made.
Q173 Lord Dear: I have a couple of questions which I am quite sure you will answer very quickly and that is fine, but if I may I would like to continue this current theme because I confess to being confused. Let me explain why. There is a body of thought that says the more information you can get in the better, from airlines, from wherever. We can put it all into a database and we will therefore have available what the normal traveller looks like, what their patterns look like, and we will then feed against that the profiles of individuals travelling on this particular day. Most of them will fit the average but some will not and it is the ones that do not that we will be interested in. I am over-simplifying it but you take the point. Is there objection in data collection terms to that approach, because it is predicated on getting all the information? That is the weak link, I think, in the argument.
Mr Hustinx: That is indeed a problem to start with. Getting as much information as possible is the worrying thing.
Q174 Lord Dear: From commercial sources or wherever?
Mr Hustinx: In this case from a source where the data is collected to move a person from A to B and sending this to another infrastructure which is then doing things which are not clear. That is the worrying thing. To be very precise, if you have a credit card, credit card companies use these techniques to see what your usual behaviour is, and if a credit card is used in Prague and then in Bucharest for money you never spent you can imagine that that is a signal that it may be stolen, so there is some merit to this, and we are not naive. But this story has not been told and has not been explained, and so far we have not had the kind of evidence which you would expect.
Q175 Lord Dear: So it turns on transparency?
Mr Hustinx: What I find worrying after a number of years—this is not just fantasy; it is happening in some place in the world—is that we still get signals like, "This is terribly useful for crime. It is very good to catch drug dealers", but that was not what we started to do, although it may be part of organised crime. The focus here was on terrorism. If you have a focus on terrorism, under present rules and discussions that means a certain scope of powers and exceptional arrangements, and this is what I find worrying.
Q176 Lord Dear: I am grateful to you; thank you. There two specific questions. The first one is about PNR information being collected from aeroplanes at the moment, and the suggestion that you could extend that to maritime and road and rail, particularly maritime and rail. Do you have any problems with that about proportionality, forgetting how difficult it might be, just on the proportionality side?
Mr Hustinx: Your question is, of course, legitimate, but this is my second flag-waving in the conversation because that was not part of the proposal we analysed. If your question is, were we worried that the maritime connections were not part of this, the answer is no. If only because of the sheer size of this project, it would be wise to do this step, and maybe there is a limit to what you can expect in practice, but it still involves all airline connections in and out of the EU, so it does raise a number of issues. I do not think that the issues we have just discussed are affected by it, not including the maritime connections and rail connections, if they exist, and we might perhaps also then discuss airline traffic within the EU. They are separate issues and they are raised, particularly the second one, as separate concerns.
Q177 Lord Dear: I was going to ask you about that because that was going to be my second point, which flows on very logically. Forgetting the external border, what about movement within the EU and perhaps within individual countries within the EU?
Mr Hustinx: What individual countries do is, of course, up to them to a large extent, but if this were to impact on the freedom to travel freely within the EU, as it seems to do, then it raises a number of issues—the principle of free movement, but also the Schengen arrangement, so should it be allowed because it seems to be problematic? If the case were made that this is necessary I think it would most certainly mean changing the existing arrangements. More Member States have recently joined the area of free movement. It would be new and I think it would be problematic, and issues of proportionality and so forth would certainly arise because that is also a principle of European law in general.
Q178 Lord Marlesford: I think we are back to profiling. First of all, is your position that you are opposed to profiling unless there is a good reason for it or are you more widely opposed to it anyway? If the objective of this whole system is to catch the bad guys without hassling too much the good guys, and also given that you have limited resources to focus them where you are most likely to catch the fish, do you accept that profiling is in practice necessary? My other supplementary is that the Commission explained to us how they have taken some care to avoid certain sorts of profiling. The good immigration officer, rather like the good customs officer, will use what one could call the observation and sixth sense way of profiling.
Mr Hustinx: His nose, or whatever.
Q179 Lord Marlesford: Absolutely. In other words, exactly the sort of profiling which the Commission in this scheme is seeking to avoid using for being worried about it being described as prejudicial discrimination. Do you see this system as being a substitute for or a complement to the existing methods of frontier control?
Mr Hustinx: The concept of profiling is at the same time fuzzy and worrying in some contexts and not in others, and that makes it another problematic thing. You have perhaps noticed that we have avoided discussion about profiling. There are references to two definitions of profiling, some emphasising more the techniques used—data warehousing, computer analysis, and the other more on substance—categorising, standardising, and it is probably a combination of the two and the European Parliament is currently thinking about how profiling could and could not be acceptable. Some of it is mild and it has been around for a long time. I think in marketing, if you want to sell or not sell, you make an offer and it depends what kind of targeting you do and whether it is inclusive or exclusive and what the consequences are. Here we are dealing with an area which is both wide-scale, it involves everybody, and in the context of combating terrorism and not allowing people entry into the European Union or on an aeroplane it has rather a big impact. What is profiling doing here? It is using data from various sources about other people who are associated with you and you fit in the presumption that this may be a risk group. There things start to have quite an impact with the lack of clarity about what a mechanism is. Is this something to correct easily? Well, if you are on the spot and you have to explain that you may fit the profile but there is no reason to be suspicious, it is very difficult with all the powers of government, and so this is an area where you have to be very careful. This is not marketing. This is not red-lining, which happens and which is also quite discriminatory in terms of whether you live in an area where you can get the mortgage paid or not. This is about freedom to move. It is also very close to the presumption of innocence, so in ways which you cannot perceive, understand or predict, you can find yourself in the situation of fitting the profile and there is little defence against it, so the mechanism in this context is I would say inherently suspect. Do I exclude this under all circumstances? No, but it means that using these mechanisms in these contexts on such a large scale requires a very high degree of robust evidence, and there we come back to square one: very little evidence has been produced so far, so this kind of profiling we say is risk assessment and we have been looking in the proposal for mechanisms to detail this. Who is to set the criteria? Who is to set the procedures? The answer is open. I also realise that the proposal is for harmonisation of these practices in all EU Member States and it involves exchange of data, no matter how the practices from country to country will be connected, so you may also feel the consequences of the kind of risk assessment happening in another country, and since people travel they are affected by this as well. The lack of harmonisation of risk assessment practices may therefore affect the freedom to move, to be not suspected of things if you are totally innocent, so maybe also the effectiveness of the mechanism to catch the group you want to catch or identify or eliminate is not terribly convincing for the time being.
|
