EUROPEAN COMMISSION Brussels, 24.7.2020 SWD(2020) 128 final COMMISSION STAFF WORKING DOCUMENT […] Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL On the review of Directive 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and proesecution of terrorist offences and serious crime {COM(2020) 305 final}



Contents 1. Introduction 2. General Context 3. Establishment of an EU-wide PNR Mechanism 3.1. Baseline and EU support measures 3.2. General state of play of implementation 3.3. Passenger Information Units 3.4. Air carrier connectivity 3.5. Processing of PNR data 3.6. Involvement of competent authorities 4. Compliance with protection standards in the Directive 4.1. Strict limits on the purpose of processing 4.2. Appointment of a data protection officer 4.3. Oversight by an independent supervisory authority 4.4. Push method 4.5. Data security and audit trail 4.6. Data retention and de-personalisation 4.7. Prohibition of processing of sensitive data 4.8. Manual review of matches obtained by automated means

4.9. Passengers’ rights concerning the use of their data 4.10. Stricter conditions on transfer of data to non-EU countries 5. Other elements of the review 5.1. The necessity and proportionality of collecting and processing PNR data 5.2. The length of the data retention period 5.3. The effectiveness of exchange of information between the Member States 5.4. The quality of the assessments including with regard to the statistical information gathered pursuant to Article 20 5.5. Feedback from Member States on the possible extension of the obligations and the use of data under the PNR Directive 6. Key operational challenges 6.1. Reliability of PNR data 6.2. Challenges identified by the air industry 6.3. Scope/restrictive purpose limitation 6.4. Cross-checks against the SIS and other instruments 6.5. Requests from third countries 1.Introduction Directive 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (henceforth ‘the PNR Directive’) was adopted by the European Parliament and the Council on 27 April 2016. The Directive regulates the collection, processing and retention of PNR data in the European Union and lays down important safeguards for the protection of fundamental rights, in particular the rights to privacy and the protection of personal data. The deadline for Member States to transpose the Directive into their national law was 25 May 2018. PNR data are unverified information provided by passengers and collected by air carriers to enable the reservation and check-in processes. The commercial and declaratory nature of PNR distinguishes this type of data from Advance Passenger Information (API) – basic information on the passenger’s and the crew’s identity, gathered during the check-in process and usually available in the machine readable zone of travel documents, which carriers would generally only collect if there is a legal requirement. The content of PNR data varies depending on the information given by the passenger and may include, for example, dates of travel and travel itinerary, ticket information, contact details like address and phone number, travel agent, payment information, seat number and baggage information. The analysis of such information can provide the authorities with important elements from a criminal intelligence point of view, allowing them to detect suspicious travel patterns and identify associates of criminals and terrorists, in particular those previously unknown to law enforcement authorities. Accordingly, the processing of PNR data has become a widely used law enforcement tool, in the EU and beyond, to prevent and fight terrorism and other forms of serious crime, such as drugs-related offences, human trafficking, and child sexual exploitation. In the EU, less than two years after the transposition deadline, the PNR Directive has already proved its necessity in the effort to achieve an effective and genuine Security Union that duly protects the rights and freedoms of citizens.

This document, which accompanies the Commission’s review report on the implementation of the PNR Directive, contains more detailed information and analysis supporting the findings of the review report. As required in Article 19 of the Directive, the review covers all the elements of the Directive, with a particular focus on specific aspects. These aspects are: compliance with the applicable standards of protection of personal data, the necessity and proportionality of collecting and processing PNR data for each of the purposes set out in the Directive, the length of the data retention period, the effectiveness of exchange of information between the Member States and the quality of the assessments including with regard to the statistical information gathered pursuant to Article 20 of the Directive. In this respect, section 2 of the document describes the context setting the background for the implementation of the Directive, while section 3 provides a general overview of the steps taken in the development of the EU-wide PNR mechanism. Section 4 focuses on a particularly important dimension of the Directive’s implementation, namely compliance with the applicable data protection requirements, with other key elements of the assessment laid down in Article 19 being addressed in section 5. The document also contains – in section 6 – an overview of the main issues and challenges encountered in the implementation and practical application of the Directive. Evidence for the review was gathered through a variety of sources of information and targeted consultation activities, including statistical data collected by national authorities pursuant to Article 20 of the Directive; the deliverables of the compliance assessment of the PNR Directive commissioned by the Commission; discussions with national authorities and the travel industry within the framework of regular meetings and dedicated workshops on the implementation of the Directive; and field visits to six selected Member States. In order to illustrate how PNR data are used in combating terrorism and serious crime, where possible, the report refers to real life examples provided by national authorities drawing on their operational experience. This document should not be considered as an exhaustive overview of the conformity and completeness of national transposition measures. Such a detailed analysis of the national measures adopted to transpose the Directive has been carried out within the framework of the aforementioned compliance assessment. Nonetheless, the review will contribute to inform the next steps to be taken by the Commission in relation to the EU internal PNR policy, including the actions necessary to ensure that all Member States’ national transposition measures are in full compliance with EU law. 2. General Context In recent years, an increasing number of countries – not limited to the EU Member States – and international organisations have recognised the value of using PNR data as a law enforcement tool. The establishment of a PNR mechanism and the implementation of the PNR Directive should be seen against the background of this broader international trend. The terrorist attacks which took place in the United States in 2001, Madrid in 2004 and London in 2005 resulted in the adoption of new measures, including legislative instruments on the collection and exchange of PNR data. To set out the elements of the EU's external PNR policy, the Commission presented a first Communication ‘On the global approach to transfers of Passenger Name Record (PNR) data to third countries’ in 2003, which was reviewed in a Communication adopted in 2010. The 2010 Communication established a set of general criteria to be fulfilled by future bilateral PNR agreements, including, in particular, a number of data protection principles and safeguards. These general criteria formed the basis of the renegotiations of the PNR agreements with the U.S., Australia and Canada, leading to the conclusion of new PNR agreements with the U.S. and Australia in 2012. These agreements provide for the transfer of PNR data by airlines on flights to and from the EU so that such data can be used in the fight against terrorism and serious transnational crime, while including safeguards for the protection of privacy and personal data. Joint evaluations of these two agreements were launched in the summer of 2019 to assess their wider functioning, operational value and necessity. In 2014, the European Parliament requested an opinion from the Court of Justice of the EU as to whether the envisaged agreement between the EU and Canada was compatible with the Treaties and the Charter of Fundamental Rights and, as a result, the draft agreement did not enter into force. On 26 July 2017, the Court of Justice concluded in its Opinion 1/15 that the agreement could not be concluded as intended because several of its provisions were incompatible with the fundamental rights recognised by the EU, in particular the right to data protection and respect for private life. Following the Court’s Opinion, new PNR negotiations with Canada were launched in June 2018. In July 2019, the EU and Canada welcomed the successful conclusion of these negotiations and emphasised their commitment to finalise the agreement as soon as possible, subject to Canada’s legal review of the text. While Opinion 1/15 concerns formally only the envisaged PNR agreement with Canada, the Commission is working closely with its other international partners to ensure compliance of international PNR data transfers with the Treaty and the Charter of Fundamental Rights, including in the context of the joint evaluations of the existing agreements referred to above. As for other third countries, following a Recommendation of the Commission, the Council authorised the opening of negotiations with Japan for the signature of a PNR agreement. The negotiations with Mexico, launched in July 2015, are currently at a standstill. On 6 November 2007, the Commission adopted a proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) data for law enforcement purposes. Upon entry into force of the Treaty on the Functioning of the EU on 1 December 2009, the Commission proposal, not yet adopted by the Council, became obsolete. In February 2011, the Commission tabled a proposal for a Directive and, as noted above, this was adopted by the European Parliament and the Council in April 2016. The Commission has supported the implementation of the Directive through the adoption of funding measures, an Implementation Plan and an Implementing Decision regulating the use of data formats and transmission protocols, on which further details are provided below in section ‎3.4. Also in 2016, the EU modernised its legislation on protection of personal data through the adoption of Regulation (EU) 2016/679 (the General Data Protection Regulation or GDPR) and Directive (EU) 2016/680 (the Law Enforcement Directive on data protection). These legislative acts ensure the effective protection of the fundamental right to data protection enshrined in primary law. On 24 June 2020, the Commission adopted a Communication on aligning the former third pillar instruments with the data protection rules and published the results of the first review and evaluation of the GDPR. In this context, it should be noted that the Belgian Constitutional Court has made a reference for a preliminary ruling to the Court of Justice on the PNR Directive. The Belgian court has expressed doubts as to the interpretation of certain provisions of the PNR Directive and their compliance with the Charter of Fundamental Rights and the Treaty. Recently, a reference for a preliminary ruling has also been made by the Cologne District Court.The Commission has submitted observations in the first of these proceedings and will do the same in the second in due course. At the global level, in December 2017 the United Nations Security Council adopted resolution 2396 (2017) requiring all UN States to develop the capability to collect, process, and analyse PNR data and to ensure that PNR data are used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms. The scope of the Resolution, focused primarily on terrorism, was then extended to organised crime by Resolution 2482 (2019). Against this backdrop, the International Civil Aviation Organisation (ICAO) has started working on the development of a standard for the collection, use, processing and protection of PNR data. A Union position on this matter was agreed by means of a Council Decision (EU) 2019/2107 of 28 November 2019 with a view to ensure compliance with the applicable Union legal framework. The Commission has actively engaged in this process, as an observer representing the EU, to ensure the compatibility of these standards with the EU legal requirements, so that they can contribute to facilitate transfers of PNR data. A draft version of the PNR standards was approved by the ICAO Facilitation Panel in February 2020 and sent to the ICAO Contracting States for consultation. After a final review by the ICAO Air Transport Committee, the standards were adopted by the ICAO Council on 23 June 2020. These standards will be binding on all ICAO member countries unless they file a difference. 