The Article 29 Working Party was asked to give its opinion on an agreement initialled on 17 November by the European Commission and the United States of America on the transfer and use of Passenger Name Records, known as PNR. The letter reviews the agreement from a data protection perspective and finds it wanting in many respects.
The Article 29 Working Party had expressed considerable concerns about PNR agreements with the USA and other countries in the past and ‘notes (modest) improvements in the draft agreement, but does not see its serious concerns removed’. It fully supports the recent opinion of the European Data Protection Supervisor of 9 December 2011 which expressed grave reservations about the agreement.
Still at root of the Working Party’s concerns is the absence of evidence ‘to demonstrate the necessity and the proportionality of mass transfer and use of PNR data for law enforcement purposes’. In light of that, the detailed criticisms are unsurprising. The fact that the data can be used for purposes not connected with terrorism and organised and transnational serious crime and that the data can be stored for up to 15 years (by the US Department of Homeland Security, and perhaps other US bodies) are the focus for just some of the Working Party’s concerns. The comment on Article 19 of the draft agreement is typical:
‘Art 19 is a somewhat hidden, but very important provision. It has to be read jointly with the purpose of the agreement. It is critical because it says that the data protection level in the US is adequate despite its excessive retention periods and its lack of independent supervision.’
The open letter may well amount to no more than a wordy sigh of despair. When one reads criticism such as that of Article 19, one wonders if the Working Party really believes that there is any hope for further improvement.
The letter can be read in full here.
