EN Official Journal of the European Union C 392/11

Executive Summary of the second Opinion of the European Data Protection Supervisor on the Proposal for a Directive of the European Parliament and of the Council on the use of Passenger Name Record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2015/C 392/09)

I. THE PROPOSAL AND ITS CONTEXT

1. Discussions on a possible Passenger Name Record (PNR) scheme within the EU have been developing since 2007, with the Proposal for a Council Framework Decision on the issue (1). The original Proposal intended to oblige the air carriers operating flights between the EU and third countries to transmit PNR data to competent authorities for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime. The EDPS issued an opinion on this proposal (2) and followed its developments.

2. On 2 February 2011, the Commission adopted a new Proposal for a Directive of the European Parliament and of the Council on the use of Passenger Name Records data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (hereafter ‘the Proposal’). The EDPS issued an Opinion on this new Proposal (3), where he made additional comments and remarks on the text regarding among others the necessity and the proportionality of the proposal, its scope, the exchange of information between Member States, and the retention of PNR data.

3. The Council adopted a general approach on the text proposed by the Commission on 23 April 2012 (4), in view to start the negotiations with the Parliament.

4. The legislative procedure has been in abeyance since the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE) rejected the Proposal on 24 April 2013 (5), questioning its necessity and proportionality. Recently, the discussions have been revived following the terrorist attacks that took place in Paris in January 2015 (6).

5. In its Resolution of 11 February 2015 on anti-terrorism measures (7), the European Parliament committed itself ‘to work towards the finalisation of an EU PNR Directive by the end of the year’ and urged the Commission ‘to set out the consequences of the ECJ judgment on the Data Retention Directive and its possible impact on the EU PNR Directive’. The European Parliament also encouraged the Council to make progress on the Data Protection Package so that the ‘trilogue’ negotiations on both the EU PNR Directive and the Data Protection Package could take place in parallel. The Commission was also invited to hear the views of independent experts from the law enforcement, security and intelligence communities and representatives of the Article 29 Working Party to discuss the necessity and proportionality of the PNR scheme.

6. In addition, the Resolution called on the Member States ‘to make optimal use of existing platforms, databases and alert systems at European level, such as the Schengen Information System (SIS) and the Advanced Passenger Information Systems (APIS)’ (8) and strongly encouraged ‘better exchange of information between Member States’ law enforcement authorities and EU agencies’ (9).

7. In this context, an updated report has been presented by the rapporteur for the LIBE Committee, on 17 February 2015 (10). Several modifications to the Commission proposal were proposed in this document, such as the inclusion of intra-EU flights. The Article 29 Working Party sent a letter to the LIBE Committee to submit its comments and remarks on the report (11). The LIBE Committee adopted its orientation vote on 15 July 2015 and agreed to enter into negotiations with the Council.

8. This EDPS Opinion will address the changes in the Proposal as proposed by the LIBE Committee and the Council in view of the trilogue negotiations that are due to begin by this month. This Opinion will take into account the Digital Rights Ireland judgement of the European Court of Justice (12) issued on 8 April 2014 (hereinafter ‘the DRI judgement’) and integrate it into its reasoning.

9. The EDPS acknowledges that Europe is facing serious terrorist threats and has to take meaningful action. The combat against terrorism and serious crime is a legitimate interest pursued by the legislator and the EDPS, as an EU independent supervisory institution, is not a priori in favour or against any measure. In full respect for the role of the legislator in assessing the necessity and the proportionality of the proposed measures, the EDPS respectfully analyses in the present Opinion their implications for the protection of the personal data of individuals and their privacy, taking into account the existing data protection and privacy legislative framework and case-law. This analysis relates to our mission to advise the institutions on the data protection implications of their policies, particularly when they have a more serious impact on the rights to privacy and data protection.

IV. CONCLUSION

62. The EDPS welcomes the various improvements made by the Council and the LIBE Committee on the Proposal, for example regarding the specific provisions on data protection, the presence of a Data Protection Officer, or a specific reference to the power of the supervisory authorities.