3.Establishment of an EU-wide PNR Mechanism 3.1.Baseline and EU support measures It should be borne in mind that, before the adoption of the Directive, most Member States did not have a pre-existing system for the collection and processing of PNR data and had to build their capabilities from scratch. The Implementation Plan, adopted by the Commission on 28 November 2016, acknowledged the challenges in terms of resources, time and technical difficulty in setting up PNR systems compliant with the Directive. The plan provided guidance to the Member States by identifying the key steps and measures that needed to be taken in order to set up an operational PNR system. The Commission has supported the Member States throughout the whole implementation process by coordinating regular meetings, facilitating the exchange of best practice and peer-to-peer support, and providing financial assistance. In particular, to support the implementation of the PNR Directive, the Budgetary Authority reinforced the 2017 Union budget with EUR 70 million for the Internal Security Fund-Police (ISF-Police), specifically for PNR-related actions. The Commission has also funded four PNR-related projects under the Union Actions of the ISF-Police. These projects aimed to ensure that the Passenger Information Units of the Member States developed the capabilities needed to exchange PNR data or the results of processing such data with each other and with Europol. The first of these projects was the 'Pilot programme for data exchange of the Passenger Information Units', or ‘PNRDEP’. The project, coordinated by Hungary and implemented from February 2016 to June 2017, was awarded EUR 1.15 million to look into the possibilities facilitating the exchange of PNR data between the Passenger Information Units and Europol. It was followed by the PIU.net project, which was coordinated by the Netherlands and implemented from November 2017 to September 2019, with a grant of EUR 3.78 million. Its objective was to deliver a technical solution that would facilitate the exchange of PNR data between the Passenger Information Units. A third project, led by Hungary under a EUR 855,000 grant (currently ongoing), focuses on developing and providing training for PNR practitioners in the Member States. In addition, Germany is currently coordinating a project that focuses on exploring the means to enhance the interoperability of PNR data with IT systems of law enforcement authorities at both national and EU level, with a budget of EUR 2.61 million.

These funding measures are in addition to the grants awarded under the Call for Proposals PNR 2012 within the Specific Programme for Prevention of and Fight against Crime (ISEC) 2007-2013, which overall amounted to EUR 37 million and aimed to help implement national schemes based on domestic PNR legislation adopted prior to the adoption of the PNR Directive. 3.2.General state of play of implementation Article 18.1 of the PNR Directive requires Member States to adopt measures necessary to comply with the Directive by 25 May 2018. As of 25 May 2020, the end date of the review period, 24 out of 26 Member States had notified full transposition to the Commission. The Commission has not hesitated to make use of its competences as the guardian of the treaties to ensure that Member States comply with their obligation to transpose the Directive. On 19 July 2018, the Commission initiated infringement proceedings, sending letters of formal notice to fourteen Member States that had failed to communicate full transposition. In ten of these cases, the infringement proceedings were closed in light of a subsequent notification of full transposition of the Directive. Spain, which has not notified any transposition measures, was referred to the Court of Justice for failure to implement the Directive on 2 July 2020. Regarding the remaining three Member States, the Commission will decide how to proceed in the coming months. In addition, most Member States have reached the key milestones identified in the Implementation Plan and have operational PNR systems in place. Considering the complexities surrounding the deployment of PNR systems and the limited time available, the operational successes achieved by Member States can be considered as a significant achievement. Further details on the main aspects of the implementation process are provided below. 3.3.Passenger Information Units The Passenger Information Unit is the core of the PNR mechanism. The Passenger Information Unit is a dedicated unit set up to receive PNR data from the air carriers. Each Member State must establish a Passenger Information Unit (Article 4.1). The Passenger Information Unit is the ‘guardian’ of the PNR database, in the sense that only its staff should have access to all the PNR data collected. The Passenger Information Unit is responsible for conducting the initial assessment of PNR data and sending the results of their processing to law enforcement authorities at the national level (the ‘competent authorities’, in the Directive’s terminology) as well as for exchanging PNR with the Passenger Information Units of other Member States and with Europol (Article 4.2). Member States are also required to adopt a list of competent authorities entitled to request or receive PNR data and the results of processing such data from the Passenger Information Unit. All Member States have established their Passenger Information Units, which – as noted above – are central to the EU PNR architecture. In every Passenger Information Unit except one, a Data Protection Officer has already been appointed to monitor the lawfulness of data processing and the compliance with data protection safeguards. 3.4.Air carrier connectivity Air carriers collect and process PNR data for their own commercial and business purposes, independently of the provisions of the PNR Directive. Importantly, the Directive does not oblige air carriers to collect or retain data from passengers, nor the passengers to provide any additional data to air carriers. At the same time, the Directive stipulates that pre-defined data categories collected by airlines in the course of their normal business must be transmitted to the Passenger Information Unit of the Member State of arrival or departure. Enabling data transfers from air carries to national authorities requires lengthy preparations. The process necessary to connect air carriers’ reservation systems to the IT systems of national Passenger Information Units is multi-faceted and involves, among other actions, engaging with air carriers (up to 180 different carriers for a single Member State), establishing IT connections with airlines and the companies managing their reservation systems, and testing the provision of PNR data. To facilitate this process, on 28 April 2017, the Commission adopted the Implementing Decision (EU) 2017/759 establishing a common list of protocols and data formats from which carriers may choose for the purposes of conducting PNR data transfers. The Implementing Decision is based on the ICAO guidelines on PNR, and the international standards developed by ICAO, the International Air Transport Association (IATA) and the World Custom Organisation (WCO) for the transmission of API and PNR data by airlines to government authorities. Member States were required to take the necessary measures to apply the Implementing Decision by 28 April 2018. This means that, as of this date, Member States had to ensure that carriers should be able to use the data format and transmission protocol of their choice – among those listed in the Implementing Decision – when transferring PNR data to the Passenger Information Units. At this stage, the process to ensure carrier connectivity is still ongoing, and the coverage in terms of passenger flows and flights differs across the Member States. The experience of Member States that are the most advanced in the implementation process shows that it takes time to achieve broad levels of coverage, in particular regarding the establishment of connectivity with small carriers. In general, a collaborative approach permeates the relationships between the authorities and the industry. Whereas all Member States have included in their national legislation sanctions for carriers who fail to transfer PNR data as required under the Directive, in practice these sanctions have been imposed only exceptionally. 3.5.Processing of PNR data Under the framework established by the Directive, the processing of PNR data can only be conducted in three ways: (I)Proactively, to create and update pre-determined criteria according to which future passengers should be subjected to additional scrutiny (Article 6.2(c)). For example, the analysis of PNR data may show that a certain travel route is particularly likely to be used by drug traffickers and this information can be used proactively to build new targeting rules, or refine existing ones. (II)In real-time, to assess the passengers prior to their scheduled arrival in or departure from a Member State, by comparing PNR data against pre-determined criteria and relevant databases – for example, the Schengen Information System (SIS) or national watch lists – in order to identify individuals who should be subject to further examination by the authorities (Article 6.2(a)). (III) Reactively, responding to ‘duly reasoned’ requests, on a case-by-case basis in compliance with the legal requirements of the Member State, from the competent authorities within the framework of criminal investigations (Article 6.2(b)). Any positive matches obtained when comparing PNR data against pre-determined criteria and databases must be individually reviewed by no-automated means to verify whether the competent authority needs to take action under national law (Article 6.5). The underlying principle is that no decisions that produce an adverse legal effect on a person or significantly affect that person should be taken only by reason of the automated processing of PNR data, without human intervention. Most Member States are now able to process PNR data against databases and watch lists relevant for the purposes of the Directive. Apart from the use of national law enforcement databases, a large majority of Passenger Information Units also compare PNR data against relevant EU and international data repositories, such as the SIS and the Interpol’s Stolen and Lost Travel Document database. The use of pre-determined criteria – more demanding from the operational, analytical and technical point of view – is still at an early stage of implementation in some Member States. Since January 2020, Europol provides assistance to the Member States in the development of this processing method through its Travel Intelligence Task Force. The Task Force centralises, analyses and distributes relevant information and intelligence on patterns, trends and modus operandi which can be used by the Member States’ Passenger Information Units to develop targeted, proportionate and specific targeting rules. Training on the development of pre-determined criteria is also supported through an ongoing EU-funded project, financed under the ISF-Police Union Actions. Member States have reported that PNR processing has already actively contributed to their successes in the prevention and fight against terrorism and other serious forms of criminality, often committed by organised criminal groups. PNR has been found to be particularly effective to combat drug trafficking, terrorism-related offences, human trafficking and child sexual exploitation, fraud and money laundering. The feedback provided by national authorities indicates that it is difficult to determine which processing method (i.e. comparison against databases, watch lists or the use of targeting rules) is the most useful or efficient. In many cases, the best results are obtained from a combination of all the various processing methods available.

