EUROPEAN COMMISSION Brussels, 12.1.2021 SWD(2021) 4 final COMMISSION STAFF WORKING DOCUMENT Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the joint evaluation of the Agreement between the United States of America and the European Union on the use and transfer of passenger name records to the United States Department of Homeland Security {COM(2021) 18 final}



Contents 1. INTRODUCTION 2. METHODOLOGY 3. THE OUTCOME OF THE JOINT EVALUATION 3.1 The use and operational value of PNR data 3.2 Targeting Rules and use of historical PNR data 4. CONSISTENCY WITH OTHER INSTRUMENTS 4.1 Other instruments for the collection of travel related data 4.2 Other instruments on PNR 5. SAFEGUARDS APPLICABLE TO THE USE OF PNR 5.1 Validation and review process for the access rights for officials and targeting rules 5.2 Sensitive data 5.3 Mechanisms to ensure transparency, access, correction and redress 5.4 Oversight 5.5 Method of PNR transmission 5.6 Onward sharing to U.S. entities outside of DHS 5.7 Onward transfers 6. DATA PROTECTION SAFEGUARDS AND THE COURT’S OPINION ON THE ENVISAGED CANADA PNR AGREEMENT 7. Conclusions

ANNEX A - Case studies ANNEX B - Questionnaire and replies ANNEX C - Composition of the evaluation teams 1.INTRODUCTION The Agreement between the U.S. and the European Union (EU) on the use and transfer of Passenger Name Record (PNR) to the U.S. Department of Homeland Security (DHS) entered into force on 1 July 2012 (herein after “the Agreement”). It responds to the needs of U.S. law requirement for airlines operating flights to or from the United States of America (U.S.) to provide the DHS, U.S. Customs and Border Protection (CBP), with PNR data for purposes of preventing, detecting, investigating, and prosecuting terrorist offenses and related crimes and certain other crimes that are transnational in nature. This information is collected in airline travel reservations and is transmitted to CBP prior to departure. Accordingly, the Agreement allows for transfers of PNR data to the U.S. from the carriers operating passenger flights between the European Union and the U.S. and from carriers storing data in the EU and operating passenger flights to or from the U.S., subject to safeguards and controls included therein. According to Article 23(1) of the Agreement, “The Parties shall jointly review the implementation of this Agreement one year after its entry into force and regularly thereafter as jointly agreed. Further, the Parties shall jointly evaluate this Agreement four years after its entry into force”. Two joint reviews of the Agreement took place in 2013 and 2015 which examined the practical application of the Agreement. The second joint review was carried out in 2015, however, the report was published in 2017. At the time of agreeing on the aspects of the joint evaluation, considering that the report had been published quite recently, it was decided for the next joint review to take place after the finalisation of the joint evaluation. These reviews, which are publicly available online, found DHS in compliance with the Agreement’s terms and proposed recommendations to further improve it. In January 2019, it was jointly agreed to launch the joint evaluation of the EU-U.S. PNR Agreement exercise as foreseen in Article 23 thereof. This document includes findings by the EU side and the result of the joint evaluation. Prior to its finalisation, it was shared with the U.S. authorities providing them with the opportunity to identify possible inaccuracies and comment on its content. Pursuant to the agreed terms of the evaluation the U.S. may issue its own report with its observations. Due to the sensitive nature of the PNR programme, some information was provided to the EU team on the condition that it would be treated as classified up to the level of EU Secret. These limitations have not come in the way of a thorough and objective evaluation, as well as an open and frank exchange of views with the U.S. authorities in a very constructive spirit. Background on PNR processing in the U.S. PNR data are transmitted to DHS/CBP pursuant to its statutory authority, 49 USC. § 44909, as implemented by the Title 19 of the Code of Federal Regulation (CFR) 122.49d. The U.S. provided the EU team with information about the implementation and use of the Automated Targeting System (ATS). DHS/CBP operates the ATS, which is a decision support system using, inter alia, PNR data to facilitate legitimate travel while identifying potential threats to the U.S. posed by individuals so they can be referred for an in depth examination prior to entering or exiting the U.S.. ATS compares information about individuals travelling on flights to or from the U.S. against U.S. law enforcement databases as well as redress records and travel history of the passengers. It compares existing information about individuals entering and exiting the country with patterns of known illicit activities (“targeting rules”) identified through risk-based assessments and intelligence. It flags possible matches to these targeting rules. It allows users to search data to provide a consolidated view of data about a person or entity of interest. It also provides users with a consolidated view of data about a person entering or departing the U.S. so a decision about their admissibility can be rendered. As such, it allows DHS to focus law enforcement attention on those individuals most likely to pose a risk while facilitating the entry of the overwhelming majority of legitimate travellers by reducing inspection requirements. The U.S. approach to making admissibility determinations, shares some similarities with the techniques adopted by other law enforcement services whose data and expertise contribute to the conduct of that analysis. In addition, representatives from these services may be assigned to work at DHS facilities, or contribute from their own locations. ATS unifies this information to support decision making procedures and is used both by CBP officers at ports of entry, including dedicated Passenger Analytical Units at relevant points of entry and at the national level, including at CBP’s National Targeting Center (NTC). This distinction between national and local operations is, in some respects different from that employed by individual EU Member States which rely on a single Passenger Information Unit (PIU) to conduct analysis at a national level. As a result of the U.S. structure, DHS officials, including from CBP, Immigration and Customs Enforcement (ICE), U.S. Coast Guard, U.S. Citizen and Immigration Services (USCIS), the Transportation Security Administration (TSA) and the Office of Intelligence and Analysis (I&A) use the ATS, although their access to PNR data is limited to what is necessary to fulfil the individual’s official responsibilities consistent with U.S. law, policy, and the Agreement. The U.S. team noted that DHS provides individual users with access to PNR data only to the extent that the users have an official need for the information to perform their duties and each user’s access to specific PNR user groups or roles must be approved by the CBP Privacy Office and the CBP Office of Chief Counsel (OCC). DHS vets all of its employees before hiring them, and DHS trains them before and regularly after giving them access to the PNR needed to perform their duties.

