Examination of Witnesses (Quesitons 180-199)
Mr Peter Hustinx, Mr H Hijmans and Mrs A C Lacoste
2 APRIL 2008
Q180 Lord Marlesford: What about the question about being a complement to or substitute for the existing methods of profiling, the on-the-spot experience of immigration officials?
Mr Hustinx: I would be interested in a comparison of how effective these mechanisms are, say, on a comparative scale. The sixth sense or the seventh sense would be plainly discriminatory, let us say, if you catch people with this religion or this ethnicity, and then it would not be acceptable.
Q181 Lord Marlesford: It would not be acceptable?
Mr Hustinx: No, of course not.
Q182 Lord Marlesford: Even if it catches people?
Mr Hustinx: That is a good point. Profiling on the basis of religion and race was not part of the Commission proposal. I think they carefully left it out, so we have no reason to criticise the proposal for that, but I would not be supportive of bringing it in.
Q183 Lord Marlesford: No, but it is in use, I imagine, on the spot.
Mr Hustinx: Yes. Again, the point is, if the nose of the customs officer is just a disguise for his discriminatory behaviour, I do not think I would be very positive about it.
Q184 Lord Mawson: I would like you to help me get a handle on it. Who funds you? How do you fit into the scene? How does all that work?
Mr Hustinx: EDPS is not an NGO. It is a European institution, briefly put, so my budget is on the European Union's budget. It is Chapter 8B, if my memory serves me right, 8A being the Ombudsman, and we share the same chapter.
Q185 Lord Mawson: Thank you. Do you know whether the profiling of passengers under the Framework Decision would raise constitutional concerns in any Member State?
Mr Hustinx: I would think so, yes. It is difficult to make a fully-fledged analysis but, for instance, if you analyse the recent decisions of the German Constitutional Court and the precision with which they look at systematic tracking of licence plates of cars, for example, which was one of the decisions that was then found partly unconstitutional, there is a provisional decision on traffic data retention. My sense is that there is a problem in Germany. Certainly the approach of getting as many data as possible just to do an analysis (the German equivalent of this was found problematic and practised and then criticised in the seventies) without standards being published and accessible I think it is problematic. In the light of the discussion about standards the problem is that it is a categorical judgment which is then applied to individuals with a shifting of the balance of proof and the presumption of evidence. It is close to all this. I think that is problematic and it is bound to be problematic also in the light of the case law in Strasbourg.
Q186 Lord Dear: It would be problematic, I would suggest, if that presumption then says, "You do not fit the norm; you fit the norm of a terrorist;", or a drug trafficker or whatever, "therefore you must stand trial for that", but if it leads to a train of thought that says, "We have to dig deeper, we have to ask more questions, because there might be something here", is that the same argument?
Mr Hustinx: I see the subtle distinction but this procedural consequence—
Q187 Lord Dear: Of questioning?
Mr Hustinx: Yes— has practical consequences and some of them may be rather drastic. It may lead to a decision that someone may be an unwanted visitor and is sent back, period, and then it is not tried because that requires more evidence.
Q188 Lord Dear: That I follow.
Mr Hustinx: We have this fishy feeling and we cannot eliminate this, but how do we draw the line? What are the risks at stake? It does not mean, if someone is issued with a decision of being an unwanted alien and then for the EU that is the immediate consequence, that anything has been proved. It is also difficult to challenge such a decision on the basis of this fishy feeling. That is the problem.
Q189 Lord Mawson: The UK believes that sensitive personal data are useful and would like the processing of sensitive personal data to be allowed under the Framework Decision, subject to specific data protection safeguards. What is your view on this?
Mr Hustinx: No, my answer is negative. It was not part of the proposal, it is not part of the proposal made by the Commission. We did not find it. In fact, we welcomed it. I think it was not there. In the negotiations with the US there has been a lot of attention given to eliminating sensitive data and that is still part of the agreement, so I do not see it as useful and appropriate to bring it in in this context. In fact, the way it is a eliminated is a bit troublesome but there is no disagreement in the EU/US PNR agreement that sensitive data should be eliminated so, applying that standard, I do not think it is a priority.
Q190 Chairman: Not at any level?
Mr Hustinx: No.
Q191 Lord Teverson: Under Article 11 all processing of PNR data will be governed by the Data Protection Framework Decision. Given that the scope of that is limited to cross-border data exchanges, do you consider this data protection regime to be adequate?
Mr Hustinx: No. Maybe you want to have some more explanation.
Q192 Lord Teverson: Yes, please.
Mr Hustinx: We chose to focus on this issue as one of the four main subjects in the Opinion, and I have been dealing with the Framework Decision in another context—
Q193 Lord Teverson: As we have.
