on the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of passenger name records to the United States Department of Homeland Security

REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL

on the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of passenger name records to the United States Department of Homeland Security

Introduction

The current Agreement between the United States (US) and the European Union (EU) on the use and transfer of passenger name records (PNR) to the United States Department of Homeland Security (DHS) entered into force on 1 July 2012.

The Agreement provides for a first joint review one year after its entry into force and regularly thereafter as jointly agreed. This joint review was carried out on 1 and 2 July 2015 in Washington and the preparation process for the joint review and subsequent Report are outlined at the end of this Report. Its main focus was to follow up progress on the previous review recommendations from 2013; the implementation of the Agreement, with particular attention to the method of transmission of PNR as well as the onward transfer of PNR as set out in the relevant articles of the Agreement.

The joint review is based on the methodology developed between the EU and the US teams for the first joint review of the 2004 PNR Agreement, which took place in September 2005, and for the joint review in 2013. The first part of this methodology consisted of a questionnaire sent by the European Commission to the DHS prior to the joint review.

The Commission Staff Working Document (SWD) accompanying this Report consists of five Chapters. Chapter 1 provides an overview of the background to the review and the purpose and procedural aspects of the exercise. Chapter 2 presents an update on the implementation of the recommendations from the review in 2013. Chapter 3 presents the main findings of the joint review of 2015 and the issues to be further addressed by DHS. Chapter 4 presents a summary of the recommendations from the 2015 review. Chapter 5 presents the overall conclusions of the exercise. Finally, the SWD is supplemented by an Annex which contains the questionnaire and DHS replies thereto.

Implementation of the 2013 recommendations

All the recommendations from the 2013 review have either been completed or improvements have been made and the work is ongoing.

As a follow up to a general recommendation of the review of 2013, the DHS Privacy Office proceeded with an internal 'Privacy Compliance Review' (PCR) of the implementation by DHS of the Agreement prior to the joint review of 2015. This PCR was conducted to determine whether DHS is operating in compliance with the standards and representations in the Agreement with the EU and the report was published on 26 June 2015.

The commencement of the six months period triggering the depersonalisation of PNR under Article 8 (1) of the Agreement now starts as from the day the PNR is loaded in US Automated Targeting System (ATS) (the so-called ATS Load Date) which is the first day the data are stored in ATS, instead of the previous practice, which delays applying the six months period (until the last ATS Update of the PNR).

The 2013 review also recommended ensuring as quickly as possible a full move to the “push” method by 1 July 2014, as required under Article 15(4) of the Agreement. At the time of the 2015 review four carriers were still not providing PNR via the "push" method; DHS were providing support to those carriers to develop the capability to "push" PNR data.

The 2013 review recommended that under Article 18 DHS should improve the procedure aimed at notifying EU Member States in case of sharing of EU PNRs between DHS and third countries occurs. In response a CBP officer has been posted to Europol as a liaison officer since July 2014. When the liaison officer identifies a targeted passenger with a nexus to a Member State, he shares this information in a report with the Member State's representatives.

Improvements have also been made to the implementation of Article 13, which relates to redress mechanisms available to individuals. The 2013 review recommended that greater transparency on the redress mechanisms available to passengers under US law should be provided. It is positive that DHS Traveller Redress Inquiry Program (TRIP) is the single point of contact for the public; however the US should continue to review all necessary means to ensure that all passengers are made aware of the redress mechanisms.

Recommendations from the 2015 review

The EU team has continued to find that the US has implemented the Agreement in line with the conditions set out therein. DHS respects its obligations as regards the access rights of passengers and has an oversight mechanism in place to guard against unlawful discrimination. The Commission also welcomes the continued effort to ensure reciprocity and pro-active sharing of analytical information obtained from PNR data with Member States and, where appropriate, with Europol and Eurojust. The masking and deletion of sensitive data are respected and DHS has stated that it has never accessed sensitive data for operational purposes.

DHS continues to implement its commitments in relation to passenger rights, in particular as regards providing appropriate information to passengers and implementing the right to access without any exemptions as provided for under Articles 11, 12 and 13. The enactment of the Judicial Redress Act of 2015 since the joint review took place is a welcome development.

Sharing of data with other domestic agencies is handled by DHS in line with the Agreement. Sharing is carried out on a case-by-case basis, logged and takes place on the basis of written understandings. Sharing of data with third countries is also interpreted strictly, and is also in line with the Agreement. The US applies the same data protection requirements to all PNR it acquires and processes regardless of whether sourced from inside or outside the EU.