EN    EN EN 
EN    EN  EUROPEAN COMMISSION 
Brussels, 2.2.2011 
SEC(2011) 133 final 
  
COMMISSION STAFF WORKING PAPER 
 
SUMMARY OF THE IMPACT ASSESSMENT  
 
Accompanying document to the 
  
Proposal for a 
 
EUROPEAN PARLIAMENT AND COUNCIL DIRECTIVE 
 
on the use of Passenger Name Record data fo r the prevention, detection, investigation 
and prosecution of terrorist offences and serious crime  
  
{COM(2011) 32 final} 
{SEC(2011) 132 final} 
EN 2   EN 1. PROCEDURAL ISSUES AND CONSULTATION OF INTERESTED PARTIES  
On 6 November 2007 the Commission adopted a proposal for a Council Framework Decision 
on the use of Passenger Name Record (P NR) data for law enforcement purposes1. The 
proposal was accompanied by an Impact Assessment2. The proposal was extensively 
discussed in the Council working groups and the progress made in the discussions was 
endorsed by the JHA Council in 2008. The discu ssions on the proposal in the working groups 
allowed consensus to be reached on most  of the provisions of the proposal.  
Upon entry into force of the Treaty of Lisbon on 1 December 2009, the Commission proposal, 
not yet adopted by the Council by that date, b ecame obsolete. ‘The Stockholm Programme — 
An open and secure Europe serv ing and protecting the citizens’3 calls on the Commission to 
present a proposal for the use of PNR data to  prevent, detect, investigate and prosecute 
terrorism and serious crime. 
For the 2007 Impact Assessment, the Commission consulted all the stakeholders. Following 
the adoption of the Commission’s 2007 proposal , all stakeholders, namely the European 
Parliament, the Article 29 Data  Protection Working Party, th e European Data Protection 
Supervisor, the Fundamental Rights Agency and airline associations, published their positions 
on it. The purpose of this report is to examine the possibility of adopting a new proposal to 
replace the 2007 proposal under the provisions and procedures of the Lisbon Treaty It aims to 
answer criticisms raised by the stakeholders and include all new facts and experience gained 
since 2007. 
2. PROBLEM DEFINITION  
2.1. Threat of terrorism and serious crime 
Over the last decade the European Union and other parts of the world have experienced a 
spread of cross-border crime. According to  the EU Source book, there were 143.948 criminal 
offences per 100.000 population in the EU Memb er States in 2007 (e xcluding Italy and 
Portugal for which data were not made availabl e), ranging from 14.465 offences in Sweden to 
958 in Cyprus. Europol’s EU Organised Cr ime Threat Assessment 2009 found that most 
organised crime threats have an international dimension and that  most serious organised crime 
involves international travel.  
Terrorism currently constitutes one of the gr eatest threats to security, peace, stability, 
democracy and fundamental rights. The threat of terrorism is not restricted to specific 
geographical zones. Europol’s ‘EU Terrorism  Situation and Trend Report 2010’, despite 
finding that terrorism decreased in the EU dur ing 2009, stressed that the threat remains real 
and serious. Most terrorist campaigns, especia lly the type that Eu ropol calls ‘Islamist 
terrorism’, have a transnational character. 
2.2. PNR data and their uses 
PNR data have been used for several year s, mainly by customs and law enforcement 
authorities around the world. It is possible to use PNR data for police and judicial matters: 
• re-actively:  in investigations, prosecu tions, unravelling of networks after a crime has been 
committed. In order to allow law enforcement authorities to go back in time far enough, a 
                                                 