3.6.Involvement of competent authorities Article 7 of the PNR Directive requires Member States to 'adopt a list of the competent authorities entitled to request or receive PNR data or the result of processing those data from the Passenger Information Unit'. It also provides that such authorities 'shall be competent for the prevention, detection, investigation or prosecution of terrorist offences or serious crime'. All Member States have already established a list of competent authorities and notified it to the Commission. Almost all Member States have appointed the police and other relevant authorities for crime prevention and the protection of public order as competent authorities. In addition, national transposition measures in many Member States designate intelligence services, including military intelligence services, as authorities competent to receive and request PNR data from the Passenger Information Unit. Less than half include the judicial authorities on their list of competent authorities, mainly the State Prosecutor’s Office and, in some cases, the courts. The vast majority of Member States have also designated customs as a competent authority, whereas only a few have done so for the financial authorities (when responsible for investigation of fraud, money laundering or other financial crimes). In principle, Member States have assessed the cooperation between the Passenger Information Units and competent authorities in positive terms, although both parties needed time to familiarise to the new tool and to develop cooperation methods. Most Member States have made use of the possibility to second staff from the competent authorities to the Passenger Information Units and report that this has resulted in the sharing of experiences and facilitated the development of closer relations. National authorities have also reported that, in the first months of the Passenger Information Units operational activities, competent authorities might have lacked sufficient awareness as to how PNR data may be used and, as a result, the requests submitted were too broad in scope or not sufficiently justified. In most cases, these problems were solved through dialogue and training. In addition, many Member States use a template for requests, which guides the competent authorities as to the elements that need to be included thereto, thus facilitating the procedure. All Passenger Information Units have observed a significant growth in the number of requests received from the authorities over a short period of time. This clearly shows that law enforcement authorities are increasingly aware of the tool and find it useful. Investigations on serious crime and terrorism are a multi-stage process, with information coming from various sources. Therefore, it may be difficult to single out the exact impact that the use of PNR data has had in each specific case. However, law enforcement authorities from across Member States have indicated that PNR data has been successfully used to organise and plan operational and monitoring activities in advance, obtain full details of persons of interest, identify previously unknown suspects, establish links between members of crime groups through the analysis of contact and payment details, and verify the assumed ‘modus operandi’ of serious criminals and organised crime groups. In addition, the establishment of the EU PNR mechanism has enhanced the authorities’ ability to trace the movement of persons subject to a criminal investigation (in particular within the Schengen area) and determine the travel patterns of criminal suspects. An outstanding issue in some Member States concerns the limited feedback provided by the competent authorities to the Passenger Information Unit following the transfer of data to them. The staff of the Passenger Information Units consider such feedback necessary to better align the processing methods with the needs of law enforcement services. The unwillingness to provide feedback has been explained by confidentiality requirements, data protection concerns and the fact that many investigations are not necessarily concluded immediately after the transfer of PNR data. 4.Compliance with protection standards in the Directive A key objective of the Directive is to ensure that the processing PNR data by national authorities is carried out in a manner compatible with the fundamental rights of all passengers. The Directive therefore regulates the way in which Member States can use PNR data transferred by airlines and establishes a number of strict data protection safeguards. This section provides a comprehensive overview of these safeguards and their implementation by the Member States. Whereas the results of the compliance assessment already available to the Commission show an overall compliance with these safeguards, instances of non-conform transposition have been identified. The Commission is committed to ensuring full conformity of transposition and hence will not hesitate to pursue infringement action, if necessary, once the compliance assessment is finalised. 4.1.Strict limits on the purpose of processing Under the Directive, PNR data can only be used by national law enforcement authorities for preventing, detecting, investigating and prosecuting terrorism and serious crime (Article 1.2). The definition of terrorist offences is further specified by referring to Framework Decision 2002/475/JHA, now replaced by Directive (EU) 2017/541 (Article 3.8). A list of offences regarded as serious crimes is provided in Annex II to the PNR Directive. To be under the scope of the Directive, these offences must be punished with a maximum term of at least three years of imprisonment (Article 3.9). Concerning the processing of PNR data, the Directive specifies that the data can only be compared against databases relevant for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, including databases on persons or objects sought or under alert or processed against pre-determined criteria (Article 6.3). In addition, competent authorities may only request and process PNR data for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime (Articles 6.2(b) and 7.4 PNR Directive). Most Member States comply with the strict purpose limitation requirements of the Directive and limit the processing of PNR data to the purposes specified in Article 1.2. Four Member States have adopted national measures that go beyond the purpose limitation, by specifically allowing the use of PNR for national security purposes. National transposition measures regulate the processing of PNR data against databases and pre-determined criteria in accordance with the requirements and limitations set out in Article 6 of the Directive. In particular, the requirement to only use the databases relevant for serious criminal offences and terrorism is explicitly reiterated in the national PNR laws of all Member States, except two. National authorities consider that the purpose limitation stipulated by law and the ensuing restrictions with regard to processing methods are crucial tools to ensure that PNR data are processed in accordance with the Directive. In terms of application, national authorities follow different practical approaches to ensure respect for the Directive’s purpose limitation. One such practice requires that the design of targeting rules is properly documented and that the rules themselves are thoroughly tested against historical data, to exclude those that generate matches considered outside the Directive’s scope. Some Member States compare PNR data only against the specific sections or alert categories in law enforcement databases that are considered more relevant for the purposes of the PNR Directive, and require the Passenger Information Unit to refrain from forwarding hits for offences that are not covered by them. The provision of training to competent authorities and the use of templates for PNR data requests also helps to ensure that the authorities in question have an adequate understanding of the purposes for which PNR data can be used. 4.2.Appointment of a data protection officer The Directive requires the Member States to appoint a Data Protection Officer to monitor data processing and to implement necessary safeguards (Article 5.1). Member States are also required to provide Data Protection Officers with the means to do their work effectively and independently. Data Protection Officers have a number of important functions such as acting as a single contact point for passengers with concerns related to PNR data (Article 5.3), being informed of PNR data transfers to third countries (Article 11.4) and conducting an ex post review of unmasking authorisations, unless such authorisation is given by a judicial authority (Article 12.3(b)(ii)). The Data Protection Officer should have access to all the data processed by the Passenger Information Unit and be competent to refer to any instance of unlawful data processing to the national supervisory authority (Article 6.7). All Member States except one have already appointed a Data Protection Officer to monitor data processing by the Passenger Information Unit and to implement necessary safeguards. The Directive’s requirement that the Data Protection Officer shall have the means to perform his or her duties and tasks independently has been mirrored in national legislations. Practically, the degree of independence of the Data Protection Officer can be expected to be greater when he or she is not a member of the Passenger Information Unit staff and is not subordinated to the head of Passenger Information Unit. According to national authorities, the Data Protection Officers play a major role in the functioning of the Passenger Information Units by carrying out regular controls of the lawfulness of data processing and providing advice to Passenger Information Unit staff on data protection matters. In many Passenger Information Units, the Data Protection Officers also participate in the development and regular review of pre-determined criteria, to ensure that these are proportionate and non-discriminatory (see below for more details). Other tools available to the Data Protection Officers include the possibility to send quarterly reports to the Passenger Information Unit with suggestions for improvement and the provision of training to the Passenger Information Unit staff. In principle, the right of data subjects to contact the Data Protection Officer as a single point of contact has been provided for by law in all but two Member States. Most Member States also facilitate the exercise of this right by making the contact details of the Data Protection Officer easily accessible, e.g. on the website of the Passenger Information Unit.

