3.

Concerning the protection of personal data: (a) Lawfulness, fairness and transparency of processing: there needs to be a lawful basis for the processing of personal data, in order to make individuals aware of the risks, safeguards and rights in relation to the processing of their personal data and of how to exercise their rights in relation to the processing. (b) Purpose limitation: the purposes for which PNR data may be used by authorities should be clearly set and should be no wider than what is necessary in view of the aims to be achieved, in particular for law enforcement and border security purposes to fight terrorism and serious crime. (c) Scope of PNR data: the PNR data elements to be transferred by airlines should be clearly identified and exhaustively listed. This list should be standardised to ensure that such data is kept to the minimum, while preventing the processing of sensitive data, including data revealing a person’s racial or ethnic origins, political opinions or religious or philosophical beliefs, trade union membership, health, sexual life or sexual orientation. (d) Use of PNR data: the further processing of the PNR data should be limited to the purposes of the original transfer, based on objective criteria and subject to substantive and procedural conditions in line with the requirements applicable to the transfers of personal data. (e) Automated processing of PNR data: automated processing should be based on objective, non-discriminatory and reliable, pre-established criteria and should not be used as the sole basis for any decisions with adverse legal effects or seriously affecting a person. (f) Data retention: the period of retention of the PNR data should be restricted and not be longer than necessary for the original objective pursued. Deletion of the data should be ensured in accordance with the legal requirements of the source country. At the end of the retention period, the PNR data should be deleted or anonymised. (g) Disclosure of PNR data to authorised authorities: the further disclosure of PNR data to other government authorities within the same State or to other ICAO Member States on a case-by-case basis may only take place if the recipient authority exercises functions related to the fight against terrorism or serious transnational crime and ensures the same protection as that afforded by the disclosing authority. (h) Data security: appropriate measures must be taken to protect the security, confidentiality and integrity of the PNR data. (i) Transparency and notice: subject to necessary and proportionate restrictions, individuals should be notified of the processing of their PNR data and be informed about the rights and means of redress afforded to them. (j) Access, rectification and deletion: subject to necessary and proportionate restrictions, individuals should have the right to get access to, and the right to rectification of, their PNR data. (k) Redress: individuals should have the right to effective administrative and judicial redress in case they consider that their rights to privacy and data protection have been infringed. (l) Oversight and accountability: the authorities using PNR data should be accountable to and supervised by an independent public authority with effective powers of investigation and enforcement that should be in a position to execute its tasks free from any influence, in particular from law enforcement authorities.