To demonstrate the scale of the CBP airport operations, in fiscal year 2019 (1 October 2018 to 30 September 2019), there were 968,914 commercial aircraft arriving from approximately 280 points of departure airports outside the United States bringing to the United States more than 135.7 million travellers. This was increase in air passenger volume of 3.76% over the previous fiscal year. Most points of entry operate 24 hours per day, seven days a week, requiring three shifts of frontline officers and supervisory officers that, among other things, receive and evaluate PNR data to determine whether travellers should be further scrutinised prior to their admission into the United States. 2.METHODOLOGY Although the Agreement does not state the scope and purpose of the joint evaluation, the Commission and DHS agreed it should take a wider approach than the joint reviews. Hence, unlike the joint reviews, whereby both parties assess together whether the Agreement is being implemented correctly, the joint evaluation consists of a more thorough examination of the Agreement. In particular, the joint evaluation explores the wider functioning and operationally added value and assess its results, impacts, effectiveness, necessity and proportionality. It also offers an opportunity to take stock of any impact caused by the evolution of the relevant legal framework and case law of both parties. As a first step, the European Commission sent a detailed questionnaire to DHS covering relevant aspects (the questionnaire and the replies provided by the U.S. can be found in Annex B). The EU team visited DHS and CBP premises on 5-6 September 2019. In order for the EU to provide insight to the U.S. on the newly EU established system, the U.S. team visited Europol headquarters, the Dutch and the Belgian Passenger Information Units (PIU) on 22–23 October 2019. The joint evaluation covers the entire period of application of the 2012 Agreement to 2019. As was the case with the joint reviews, the European Union was represented by the European Commission. The Commission team was led by the Director for Security and included officials from the Directorate General for Migration and Home Affairs, the Directorate General for Justice and Consumers, Europol, as well as data protection and law enforcement experts from the EU Member States. The U.S. was represented by DHS with a team composed of officers from various units in charge of the PNR data collection and analysis as well as participants from its legal, policy and privacy officers, and the U.S. Departments of State and Justice. A full list of the members of both teams appears in Annex C (the composition of the teams). The joint evaluation relied on the following elements: ·The questionnaire sent to the U.S. in advance of the joint evaluation and the replies to this questionnaire (Annex B); ·Visits to DHS headquarters, CBP, and the CBP NTC in Washington, D.C., and Virginia, U.S. on 5-6 September 2019; ·Visit of the U.S. team to the Belgian and Dutch Passenger Information Units and Europol on 22-23 October 2019; ·Exchanges with DHS personnel responsible for the PNR programme, including analysts who use and have access to PNR data; ·The information provided during the visits to the U.S. and discussions with representatives from DHS, U.S. Customs and Border Protection, the U.S. Department of Justice, and the U.S. Department of State; ·Documentation received from U.S. (including on the CBP’s targeting programme and its privacy framework and oversight). ·The joint review reports of 2013 and 2015, where appropriate; ·Related legislation and case law; notably the Opinion 1/15 of the European Court of Justice of 26 July 2017 on envisaged EU-Canada PNR Agreement. ·The evolution of the security environment in the EU, the U.S., and globally, including the adoption of an obligation for all States to collect and use PNR in the United Nations Security Council Resolution 2396 (2017). The present document has received the unanimous agreement of the members of the EU team. It has also been shared with DHS, providing the U.S. with the opportunity to comment on inaccuracies, identify information which cannot be disclosed to public audiences, and respond to conclusions by the European Commission. While the evaluation itself was conducted jointly, this is document is not a joint report of the EU and U.S. teams. 3.THE OUTCOME OF THE JOINT EVALUATION This Chapter provides the main findings resulting from the joint evaluation of the EU team.

3.1.The use and operational value of PNR data The evaluation teams discussed different ways in which PNR data are used for purposes of preventing, detecting, investigating, and prosecuting terrorist offenses and related crimes and certain other crimes that are transnational in nature as defined in Article 4 of the Agreement, as well as other purposes addressed by Article 4 of the Agreement, to include the protection of vital interests of any individual. PNR data contains elements that are not available through other means and is used to assist in identifying high risk travellers who are not otherwise known to law enforcement agencies (examples of real cases are provided throughout the present document). PNR data are used to help identify travellers to or from the U.S. who may be involved in terrorism or serious transnational crimes. This is done by comparing PNR data with relevant databases and on the basis of targeting rules established on the basis of past investigations and intelligence showing how terrorists and criminals exploit air travel to identify passengers who may need additional scrutiny. If there is a match, CBP conducts additional research using other available information and databases. . According to the U.S. authorities, the transfer, processing, and analysis of PNR data under the Agreement: ·Facilitates the expeditious entry of the overwhelming majority of travellers posing no threat to public safety. ·Contributes to the effective and accurate identification of individuals who should undergo further inspection upon arrival. ·Complements other information about a traveller and their journey such as Advance Passenger Information (API), visa applications, Electronic System for Travel Authorization (ESTA) applications, and biometrics to provide a complete and accurate picture of the traveller’s identity and means of travel as relevant for border enforcement purposes. ·Helps DHS to limit inspections to travellers posing higher relative risk when processed and analysed along with other information in relevant databases, past enforcement actions and known or suspected illicit trends, thereby expediting the admission of all other travellers. ·Provides insight into the travel of the individual, at times including multiple legs of the journey, prior to and after arrival and/or boarding that is not available from other information that is relevant to border enforcement. ·Illuminates the modus operandi of criminals and terrorists through the review of historical PNR of newly identified suspects. ·Identifies previously unknown terrorists and criminals, both during routine border encounters and through the review of current and historical PNR during investigations. Example: In January 2015, DHS referred an individual for a secondary inspection, as the information in his PNR matched the modus operandi of known terrorists. During the secondary inspection, a review of the traveller’s electronic device revealed images related to terrorist activities. The traveller could not explain why he had these images. Based on secondary inspection, DHS referred him to another law enforcement agency for further investigation. In another example, in January 2019, an EU citizen sought to travel from the U.S. to the