# EUR-Lex - 52013DC0844 - EN

*|*

# 52013DC0844

**REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of passenger name records to the United States Department of Homeland Security /* COM/2013/0844 final <EMPTY> */**

			*

			*

REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND
THE COUNCIL

on the joint
review of the implementation of the Agreement between the European Union and
the United States of America on the processing and transfer of  passenger name
records to the United States Department of Homeland Security

The current Agreement between the United States and the European Union on the use and transfer of passenger name records to
the United States Department of Homeland Security entered into force on 1 July
2012.

The Agreement
provides for a first joint review one year after its entry into force and
regularly thereafter as jointly agreed. This joint review was carried out on 8
and 9 July 2013 in Washington. Its main focus was
the implementation of the Agreement, with particular attention to the method of
transmission of passenger name records (PNR) as well as the onward transfer of
PNR as set out in the relevant articles of the Agreement, and in accordance
with recital No 18 of the Agreement.

The joint review is based
on the methodology developed between the EU and the U.S. teams for the first
joint review of the 2004 PNR Agreement, which took place in September 2005. 
The first part of this methodology consisted of a questionnaire sent by the
European Commission to the U.S. Department of Homeland Security (DHS) prior to
the joint review. DHS provided written replies to the questionnaire prior to
the joint review. The second part consisted of a field visit to a DHS operation
center by the EU team. The third part consisted of a meeting between
representatives of DHS, the U.S. Department of Justice and the U.S Department
of State, the EU team and the DHS Privacy Office, discussing in detail the
implementation of the Agreement.

Prior to the
joint review the DHS Privacy Office proceeded with an internal review of the
implementation by DHS of the Agreement. This review was conducted to determine
whether DHS is operating in compliance with the standards and representations
in the Agreement with the EU.

The EU team
found that DHS implemented the Agreement in line with the conditions set out therein.
For example DHS uses effective filters for filtering out data without a U.S. nexus as well as PNR data outside the 19 PNR categories described in the Annex to the
Agreement. The masking and deletion of sensitive data are respected and DHS has
stated that it has never accessed sensitive data for operational purposes.

DHS also implements its
commitments in relation to passenger rights, in particular as regards providing
appropriate information to passengers and implementing the right to access
without any exemptions. However, this should be read against the fourth
recommendation made below which addresses the need for more transparency on the
redress mechanisms available to passengers.

Sharing of data with
other domestic agencies is handled by DHS in line with the Agreement. Sharing
is carried out on a case-by-case basis, logged and takes place on the basis of
written understandings. Sharing of data with third countries is also interpreted
strictly, and is also in line with the Agreement.

As a general
recommendation, it is advised to envisage another internal review of the
Agreement by the DHS Privacy Office ahead of the next joint review.  The two
sides suggest organising the next joint review during the first half of 2015.

It is also recommended
to ensure as quickly as possible a full move to the “push” method and in any
case by 1 July 2014, as required under Article 15(4) of the Agreement.

It is further
recommended that the U.S. and the EU work together to promote the use of common
transmission standards, in particular the PNRGOV standard as developed by IATA,
airlines, and government. In this respect it would be welcomed if the
discussions in IATA on a common “Push” standard also would lead to a common
standard for ad hoc “push”.

Despite the
implementation of the Agreement, some improvements remain necessary. First, this concerns the commencement of the six months period
triggering the depersonalization of PNR under Article 8 (1) of the Agreement.
Currently the calculation of this period starts only as soon as a PNR is last
updated in the DHS Automated Targeting System (ATS) which holds the PNR, not
when PNR is loaded in ATS. It is recommended to start applying the six months
period as from the day the PNR is loaded in ATS (the so-called ATS Load Date)
which is the first day the data are stored in ATS, instead of the current
practice, which delays applying the six months period (until the last ATS
Update of the PNR).

Second, particular
attention should be paid to the use of the ad hoc “pull” method. It is
recommended that DHS, in addition to its current logs, keeps better records of
the reasons why the ad hoc “pull” method is applied in each case, which would
allow for a better assessment of the proportionality and a more effective
auditing of its use, which is meant to be an exception to the rule.

Third, DHS is requested
to respect its commitment to ensure reciprocity and pro-actively share
individual PNRs and analytical information flowing from PNR data with EU Member
States and where appropriate with Europol and Eurojust.

Fourth, it is advised to
provide more transparency on the redress mechanisms available under U.S. law. Such transparency should allow passengers who are not U.S. citizens or legal
residents to challenge DHS decisions related to the use of PNR data, in
particular when the use of such data may contribute to a recommendation to deny
boarding by carriers.

Lastly, DHS also
implemented measures that go beyond the Agreements’ requirements. DHS foresees
a notification to the European Commission within 48 hours of access to
sensitive PNRs. DHS has installed a new procedure to quarterly oversee and
review the implementation of the ATS and to review all travel targeting scenarios,
analysis and rules to ensure that they are proportionate to minimize the impact
on bona fide travellers’ civil rights, civil liberties and privacy, and to
avoid discrimination against travellers.

Notwithstanding
Article 23(1) on a joint evaluation of the Agreement four years after its entry
into force, a preliminary assessment of the question whether PNR serves the
purpose of supporting the fight against terrorism and other crimes that are
transnational in nature showed that PNR provides DHS with the possibility of
carrying out pre-departure assessments of all passengers up to 96 hours which
gives DHS sufficient time to carry out all the background checks before the
arrival of a passenger and prepare its response. This processing also supports DHS
when deciding if a passenger should board a plane or not. It also provides DHS
with the opportunity to perform risk assessments on the basis of scenario-based
targeting rules in order to identify the ‘unknown’ potential high-risk
individuals. PNR further provides the possibility to make associations between
passengers and identify criminals who belong to the same organised crime group.
According to DHS PNR is also successfully used for identifying trends of how
criminals tend to behave when they travel, for example by understanding which
routes they use.

The Joint
Review Report accompanying this Report consists of three Chapters. Chapter 1
provides an overview of the background to the review and the purpose and
procedural aspects of the exercise. Chapter 2 presents the main findings of the
joint review and the issues to be further addressed by DHS. This Chapter is
supplemented by Annex A which contains the questionnaire and DHS replies
thereto. Finally, Chapter 3 presents the overall conclusions of the exercise.
Annex B presents the composition of the EU and U.S. teams that carried out the
review exercise.