The access of the Data Protection Officer to all data processed by the Passenger Information Unit is guaranteed by law in all Member States except one. The control powers of the Data Protection Officer have in principle been correctly mirrored in national legislation, although several instances of non-conform transposition have been detected. Four Member States do not explicitly recognise the competence of their Data Protection Officers to refer cases of unlawful processing to a national supervisory authority. In addition, the exercise of this competence has been limited in two others, either by restricting it to certain types of cases or by introducing an intermediary procedure, not foreseen by the Directive. 4.3.Oversight by an independent supervisory authority An independent national data protection supervisory authority must oversee the application of the Directive at the national level with a view to protecting fundamental rights in relation to the processing of personal data (Article 15.1-2). The supervisory authority is responsible for dealing with the complaints of data subjects. All Member States have appointed a national supervisory authority. In most Member States, this authority is provided for under the general law on data protection transposing Framework Decision 2008/977/JHA or Directive (EU) 2016/680 (also known as the Law Enforcement Directive) which repeals and replaces it. In most Member States, the competences of the supervisory authority to deal with complaints from data subjects, to carry out investigations, to verify the lawfulness of data processing and to provide advice to data subjects have been fully and correctly enshrined in the national legislation. Six Member States reflected most of these competencies, but failed to include all in their laws. Under the Directive, the Passenger Information Units are also under obligation to report, to the supervisory authority and the person concerned, any personal data breach likely to result in a high risk for the protection of personal data or to affect the privacy of the data subject adversely (Article 13.8). All Members States have transposed this obligation into their national laws, whilst two narrow its scope of application, by limiting the situations in which the data subject must be informed. No data breach has been reported by a Member State thus far. 4.4.Push method Under the Directive, PNR data should be made available to national authorities through the so-called ‘push method’ (Article 8). This means that the data must be transmitted by the air carriers to the Passenger Information Unit instead of the Passenger Information Unit obtaining data by accessing the air carriers’ reservation systems (‘pull method’), which is considered a more privacy-intrusive method. In line with this requirement, all the Member States provide for data transmissions exclusively by the push method. In addition, all national transposition measures preserve the role of the Passenger Information Unit as the only entity that can receive, process and store PNR data. This is important as it preserves, in all Member States, the function of the Passenger Information Unit as the custodian of the PNR database. As a result, other public authorities have no direct access to PNR data, either when stored in the airlines’ reservations systems or at the Passenger Information Unit. 4.5.Data security and audit trail Member States must implement the necessary technical and organisational measures to ensure that PNR data are processed with a high level of security (Article 13.7). Processing operations – such as the collection, erasure, disclosure and consultation of PNR data – should be logged and documented, so that the supervisory authority can have access the records if necessary, for example, to conduct audits (Article 13.5 and 13.6). These records should be kept for a period of five years and can be used only for the purposes enumerated in the Directive (Article 13.6). In practice, the confidentiality and security of data processing are ensured by a number of administrative, technical and practical measures. In particular, only the selected Passenger Information Unit staff members have access to PNR data and their activities are monitored. The processing takes place in secure premises and with the use of highly secured IT systems. All Member States have transposed the obligation to keep records of all processing operations. National authorities have highlighted such logging as an important tool to ensure the lawfulness of data processing within the Passenger Information Unit, in particular because it allows the Data Protection Officers to monitor all the processing operations. Nevertheless, several instances of non-compliance with the key requirements relating to logs have been identified. Three Member States have failed to correctly transpose all Directive requirements concerning information, which should be recorded, whereas three others extended the purposes for which the logs can be used. In addition, three Member State have failed to transpose the provision regulating the duration for which logs need to be stored and two others have transposed it incorrectly, either by shortening or extending the period. The obligation to make the logs available to the national supervisory authority has not been transposed by one Member State and was transposed in a non-compliant manner by two others. 4.6.Data retention and de-personalisation PNR data can be stored in the database of the Passenger Information Unit for five years (Article 12.1). However, after six months the data will be ‘masked out’ by removing all the elements that may serve to identify a passenger – for example, the name, contact and payment information (Article 12.2). After this, the authorities will only be able to access the full PNR data set (including the elements masked out) under specific conditions (Article 12.3). The reservation details, such as the PNR record locator, date of reservation and travel, the itinerary, travel agency information, code share and luggage information will be still directly available to the user, allowing for data processing for statistical purposes as well as to gather intelligence. Depersonalised data can also be searched and disclosed in the framework of investigations into terrorist and serious criminal activities, with the approval of the designated authorities and following the established procedures. All the national transposition measures limit the retention period to five years and provide for the depersonalisation of PNR data after six months. Nevertheless, concerning depersonalisation, one Member State has failed to define any data element which should be masked, while five other Member States have failed to include some of the data elements required by the Directive in their national laws. The requirement to only disclose full PNR data after the expiry of the six-month period when certain conditions are met was correctly transposed by a large majority of Member States. Nevertheless, two Member States have failed to correctly transpose the requirement that the disclosure of full data must be reasonably believed to be necessary for responding to a request according to Article 6.2(b). In all Member States, such disclosure must be approved either by a judicial authority or by another competent national authority. In some Member States, both methods have been used. However, four Member States have failed to correctly transpose the safeguard concerning the need forex-post review by the Data Protection Officer when the disclosure of PNR data has been approved by another competent authority. 4.7.Prohibition of processing of sensitive data The Directive prohibits the processing of ‘sensitive data’ – that is, information which could reveal a person's race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sexual life or sexual orientation (Article 13.4). In addition, the criteria against which PNR data can be processed, cannot be discriminatory and shall, in no circumstances, be based on a person's race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation (Article 6.4). The principle of non-discrimination also applies to decisions made by national authorities, following the processing of PNR data (Article 7.6). The prohibition of processing sensitive data was fully transposed by a large majority of Member States, with only two exceptions. In addition, all Member States but one require an immediate deletion of such data, if collected. However, four Member States have failed to transpose correctly the prohibition on the use of discriminatory pre-determined criteria or criteria based on sensitive data. Five Member States did not transpose the obligation that decisions of competent authorities must respect the principle of non-discrimination.

With regard to the practical realisation of the prohibition to collect and process sensitive data, national authorities report that the IT systems of the Passenger Information Unit are designed in a way that makes the collection and processing of sensitive data technically impossible. This means that such data, even if transferred by air carriers, is filtered out and blocked or deleted by the system. In addition, the fact that sensitive data are not collected in practice excludes the possibility of designing pre-determined criteria based on a person's race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation. 4.8.Manual review of matches obtained by automated means Any match obtained through the automated processing of PNR data must be manually reviewed (Article 6.5). For example, the comparison of PNR data with the data stored in a watch list may flag up an individual flying to the Member State for further examination. In this case, the competent staff must review the match to either confirm it or discard it. This is to ensure that no decisions having an adverse effect on an individual (such as being subject to further checks on arrival or departure) are taken without human intervention. All the Member States have transposed the obligation to verify the matches resulting from automated processing. With regard to practical application, the measures adopted concern, for instance, the technical design of the IT system as well as internal procedures regulating the functioning of the Passenger Information Unit, which impose the manual verification of matches. 4.9.Passengers’ rights concerning the use of their data Passengers have a right to access their data, rectify them and have them deleted or have their processing restricted. They also have the right to receive compensation for any damage they have suffered and to seek redress before a court (Article 13.1). These rights are further developed in the Law Enforcement Directive. In addition, Member States must ensure that passengers are clearly informed about the collection of PNR data and of their rights. Most Member States have transposed the provisions relating to data subjects’ rights through the national legislation implementing the Law Enforcement Directive. This Directive was transposed either by specific legislation on the handling of personal data by law enforcement authorities for the prevention, detection, investigation and prosecution of certain offences, or by the general law on protection of personal data. However, in three Member States national transposition measures on the PNR Directive do not contain a correct cross reference to the national legislation transposing the Law Enforcement Directive. With regard to the practical exercise of data subjects’ rights, including the obligation to inform the passengers about the collection and processing of their data, national authorities pointed to the fact that relevant information has been made available online, including on the steps to follow to exercise the rights to access, rectification, erasure, restriction, compensation or judicial redress. Many also underlined the role of the Data Protection Officer, acting as a single point of contact, to provide passengers with the information and facilitate the exercise of their rights. 