Policy Observatory

A new EU system for the use of Passenger Name Record (PNR) data would include intra-EU flights and require sensitive data be kept for minimum 30 days, according to the draft text discussed in the civil liberties committee on Thursday. The committee rejected a 2011 draft directive in April 2013.

On 25 November the European Parliament voted, by 383 votes to 271, in favour of a resolution to refer the EU-Canada agreement on Passenger Name Records (PNR) to the European Court of Justice (CJEU). The CJEU will now decide on the compliance of the agreement with EU law, in particular the Charter of Fundamental Rights. As explained in previous EDRi-gram articles, PNR data has become an attractive and invasive source for governments to obtain personal data.

On February 11th, the European Parliament has adopted a resolution in which it commits to work toward finalising, by the end of 2015, a directive on EU Passenger Name Records (PNR). This proposal aims at the systematic data collection, retention and analysis by national authorities of passengers taking flights entering or leaving the EU. This data, originally collected by airline companies, contains plethora of personal data, from passengers’ personal and contact details, itinerary, payment methods, to sometimes even food preferences.

While the debate over an EU-wide scheme continues, the same scheme has been operating for all flights between EU member states and the US since 2001.

This blanket mass surveillance was instigated by the US in the wake of the 9/11 terrorist attacks, but put airlines in a bind: the US Department of Homeland Security demands the information from them, but European data protection law bars the transfer of data outside the EU.

Giovanni Buttarelli criticizes the Passenger Names Records (PNR) law saying it makes more sense to target specific categories of flights, passengers, and countries and declaring it as too invasive and unlikely to stop terrorism. “I’m still waiting for the relevant evidence to demonstrate, even in terms on the amount of money, and years to implement this system, how much it is essential,” he said.

His comments come after MEPs in the civil liberties committee on 15 July agreed a legislative proposal that will allow the collection of detailed information – such as credit card details and addresses – of all people flying in and out of the EU. Buttarelli is due to give a formal opinion on it in September.

On Wednesday, the European Parliament’s Committee on Civil Liberties (LIBE) adopted the EU Passenger Name Records (EU-PNR) directive proposal, presented by Rapporteur Timothy Kirkhope, a conservative MEP from the UK.

The EU-PNR directive would establish the systematic collection, retention, and analysis of passenger data for everyone flying into or leaving the EU. Passenger data contains a plethora of personal information, such as passengers’ personal and contact details, itinerary, payment methods, and sometimes even car and hotel bookings.