EU with weapons in his checked baggage. Through PNR, DHS was alerted that the individual had checked weapons in his luggage. DHS inspected the luggage and found several rifles. Processing of PNR data alerted DHS of the weapons. DHS reviewed additional information and determined that the individual had not obtained the required export licence. Because the illicit export of the rifles constituted a serious violation, DHS seized the items. The U.S. explained that, without PNR data, DHS Officers would need to undertake much more intrusive and time-consuming interviews and inspections of each and every traveller, significantly delaying passengers and the operation of the international air transportation system. PNR data allows DHS to focus on high-risk individuals, thereby reducing passenger wait times and inspections at ports of entry for nearly all travellers to a few minutes or less. 3.2.Targeting Rules and use of historical PNR data During the evaluation exercise, the U.S. Delegation provided additional information about PNR’s contribution to security. The U.S. representatives stated that PNR data provides important historical information for investigations and thus assists with identification of previously unknown persons of interest, who have been linked to known or suspected terrorists, criminal networks, or other illegal activities. This was also the case regarding the investigations into several terrorist attacks in the EU. At the request of European national law enforcement agencies leading the investigations, DHS shared PNR and other records that aided European authorities in locating additional, previously unknown suspects. DHS’s receipt and retention of PNR allowed it to support EU Member States directly or through EUROPOL following many of the EU-based terrorist attacks since at least 2012, including the Paris Bataclan, Barcelona, Brussels, Berlin Christmas Market, and Bastille Day attacks. The U.S. authorities illustrated the operational added value of the processing of PNR data including historical PNR data on a number of case studies and examples available below and in Annex A and B. Examples: I. In August 2019, DHS identified a previously unknown associate of a known or suspected terrorist, based on matches to multiple historic PNR data belonging to the previously unknown associate. DHS’s ability to validate the association between the two individuals over the course of many years was critical to establishing reasonable suspicion and the individual was referred to law enforcement for further investigation.

II. In January 2014, a U.S. law enforcement agency asked for DHS’s assistance in locating a criminal fugitive wanted since 2004 and believed to have fled the country. Using historical PNR, DHS identified the probable residence of the subject in a foreign country. The U.S. law enforcement agency, with assistance from the foreign country, located the subject in the other country in June 2014, and successfully had the subject extradited back to the U.S. III. In 2004, U.S. authorities detained a woman who had smuggled children into the U.S. A transnational criminal organisation recruited her to smuggle the children into the U.S. where the organisation’s operatives sold them. Through information gained during her interview about the organisation’s routine operations, DHS used historical and current PNR data to identify additional potential smugglers and victims previously unknown to U.S. law enforcement. The U.S. and a foreign government conducted joint law enforcement operations to shut down two transnational criminal organisations who used the same technique to smuggle children into the U.S. The joint operations resulted in the arrest of dozens of criminals and the return of dozens of children to their parents in foreign countries. The modus operandi discovered by this case supported law enforcement investigations and interdictions for many years, leading to additional arrests and rescued children. IV. In 2012, the U.S. investigated an individual for child sex tourism. Similar allegations about the subject had been made since the 1970’s, and he had been previously charged in the U.S., the UK, and Egypt. DHS provided certified copies of historical PNR data to the Assistant U.S. Attorney for use at trial. The historical PNR data showed the subject’s travel, his use of aliases, and the identity of third parties who paid for his tickets. On 28 February 2013, a U.S. district court found the individual guilty of child sex tourism charges. V. In the 1990s, an individual joined al Qaeda and fought in Afghanistan. When he returned to the U.S., U.S. authorities arrested him for planning to set off bombs in the U.S. and Europe. DHS provided U.S. prosecutors with historical PNR data of his travel to various countries with a significant terrorist presence, data which DHS retained at a time when the individual was not under suspicion of any criminal activity. The retained PNR contributed to his conviction and 15-year prison term for conspiring to use weapons of mass destruction and providing support to terrorists. VI. In 2019, a U.S. citizen travelled to the United States from Europe. Because his historical PNR matched an illicit trend used by known or suspected terrorists, DHS/CBP referred him for secondary inspection. The subject claimed that he had been overseas for a few years attending school and working. When asked if he knew anyone involved in the Syrian conflict, he stated that he attended a mosque that was soliciting funds to support the conflict in Syria. During the secondary inspection, DHS discovered photos of weapons on his electronic device, of the subject aiming a gun at someone, and of a video of militants wearing ISIS patches. Based on this inspection, and the availability and use of historical PNR data, DHS was able to refer him to law enforcement for further investigation. VII. In February 2010, a terrorist pleaded guilty to conspiring to conduct suicide attacks against the New York City subway system. The terrorist and two co-conspirators planned to travel from the U.S. to Afghanistan to join the Taliban and fight against the U.S. military and its allies. Another U.S. law enforcement agency requested immediate assistance from DHS in investigating the suspected terrorist due to his likely involvement in imminent attack planning. DHS’s research indicated that he travelled to Pakistan with two other individuals, who were previously unidentified co-conspirators at the time DHS conducted the research and at the time of their travel. According to DHS, if DHS had deleted the suspect’s and others’ PNR data after their departure from the U.S.., DHS would not have been able to help the U.S.. law enforcement agency to identify the co-conspirators and the full scope of the plot and the network supporting it. VIII. In April 2017, a traveller arrived at a U.S. land port of entry. By reviewing the traveller’s historical PNR data from 2012, DHS officers determined the individual had a connection to a recently identified known or suspected terrorist. The linkage between the two travellers was supported by information in the known or suspected terrorist’s 2015 PNR. During inspection, DHS discovered that the traveller’s phone contained several images of persons holding what appeared to be AK-47 assault rifles, and images of people bound and gagged who appeared to be dead. DHS officers also discovered several images of what appeared to be the traveller brandishing weapons while with a group of fighters. Further questioning confirmed the ties between the traveller and the known or suspected terrorist. IX. In May 2014, DHS and a foreign law enforcement agency used historical PNR data to investigate two missing women feared to be