Follow-up: EU working on a Passenger Name Record (PNR)

In August, I have written an article on the planned Passenger Name Record (PNR), and now a follow-up document (including Corrigendum 1 and Corrigendum 2) summarising discussions from July to November has been published by the EU Council.

Let me quote the most important lines from the document:

• [Air transport] operators are seeking the European Union's support to work towards the greatest possible harmonisation of the obligations imposed on them in order to limit the cost and the burden of legal responsibilities which they face to the minimum necessary.

• Mr Gilles de Kerchove [the EU anti-terrorism co-ordinator] relayed the views of counter-terrorism services which he had consulted. These views are that in Europe, as elsewhere in the world, PNR data are undeniably useful in the field of counter-terrorism, partly on account of the specific vulnerability of terrorists when crossing international borders and partly on account of the significant and intrinsic potential afforded by the PNR tool.

• [R]isks of discrimination, notably on ethnic or religious grounds, were eliminated by following the [Fundamental Rights] Agency's recommendations. 

• A significant effort was made as regards the clarification and coherence of the data protection rules applicable, since specific rules have to be identified in the instrument, in particular to ensure that the limits imposed on the use of PNR data are strictly complied with. 

• The approach of having a centralised PNR system at EU level has been rejected by a vast majority of delegations, and the Commission has refused it, particularly because of the technical complexity of such a tool which could have grave consequences for data security. 

• A Passenger Information Unit (PIU) would be set up in each Member State to act as the public authority hosting the PNR database and ensuring compliance with the rules in force. 

• The procedure for analysing the terrorist and criminal risk should be clearly delimited. 

• The list of data to be transmitted can be reduced compared with the original proposal since it was not deemed necessary to maintain the information relating to unaccompanied minors which it contained. 

• [R]igorous traceability of all access to the PNR database, all analyses and all transmissions made;
  

Still to be discussed are questions regarding sensitive data (i.e. special health needs of passangers), the retention period for data, as well as the possible exchange of bulk data.

In total, I am not really convinced that the effect of this PNR will outweight the reduction of privacy, and the risks of misuse of the data gathered by the authorities. Altogether, the progress report paints a rather positive and unproblematic picture, but I am not sure that the member states take due account of all critical matters connected to the database.