52013DC0844

REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL

on the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of  passenger name records to the United States Department of Homeland Security

The current Agreement between the United States and the European Union on the use and transfer of passenger name records to the United States Department of Homeland Security entered into force on 1 July 2012.

The Agreement provides for a first joint review one year after its entry into force and regularly thereafter as jointly agreed. This joint review was carried out on 8 and 9 July 2013 in Washington. Its main focus was the implementation of the Agreement, with particular attention to the method of transmission of passenger name records (PNR) as well as the onward transfer of PNR as set out in the relevant articles of the Agreement, and in accordance with recital No 18 of the Agreement.

The joint review is based on the methodology developed between the EU and the U.S. teams for the first joint review of the 2004 PNR Agreement, which took place in September 2005.  The first part of this methodology consisted of a questionnaire sent by the European Commission to the U.S. Department of Homeland Security (DHS) prior to the joint review. DHS provided written replies to the questionnaire prior to the joint review. The second part consisted of a field visit to a DHS operation center by the EU team. The third part consisted of a meeting between representatives of DHS, the U.S. Department of Justice and the U.S Department of State, the EU team and the DHS Privacy Office, discussing in detail the implementation of the Agreement.

Prior to the joint review the DHS Privacy Office proceeded with an internal review of the implementation by DHS of the Agreement. This review was conducted to determine whether DHS is operating in compliance with the standards and representations in the Agreement with the EU.

The EU team found that DHS implemented the Agreement in line with the conditions set out therein. For example DHS uses effective filters for filtering out data without a U.S. nexus as well as PNR data outside the 19 PNR categories described in the Annex to the Agreement. The masking and deletion of sensitive data are respected and DHS has stated that it has never accessed sensitive data for operational purposes.

DHS also implements its commitments in relation to passenger rights, in particular as regards providing appropriate information to passengers and implementing the right to access without any exemptions. However, this should be read against the fourth recommendation made below which addresses the need for more transparency on the redress mechanisms available to passengers.

Sharing of data with other domestic agencies is handled by DHS in line with the Agreement. Sharing is carried out on a case-by-case basis, logged and takes place on the basis of written understandings. Sharing of data with third countries is also interpreted strictly, and is also in line with the Agreement.

As a general recommendation, it is advised to envisage another internal review of the Agreement by the DHS Privacy Office ahead of the next joint review.  The two sides suggest organising the next joint review during the first half of 2015.

It is also recommended to ensure as quickly as possible a full move to the “push” method and in any case by 1 July 2014, as required under Article 15(4) of the Agreement.  

It is further recommended that the U.S. and the EU work together to promote the use of common transmission standards, in particular the PNRGOV standard as developed by IATA, airlines, and government. In this respect it would be welcomed if the discussions in IATA on a common “Push” standard also would lead to a common standard for ad hoc “push”.

Despite the implementation of the Agreement, some improvements remain necessary. First, this concerns the commencement of the six months period triggering the depersonalization of PNR under Article 8 (1) of the Agreement. Currently the calculation of this period starts only as soon as a PNR is last updated in the DHS Automated Targeting System (ATS) which holds the PNR, not when PNR is loaded in ATS. It is recommended to start applying the six months period as from the day the PNR is loaded in ATS (the so-called ATS Load Date) which is the first day the data are stored in ATS, instead of the current practice, which delays applying the six months period (until the last ATS Update of the PNR).

Second, particular attention should be paid to the use of the ad hoc “pull” method. It is recommended that DHS, in addition to its current logs, keeps better records of the reasons why the ad hoc “pull” method is applied in each case, which would allow for a better assessment of the proportionality and a more effective auditing of its use, which is meant to be an exception to the rule. 

Third, DHS is requested to respect its commitment to ensure reciprocity and pro-actively share individual PNRs and analytical information flowing from PNR data with EU Member States and where appropriate with Europol and Eurojust.

Fourth, it is advised to provide more transparency on the redress mechanisms available under U.S. law. Such transparency should allow passengers who are not U.S. citizens or legal residents to challenge DHS decisions related to the use of PNR data, in particular when the use of such data may contribute to a recommendation to deny boarding by carriers. 

Lastly, DHS also implemented measures that go beyond the Agreements’ requirements. DHS foresees a notification to the European Commission within 48 hours of access to sensitive PNRs. DHS has installed a new procedure to quarterly oversee and review the implementation of the ATS and to review all travel targeting scenarios, analysis and rules to ensure that they are proportionate to minimize the impact on bona fide travellers’ civil rights, civil liberties and privacy, and to avoid discrimination against travellers. 

Notwithstanding Article 23(1) on a joint evaluation of the Agreement four years after its entry into force, a preliminary assessment of the question whether PNR serves the purpose of supporting the fight against terrorism and other crimes that are transnational in nature showed that PNR provides DHS with the possibility of carrying out pre-departure assessments of all passengers up to 96 hours which gives DHS sufficient time to carry out all the background checks before the arrival of a passenger and prepare its response. This processing also supports DHS when deciding if a passenger should board a plane or not. It also provides DHS with the opportunity to perform risk assessments on the basis of scenario-based targeting rules in order to identify the ‘unknown’ potential high-risk individuals. PNR further provides the possibility to make associations between passengers and identify criminals who belong to the same organised crime group. According to DHS PNR is also successfully used for identifying trends of how criminals tend to behave when they travel, for example by understanding which routes they use.

The Joint Review Report accompanying this Report consists of three Chapters. Chapter 1 provides an overview of the background to the review and the purpose and procedural aspects of the exercise. Chapter 2 presents the main findings of the joint review and the issues to be further addressed by DHS. This Chapter is supplemented by Annex A which contains the questionnaire and DHS replies thereto. Finally, Chapter 3 presents the overall conclusions of the exercise. Annex B presents the composition of the EU and U.S. teams that carried out the review exercise.