victims of trafficking and forced prostitution. Based on a review of the victims’ historical PNR, DHS and the foreign partner agency linked the two women to a suspected trafficker and to potential co-conspirators, and they also identified another possible victim. Based on this information, DHS was able to identify the suspected trafficker when he attempted to travel again to the U.S. in August 2014, and DHS arrested him. More examples are available in Annex A and B. The EU-U.S. Agreement allows PNR data to be retained in an active database for up to five years, but requires such data to be depersonalized and masked after six months. In line with the EU-U.S. PNR Agreement, after 5 years, PNR shall be transferred to a dormant database for a period of up to ten years and PNR data may be repersonalised during these ten years only in connection with law enforcement operations and where there is an identifiable case, threat or risk. In this respect, the U.S. has provided figures concerning the use of such dormant data over a twelve month period, showing a regular but reduced use of such information. Figures related to information sharing with other authorities show that PNR dataset’s age (time since a record was collected from an airline) at the moment of disclosure was below one year in the overwhelming majority of the cases. The U.S. authorities noted that older PNR data have proven vital in a number of high profile counterterrorism investigations and prosecutions. Under the discussions on Article 8(6) of the EU-U.S. PNR Agreement, which states that within the framework of the evaluation as provided for in Article 23(1), the necessity of a 10-year dormant period of retention will be considered, the U.S. noted that the figures shared with the EU team clearly demonstrate the necessity of maintaining dormant PNR data. In particular, the Agreement requires that the dormant data be “subject to additional controls, including a more restricted number of authorised personnel and higher level of supervisory approval before access.” It also requires, as noted above, that dormant PNR only be accessed “in connection with an identifiable case, threat and risk.” According to the U.S., these controls greatly reduce the number of times dormant PNR would be used. Although compliant with the Agreement, and given the comparatively reduced number of requests the EU team considers that the U.S. should continuously review the necessity of the dormant database in order to ensure that the use of PNR data remains relevant and necessary for the purposes for which it is collected. The U.S. committed to continue evaluating the utility of dormant PNR data during future joint reviews. 4.CONSISTENCY WITH OTHER INSTRUMENTS 4.1.Other instruments for the collection of travel related data PNR data remains a critical data element in the identification of serious transnational crime and terrorism. The U.S. team highlighted that without it, it is certain that an increase of illicit or nefarious goods, or individuals that seek to cause harm to the U.S. and the global community through criminal and terrorist acts, will enter or leave the U.S. undetected; when they could have been otherwise prevented through the use of PNR data. The necessity and peculiarity of collecting PNR data to fight terrorism and serious crime is also identified in relation to other measures available: there is information contained within PNR data that cannot be found in any other type of data collection. This information, like full travel paths, is a unique and critical information source in the identification of serious transnational crime and potential terrorist activity. Example: PNR data as the key piece of intelligence

In December 2009, unbeknownst to the U.S. Government, a radicalised individual received explosives training in Waziristan, Pakistan from individuals affiliated with Tehrik-e-Taliban (TTP), a terrorist group based in Pakistan. In February 2010, he arrived in the U.S. from Pakistan. Immediately following a failed detonation of a vehicle-born improvised explosive device at Times Square in New York City on May 1, 2010, DHS, at the FBI’s request, used API and PNR data to link him to information uncovered early in the time-sensitive investigation of the failed detonation. DHS also quickly discovered that he had just booked a flight to Dubai. DHS apprehended him at New York’s JFK Airport as he was about to board the aircraft for the flight to Dubai. On June 21, 2010, he pleaded guilty to all ten offenses related to his attempt to detonate a car bomb in Times Square and he received a life sentence in prison. The unique data contained within PNR becomes evident when comparing PNR data to data in other systems containing travel-related information (e.g. Visa data, Advance Passenger Information (API), and Electronic System for Travel Authorization (ESTA) data). For instance, API mostly includes biographic information that is rather ‘static’ (it does not change substantially over time) and does not show the behaviour of the passenger (as opposed to PNR data where one can see choices made by the passenger, such as baggage information, payment information, date of reservation/issuance of ticket, etc.). Similarly, the other systems created to grant authorisation to travel mainly rely on ‘static’ biographic information and are occasionally supplemented by some additional ‘status’ data such as level of education or occupation. In addition, PNR can be made available much earlier than API data, and hence provides an advantage to law enforcement authorities in allowing more time for its processing, analysis and any follow-up action. Specifically, under the agreement, PNR data becomes available beginning 96 hours prior to departure although an airline may collect it weeks or months ahead of departure. On the other hand API data may not be transmitted until 72 hours before departure and may be much later depending on when the passenger checks in. The additional time to review and analyse the PNR information often proves critical to determinations on possible appropriate actions to be taken. 4.2.Other instruments on PNR Since the entry into force of the Agreement, new trends and new security threats have emerged and continue to evolve. There is not only a growing interest in the use of PNR worldwide for anti-terrorism and law enforcement purposes, but also newly created international obligations. At global level, the United Nations Security Council Resolution (UNSCR) 2396, adopted unanimously on 21 December 2017, requires UN Member States to ‘develop the capability to collect, process and analyse, in furtherance of ICAO (the International Civil Aviation Organisation) standards and recommended practices, passenger name record (PNR) data and to ensure PNR data are used by and shared with all their competent national authorities, with full respect for human rights and fundamental freedoms’. This Resolution has therefore placed a legal incentive on all UN States to develop effective PNR programmes. The scope of the Resolution, focused primarily on terrorism, being extended to organised crime by Resolution 2482 (2019). In those instruments, the UN Security Council decided that UN member states must collect, process and analyse PNR for effective border controls to prevent terrorist travel as well as to help security officials make connections between individuals associated to organised crime, whether domestic or transnational, and terrorists, to stop terrorist travel and prosecute terrorism and organised crime. This obligation is binding on all UN Member States and as a result, more countries are expected to soon begin establishing PNR programs. The UNSCR 2396 (2017) also urges ICAO ‘to work with its Member States