EUROPEAN COMMISSION
Brussels, 12.1.2021
COM(2021) 18 final
REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL
on the joint evaluation of the Agreement between the United States of America and the European Union on the use and transfer of passenger name records to the United States Department of Homeland Security
{SWD(2021) 4 final}
REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL
On the joint evaluation of the Agreement between the United States of America and the European Union on the use and transfer of passenger name records to the United States Department of Homeland Security
Introduction
The Agreement between the United States of America (U.S.) and the European Union (EU) on the use and transfer of passenger name record (PNR) data to the Department of Homeland Security (DHS) entered into force on 1 July 2012 1 . The Agreement under Article 23(1) states that the Parties shall jointly evaluate this Agreement four years after its entry into force.
The joint evaluation consists of a more thorough examination of the Agreement, by exploring the wider functioning and operationally added value and assessing its results, impacts, effectiveness, necessity and proportionality. It also offers an opportunity to take stock of any impact caused by the evolution of the relevant legal framework and case law of both parties. Hence, the joint evaluation takes a wider approach than the joint reviews, whereby both parties assess whether the Agreement is being implemented correctly.
Preparation process for the joint evaluation and Report
·The Commission sent a questionnaire to the U.S on 2 August 2019 in advance of the joint evaluation. The Department of Homeland Security provided written draft replies to the questionnaire prior to the joint evaluation and a final consolidated version thereafter.
·The EU team conducted the joint evaluation visit on 5 and 6 September 2019 followed by a U.S. visit to the Belgian and Dutch Passenger Information Units (PIUs), and Europol on 22 and 23 October 2019.
·The EU team also had the opportunity and the time to raise further questions with DHS personnel responsible for the PNR programme and address all the various aspects of the Agreement.
·The findings of the EU team were laid down in the accompanying Staff Working Document which was shared with DHS, providing the U.S. with the opportunity to comment on inaccuracies and identify information which cannot be disclosed to public audiences.
The accompanying Staff Working Document provides more detailed information and a comprehensive analysis of the methodology of the joint evaluation and all matters covered by this report.
Findings of the Joint Evaluation
The main findings of the joint evaluation can be summarised as follows:
The evaluation teams have discussed different ways in which PNR data are used for purposes of preventing, detecting, investigating, and prosecuting terrorist offenses and related crimes and certain other crimes that are transnational in nature. The joint evaluation confirmed that PNR data contains elements that are not available through other means, and in particular, the information contained within PNR data cannot be found in any other type of data collection.
The necessity of the collection of PNR data was also demonstrated by its ability to assist the relevant authorities in identifying high risk travellers who are not otherwise known to law enforcement agencies. Moreover, the usefulness of retained - so called historical - PNR data has been illustrated by numerous examples in which historical PNR data had been crucial in solving high-profile counterterrorism cases not only in the U.S but also in the EU.
In addition, the joint evaluation also takes note of the growing interest in the use of PNR worldwide for anti-terrorism and law enforcement purposes and newly created international obligations. In this context, particular reference is made to the adoption of the EU PNR Directive 2 and, globally, to the new Standards and Recommended Practices (or SARPs) on the collection, use, processing and protection of PNR data by the International Civil Aviation Organisation (ICAO), as mandated by United Nations Security Council Resolution 2396 (2017) 3 .
The joint evaluation also analysed and assessed the safeguards contained in the EU-U.S PNR Agreement. These include the application of the validation and review process for the access rights for officials and targeting rules, the processing of sensitive data by the U.S authorities, as well as the mechanisms to ensure transparency, access, correction and redress. In addition, the assessment also covered the oversight activities carried out by the U.S, and the onward sharing of PNR data both to U.S entities outside of DHS and to third countries.
Finally, the evaluation teams also discussed Court’s Opinion 1/15 on the envisaged EU Canada PNR Agreement. 4
Conclusions
The joint evaluation has clearly demonstrated the added value and operational effectiveness of the Agreement in the fight against terrorism and serious transnational crime. Examples provided during the evaluation have shown that PNR, including historical PNR, being a unique dataset, have been critical to prevent the return of foreign terrorist fighters and to combat in particular drug crimes and child exploitation. In addition, the Agreement’s objectives are consistent with the international obligations to collect, process and analyse PNR data for effective border controls to prevent terrorist travel as well as to help making connections between individuals associated to organised crime, and prosecute terrorism and organised crime.
The Commission recognises the efforts made by U.S to comply with the requirements of the Agreement from 2012 in both technical and organisational aspects, and recommends DHS to continue its efforts to i) limit the number of users who have access rights to PNR data, ii) comply with the requirements on sensitive data and to put in place mechanisms aiming at immediately deleting sensitive data if received, iii) review the necessity of keeping PNR in a dormant status, iv) improve the systems in place concerning onward case-by-case sharing to U.S entities outside of DHS and to other third countries, v) ensure feedback concerning the effectiveness of targeting rules at a regional and local level and vi) ensure that the requirement, in specific cases, to air carriers to provide access to DHS is regularly assessed and overly minimised.
At the same time, the EU team noted that despite the numerous safeguards contained therein, several aspects of the Agreement are not fully in line with Opinion 1/15 of the Court of Justice on the envisaged PNR Agreement with Canada, as the U.S Agreement was concluded before the Court delivered its Opinion. These concern the retention of PNR data, the processing of sensitive data, notification to passengers, prior independent review of the use of PNR data, rules for domestic sharing and onward transfers, independency of oversight and the sole use of databases in relation to the fight against terrorism and serious transnational crime for cross-checking of PNR data.
The Commission takes note of the position expressed and the arguments put forward by the U.S. The Commission equally takes note of the importance the U.S. places regarding the necessity to retain historical PNR data.
Against this background, parties committed to continue their constructive dialogue on the implementation of the Agreement and to work on the recommendations from the (2015) Joint Review and this Evaluation in the light of the Court’s Opinion on the envisaged EU Canada PNR Agreement. In this context, the Commission will assess the necessary follow-up action also taking into account the feedback received by the European Parliament and Council on this Evaluation.
Generally, the Commission will review the EU external strategy towards PNR transfers to third countries next year.
Agreement between the United States of America and the European Union on the use and transfer of passenger name records to the United States Department of Homeland Security, OJ L 215, 11.8.2012, p. 5.
Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, OJ L 119, 4.5.2016, p. 132.
Resolution 2396 (2017) - Adopted by the Security Council at its 8148th meeting, on 21 December 2017.
Opinion 1/15 of the Court (Grand Chamber), ECLI:EU:C:2017:592.