1 COM(2007) 654. 
2 SEC(2007) 1453. 
3 Council document 17024/09, 2.12.2009. 
EN 3   EN commensurate period of retention of the data by law enforcement authorities is necessary 
in such cases; 
• in real time: prior to the arrival or departure of pa ssengers in order to prevent a crime, 
watch or arrest persons before a crime has been committed or because a crime has been or 
is being committed. In such cases PNR data ar e especially useful for running such data 
against predetermined assessment criteria in or der to identify persons who were previously 
‘unknown’ to law enforcement authorities and for running the data against databases of 
persons and objects sought; 
• pro-actively:  for analysis and creation of assessment criteria, which can then be used for a 
pre-arrival and pre-departure assessment of passengers. In order to carry out such an 
analysis of relevance for terrorist offences and serious crime, a commensurate period of 
retention of the data by law enforcement au thorities is necessary in such cases. 
It is necessary to impose those legal obligati ons on air carriers for the following reasons: 
First, PNR data enable law enforcement authoriti es to identify persons , who were previously 
"unknown", i.e. persons previously unsuspected of involvement in serious crime and terrorism, but whom an analysis of the data s uggests may be involved in such crime and who 
should therefore be subject to further examinat ion by the competent aut horities. Identifying 
such persons helps law enforcement authoritie s prevent and detect serious crimes including 
acts of terrorism. To achieve this, law enforcement authorities need to use PNR data both in real-time to run PNR against predetermined assessment criteria which indicate which 
previously ‘unknown’ persons re quire further examination and pro-actively for analysis and 
creation of assessm ent criteria.  
For example, an analysis of PNR data may give indications on the most usual travel routes for 
trafficking people or drugs which can be made part of assessment criteria. By checking PNR 
data in real-time against such criteria, crim es may be prevented or detected. A concrete 
example given by a Member State on traffick ing in human beings is a case where PNR 
analysis uncovered a group of hum an traffickers always travel ling on the same route. Using 
fake documents to check in for an intra-EU flight, they would use authentic papers to 
simultaneously check in for another flight bo und for a third country. Once in the airport 
lounge, they would board the intr a-EU flight. Without PNR it w ould have been impossible to 
unravel this human trafficking network. 
The combined pro-active and real-time use of  PNR data thus enable law enforcement 
authorities to address the threat  of serious crime and terroris m from a different perspective 
than through the processing of other categories of personal data: as explained further below, 
the processing of personal data  available to law enforcement authorities through existing and 
planned EU-level measures such as the Directive on Advance Passenger Information,
4 the 
Schengen Information System (SIS) and the s econd-generation Schengen Information System 
(SIS II) do not enable law enforcement authorities to identify 'unknown' suspects in the way that the analysis of PNR data does.  
Second, PNR data help law enforcement authoritie s prevent, detect, inve stigate and prosecute 
serious crimes, including acts of terrorism, after a crime has been committed. To achieve this, law enforcement authorities need to use PNR data in real-time to run the PNR data against 
various databases of 'known' pers ons and objects sought. They also  need to use PNR data in a 
re-active  manner to construct evidence and, where rele vant, to find associates of criminals and 
unravel criminal networks.  
                                                
