Frits Bolkestein

No. 82/03
December 16, 2003

Following months of negotiations with the United States on the Passenger Name Record (PNR) issue, EU Commissioner Frits Bolkestein, whose responsibilities include the protection of EU citizens’ personal data, announced today that the European Commission will adopt an “adequacy finding” on transfers of PNR to the US Bureau of Customs and Border Protection.  

The Commission gave its agreement to this proposal today. The full text of the proposal is available at: http://europa.eu.int/comm/internal_market/privacy/docs/adequacy/apis-communication/apis_en.pdf 

The Commission will submit a formal proposal to the European Parliament and a member-state regulatory committee in February, for their opinions, with a view to having an Adequacy Finding in place by mid-2004. 

Commissioner Bolkestein, in remarks to the European Parliament (excerpted below), said the present arrangement should be time-limited. The adequacy finding will expire after three-and-a-half years unless the two sides agree on terms for their prolongation. “This will allow not only to test the solidity of the arrangements we have agreed with the US to see how it works in practice but also to review matters in the light of other developments,” Bolkestein said.

In parallel, and as part of the negotiated package, the Commission will draw up the text of an international agreement with the United States to address the issues of reciprocity (the transfer of data from the US to the EU once it establishes its own system in 2004) and transfer of data to foreign authorities, not covered by the Adequacy Finding. The intention is to have the Adequacy Finding and the Agreement in place at the same time.

The following are extracts of the Commissioner’s remarks in Strasbourg today to the European Parliament’s Committee on Citizens' Freedoms and Rights, Justice and Home Affairs and Legal Affairs and the Internal Market. In it, Commissioner Bolkestein paid tribute to US Secretary of Homeland Security Tom Ridge for his leadership and flexibility in the discussions.  

“The Commission took the high road and sought improvements from the US in the way they process PNR. This was by no means easy. It has taken protracted discussions at both officials' and political level. But the US leadership were finally persuaded of the need for flexibility. In the end, the US has made a number of important concessions. It is to their credit that they attached sufficient importance to obtaining our co-operation that they were prepared to do this.  

“Firstly, clear limits on the amount of data to be transferred with a closed list of 34 elements. Furthermore, the US has undertaken not to require airlines to collect any data where any of these 34 elements would be empty. In practice, most PNRs consist of no more than 10-15 items.  

“Secondly, a significant movement on the length of data storage. The US has agreed to cut its initially proposed fifty year period to 3 ½ years. This is related to the expiry of the whole arrangement after 3 ½ years. We have thus managed to link the lifetime of the agreement with the duration of the retention period.  

“This sunset clause will give us the opportunity to revisit all the questions and decide in the light of experience what should continue and what not. Hopefully, the EU will have developed by then its own policy on the use of PNR for law enforcement purposes. The US debate on data privacy will also have evolved.  

“The third important success we achieved is that the arrangement will not cover the US Computer Assisted Passenger Pre-Screening System (CAPPS II). The latter will only be considered in a second round of discussions yet to come. In any case, such discussions can only conclude once Congress' privacy concerns have been met, and so far they have not.  

“Fourthly, we obtained stronger guarantees with respect to overall US compliance. The US finally accepted after refusing it earlier in our talks an important safeguard in the form of a joint review, to be carried out together with EU authorities at least every year. We have thus secured a way to ascertain how well the US implements its Undertakings.  

“The fifth useful development regards redress for individual EU passengers. Passengers whose complaints to the Department of Homeland Security have not been satisfactorily resolved by the DHS or its Privacy Office. Parliament has rightly so stressed this issue in its October Resolution. The US is now ready to recognise the right of EU data protection authorities to represent EU citizens.  

“Finally, all categories of sensitive data will be deleted, and there will be no bulk sharing of data with other agencies.  

“On the question of purpose limitation, we had insisted since the start that the unusually intrusive nature of this new information instrument could only be justified in relation to the threat posed by terrorism. When I last reported to you, the US side was still adamant that they wanted to use PNR data also for fighting serious domestic crime. I can now report to you that the US side has agreed to make the deletion we sought from the purpose limitation text. It now only refers to ‘terrorism and related crimes’ and to ‘other serious crimes, including organized crime, of a trans-national nature.’ Domestic crime is thus excluded.  

“The Commission believes the adequacy finding is now the right solution for a combination of reasons:  

“The final important progress agreed by the US means that 3 of the 4 major issues we had sought from them back in June have been delivered. On the fourth, which was the need for an independent redress mechanism, the Department of Homeland Security is the first US government department to appoint a Chief Privacy Officer. This officer, though part of the Department and not strictly independent, has a good measure of organizational autonomy and will in particular report annually to Congress. Secretary Ridge has said, moreover, that the Privacy Officer's rulings on complaints will be binding on the Department. I think a reasonable response to this is, ‘Let us see how all this works in practice.’”