Brussels, 29/03/2011 (Agence Europe) - The European system for the transfer of air passengers' data, presented by Home Affairs Commissioner Cecilia Malmström on 2 February (see EUROPE 10307) “does not meet the requirements of necessity”, according to an opinion adopted by European Data Protection Supervisor (EDPS) Peter Hustinx on 25 March.
The Commission proposal seeks to oblige airline carriers to provide EU member states with personal data on passengers (Passenger Name Record - PNR) entering or departing from the EU for the purpose of fighting serious crime and terrorism. Such data may include, for example, home address, mobile phone number, frequent flyer information, email address and credit card information.
The EDPS acknowledges the data protection improvements brought to the present proposal, compared to an earlier proposal adopted in 2007, and “in particular the efforts to restrict the scope of the proposal and the conditions for processing PNR data”. He notes, however, that “the need to collect or store massive amounts of personal information must rely on a clear demonstration of the relationship between use and result (necessity principle). This is an essential prerequisite for any development of a PNR scheme”.
In the view of the EDPS, the current proposal and its accompanying impact assessment “fail to demonstrate the necessity and the proportionality of a system involving a large-scale collection of PNR data for the purpose of a systematic assessment of all passengers”.
Hustinx says the scope of application should be “much more limited with regard to the type of crimes involved”. He recommends that minor crimes be explicitly defined and ruled out from the scope and that member states be denied the possibility of extending it. “No data”, the EDPS says, “should be kept beyond 30 days in an identifiable form, except in cases requiring further investigation” and there should be stronger guarantees to citizens: “a higher standard of safeguards, in particular in terms of data subjects' rights and transfers to third countries, should be developed”, he says.
That sensitive data are not included in the list of data to be collected is to be welcomed, but “this list remains too extensive and should be further reduced”, the EDPS adds. In a press release, Hustinx says: “Air passengers' personal data could certainly be necessary for law enforcement purposes in targeted cases, when there is a serious threat supported by concrete indicators. It is their use in a systematic and indiscriminate way, with regard to all passengers, which raises specific concerns”. (S.P./transl.rt)