4.10.Stricter conditions on transfer of data to non-EU countries The transfer of PNR data by the Member States to countries outside the EU is only allowed on a case-by-case basis and when necessary for fighting terrorism and serious crime (that is, exclusively for the purposes for which PNR can be used under the Directive). Furthermore, PNR data may be shared only with public authorities that are competent for combating these kinds of offences (Article 11.1). Importantly, PNR data can only be transferred to non-EU countries only under conditions consistent with the PNR Directive and those laid down in the Law Enforcement Directive, and only upon ascertaining that the use the recipients intend to make of the PNR data is consistent with those conditions and safeguards (Article 11.3). The Data Protection Officer should be informed about every transfer of data to a third country (Article 11.4). All the Member States have established a regulatory framework for PNR data transfers to third countries that mirrors the strict limitations imposed by the Directive. In particular, the requirement that such transfers can only be made on a case-by-case basis has been transposed by all Member States. However, four Member States have failed to fully transpose other conditions provided for by the Directive relating to the purposes for which the data can be transferred or the authorities competent to receive it. Importantly, the law in all Member States requires that recipient third countries agree that onward transfers to another third country can be made only with the express authorisation of the Member State whose Passenger Information Unit has transferred the data, as required under Article 11.1(c). The Directive also provides that in exceptional circumstances such a transfer can take place also without prior authorisation if certain conditions are met, notably that the transfers are essential to respond to a specific an actual threat related to terrorist offences or serious crime in a Member State or a third country and prior consent cannot be obtained in good time (Article 11.2). These conditions were not fully mirrored in the legislation of eight Member States. National authorities have pointed to the active role of the Data Protection Officer in the processing of requests received from third countries. However, in two Member States, the transposition of Article 11.4 of the Directive, requiring that the Data Protection Officer be informed each time the Member State transfers PNR to a third country, is not in -conformity as the national transposing legislation restricts the role of the Data Protection Officer. In these Member States, the Data Protection Officer is only informed in case a transfer is carried out without the prior consent of the Member State from which the data were obtained. 5.Other elements of the review 5.1.The necessity and proportionality of collecting and processing PNR data Article 19 requires the Commission to assess the necessity and proportionality of collecting and processing PNR data for each of the purposes set out in the Directive, i.e. (i) to assess the passengers prior to their arrival to or departure from the country; (ii) to respond to a duly reasoned request from the competent authorities, within the framework of criminal investigations; and (iii) to update and create the pre-determined criteria to be used to identify passengers requiring additional scrutiny by the authorities (see also above section 3.5). The assessment below presents several elements justifying the necessity and proportionality of such processing. The objectives and effectiveness of PNR processing Identifying whether PNR processing meets an objective of general interest constitutes an important step in performing a necessity and proportionality assessment. The PNR Directive, and the processing of data which it legitimises, is intended to protect public security by ensuring the prevention, detection, investigation and prosecution of serious crime and terrorism in the area without internal borders existing in the Union. As confirmed by the Court of Justice in Opinion 1/15, the objective of ensuring public security in the fight against terrorist offences and serious crime is an objective of general interest of the Union capable of justifying interference, even serious, with the fundamental rights enshrined in Articles 7 and 8 of the Charter. This conclusion can be reasonably expected to apply to PNR processing operations which serve to ensure public security in the territory of the Union. In the limited time since the transposition deadline, PNR has proven to be effective in achieving the objective of general interest pursued. According to the Member States, the different types of processing of PNR data available to them (real time, reactive and proactive) have already delivered tangible results in the fight against terrorism and crime. National authorities have also highlighted that these results could not have been achieved without the processing of PNR data, e.g. by using exclusively other tools such as API. Put differently, pre-existing measures were insufficient to achieve the intended objectives. The effectiveness of the various means of PNR processing is further detailed below. In real-time, PNR data are used – in a similar way to API and in combination with it - to track down individuals known for their involvement in terrorist offences and serious crime. To attain this objective, PNR data are automatically checked before arrival or departure against various law enforcement databases of persons and objects sought. However, unlike API, which is collected at the moment of check-in, PNR data are transferred to Passenger Information Units 48 to 24 hours before the flight scheduled departure. This allows the competent authorities more time to prepare a law enforcement action, if necessary, which is often crucial for the success of the intervention.

Even more importantly, PNR data can be used to identify persons involved in criminal or terrorist activities who are, as of yet, not known to the law enforcement authorities. This is because the processing of PNR data can highlight - for a further assessment- passengers whose travel behaviours are atypical or fit the travel patterns usually encountered in the case of offenders. This objective can only be achieved through the use of PNR data. In practice, this is done by comparing PNR data, through automated means, against combinations of predetermined fact-based risk indicators. Examples of such risk-indicators reported by national authorities include the fact that the passengers have booked their tickets using travel agencies known to be used by traffickers or have chosen travel routes that are both longer and more expensive than the routes a person travelling for business or tourism purposes might have chosen. The use of pre-determined criteria may also identify passengers whose luggage does not correspond with the length of the stay and destination, which may raise suspicions of involvement in trafficking of illicit goods or money laundering. Similarly, information that

a credit card belonging to a suspected trafficker was used in order to book a ticket for another person might reveal the existence of a form of trafficking, even though the person travelling may not be known to law enforcement authorities. According to the Member States, used in combination with other investigative tools and methods, PNR allows law enforcement authorities to detect suspicious behaviour, better target their investigation, prioritise one lead over the other, build up their case and gather evidence necessary to obtain a conviction. Without claiming to be exhaustive, Member States have provided examples to the Commission, some of which are quoted at the end of this section, that illustrate how the comparison of PNR data against databases and pre-determined criteria was necessary for the identification of potential perpetrators of acts of terrorism or persons involved in other forms of serious crime, such as drug trafficking, cybercrime, human trafficking, child sexual abuse, child abduction and participation in organised criminal groups. Notably, some cases could not have been solved without the use of PNR data, in particular if there had been no other indication that the suspect might be involved in terrorist or other criminal activities. In some instances, the use of PNR data resulted in the arrest of persons previously unknown to the police services, or allowed for the further examination by the competent authorities of passengers who would not have been checked otherwise. The assessment of passengers prior to their departure or arrival has also helped prevent crimes from being committed. In addition to real-time processing, national authorities have reported that PNR data retained after the passengers’ arrival or departure have also been successfully used in a retrospective manner to support the investigation, prosecution and unravelling of criminal networks after

a crime had been committed. In this respect, the analysis of historical data has sometimes been the only tool available to identify individuals involved in certain forms of criminal activity or terrorism or to obtain evidence necessary to prove the guilt of a criminal. The increasing number of case-by-case requests submitted to the Passenger Information Unit by the competent authorities shows that the latter are actively using PNR data in their investigations. Further details and practical examples on the use of PNR data retained in the Passenger Information Unit database are provided in the section on data retention below. PNR data are also used proactively, i.e. to develop and update pre-determined criteria, which are used for the processing of passengers’ data prior to the flight’s departure or arrival. National authorities have confirmed that PNR data are indispensable to gain a detailed insight into the travel patterns of those involved in terrorism and serious crime and to develop pre-determined criteria that are proportionate, targeted and specific, as required by the Directive. It is also crucial that the Passenger Information Unit staff are able to quickly detect changes in the criminals’ travel behaviour (e.g. the change of routes) and to adapt the criteria accordingly. Again, this aim cannot be achieved to the same extent by relying on other sources of intelligence, making the processing of PNR data necessary. In particular, according to national authorities, the proactive processing of PNR data has been necessary in the detection and investigation of drug and human trafficking and money laundering. Moreover, historical data are necessary to test new pre-determined criteria and ensure that they meet the requirements laid down in the Directive. The data subjects concerned and categories of data processed Under the PNR Directive, the processing of PNR data concerns all passengers on inbound and outbound extra-EU flights. Such broad coverage is necessary to achieve the Directive’s intended objectives. In this respect, the Court in Opinion 1/15 acknowledged that ‘the exclusion of certain categories of persons, or areas of origin, would be such as to hinder the achievement of the objective of automated processing of PNR data’, that is to say, the prior identification of persons who may represent a risk to public security ‘among all air passengers’. Furthermore, while it is undoubtedly the case that PNR data may ‘reveal very specific information’ on a person’s privacy, where relevant, as acknowledged by the Court of Justice ‘the nature of that information is limited to certain aspects of private life”, in particular the aspects relating to air travel. As to the data processed, it should be recalled that PNR data are collected initially by the airlines for their commercial use. As stated in its Recital (8), the Directive does not impose an obligation to collect or retain additional data, nor does it oblige passengers to submit data beyond those already provided to air carriers. As the data collected differ on each occasion, the level of intrusion into the privacy of individuals also varies and should not be equated in all cases with the maximum level that is theoretically possible under the Directive. The collection of data by air carriers is necessary not only for the performance of the transport contract, but also to satisfy the specific needs or expectations of passengers. Therefore, in drawing on the data collected by carriers for commercial purposes, the PNR Directive is less intrusive than a measure which would require passengers to supply all the data contained in its Annex I. In line with clarity and precision requirements, the categories in Annex I reflect internationally agreed standards, in particular at ICAO level. While some of these categories are similar to the ones in the draft EU-Canada PNR agreement of which the Court criticised the lack of precision, they are overall drafted in a more precise manner (see e.g. headings 5 and 8 of Annex I). In practice, Member States have confirmed that the possibility to collect such categories of PNR data – to the extent that the various data elements have been provided by the passenger - is necessary for the implementation of an effective and proportionate PNR system. As already noted, information on payment methods, baggage, travel itineraries and travel agencies can be the only means to identify potential perpetrators of criminal and terrorist acts through comparisons against predetermined criteria. The same applies to other categories such as seat information, date of booking, split/divided PNR information, ticketing field information, code share information and data concerning minors in the general remarks section. Other data elements, such as contact information, frequent traveller data or API, allow the authorities to verify the accuracy of PNR data and ensure that the system works in a targeted manner so that only those passengers who are genuinely suspicious are identified. In sum, the categories referred to in Annex I to the Directive comprise types of data which are strictly necessary to achieve the objectives pursued. Additional safeguards surrounding the processing of PNR data The PNR Directive contains strict safeguards to further limit the degree of interference to the absolute minimum and ensure the proportionality of the methods of processing available to national authorities. The analysis of the national transposition measures indicate that, in general, these safeguards have been implemented in a compliant and effective manner by the Member States. As already indicated, PNR data can only be processed for the purposes of preventing, detecting, investigating and prosecuting terrorist offences or serious crime, as defined by the Directive. This purpose limitation determines how the automated processing of passengers’ data prior to their arrival or departure is carried out. The data can be compared only against databases used to combat terrorist offences and serious crimes, including databases on persons or objects sought or under alert. Such databases contain data of persons wanted by national law enforcement authorities in relation with serious and dangerous offences. Even though PNR data of all passengers are compared against such databases, including the data of bona fide passengers, such comparison does not generate a match for the vast majority of passengers, who are not involved in criminal or terrorist activities. As a result, their data are not further accessed. Importantly, the PNR Directive strictly prohibits the processing of sensitive data. This constitutes an important difference with regard to the pre-existing draft EU-Canada PNR agreement, as explicitly acknowledged by the Court of Justice in Opinion 1/15. The more intimate part of private life therefore remains fully protected by the processing operations provided for in the PNR Directive. Under the Directive, the information revealed by the processing of PNR data is in fact limited to the circumstances of the passenger’s travel and would be established on the basis of data provided by the passengers themselves. The processing against pre-determined criteria is also limited by important safeguards. The criteria used must be targeted, proportionate and specific to the aim pursued and are subject to regular review. They cannot be based on sensitive data and the assessment cannot be carried out in a discriminatory manner. This limits the risk that discriminatory profiling will be carried out by the authorities. Moreover, in practical terms, PNR data are not used to establish an individual profile of all passengers, but to assess risk and establish anonymous scenarios. Such ‘abstract profiles’ may consist, for example, of travel itineraries and behaviours associated with the preparation or commission of crimes such as suspicious payment methods or booking patterns (in cash, last-minute bookings, use of specific booking intermediaries). Any results obtained through automated processing must also be verified by non-automated means. This obligation ensures the elimination of the so-called ‘false positive matches’, i.e. situations in which a comparison of a passenger’s data with a database or watch list generates a match which is not confirmed by further processing, e.g. when a person included in a database has the same name as the passenger, but is not the same person. The safeguards surrounding the automated processing of PNR data guarantee that only the data of a very limited number of passengers will be transferred to competent authorities for further processing. Indeed, the statistics gathered by the Commission for 2019 indicate that 0.59% of all passengers whose data have been collected have been identified through automated processing as requiring further examination. An even smaller fraction of 0.11% was transmitted to competent authorities. This means that, overall, PNR systems deliver targeted results which limit the degree of interference with the rights to privacy and the protection of personal data of the vast majority of bona fide travellers. With regard to the processing of historical PNR data, two main safeguards have been put in place to ensure the proportionality of data processing. Firstly, after passengers’ arrival or departure, their data can only be processed to respond to a duly reasoned request from the competent authorities. The requesting authority must provide sufficient grounds to justify that the data are necessary for the prevention, detection, investigation and prosecution of terrorist offences or serious crime. Each request must be assessed by the Passenger Information Unit on a case-by-case basis. Secondly, after six months, all passengers’ data are depersonalised. All the elements, such as name or contact details, which enable the identification of the passenger, become invisible to the user. The data can be unmasked (i.e. these elements can be made visible), but only with approval of a judicial or other authority and if necessary to respond to a duly reasoned request from competent authorities. If the authorising authority is not a judicial authority, the disclosure of the full PNR data are subject to informing the Data Protection Officer and to an ex-post review by that Data Protection Officer. Case studies illustrating the different means of processing PNR data:

A fugitive convicted to a six-year prison sentence for drug-related offences was wanted by the authorities. The processing of PNR data, received by the Passenger Information Unit at least 24 hours before the flight departure, allowed to notify the relevant authority well in advance and to prepare for action before the arrival of the airplane, coming from a non-EU country. The individual was arrested immediately after arrival and brought before a judge. In another example, four individuals belonging to an organised crime group were wanted for kidnapping and attempted murder of an adolescent, aged 17. The video recording of this violent assault was widely shared on social media and caused widespread shock. The processing of PNR data established that one of the suspects was on a plane arriving from Asia. The man was arrested upon arrival. The investigators also found his car in the airport carpark. The analysis of the car’s navigation system led to the discovery of the victim’s body, abandoned 200 km away from the crime scene. A Passenger Information Unit transferred information regarding suspicious travel patterns of persons linked to a specific company to a unit dealing with organised crime. On the basis of the information provided by the Passenger Information Unit, the organised crime unit launched an investigation into the activities of individuals previously unknown to law enforcement authorities. The investigation revealed their involvement in money laundering and other international economic crimes. In one Member State, convicted sex offenders must notify their intention to travel abroad and may be refused authorisation if the destination is considered to present a risk. A disproportionate number of convicted offenders declared travels to Dubai. However, the processing of PNR data showed that these offenders booked further flights to destinations to which travel would not have been authorised. The processing also enabled the authorities to establish that all the bookings were made by the same employee of a travel agency. Without PNR processing, the authorities would have not been able to establish the link between the passengers and the travel agency and would not have known about their final destination. In another case, PNR processing revealed that three children were travelling unaccompanied outside Europe. There was no information on who should receive them upon their arrival. The authorities of the country of arrival were alerted and carried out a control on the person waiting for the children, who turned out to be a convicted sex offender. Without the processing of PNR data, it would have not been possible to know that the children were travelling unaccompanied and no additional controls would have been carried out. The use of pre-determined criteria indicated that an individual might be potentially travelling to a terrorist training camp. An analysis on the persons’ travel history revealed that the person had travelled to this destination many times before, while trying to conceal the final destination. The individual’s involvement in a violent extremist organisation, responsible for several terrorist attacks, was later confirmed. 5.2.The length of the data retention period Article 12.1 of the PNR Directive requires the Member States to retain the PNR data transferred by air carriers for five years. This retention period is justified by objective considerations linked to the way PNR systems operate and the nature and length of criminal investigations. Firstly, the need to retain data for five years stems from the nature of PNR as an analytical tool aimed not only at identifying known threats but also at uncovering unknown risks. Travel arrangements recorded as PNR data are used to identify specific behavioural patterns (that is, instances of repeated behaviour) and make associations between known and unknown people. By definition, the identification of such patterns and associations calls for the possibility of long-term analysis. In turn, this analysis requires that a sufficient pool of data is available to the Passenger Information Unit for such a relatively long period. In particular, the pre-determined criteria used in the automated processing of PNR data are reprogrammed and refined regularly in order to ensure that they are targeted, proportionate and specific and avoid false positive results, i.e. the wrong reporting of persons who do not present a risk. These false positives constitute a greater interference with fundamental rights than the mere storage of PNR in the Passenger Information Unit database, as such data are never brought to the attention of the Passenger Information Unit staff. To upgrade the pre-determined criteria, the software used for PNR processing must be capable of distinguishing ‘normal’ behaviours from those that can be objectively assumed to indicate a risk. This distinction must be based on reliable benchmarks, which can only be established if the IT system is supported by a database that represents the whole passenger population and its macro trends over time. Notably, some threats are rare, others are of a seasonal nature, so they would be impossible to detect if historical data were not retained for a long period of time. Therefore, the generalised retention of passenger data is necessary for the Passenger Information Unit to assess passengers prior to their arrival or departure in an effective and proportionate manner. Secondly, the retention of PNR data for five years is needed to ensure the effective investigation and prosecution of terrorist offences and serious crime. Investigating and prosecuting such offences usually involves months and, often, years of work. In many cases, the investigation concerns acts committed some time beforehand. Even if the arrest shortly follows the criminal act, it may be revealed that the same person might have been involved in other criminal activities and/or cooperate in their commission with other persons. Importantly, a passenger may be identified as posing a risk only at a later stage, and not in the automated assessment carried out by the Passenger Information Unit prior to arrival or departure. For example, a connection with a terrorist or criminal organisation may only be detected when more information becomes available, as an investigation progresses or following the commission