to establish a standard for the collection, use, processing and protection of PNR data’. Against this backdrop, ICAO started working on the development of a standard for the collection, use, processing and protection of PNR data. In March 2019, the ICAO Air Transport Committee (ATC) set up a Facilitation Panel Task Force to consider proposals for Standards and Recommended Practices (SARPs) on the collection, use, processing and protection of PNR data in line with UNSCR 2396. The U.S. participated in this Task Force, alongside several EU Member States, with the Commission representing the EU in an observer capacity. The position to be taken by the EU Member States when participating in these discussions was agreed by means of a Council Decision (EU) 2019/2107 of 28 November 2019 with a view to ensuring compliance with the applicable Union legal framework including the Charter of Fundamental Rights as interpreted in the Court of Justice’s Opinion 1/15. This required the EU Member States to act jointly in the interest of the Union in accordance with the objectives pursued within the framework of PNR policy and promote the inclusion in the ICAO SARPs of a number of principles on the modalities of PNR processing, the protection of personal data and information sharing among law enforcement authorities. Participating Member States and the Commission worked closely with the United States, as well as other nations, to achieve these goals. A draft version of the PNR standards was approved by the ICAO Facilitation Panel in February 2020 and sent to the ICAO Contracting States for consultation. After a final review by the ICAO Air Transport Committee in May 2020, the SARPs were adopted by the ICAO Council in June 2020. At the moment of drafting this document the SARP is not yet into force and the Union has not taken a formal position in its regard. However, the entry into force of the SARPs create another, more detailed obligation on all States to establish PNR programs and will help ensure both that their programs are effective and that they meet a high standard of data protection. These developments at international level demonstrate that there is now a global consensus and that it is necessary and appropriate for States to collect and process PNR routinely as part of a modern border management process. This is a significant change in the global environment and international law and, in the near future, the collection and use of PNR by governments to detect crime and terrorism at their borders will be the global norm, not the exception as it was when the EU began negotiating PNR agreements in 2003, beginning with the U.S.. The EU PNR Directive Within the EU, processing of PNR data constitutes an essential instrument in the common response to terrorism and serious crime and a building block of the Security Union. Identifying and tracing suspicious patterns by processing PNR to gather evidence and, where relevant, find perpetrators of serious crime and their associates and unravel criminal networks is proving essential to prevent, detect, investigate and prosecute terrorist and serious crime offences. On 27 April 2016, the European Parliament and the Council adopted Directive (EU) 2016/681 on the use of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. This Directive enables EU national authorities to gain direct access to crucial information held by airlines, in full respect of fundamental rights, in particular, data protection rights. It provides all Member States with an important tool for preventing, detecting and investigating terrorism and serious crimes, including drugs and human trafficking and child sexual exploitation. The deadline for the Member States to transpose the PNR Directive into national law expired on 25 May 2018. Article 20, paragraph 2, of the EU-U.S. PNR Agreement envisages the consultation of Parties if and when an EU PNR system is adopted to determine whether the Agreement would need to be adjusted accordingly to ensure full reciprocity. During the joint evaluation, the EU team showed DHS the key features of the EU PNR architecture. DHS recalled the good, although only occasional, cooperation with EU authorities stemming from these developments. Both parties agreed that the new EU PNR framework provides opportunities to improve operational cooperation between the U.S. and the EU as it now identifies specific counterparts in each EU Member State for handling PNR, i.e. the Passenger Information Unit (PIU) as the dedicated entity entitled to collect and process PNR data. In addition, the PNR Directive also foresees that each EU Member State designate authorities entitled to request or receive PNR from the PIU. Such a list is published in the Official Journal of the European Union and regularly updated by the European Commission. DHS could therefore verify whether requests for information and other types of cooperation under Article 18 (2) of the Agreement come from appropriate EU competent authorities. In this respect the new EU framework on PNR complements and generally aligns with the Agreement. Further to the U.S.’s visit to the EU in October 2019, the U.S. stated that they had not observed any practices in the PNR programs of EU Member States that require it to exert its rights under Article 20, Paragraph 2. The United States informed the EU that they will continue to monitor developments in the EU to assess whether this situation changes. More generally, the United States applauded the EU’s initial progress in establishing PNR programs, which has led to a more secure and efficient Europe. The U.S. encouraged the EU to continue this work, and in particular, to empower their PIUs to learn from and work collaboratively with third countries to identify and share information on a case by case regarding suspicious and illicit travelers. As countries around world adopt programs similar to those employed in the U.S. and EU, collaboration between States to protect the air transport system, in full respect for human rights and fundamental freedoms, will become even more critical. 5.SAFEGUARDS APPLICABLE TO THE USE OF PNR 5.1 Validation and review process for the access rights for officials and targeting rules The users access PNR data at ports of entry and other field locations (by Border Patrol agents), at the NTC, at the CBP headquarters, and within DHS by DHS agents, analysts, and officers in DHS’s Office of Intelligence and Analysis (I&A), Immigration and Customs Enforcement (ICE), U.S. Coast Guard, U.S. Citizen and Immigration Services (USCIS), and Transportation Security Administration (TSA). DHS maintains 24/7 operations at over 100 locations in the United States and abroad that are responsible for processing inbound and outbound traveller. Each of these locations maintains three shifts of frontline and supervisory officers who must access PNR to make accurate decisions on whether to admit travellers to the United States. The number of users fluctuates depending on mission need, coverage needed at points of entry, and job responsibilities, but the EU team is of the opinion that the number of authorised users (totalled 16,233 as of 6 August 2019, constituting 6.76% percent of approximately 240,000 DHS employees and 2% of nearly 700,000 sworn law enforcement officers in the United States) remains high. According to the U.S., these figures represent approximately 40 CBP users (at the ports of entry and NTC) per airport shift who over the course of year process 238.7 million travellers. In addition, the U.S. authorities informed the EU that DHS had to increase the number of officers with access to PNR in order to implement the Agreement’s requirements for senior official approval to access masked and dormant data.

