Use of passenger personal data - Agreement with the USA on the use of Passenger Name Record data

Speech delivered on Thu 7th Sep 2006

Mr President, it is not clear that there is any current use for PNR data in the US for the purposes for which the original agreement was signed - i.e. by the Customs and Border Protection Service - because CAPS II and the Secure Flight programme are dead.

In his article ten days ago, the US Secretary of Homeland Security Michael Chertoff complained of being handcuffed and prevented from using all available resources. He wants to analyse PNR records in conjunction with current intelligence, to identify high-risk travellers who are 'unnamed threats', and to share the information routinely with other homeland security sections, such as immigration, as well as the FBI and, indeed, 'our allies in London'. So we do not need a European PNR system: we will get it by the back door.

The Chertoff vision is of data-mining and profiling on the basis of past and assumed future behaviour and stereotypes of potential terrorists. This takes us well beyond the simple checking of people against watch lists, for which APIS data - i.e. name, date of birth, nationality and passport number - is quite sufficient. We have not begun to tackle the risks of this, so we need a very good explanation of what PNR data is being used for in the United States and what profiling techniques are being used. We need strict and legally-binding purpose- and access-limitation provisions.

Similar concerns arise in the context of the EU plans for European PNR and so-called 'positive profiling'. Under the 2004 EU APIS Directive, governments gave themselves the power to use the personal data for law-enforcement purposes 'in accordance with their national law and subject to the data protection provisions under Directive 95/46/EC'. Surely the Court judgment on the US PNR agreement has shown that Directive 95/46/EC cannot be the legal basis for data used for security purposes? Therefore we need the third-pillar measure. Has the Commission thought about this?

I agree with Commissioner Frattini and Mrs in 't Veld on the need for a coherent EU policy. If you look at this PNR topic, the SWIFT scandal or CIA rendition, you see a pattern of a disunited Europe: Member States running round like headless chickens, subject to divide and rule by the United States. We are not even a reliable partner: we are not even ratifying the agreements like Europol protocols, which would allow cooperation with the FBI. We are ineffective, dysfunctional and we are letting our citizens down. We must stop this incoherence and achieve a clear and assertive EU competence, but that policy must be determined to safeguard our privacy. Can we trust the Commission on that?