Mr Hustinx:— so I can refer to that, but this was an occasion to illustrate how unfortunate the limited scope of the Framework Decision is. Apart from the limited scope in law enforcement this is also an area in which you see perhaps public/private co-operation. We see data moving from the private sector to the public sector in a way which is not entirely clear but seems to involve service companies and certain collecting points and transfer points. If you analyse the architecture which the proposal suggests it involves the First Pillar Framework, it involves the Third Pillar Framework, but it also shows gaps between the First and the Third and most certainly also it shows that the scope of the data protection in the Third Pillar is limited. How do you tackle this? The language in the proposal is declaratory, that the standards "shall" apply. You could say they do not, but if the intention is that we want them to apply then it would certainly need upgrading in this context, adding and specifying a number of safeguards and compensating for the lack of scope in the Framework Decision and the lack of protection between the First and the Third Pillars as we see it. It certainly is totally unclear where the one ends and the other begins, and that is an independent source of concern.
Q194 Baroness Garden of Frognal: In your Opinion you question the applicability of the DPFD to private sector bodies, such as airlines and their intermediaries, and other First Pillar actors, such as immigration authorities, involved in PNR collection and processing. What data protection regime should apply to them?
Mr Hustinx: That is to a large extent the existing First Pillar Data Protection Framework. That is general. It is the Framework Directive as it is being implemented in national data protection law. On a national level quite often it has been implemented horizontally, so including other areas, but it has been a long-term vision that the First and Third Pillars should have a seamless approach. This is likely to happen eventually in the context of the Lisbon Treaty but presently we think that if the EU PNR proposal proceeds it should specify a number of things which apply under the First Pillar, it should add a number of things which do not apply yet and specify in terms of making it fit the subject, and most certainly also the Third Pillar, but we have mentioned that. The lack of precision in terms of which actors have access to data makes it difficult now to imagine what the safeguards precisely should be, but knowing what we know from the airline industry, because we cover some other subjects there, it is likely to involve some of the service companies. The question is, what is their responsibility? That has enormous consequences. Who is acting if an airline shares data with government? That is not so clear. What is the scope of their responsibility? Who should be responsible if something goes wrong? All these issues are important, and then what is the status of a passenger information unit? The proposal leaves Member States some discretion. It could be the police, it could be government, but it could be another body. If it is the police it is likely to be a Third Pillar discussion, but the Third Pillar framework only applies when data move from country to country and at the collection point it does not apply yet. If a passenger information unit is a government agency it is the First Pillar, perhaps; it depends on the task, and this is just a consequence of the current definitions in the Third Pillar Framework. If it is a private body, what then? It is not so clear, but what protection should apply to them? A consistent set of safeguards should apply, for which I take the First Pillar Framework as the measuring stick for the time being, focusing on the risks which arise in this particular context.
Q195 Lord Teverson: I think probably you have answered this already, but is it feasible to have different regimes of data protection at different stages of PNR processing and the different people involved?
Mr Hustinx: I think it is very complex. At the same time I am aware of the fact that this is a proposal to harmonise national rules; this is not a standards approach, but if this is to work in a legitimate, appropriate and efficient manner we have to mind the connecting points, country-to-country differences, and we have already mentioned some of this. If there is too much scope for diversity within the proposal we will probably see the unfortunate effects of that diversity and they will be to the detriment of the legal protections for citizens but they will also be to the detriment of the efficiency and effectiveness of the system itself. If data come from other countries and if it is not clear what the risk assessment has been in another country then the question is, what does this signal mean? If you start exchanging signals, the quality of which is doubtful, it is bound to raise further problems. I find this lack of precision worrying from different perspectives, including the effectiveness of the system.
Q196 Lord Teverson: Following on from that and your earlier comments, do you find that both the Commission and the Council really find data protection and your office a nuisance but they have to have it there to apply the democratic brand?
Mr Hustinx: I do not think anyone would subscribe to that language. The proposal is dealing with a very difficult subject. Quite frankly, I think it was premature and there was a reference to this, that it might have benefited from some further thinking. The data protection is part of the set of safeguards which has recently been confirmed in the EU Charter made binding on the Member States and all institutions and bodies in the Lisbon Treaty. It is not easy to implement but I get quite a few letters from commissioners thanking us for the service we give them.
Q197 Lord Teverson: It is nice to hear that.
Mr Hustinx: Maybe Mr Frattini will write one on this subject as well. If he sees your report he might also think it is helpful.
Q198 Lord Marlesford: Just following up that theme, in your opinion, if this European PNR scheme comes into force, would a person detained at the border on the basis of risk assessment who is then found not to have been justified in being detained have a case under the European human rights legislation?
Mr Hustinx: I would think so.
Q199 Lord Marlesford: They would?
Mr Hustinx: Oh, yes, I would think so. But, of course, this is exactly the practical consequence which we have imagined—what could go wrong and what could someone suffering that result do to challenge that? I am afraid that is a difficult course, but if the proposal is made sound, if it is implemented well, then most certainly in the real world things like that will happen, so if eventually it were not be possible to challenge the negative consequences of a legitimate proposal that in itself would also be a source of some difficulty, but I would be very surprised if this would not under all circumstances lead to cases in the court. The criticism I have been making in the Opinion is about the kinds of things which the court in Strasbourg would most likely also feel because that is the standard we have been using.
| 