The U.S. also explained that access to ATS and PNR is limited to those individuals with a demonstrated need-to-know, based on the specific job responsibilities at ports of entry or the NTC and that such determinations are regularly reviewed. Furthermore, access to PNR is further controlled by providing each user only those accesses required to perform the responsibilities of the position. The ATS database logs and maintains audit trails of what information has been accessed; these logs are maintained and used to support internal audits to ensure compliance with the stated purposes of the system. All officials with access to PNR data undergo initial training and bi-annual training on privacy, policy, and system requirements related to PNR data to access and maintain access to ATS. Users with access have to certify every six months that they have read and understood the conditions and requirements associated with the legal use of PNR data. In addition, CBP promptly removes access of individuals to information, including PNR data, if the individuals no longer require it, for example, when a DHS employee transfers to a new office or position where access to PNR is no longer necessary. However, the EU team is of the opinion that the number of users with access to the system remains high taking also into account the consistent increase in the number since 2013. The EU team suggests DHS to put in place additional procedures aiming at ensuring that access is only granted under a strict need to know basis and only when the tasks carried out by the officer warrant it. The U.S. team informed about how targeting rules are developed and implemented by the entrusted users at the NTC and Passenger Analytical Units at individual ports of entry. At the NTC, prior to the creation of the rule, consideration is given to its proportionality and the impact on the operations and the traveling public before implementing them. To accomplish this, each rule is tested against historical data to determine the likely number of travellers who will be referred for further examination. In addition, the NTC rules as well as the supporting intelligence or law enforcement information behind the rules are reviewed quarterly by CBP operational authorities and DHS Privacy Office, DHS Office for Civil Rights and Civil Liberties, and DHS Office of General Counsel. Targeting rules may match against PNR in dormant status, when necessary to identify possible high risk travellers with an association to illicit historical trends. This ensures that the targeting rules are tailored to minimise the impact upon bona fide passengers and that they comply with relevant legal authorities, regulations and policies. This review provides operational and oversight offices with an opportunity to identify and eliminate or deactivate rules that no longer address potential threats. In some cases, the U.S. Privacy Office, the DHS Office of Civil Rights and Civil Liberties, and the U.S. Office of the General Counsel discussed with CBP whether specific rules may be further scoped to be made more effective. The U.S. also noted that rules employed by the Passenger Analytical Units at individual ports of entry also have their own safeguards in place to provide a level of oversight and review. First, regional and local level rules have to be approved by senior managers. CBP headquarters recommends these senior managers require an impact assessment prior to approval. Further, during routine operations, when a regional or local level rule matches a traveller, CBP’s IT systems send a notification to regional or local, supervisory CBP personnel to review the match. Additional research and analysis is conducted by the onsite officer on duty, and, based on all available information, a decision is made whether to send the traveller for a secondary inspection. In addition, NTC conducts an audit of Passenger Analytical Units developed rules twice a year and requires field and NTC users to certify that a rule is still valid and necessary. If no response is received, the rule is deactivated. DHS does not develop rules at individual ports of entry for counterterrorism purposes but only utilizes them to address issues specific to a point of entry, such as localised smuggling trends. The EU team considers that rules designed at regional or local level do not benefit from the robust review system used for rules created at the national level, although they adhere to specific guidelines. In that regard the EU team recommends the U.S. including additional safeguards such as the generalisation of prior impact assessments before the approval of new rules. The individual ports of entry generally develop rules in the same way as individual PIUs in EU Member States. DHS clarified that local rules are not subject to the same review process as national level counterterrorism rules because points of entry developed rules do not directly impact the traveling public. When a passenger matches a rule by a given port of entry, he or she is not automatically referred for a thorough exam. Instead, each rule match is reviewed by an onsite officer who takes into consideration the totality of information known about the passenger in addition to the rule match to decide if a secondary inspection is warranted. Nonetheless, rules for regional and local users have to be approved by Assistant Directors with an understanding of local illicit trends or their designees. Impact assessments are also a recommended best practice for regional and local rule requesters. If no response is received, the rule is deactivated. A very limited number of CBP users can access rule firing information; only persons in positions that have a need to know receive access; users who do not already have access to PNR information cannot access it via this method. In fact, not every officer that receives rule matches/results has access to the actual rules. During the visit, the U.S. informed the EU team that there are no specific rules on providing feedback on the impact of targeting rules in production. Against this background, the EU team suggests that systematic feedback from the law enforcement community about the follow up of the cases referred by CBP could further improve the quality of the targeting rules. The EU team also considers important that there is a validation and a review process of access rights and of the new and existing targeting rules implemented at all the locations. Future joint reviews should further examine the use by rules of PNR data in dormant status. 