63. However, the essential prerequisite for a PNR scheme — i.e. compliance with necessity and proportionality principles — is still not met in the Proposal. The Proposal does not provide for a comprehensive evaluation of the ability of the current existing instruments to reach the purpose of the EU PNR scheme. In addition, it does not set forth any detailed analysis of the extent to which less intrusive measures could achieve the purpose of the EU PNR scheme. Finally, the non-targeted and bulk collection and processing of data of the PNR scheme amount to a measure of general surveillance. In the view of the EDPS, the only purpose which would be compliant with the requirements of transparency and proportionality, would be the use of PNR data on a case-by-case basis but only in case of a serious and concrete threat established by more specific indicators.

64. Since there is no information available to the effect that the necessity and proportionality of the measures proposed have been adequately demonstrated, the EDPS considers that the Proposal, even modified, still does not meet the standards of Articles 7, 8 and 52 of the Charter of Fundamental Rights of the Union, Article 16 of the TFEU and Article 8 of the ECHR.

65. The EDPS would encourage the legislators to further explore the feasibility against current threats of more selective and less intrusive surveillance measures based on more specific initiatives focusing, where appropriate, on targeted categories of flights, passengers or countries.

66. In addition to the essential shortcomings of the Proposal identified above, the main comments of the EDPS in the present Opinion concern the following aspects: — the Proposal should limit the data retention period to what is justified by objective criteria explaining the period retained; — the proposal should more explicitly provide that the PNR data may not be used for other purposes than the prevention, detection, investigation or prosecution of terrorist offences and serious transnational crimes; — a prior approval by a court or an independent administrative body should be obtained, in principle, upon a request of access to the data by a competent authority; — the Proposal should refer to appropriate safeguards guaranteeing the security of the data processed by the PIU; — the scope of the PNR scheme should be much more limited with regards to the type of crime. Additionally, the definition of ‘serious transnational crime’ and ‘immediate and serious threat to public security’ should be further defined; — the criteria required to access PNR data by the competent authorities should be better defined and more precise; — the legislators are invited to wait until the adoption of the new Data Protection Package to fully align the obligations of the Proposal with the new provisions adopted; — the evaluation of the Directive should be based on comprehensive data, including the number of persons effectively convicted and not only prosecuted, on the basis of the processing of their data.

Bruxelles, 24 September 2015. Giovanni BUTTARELLI European Data Protection Supervisor

(1) COM(2007) 654 final.

(2) Opinion of the EDPS of 20 December 2007 on the Proposal for a Council Framework Decision on the use of Passenger name record (PNR) data for law enforcement purposes (OJ C 110, 1.5.2008, p. 1).

(3) Opinion of the EDPS of 25 March 2011 on the Proposal for a Directive of the European Parliament and of the Council on the use of Passenger Name Record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.

(4) General Approach of the Council, text adopted on 23 April 2013, 8916/2.

(5) See Resolution of the European Parliament of 23 April 2013.

(6) See https://en.wikipedia.org/wiki/Charlie_Hebdo_shooting For the connection made with EU PNR proposals; see e.g. the statement by the members of the European Council following the Informal meeting of the Heads of State or Government Brussels, 12 February 2015: http://www.consilium.europa.eu/en/press/press-releases/2015/02/150212-european-council-statement-fight-against-terrorism/ and the report on implementation of measures by the EU Counter-Terrorism Coordinator: http://data.consilium.europa.eu/doc/document/ST-9422-2015-REV-1/en/pdf

(7) Resolution 2015/2530 of the European Parliament.

(8) Resolution, paragraph 11.

(9) Resolution, paragraph 22.

(10) The report is available on the following link: http://www.europarl.europa.eu/sides/getDoc.do?type=REPORT&mode=XML&reference=A8-2015-0248&language=EN

(11) Letter of 19 March 2015 from the Article 29 Working Party to the Chairman of the LIBE Committee.

(12) CJUE, Digital Rights Ireland Ltd,8 April 2014, in joined cases C-293/12 and C-594/12.