of crime or a terrorist attack. In this vein, Member States have confirmed that the five-year retention period is necessary from an operational point of view. The availability of historical data ensures that when an individual is accused of having committed a serious crime or being involved in terrorist activities, it is possible to review the person’s travel history and see who they have travelled with, identifying potential accomplices or other members of a crime group, as well as potential victims. National authorities have also reported that, in some cases, the analysis of historical PNR data has been the only tool available to establish or prove the links between the persons involved in the commission of an offence. Historical data can also be used to verify the alibi of a suspect or to establish in an unquestionable manner that a lead is not valid or reliable enough to continue to be pursued. In addition, the safeguards provided in the PNR Directive concerning access by the competent authorities to the data stored by the Passenger Information Unit and in relation to the depersonalisation and unmasking of data aim to prevent abuses. In particular, historical data can only be accessed on a case-by-case basis, in response to a duly reasoned request from competent authorities. Such a request must be based on sufficient grounds for the competent authorities to process PNR data, in relation to a specific case, for the purposes of the Directive. Following depersonalisation, the full disclosure (‘unmasking’) of PNR data requires an authorisation from a judicial or other authority, which must be preceded by the analysis of necessity of such a disclosure for the purposes of preventing, detecting, investigating and prosecuting terrorist offences or serious crime. Finally, in respect of the time limits for retaining the PNR data to be transmitted to Canada, considered by the Court of Justice in Opinion 1/15, it is important to note that the performance of border controls is not a purpose of the PNR Directive, which clearly seeks the objective of ensuring security in the Union and its area without internal borders, where the Member States share responsibility for ensuring public security. In addition, unlike the draft agreement with Canada, the Directive does not concern data transfers to a third country, but the collection of passenger data from and to the EU by the Member States. In practical terms, for passengers returning to the Union to reside there it may be impossible to determine the timing of the erasure of the data given that they will not depart from the territory of the Member States. As a result, it can be concluded that the rule of erasure on exit laid down in Opinion 1/15 does not correspond to the objectives of the Directive and to the situation it seeks to regulate. In a similar vein, the nature of the PNR Directive as secondary law means that its application is surrounded by the additional guarantees intrinsic to the acquis, and thus takes place under the control of the national courts of the Member States and, in the final instance, of the Court of Justice. Furthermore, the national laws implementing the Law Enforcement Directive also apply to the processing of data provided for in the PNR Directive, including any subsequent processing by competent authorities. Such considerations cannot be applied in the context of an international agreement involving the transfer of personal data outside the EU. Case studies illustrating the use of historical data: The police in a Member State was engaged in an ongoing investigation wherein it was gathering evidence to prosecute a suspect accused of human trafficking, in the context of the activities of an organised crime group. To link the suspect with the victims, information about a flight made in 2015 was necessary. As the Passenger Information Unit of that Member State had been established after this date, it made a request to the Passenger Information Unit which was operating in the destination of the relevant flight. The requested Passenger Information Unit was able to transmit flight information that linked the suspect with the victims (all passengers had been booked under one PNR) and provided the necessary evidence against the suspect. In another case, two persons were arrested and charged with drug trafficking. Despite the fact that the arrest took place in a public place, when the defendants were exchanging drugs and money, they both denied knowing each other when interrogated. However, the analysis of PNR data established that they had travelled together 20 times during a period of 2 years. They had not only booked the same flights, but also travelled next to one another. A Passenger Information Unit was requested to provide travel information related to a person suspected to have been involved in ISIS activities in Syria before being arrested in another Member State. Intelligence available on the suspect pointed to a rich travel history around Europe. The analysis of PNR data allowed to trace back the movements of this individual between several Member States and to identify potential co-travellers. This information played a crucial role in this specific investigation and provided valuable insights into new travel patterns of ISIS members returning to Europe.

An individual had been wanted by law enforcement in relation to serious drug offences for more than 10 years. Intelligence indicated that the individual was a frequent traveller to other European countries, but no details of the person’s travel history could be identified. Communications data analysis of a telephone number attributed to the individual revealed when their phone was in certain countries. Analysis of passenger data for flights to and from those locations on specified days revealed a single otherwise unknown individual whose travel destination matched the location of the mobile telephone. Analysis of this individual's PNR revealed a previously unknown identity, email address and residential address. This intelligence-led investigative work led to the person’s arrest. Without the use of historical PNR data, this arrest would have not been possible. The use of pre-determined criteria, developed on the basis of historical data, enabled the arrest of a passenger upon the arrival from Airport X with 4kg of heroin. The previously unknown passenger’s PNR contained data elements that corresponded to pre-determined criteria created after the arrest of other drug smugglers. 5.3.The effectiveness of exchange of information between the Member States One of the key objectives of the PNR Directive is to lay the foundations of an EU PNR mechanism. The Directive does not foresee the creation of a centralised database. Each Member State is competent for the collection, processing and storage of PNR data from the flights arriving and departing from its territory. At the same time, the cooperation and exchange of PNR data between the Passenger Information Units is one of the most important elements of the Directive. The regular meetings on the application of the PNR Directive, organised by the Commission, as well as the Informal Working Group on PNR, led by the Member States, have allowed for the creation of a ‘EU PNR community’, where national authorities can discuss, exchange ideas, share best practices and address the issues arising from the practical application of the Directive. The PNR Directive sets out two options for data transfers between the Passenger Information Units. In the first scenario, a Passenger Information Unit may transfer PNR data on its own initiative, when it considers this is ‘relevant and necessary’ for the prevention, investigation and prosecution of terrorist offences and serious crime in another Member State (the so-called ‘spontaneous transfers’). The second scenario envisages that a Passenger Information Unit transfers data in reply to a request received from the Passenger Information Unit of another Member State. Such a request should be justified and the reasons provided must be relevant for the prevention, investigation and prosecution of terrorist offences and serious crime. The Directive sets additional requirements for the transfer of data that had previously been depersonalised. According to national authorities, the exchange of data between the Member States based on requests functions in an effective manner. The number of requests has grown consistently and national authorities consider the possibility to request data from another Passenger Information Unit as both very useful and practical. Member States have adopted certain practical tools that facilitate the exchange of PNR data between the Passenger Information Units. For example, a large majority of Member States use a common template to request data. This helps prevent the impact of possible divergences in the interpretation of the requirement to provide due reasons for each requests. The rate of refusals is low, with most Member States having refused to share data only sporadically or having responded positively to all requests. The delay in providing a reply varies from a few hours to a few days, depending on the availability of staff and other factors such as whether the data requested have already been depersonalised or the seriousness of the crime in question (e.g. some Passenger Information Units prioritise requests related to terrorist offences). In general, PNR practitioners do not consider the time necessary to receive the requested data as an obstacle to the efficient cooperation between the Passenger Information Units. Most Member States use the Europol Secure Information Exchange Network Application (SIENA) for their communications with the Passenger Information Units of other Member States and the experience has been overall positive, although minor technical and other issues have been encountered. In terms of challenges, national authorities have pointed out to the increasing number of requests and the impact of the divergences in national regulations and practices on the cooperation between the Passenger Information Units. Some practitioners have expressed concerns that the rapidly growing number of requests received both from their own national competent authorities and the Passenger Information Units of other Member States might create an excessive workload for their Passenger Information Units and lead to longer delays in processing data. Of particular concern is the practice of sending broad and unspecified requests to many (or even all Passenger Information Units). Such requests, even if refused as not duly reasoned, create an additional burden for the Passenger Information Unit staff. National authorities have also pointed out to divergences in national legislation as affecting the cooperation between the Passenger Information Units. In particular, national authorities may be more or less strict in assessing if a request is duly reasoned. Some may be stricter in requiring the proof of a link between the request and their Member States, whereas others may be more flexible. The fact that the Passenger Information Units are embedded in different authorities in the Member States (Ministry of Interior, Border Guard, state security agency), and differ in terms of their competences and tasks, may also have an impact on their cooperation. The lack of harmonisation of national criminal laws leads to additional complexity in this respect. With regard to the serious crimes listed in the PNR Directive, the terminology, classification and applicable sanctions vary across the Member States, which may result in differences in the scope of application. Another problematic element is the lack of feedback – a Passenger Information Unit will not know why a particular request has been refused. In contrast with the widespread use of request-based information exchanges, the possibility to transfer PNR data on the Passenger Information Unit’s own initiative is much less prevalent. A significant number of Member State have never spontaneously transferred data to other Member States. Others use this possibility sporadically or have rather developed a practice of providing additional information in reply to a request. Importantly, Member States vary in their interpretation of the concept of ‘relevant and necessary’: some consider that hits resulting from processing against watch lists and databases as an indication of relevance and necessity, whereas others rely on a case-by-case individual assessment of relevance and necessity by Passenger Information Unit staff. In conclusion, national authorities have identified the broad and relatively unclear formulation of the Directive’s provision on spontaneous transfers as a reason for divergences in its interpretation and a certain reticence in its application. Others have also indicated that the Passenger Information Units have no human and technical capacity to conduct assessments targeted at the needs of other Member States and to engage in proactive transfers of data. Nevertheless, some practitioners have confirmed the usefulness of information received spontaneously (without a request) from another Passenger Information Unit. Member States have not yet made use of the request possibilities linked to emergency situations and specific and actual threats, provided for in Articles 9.3 and 9.4. 