5.2 Sensitive data According to Article 6 of the Agreement access to, as well as processing and use of, sensitive data shall be permitted in exceptional circumstances where the life of an individual could be imperilled or seriously impaired. The U.S. team informed the team that no sensitive data has been processed other than for the purposes of testing of the proper implementation of the safeguards designed to confirm this statement. The U.S. team confirmed that certain codes and terms that may be in a PNR but that have been identified as “sensitive” are automatically filtered out and blocked by CBP in the passenger mode of ATS and that ATS generates a daily email informing CBP management whether or not any sensitive data elements have been accessed. Article 6 of the Agreement provides for the deletion of sensitive data no later than 30 days from the last receipt of PNR containing such data by DHS, unless it is used for a specific investigation, prosecution or enforcement action, in which case it may be retained for the retention period of that case. According to the U.S., all sensitive data have been deleted in accordance with the Agreement, which was internally verified during two separate tests of sensitive word data in February 2018. CBP conducted a test on 21 February 2018 using PNR for travel that occurred on 7 February 2018. The test confirmed that ATS automatically filters out sensitive word data from PNR. Also on 21 February 2018, but separate from the test on the 7 February 2018 PNR, CBP verified that ATS permanently deletes sensitive word PNR data after 30 days in accordance with the EU-U.S. PNR Agreement. These tests follow similar tests conducted on August 18, 2015 with the approval of the Deputy Commissioner of CBP. In addition, the U.S. confirmed that no sensitive data has been processed, other than for the purposes of testing the proper implementation of the safeguards designed to confirm this statement. The EU team encourages DHS to continue to comply with the requirements of Article 6 of the Agreement including the employment of automated systems to filter and mask out sensitive data from PNR and its deletion not later than 30 days from the last receipt of PNR containing such data. In addition, it recommends the U.S. to put in place mechanisms aiming at immediately deleting sensitive data if received. The U.S. however, stated that at first this recommendation would not address an identifiable privacy harm to the individual or situation of non-compliance with the Agreement. In addition, the U.S. expressed its opinion that the broad definition of sensitive data includes information that may be necessary to accurately identify an individual or tie a traveller to specific intelligence or law enforcement information in exceptional circumstances where the life of an individual could be imperilled or seriously impaired. DHS confirmed that it filters out sensitive data and has never used it. The U.S. further stated that the U.S. is fully compliant with this provision and there is no evidence to the contrary and that these measures protect individual privacy to an exceedingly high level. The U.S. further commented that any marginal privacy gained by immediately deleting sensitive data is outweighed by the potential risk of missing serious threats. 5.3 Mechanisms to ensure transparency, access, correction and redress DHS provides transparency under Article 10 of the Agreement, by providing the travelling public with information on its collection and use of PNR. Such information is readily available on various DHS public websites (i.e. DHS Privacy Office and CBP) as well as through other official websites. General public notice is additionally provided through the publication of a System of Records Notice for the ATS and via websites of U.S. Embassies located in the EU. The Privacy Impact Assessments for the ATS, which is the system that maintains PNR, are posted on DHS public website. DHS further publishes the actual PNR Agreements that DHS has entered into, a CBP PNR Privacy Policy, and a list of Frequently Asked Questions and Answers. The guidance provided to the affected carriers encourages them to provide information to passengers at the time of booking regarding the purpose of the collection, processing, and use of PNR by DHS, and many carriers have posted information on their websites, some with links to the government sites provided. CBP works with carriers to incorporate notices into their documents and websites, which travellers may see at the time of booking (more detailed information provided by the U.S. in the replies to the questionnaire under Safeguards and Q7). DHS Traveller Redress Inquiry Program (‘TRIP’) remains a single point of contact for individuals, regardless of citizenship or residency, who have inquiries or seek resolution regarding difficulties they experienced during their travel screening at transportation hubs – like airports – or crossing U.S. borders From June 2015 to June 2019 there were only three EU inquiries including a reference to the travellers’ PNR, each of which was sufficiently resolved as detailed below. In 2016, an EU DHS TRIP inquiry went through the process and resulted in a letter to the traveller. There was no additional appeal from the traveller. In 2018, an EU DHS TRIP inquiry was received, but the traveller did not respond to a DHS request for additional information to process the request. There was no additional appeal from the traveller. In 2019, DHS Privacy Office received an inquiry from an EU traveller, which was determined not to be a DHS TRIP inquiry but was handled as a Freedom of Information Act (FOIA) request. There was no additional appeal from the traveller. All of these DHS TRIP inquiries were resolved and neither the CBP Customer Service Centre nor DHS Chief Privacy Officer have ever received any complaints of misuse of EU PNR data.

