Pact Allows Transfer Of EU Airline Passenger Data To U.S. Authorities

A new agreement on the transfer of EU air passengers' personal data to the US authorities was approved by the European Parliament on Thursday. The deal sets legal conditions and covers issues such as storage periods, use, data protection safeguards and administrative and judicial redress. The agreement will replace a provisional deal in place since 2007.

The EU-US Passenger Name Record (PNR) agreement was adopted with 409 votes in favour, 226 against and 33 abstentions. A significant minority of MEPs voted against the deal due to concerns over data protection safeguards, including rapporteur Sophie in'T Veld (ALDE, NL), who withdrew her name from the report. A proposal to refer the agreement to the European Court of Justice was rejected by MEPs.

Under the new agreement, US authorities will keep PNR data in an active database for up to 5 years. After the first 6 months, all information which could be used to identify a passenger would be "depersonalized", meaning that data such as the passenger's name or her/his contact information would be codified. After the first 5 years, the data will be moved to a "dormant database" for up to 10 years, with stricter access requirements for US officials. Thereafter, the agreement says, data would be fully "anonymized" by deleting all information which could serve to identify the passenger. Data related to any specific case will be retained in an active PNR database until the investigation is archived.

PNR data will be used mainly to prevent, detect, investigate and prosecute terrorism and serious transnational crimes. Transnational crimes are defined as crimes punishable by 3 years of imprisonment or more under US law.  PNR data will also serve "to identify persons who would be subject to closer questioning or examination".

Sensitive data such as those revealing the ethnic origin, religious beliefs, physical or mental health or sexual orientation of a passenger could be used in exceptional circumstances when a person's life is at risk. This data is most frequently tied to a religious meal choice or requests for assistance due to a medical condition. This data will be accessed only case-by-case and will be permanently deleted after 30 days from receipt, unless it is used for a specific investigation.  Should their data be misused, EU citizens will have the right to administrative and judicial redress in accordance with US law. They will also have the right to access their own PNR data and seek rectification by the Department of Homeland Security (DHS), including the possibility of erasure, if the information is inaccurate.

"I welcome today's vote of the European Parliament giving its consent to the new Passenger Name Record Agreement with the United States of America," said European Union Home Affairs Commissioner Cecilia Malmstrom in a statement after the vote. "This is an agreement the three EU institutions can be proud of: it provides stronger protection of EU citizens' right to privacy and more legal certainty for air carriers than the existing EU-U.S. PNR Agreement from 2007. At the same time, it fully meets the security needs of the United States of America and the EU.

Under the new agreement, data of passengers travelling to the United States of America will be used to fight serious transnational crime and terrorism. It will be made anonymous six months after a passengers' flight. EU citizens will be informed about the use of their data, and will be able to access and request the correction or deletion of their PNR data. The new agreement is a substantial improvement on the existing Agreement from 2007, and I am pleased that the European Parliament has recognized this today."

FMI: www.europarl.europa.eu, www.eurunion.org