EU: European Commission PNR proposal: Summary of impact assessment
01 November 2007
EU-PNR: Tony Bunyan, Statewatch editor, comments:
"Unless stopped in its tracks it is just a question of time before the scope of the EU-PNR scheme is extended to cover all crime, flights inside and between Member States and sea, land and rail travel as well."
European Commission PNR proposal: Summary of impact assessment (SEC 1422) (pdf) The EU-PNR scheme plans for the personal data of all travellers by air in and out of the EU to be checked against "watchlists". The terminology in this Impact Assessment at times refers to "terrorism and organised crime" and at other times to "terrorists and criminals" suggesting that the intended scope of the measure may be changed in the near future. This impression is confirmed when the assessment speaks of:
"a wider application at a later stage. It should be left to member states to extend the scope of the proposal to other modes of transport at this point.... the majority of consulted parties agree the scope of the proposal should be limited to air transport as a first step, with the possibility of extending it to other forms of transport at a later stage...At this stage, it is thought disproportionate to extend the scope of the proposal to flights from one Member State to another Member State and to internal flights within a Member State"
On data protection the assessment is equally confused. First, it refers to the draft Framework Decision on personal data in police and judicial matters which has yet to be agreed but which offers little or no protection - and anyway, only covers the transfer of data between member states not national laws. The assessment goes on to states that member states should:
"the Convention 108 for the Protection of Individuals with Regard to Automatic Processing of Personal Data of the Council of Europe. In practice, all Member States should also already have national legislation in place to cover data processing by law enforcement authorities."
The term "should" tells us that the Commission does not know. Moreover, the failure to fully incorporate of Council of Europe's Convention 108 of 1981 plus Recommendation 15 of 1987 and its two Additional Protocols in the proposed Framework Decision is highlighted by EU Data Protection Commissioners - see story below.
For full background and the European Commission's PNR proposal see
Observatory: EU surveillance of passengers (PNR) (link)