5.4.The quality of the assessments including with regard to the statistical information gathered pursuant to Article 20 The analysis presented above was informed by quantitative and qualitative information gathered by the Commission in the preparation of the review. The sources of evidence used included Member States’ statistical submissions and brief case studies illustrating the use of PNR data, discussions in dedicated workshops and other meetings on the implementation of the PNR Directive as well as field visits to the Passenger Information Units of specific Member States. Throughout the review process, national authorities and other stakeholders involved in the practical application of the Directive were open to share information and experiences with the Commission. In this regard, it must be noted that Article 20 of the PNR Directive requires Member States to collect, as a minimum, statistical information on the total number of passengers whose PNR data have been collected and exchanged, and the number of passengers identified for further examination. As indicated above, the analysis of this information leads to the conclusion that only the data of a very small fraction of passengers are transferred to competent authorities for further examination. Thus, the statistics available indicate that, overall, PNR systems are working in line with the objective of identifying high risk passengers without impinging on bona fide travel flows. It should be noted that the statistics provided to the Commission are not fully standardised and therefore not amenable to hard quantitative analysis. This issue is compounded by the relatively early stage of development of most national PNR systems and the fact that the coverage of data collection still varies across the Member States. The Commission has mitigated these difficulties by collecting various types of evidence, as discussed above, to establish a solid evidence base for the review. Importantly, in most investigations PNR data constitutes a tool, or a piece of evidence, among others, and it is thus often not possible to isolate the results attributable specifically to the use of PNR alone, or to draw conclusions on its effectiveness based solely on quantitative assessments. For this reason, a combination of quantitative and qualitative sources appears to be better suited for this type of analysis. The Commission will also continue working closely with the Member States to improve the quality of the statistical information collected under the Directive. 5.5.Feedback from Member States on the possible extension of the obligations and the use of data under the PNR Directive Intra-EU flights Under the PNR Directive, Member States are allowed but not obliged to collect PNR data on intra-EU flights, in which case they have to inform the Commission (Article 2). However, because of the current security situation in Europe, on 18 April 2016 Member States declared in a statement that they intended to make full use of the possibility provided for in the Directive of requiring PNR on intra-EU flights. All Member States but one have notified the Commission on the collection of PNR data in intra-EU flights under Article 2. Nevertheless, any such extension of the scope of the Directive must be subject to an impact assessment, including an assessment of its necessity and proportionality. The collection of PNR data for intra-EU (and in particular intra-Schengen) flights is an important tool for law enforcement authorities to track the movements of known suspects and to identify suspicious travel patterns of unknown individuals who may be involved in criminal/terrorist activities when they travel within the Schengen zone. Some national authorities have reported, based on their operational experience, that the processing of PNR data for intra-EU flights produces significant number of matches, in some cases higher than for extra-EU flights.

Case studies illustrating the use of PNR data collected on intra-EU flights: A third country national residing in one Member State was prohibited from entering the territory of another Member State because of links with a terrorist organisation. It was only thanks to the processing of PNR data that the individual’s presence on a plane was discovered by the authorities. The person was intercepted immediately after arrival and sent back on the same day. Based on the information provided by the Passenger Information Unit of Member State A, related to a match obtained by comparing PNR data with the SIS, the Border Police of Member State B was alerted while a person of interest was travelling from Member State A and the individual was arrested in compliance with an European Arrest Warrant issued by Member State C. As this was an intra-EU flight, passengers were not subject to border controls. Only the collection of PNR data made it possible to identify the target and conduct the arrest. Non-carrier economic operators The Directive does not require travel agencies and tour operators (the ‘non-carrier economic operators’) to send PNR data but does not prohibit Member States to also collect PNR from these entities under their national law, if such measures are compatible with the EU law. In a few Member States, national legislation provides for a legal basis for such collection, but it is not implemented in any of them. Tour operators and travel agencies provide travel-related services, including the booking of both regular and charter flights. To make a booking they collect passengers’ information, which may include, in addition to name and surname, the contact and payment details. However, only very limited information is further provided to the airlines in order to finalise the reservation. In most cases, only name, surname and information on the passenger being an infant or child is shared with the airlines. In addition, the exact data elements transferred to airlines, as well as the timing and the technical modalities of the transfer, differ depending on the carrier. Travel agencies and tour operators have reported that, due to business considerations, they are unwilling to transfer to airlines (or to other tour operators) data elements other than those that they consider strictly necessary. Their main concern is that passengers’ contact details may be used by airlines to approach them directly to propose services. As a result, for reservations made by non-carrier economic operators, only very limited data elements are transmitted to the Passenger Information Units. However, the contact details and payment information may be very relevant for law enforcement authorities. For instance, the same email address or credit card may be used by members of a group involved in criminal or terrorist activities. The processing of such data may allow to identify the links between seemingly unrelated passengers and trace the movements of the members of the group. Given that, depending on the Member State, up to 50% of flight reservations may be made by travel agencies and tour operators, an important share of the data provided by passengers is not collected and processed by the Passenger Information Units, which creates an important security gap. Importantly, the concerns of non-carrier economic operators that their competitors could use the data of customers for their own commercial purposes would not be relevant in case of data transfers to the Passenger Information Units. However, the extension of data collection to non-carrier economic operators will require a detailed analysis of the legal, financial and technical aspects stemming from such extension, like the lack of standardisation of data formats. Other modes of transportation The Directive does not exclude that Member States might provide, under their national law, also for the collection and processing of PNR from other transportation services providers, if this is compatible with Union law (Recital (33)). Any such extension of the scope must be subject to an impact assessment, including as to its proportionality and necessity. This possibility has been used so far only by a few Member States, which extended passenger data collection to other modes of transport, namely maritime, rail and road carriers. These regulations are still at an early stage of implementation. However, a number of positive operational experiences have already been shared by the authorities using passenger data collected on these transportation modes. Serious concerns have been raised by law enforcement experts with regard to the lack of collection of passengers’ data from other modes of transportation. The phenomenon of ‘broken travels’, by which criminals divide their travel and use different modes of transportation to conceal their final destination, is well known to law enforcement authorities. These have warned that the progressive deployment of PNR data collection in the air sector may bring about changes in travel patterns of persons involved in terrorism and serious crime, who may increasingly choose other modes of transportation. At the same time, the collection of passenger data for other modes of transportation raises practical, technical and legal questions, including considerations on their impact on fundamental rights. Firstly, passenger data formats are not as standardised for other modes of transportation as the PNR for the air sector. In addition, rail and road transport present very different characteristics: a ticket can be bought at the very last moment (or even already on board) and in many cases is not nominal. The journey may have many stops before reaching the final destination, with passengers starting and finishing the journey at different moments. The possibility of extending PNR collection to other modes of transportation was discussed within the Council Working Party on Information Exchange and Data Protection (DAPIX), under the Finish Presidency during the second semester of 2019. These discussions led to the adoption of Council conclusions of 2 December 2019 on ‘Widening the scope of passenger name record (PNR) data legislation to transport forms other than air traffic’. The conclusions note that some Member States have acknowledged the potential added value of extending PNR data collection to other transport modes for the fight against terrorist offences and serious crime, while also taking stock of the concerns voiced by some Member States regarding the legal, technical and financial challenges this could create, in particular with regard to fundamental rights and the principles of necessity and proportionality. The document recommends that a thorough assessment be carried out before any further decisions may be made in this regard. The use of PNR data to protect public health in case of a pandemic A number of Member States have pointed out that PNR data could constitute a valuable tool to protect public health, in particular to prevent the spread of infectious diseases. On the latter, the seat information – which could allow the health authorities to identify passengers who had been in the proximity of a person who was subsequently diagnosed as with an infectious disease – could be important in case of epidemics. This issue has gained more prominence since the beginning of the COVID-19 pandemic in 2020, with more Member States indicating that there is a need to be able to use PNR data to tackle such health-related emergencies. The PNR Directive currently only allows for the processing of PNR data in the fight against terrorism and serious crime, with no exceptions. By way of comparison, the EU PNR agreement with Australia does recognise that there may be exceptional circumstances where PNR can be processed to protect the vital interests of any individual, such as a risk of death or serious injury or a significant public health risk. The Court of Justice, in its Opinion 1/15 on the draft EU-Canada PNR agr