UK opts in to EU PNR Agreement with the US

The UK has opted in to the EU Passenger Name Record (PNR) Agreement with the US. Minister of State for Immigration, Damian Green, said PNR data was “vital” to ensure public safety against terrorism and serious crime.

“The UK, in common with many other EU Member States and third countries, places considerable value on the collection and analysis of PNR data (that data collected by carriers in the exercise of their business) for the purpose of preventing terrorism and serious crime. The appropriate use of PNR data is vital in keeping the public safe,” Mr Green said in a written ministerial statement.

PNR data is mainly used as a criminal intelligence tool to identify potential passenger risks and to provide law enforcement authorities with data prior to the arrival or departure of a flight.

PNR data typically includes personal information such as home addresses, mobile phone numbers, frequent flyer information, email addresses and credit card details.

“We fully recognise the importance of working with partners outside the EU given that the threats we face are global in nature and, in common with other EU Member States, we view the US as a key partner,” added Mr Green.

“The Government also believes that clear PNR agreements between the EU and third countries play a vital role in removing legal uncertainty for air carriers flying to those countries, and help ensure that PNR information can be shared quickly and securely, with all necessary data protection safeguards in place. It is for this reason the Government has opted in to the EU-US Agreement on the exchange of PNR data.”

The agreement replaces the EU-US PNR Agreement which has been applied provisionally since July 2007.

Despite civil liberties and privacy concerns, Mr Green said that privacy and security could be balanced.

“The coalition government is firmly committed to protecting the security of UK citizens and to defending civil liberties. Our experience is that both security and privacy are possible. We must resist trading one off against the other as some would wish us to do.

“We are firmly committed to consistency in our approach to civil liberties and will seek to translate our domestic agenda to the EU level – this includes purpose limitation; rigorous evidence-based arguments; the principles of necessity and proportionality; stringent data protection safeguards, especially when handling sensitive personal data; independent data protection oversight; and, of course, full compliance with EU law and the EU Treaties.”

The agreement:

•Restricts the purposes for which data can be processed to the prevention of and combating of terrorist offences and serious transnational crime;

•Makes express provision for data security;

•Requires data to be masked after six months and transferred to a dormant database after five years. Data may be retained in the dormant database for a period of up to ten years, during which additional controls will apply (including a more restricted number of personnel authorised to access it as well as a higher level of supervisory approval required);

•Provides that masked data can only be re-personalised in connection with an identifiable case, threat or risk. After five years in the dormant database (ten years in total) data can only be re-personalised for the purpose of preventing and combating terrorist offences;

•Provides that sensitive personal data must be filtered out and may only be accessed in exceptional circumstances where the life of an individual may be imperilled or seriously impaired;

•Provides for independent review and oversight by Departmental Privacy Officers with a proven record of autonomy, such as the Department of Homeland Security’s Chief Privacy Officer;

•Sets out rights of access, rectification and erasure and redress;

•Regulates the transfer of PNR data to other US Government authorities;

•Only permits onward data transmission to a third country on