 
4 Directive 2004/82/EC of 29 August 2004. 
EN 4   EN For example, the credit card information whic h is part of the PNR data may enable law 
enforcement authorities to identify and prove links between a person a nd a known criminal or 
criminal organisation. An example given by a Member State relates to a large scale human and drug trafficking involving a Member State and third count ries. Cartels were importing 
drugs to several destinations in Europe. Th ey were using drugs swallowers who were 
themselves trafficked persons. They were id entified on the basis of having bought the ticket 
with stolen credit cards on the ba sis of PNR. This led to arrests in the Member State. On this 
basis, an assessment criterion was created which itself led to several arrests in other Member 
States and third countries.  
Finally, the use of PNR data prio r to arrival allows law enfor cement authorities to conduct an 
assessment and perform a closer screening only  of persons who are most likely, based on 
objective assessment criteria and previous experi ence, to pose a threat  to security. This 
facilitates the travel of  all other passengers and reduces the risk of passengers being subjected 
to screening on the basis of unlaw ful criteria such as nationality or skin colour which may 
wrongly be associated with secu rity risks by law enforcement au thorities, including customs 
and border guards.  
Arrangements for the transmission of PNR data in the context of the fight against terrorism 
and transnational organised crime have been  concluded between the EU and the United 
States, Canada and Australia. It can be anticipat ed that more third countries are likely to 
request the provision of PNR data from air carriers opera ting flights from the EU. 
The United Kingdom, France and Denmark have al ready enacted primary legislation for the 
capture and use of PNR data. Such national meas ures diverge in several respects and it is 
likely that once the complete re gulatory framework in these Me mber States is adopted, there 
will be further divergence. As more Member St ates are preparing their own PNR legislation, 
up to 27 considerably diverging systems could be created, resulting in uneven levels of data 
protection, security gaps, increased cost s and legal uncertainty for carriers.  
2.3. EU right to act and subsidiarity 
The right of the EU to act in this field is ensh rined in Articles 82 and 87 in Title V of Chapter 
V of the Treaty on the Functioning of the Eur opean Union. As most of the categories of 
serious crimes, such as drugs and human traffi cking, include internatio nal travel at some 
stage, it is essential that authorities collect, process and exchange PNR data for increasing the 
internal security of the EU. Because of the free circulation of persons in the Schengen area, it 
is necessary for all Member States to use PN R data, in order to avoid security gaps. In 
addition, action at EU level will ensure harmonised provisions on safeguarding data 
protection, reduced costs and lega l certainty for the carriers. 
3. O
BJECTIVES  
3.1. Policy objectives 
The general objective is to increase the internal security of the EU, while respecting the right 
to protection of personal data and other fundame ntal rights, with the following specific policy 
objectives: 
(1) To prevent and redu ce terrorist activities and othe r serious crime through a global 
approach to the use of PNR da ta and avoiding security gaps. 
(2) To ensure that individuals’ right to th e protection of their personal data is duly 
respected when PNR data are collected and processed by facilitating the exchange of 
EN 5   EN PNR data among responsible authorities a nd ensuring that access to PNR data is 
limited to what is necessary. 
(3) To provide legal certainty to and reduce co sts for carriers by reducing differences in 
legal and technical require ments imposed on carriers. 
3.2. Fundamental rights considerations 
The impacts on fundamental rights in the Impact Assessment have been assessed in line with 
the Fundamental Rights "Check List" as provid ed for in the Commission's Strategy for the 
effective implementation of the Charter of  Fundamental Rights by the European Union5. 
The use of PNR data would interfere with the fundamental rights to th e protection of private 
life and to the protection of personal data. Th is may be made subject to limitations and 
conditions, provided such interfe rence is carried out ‘in accordance with the law’ and is 
‘necessary in a democratic society’. As the proposed actions aim to combat terrorism and other serious crime, they would serve an  objective of general interest able to justify such limitations, 
subject to the principle of proportionality. 
Any proposed action would fall within the scope of Title V of Chapter V TF EU on police 
cooperation. The Framework D ecision 2008/977/JHA on the protection of personal data 
processed in the framework of police and judicial cooperation in criminal matters
6 would only 
apply to those aspects of any proposed action where some personal data would be transmitted 
between Member States and theref ore leave a gap for personal data processed at national level 
only. There are currently no EU rules regulating such processing of personal data at national 
level. The most suitable solution would be that the data protection safeguards of any proposed 
measure are in line with the Framework Decision 2008/977/J HA. This would guarantee a 
uniform standard of protection of personal data.  
A commensurate period during which the data are retained by the relevant authorities is 
necessary. On the method of transmission of the data by the carriers, the advantages of the 
‘push’ system over the ‘pull’ system are indis putable, and therefore th e ‘push’ system should 
apply for all transmissions. 
As regards criticisms of ‘profiling’, EU data protection laws grant ever y individual the right 
not to be subject to a decision which prod uces legal effects co ncerning him/her or 
significantly affects him/her and which is ba sed solely on automate d processing of data 
intended to evaluate personal as pects relating to him/her. Any automated individual decision 
should be fully verified and confirmed by a hu man being and comprise arrangements allowing 
the data subject to put hi s or her point of view. 
4. POLICY OPTIONS  
The Impact Assessment examines four main options. 
Option A . Refraining from addressing the issue at EU level and maintaining the status quo. 
Option B . Options addressing the structure of the PNR system: 
B.1: Decentralised collection and processing of  data by Member States; B.2: Centralised 
collection and processing of data at EU level. 
                                                 
