The European Commission on Wednesday presented a proposal for a European Union (EU) Passenger Name Record (PNR) Directive to fight serious crime and terrorism.
The proposal obliges air carriers to provide EU Member States with data on passengers entering or departing from the EU, whilst guaranteeing a high level of protection of privacy and personal data.
The Commission lays down common rules for EU Member States to set up national PNR systems that carry data consisting of information provided by passengers and collected by carriers during the reservation and booking of the tickets and when checking in on flights.
In practice many law enforcement authorities in Member States already collect PNR data on a case-by-case or on a flight-by-flight basis, but the proposal would allow for a more systematic use of the data for all relevant flights and across all Member States, avoiding uneven levels of protection of passengers’ personal data, as well as security gaps, increased costs, and legal uncertainty for air carriers and passengers.
The Commission is proposing that air carriers transfer data on passengers on international flights held in the carriers’ reservation systems to a dedicated unit in the Member State of arrival or departure.
Member States will analyze and retain the data for the purpose of preventing, detecting, investigating and prosecuting serious crime and terrorist offenses.
It also proposes strong protection of privacy and personal data, as PNR data may not be used for any purpose except fighting serious crime and terrorist offenses.
Law enforcement authorities in Member States must make the data anonymous 1 month after the flight, and data must not be retained for more than five years in total.
In addition, sensitive data that could reveal racial or ethnic origin, political opinions, or religious beliefs may never be transferred by air carriers to, or in any way used by, the Member States, the Commission explained.
Furthermore, Member States will not be able to access the databases of air carriers, the data must be requested and sent to them by the concerned air carriers.
Clear rules on passengers’ right to accurate information about the collection of PNR data are also introduced, as well as rules giving passengers the right to access, rectify, and delete their data, and to compensation and judicial remedies.
With the U.S., Canada and Australia currently obliging EU air carriers to make PNR data available for all persons who fly to and from these countries and the combined experience of the EU Member States that use PNR data, confirms that PNR data are necessary to fight serious crime and terrorism, the Commission said.
“Common EU rules are necessary to fight serious crime such as drugs smuggling and people trafficking as well as terrorism, and to ensure that passengers’ privacy is respected and their rights fully protected in all Member States,” said Cecilia Malmström, European Commissioner for Home Affairs. “The proposal requires Member States to anonymise all PNR data that is collected.”
