Brussels, 02/02/2004 (Agence Europe) - National privacy authorities are unhappy with the agreement to provide personal information about passengers on transatlantic flights, signed in December by the European Commission with the United States. In a report published on Monday, experts from the Article 29 advisory group point out that the commitments made by the US do not meet the requirements of EU data protection legislation for personal information. The Commission is taking a prudent line with the spokesperson for Commissioner Frits Bolkestein, Jonathan Todd, commenting that it would take Article 29's views into consideration when it unveils its draft decision later this month at the Council and the European Parliament.
As one of the measures to combat terrorism established at the start of last year, the US customs and border protection bureau collects information from airlines. Airlines are threatened with fines or banned access to US airports if they fail to comply. In response, the Commission launched negotiations to restrict the range of information required, the uses made of the data and the time they are stored. In December, Commissioner Frits Bolkestein and US Security Secretary Tom Ridge announced that they had reached an agreement (see EUROPE of 18 December, p. 9).
Article 29 disagrees with the Commissioner, arguing that the progress to date does not meet with the EU personal data protection legislation. It argues that the Commission must not base its decision on simple promises from an administrative agency but on officially published commitments at federal register level or higher. But on 12 January, Group 29 points out, the US published a document openly stating that the commitments made in the agreement did not create or confer any right or benefit on any person or party, whether private or public. Information supplied to passengers cannot replace a legal commitment, the experts stress.
Group 29 is particularly concerned by the future use of data in the CAPPS II programme (of data collection) which is currently being discussed by the US Congress. It wants any agreement on this programme to be the subject of a new decision submitted to both Council and Parliament.
Group 29 points out that 34 items of information has been set as the upper limit, but in its report published in June 2003, Group 29 pointed out that only 19 items could be supplies. 'Sensitive' data concerning religion, membership of political parties or passengers' state of health will be scrapped, but not the 'free boxes' for airlines. A three and a half year limit has been agreed for the storage of data, but Australia has established a system whereby data is immediately deleted unless passengers are identified as potentially dangerous. Group 29 wants a system to be established that enables the filtering of information before it is sent off to the US authorities (a push system).
The experts note that the use of data has been restricted to combating terrorism and related crime, but also includes other 'serious crimes, including authorised transnational crime', which they describe as too vague. They want serious guarantees to ensure passengers can access their records and appeal against it if necessary. They point out that the 1974 private life legislation in the US only applies to US citizens and residents. Non-discriminatory access to mechanisms allowing the correction of information must be guaranteed, asserts Group 29..
The NGO "Statewatch" has also slammed the agreement, describing it as a clear violation of fundamental rights. It urges the European Parliament and civil society to ensure the decision is not adopted that would enable the agreement to be implemented. Statewatch has published the agreement on http: //http://www.statewatch.org/news/2004/feb/01eu-us-pnr-agreement.htm (see EUROPE of 29 January, p.14, on the appeal by MEP Marco Cappato).