5 COM(2010) 573, 19.10.2010 
6 Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data 
processed in the framework of police and judicial cooperation in criminal matters (OJ L 350, 
30.12.2008, p. 60). 
EN 6   EN Option C . Options on the limitation of the purpose: 
C.1: Access for terrorist offences and seri ous crime only; C.2: Access for terrorist 
offences and serious crime and other policy objectives. 
Option D . Options on the modes of transport: 
D.1: Air carriers only; D.2: Air, sea and rail carriers. 
Option E. Voluntary/enhanced cooperation. This opt ion of encouraging cooperation between 
the Member States in the field wa s rejected at th e initial stage. 
5. COMPARISON OF POLICY OPTIONS AND THEIR IMPACTS  
The options were assessed in relation to their impacts in terms of increasing security in the 
EU, increasing the protection of personal data , costs for public authorities, costs for 
carriers/competition in the inte rnal market, relations with th ird countries, and encouraging a 
global approach. 
Option A on maintaining the status quo presents limited advantages with respect to increasing 
the security of the EU, but otherwise has negative impacts, in the sense of creating 
administrative difficulties and costs stemming fr om numerous diverging national systems.  
On Option B, the decentralised collection of da ta (Option B1) presents advantages over the 
centralised collection of such data (Option B2) in  relation to increasing the security of the EU. 
The option of centralised collecti on of data would have a high ri sk of failure because it cannot 
guarantee adequate cooperation between the Member  States and at a practical level the system 
would be cumbersome and costly to operate. Op tion B1 would be more costly compared with 
Option B2. However, the advantages for secur ity outweigh the disadvantages in terms of 
costs. 
On purpose limitation, Option C2 presents some  advantages for security compared with 
Option C1, but involves substan tially more interference with data protection and more costs 
than Option C1. Option C2 on extending the use of PNR data to other purposes seems 
disproportionate at this stage. 
On the modes of transport, Option D2 presents advantages for security compared with Option 
D1 as it would cover more modes of transp ort and more passenger s, but involves more 
interference with data prot ection and more costs than Op tion D1, under which the measure 
would be applied exclusively to  air carriers. Option D2 on exte nding the scope of the measure 
to cover sea and rail travel seems pr emature, at least at this stage.  
6. PREFERRED OPTION  
The creation of a new legislativ e proposal applicable to trav el by air with decentralised 
collection of data for the purpose of preventi ng, detecting, investigating and prosecuting 
terrorist offences and other serious crime seem s to be the best policy option at this stage 
(combination of Options B1, C1 and D1). It w ould provide better means of increasing security 
in the EU, while ensuring that interference with data protection is kept to a minimum and that 
costs are kept at an  acceptable level.  
An analysis of the costs of th e preferred policy option was carri ed out for the purposes of the 
2007 Impact Assessment.  According to the 2007 calculations, th e overall cost of the preferred 
option for public aut horities and carriers would be as follows: 
In relation to public authoritie s, the estimated costs for all Member States together are : 
EN 7   EN Set-up cost (non-recurring cost) €  614  833  187 
BUT assuming an amortisation period of five years €  122  966  637 
Annual personnel costs (recurring) €  11 686  749 
Annual maintenance costs (recurring) €  61 483  319 
In relation to all EU carriers together, such costs are : 
Set-up cost for PUSH (non-recurring) €  11 647  116 
BUT assuming an amortisation period of five years €  2 329  423 
Transmission costs for PUSH twice per passenger (recurring) €  2 250  080 
Personnel and maintenan ce costs (recurring) €  5 435  321 
In 2008 the Commission published a tender for a study on ways of setting up an EU PNR 
network. The report ‘Study on ways of setting up an EU network on exchange of Passenger 
Name Record (PNR) data for law enforcement purposes’7 was issued in 2009 and includes a 
new assessment of the costs. 
In relation to public authoritie s, the estimated costs for all Member States together are:  
Set-up cost (non-recurring cost) €  221  000  000 
BUT assuming an amortisation period of five years €  44 200  000 
Annual personnel costs (recurring) €  11 686  749 
Annual maintenance costs (recurring) €  61 483  319 
In relation to carriers together, such costs are:  
Set-up cost for PUSH (non-recurring) €
 100  000 * 120 EU-based carriers = €  12 000  000 
€ 100  000 * 80 non-EU-based carriers = €  8 000  000 
BUT assuming an amortisation period of five years €  4 000  000 
Transmission costs for PUSH twice per passenger (recurring) €
 33 500 per airline per year*120 ca rriers*3connections*2 PUSH €  24 120  000 
Personnel/maintenance costs (recurring) €  6 240  000 
The 2009 figures indicate a decrease in costs for public authorities to set up an EU PNR 
system but an increase in costs for carriers in  comparison with the cost calculation performed 
in 2007. The actual costs will be somewhere in be tween these two assessme nts and, at least as 
regards the costs to carriers, most likely clos er to the 2007 assessments, which are based on 
the market prices taken directly from carriers. 
Even with the very high calculations of 2009, if  the carriers decide to pass on their costs to 
passengers, this would result in  a surcharge of less than €  0.10 per ticket, a negligible amount 
in relation to the overa ll price of tickets. 
                                                 
7 Authors: Accenture and SITA. 
EN 8   EN 7. MONITORING AND EVALUATION  
Each Member State could prepar e an annual report on the impl ementation of the systems. The 
Commission should assess th e operation of the Directive within four years from its entry into 
force to monitor whether the use of PNR data has met its objectives, whether Member States have complied with their obligations and wh ether the system has been successful.  
The Commission should also consider the possibili ty of extending the measure to internal EU 
flights. This would provide th e opportunity to have a transiti onal period and gain experience 
from the functioning of the first PNR Directive.