Last week saw the publication of the Report on the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the United States Department of Homeland Security (DHS).
A team comprised of representatives from both the European Commission and the DHS was charged with reviewing the implementation of the July 2007 bilateral agreement which permits the transfer of PNR data from airlines in the EU to the DHS. Under this agreement, the DHS has the right to use the data only for the purpose of preventing and combating (i) terrorism and related offences and (ii) other serious offences which are transnational in nature. The team found that the DHS generally complies with the terms of the agreement, but nonetheless recommended some improvements, expressing anxiety that the broad use of PNR data, and especially the matching-up of that data against databases with an immigration and customs policy element, might violate the purpose restriction under which the data is disclosed.
The DHS is also recommended to make more effort to ensure that all EU airlines use the “push” method for data transfers (where carriers are required to send the PNR data in their reservation systems to the US) rather than the “pull” method (where carriers give direct electronic access to the DHS to the data on their reservation systems).
A further concern relates to the number of ad hoc requests for data as well as what is felt to be a degree of reluctance on the part of the DHS to share any analytical information with EU Member States, Europol and Eurojust.
A further review will be carried out next year. Datonomy hopes, but doubts, that the review committee will be able to report a sharp improvement in this current state of affairs.