Zorgen over opslag passagiersgegevens (en)

EDPS/07/13

Thursday, 20 December 2007

EDPS expresses serious concerns about EU PNR proposal

The European Data Protection Supervisor (EDPS) today issued his Opinion onthe recent proposal of the Commission for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes. The proposal involves obligations for air carriers to transmit data about all passengers on flights to or from an EU Member State.

The Opinion emphasizes the major impact the proposal would have on privacy and data protection rights of air passengers. While acknowledging that the fight against terrorism is a legitimate purpose, the EDPS expresses serious concerns about the necessity and proportionality of the proposal which, in his view, are not sufficiently established in the proposal. In addition, the EDPS takes a critical stance on the lack of clarity in relation to various aspects of the proposal, in particular the applicable legal framework, the identity of the recipients of personal data, and the conditions of transfer of data to third countries.

Peter Hustinx, EDPS, says : The fight against terrorism can be a legitimate ground to apply exceptions to the fundamental rights to privacy and data protection, but only within certain limits. The necessity of intended measures must be supported by clear and undeniable elements, and their proportionality must be demonstrated. These two aspects are essential conditions and they are clearly not fulfilled in this case."

The Opinion focuses on four key issues and draws the following conclusions:

  • legitimacy of the processing: the proposal does not provide for sufficient elements of justification to support and demonstrate the legitimacy of the processing of data;
  • applicable legal framework: a significant lack of legal certainty is noted as regards the regime applicable to the different actors involved in the matter;
  • the identity of data recipients: the draft Decision does not provide for any specification concerning the identity of the recipients of personal data collected by airlines companies;
  • transfer of data to third countries: it is imperative that conditions of transfer of PNR data to third countries be coherent and subject to a harmonised level of protection.

Finally, the EDPS advises not to adopt the draft Decision before the new Lisbon Treaty's entry into force, so that it can follow the co-decision procedure foreseen by the new Treaty and the European Parliament is fully involved.

The Opinion is available on our website.

For more information, please contact the EDPS Press Service at: +32 2 283 19 00

EDPS - the European guardian of personal data protection

www.edps.europa.eu