The U.S. informed that DHS has never received a request for correction or rectification of PNR data from EU citizens, as provided under Article 12, since the Agreement went into force in 2012. They also noted that, DHS nevertheless has sufficient mechanisms in place, in accordance with Article 12, to handle such requests. In addition, DHS practices exceed the requirements of Article 12 by including an automated mechanism to update its records when new information becomes available in order to avoid any future incident of misidentification stemming from the original record. The EU team recommends the U.S. to assess possible ways to improve cooperation between DHS and air carriers concerning transparency and the exercise of passenger rights as recognized in the Agreement. 5.4 Oversight The U.S. provided detailed explanations of how Personally Identifiable Information is processed by DHS in accordance with DHS policy and U.S. law. The U.S. has as a number of laws that govern privacy, and multiple entities in various branches of government that conduct oversight of the collection and use of Personally Identifiable Information, including PNR. This approach begins with the U.S. Constitution which grants enumerated powers to the Executive, the Legislative and the Judicial branches of government, thereby creating a system of checks and balances. In particular, the U.S. Constitution does not authorise the Executive Branch to play a formal role in the legislative process or to direct Congressional oversight of the Executive branch. The U.S. Constitution established three separate, independent, and co-equal branches: ·The Executive Branch places privacy officers and officers for civil rights and liberties, government lawyers, and Inspectors General in each Department or agency. It also has a specialised entity named the Privacy and Civil Liberties Oversight Board, which initiated an oversight project in June 2019 related to the use of PNR. This Branch implements the laws passed by Congress including the Privacy Act and the Freedom of Information Act. ·In the Legislative Branch, the U.S. Congress may pass or change U.S. laws, investigate the Executive Branch, issue reports, and withhold funding from the Executive branch based on negative findings in an investigation of an agency’s handling of personal information. The oversight authorities of the Executive Branch are all required to keep Congress informed of their activities and to respond to congressional requests for information. An additional body, the Government Accountability Office, is an independent, nonpartisan agency that works for Congress under the Comptroller General of the U.S. It has the authority to audit and/or investigate Executive Branch programmes and activities, including those related to privacy or civil rights and liberties and issue reports with its finding and recommendations. ·The Judicial Branch provides independent judicial review and redress. The Chief Privacy Officer of DHS has statutory authority and powers to investigate any departmental program under 6 USC. § 142, which allows her to fulfil the requirements of Article 14 of the Agreement. She may also refer any issue concerning the use of PNR to the Congress or to DHS Office of the Inspector General. For serious cases of misconduct, she may refer the matter to the Department of Justice, which may issue an indictment against the individual. The U.S. representatives also noted the differences between the EU and U.S. respective EU and U.S. oversight systems while ensuring to demonstrate that, from a performance-based perspective, DHS protects the data in line with the requirements of the Agreement. Concerning the application of Article 14(2), an independent review by DHS Inspector General, the General Accountability Office, or Congress, has not taken place since the Agreement was signed. According to the U.S., this is likely due to DHS compliance with the Agreement’s terms, as verified by the prior independent and extensive joint reviews conducted by the Commission, and the lack of complaints from the public. Nonetheless, DHS Privacy Office has conducted five internal reviews, in addition to the three joint reviews of the Agreement with the EU. In addition, the CBP Privacy Officer, in cooperation with DHS Chief Privacy Officer, carries out ongoing oversight of the processing activities by ensuring that privacy compliance documentation is transparent and up to date. Since the implementation of the Agreement, the System of Records Notice has been updated once and the Privacy Impact Assessment has been updated four times. These documents are both available to the public. The U.S. stated that it fully adheres to Article 14 of the Agreement and meets the EU legal requirements for independent oversight through the activities mentioned above. The EU team considers oversight activities as one of the key elements of the Agreement to ensure full compliance with the privacy safeguards and welcomes the continuous involvement of the Department’s Privacy Officer on guidance and oversight activities. However, the EU team also considers essential that oversight activities are carried out in accordance with the requirements not only of Article 14(1) but also of Article 14(2) of the Agreement. 5.5 Method of PNR transmission According to Article 15 of the Agreement, carriers shall be required to transfer PNR to DHS using the ‘push’ method, initially at 96 hours before the scheduled flight departure and additionally either in real time or for a fixed number of routine and scheduled transfers as specified by DHS. On a case-by-case basis, DHS may require a carrier to transmit PNR between or after the regular transfers. In order to respond to a specific, urgent, and serious threat, DHS may require carriers, on a case-by-case basis, to otherwise provide access when the carriers are unable for technical reasons, to respond in a timely manner. This in practice means using a ‘pull’ method to obtain PNR from carriers. At present, all carriers affected by the Agreement are set up to push PNR. DHS has relied on the pull method in specific cases of carriers not being technically capable of transmitting the data for example when an airplane is unexpectedly rerouted to land in the U.S... Following the joint review from 2017, DHS was recommended to improve the statistical collection and reporting related to the number of “pulls” of data collected under the Agreement. The EU team considers that, while this practice is in line with the provisions of the Agreement, the use of ‘pulls’ is more intrusive as requires the authorities to enter into the air carriers database. Hence, the use of this method must be regularly assessed. It should be adhered to only in fully justified and fully documented cases and minimized in full accordance with the conditions set out in Article 15. 5.6 Onward sharing to U.S. entities outside of DHS The PNR information collected in the context of the Agreement may be made available to other government agencies outside of DHS for law enforcement or public health purposes only after DHS determines that the recipient has a need to know the information to carry out functions consistent with the “routine uses” included in the ATS System of Records Notice, 77 Fed. Reg. 30297 (May 22, 2012) and have sufficient capability to protect it consistent with the requirements of the Agreement. In accordance with U.S.’s Privacy Policy, and consistent with Article 16 of the Agreement, PNR information is not shared outside of DHS unless the receiving agency has a need to know the information for purposes specified in the Agreement and can ensure the information will be protected under the safeguards set out in the EU-U.S. PNR Agreement. The CBP ATS system of Records Notice lists a number of agencies that may request and, if consistent with the requirements and purposes specified in the Agreement, receive PNR data, including federal, state, tribal, or local organizations responsible for investigating and enforcing civil or criminal laws.

The EU was informed about the instances in which PNR data have been shared with other government authorities. Between 2012 and the Joint Evaluation in September 2019, PNR records have been disclosed to domestic authorities in 12.189 instances, 98% of which were made to other U.S. federal agencies and 2% to state or local agencies. Only two percent of these disclosures to domestic authorities (242 total) were made to U.S. state or local level agencies. In almost all cases, DHS shared the information for purposes of fighting terrorism and serious transnational crime, with only few cases in which the purpose was the protection of health or public safety. The U.S. also provided information about the number of records shared between 2015 and 2019 according to the age of the PNR at the time of its onward disclosure. In that regard, in almost 80% of the cases, the PNR data requested and shared was only a year or less old. The requests resulting in PNR data shared older than 5 years are small in relation to the total amount. Requests for PNR data by a non-DHS requestor, must be submitted in writing and must describe the information requested, the reason for the request and how the information will be used. All requests must be approved by the CBP Privacy Officer or by an individual who has been delegated by the authority to approve such requests. The written authorisation letter by CBP to the non-DHS requestor as a matter of course restricts the use of the PNR data consistent with the requirements and purposes specified in the Agreement, including requiring the non-DHS requestor to afford the PNR data equivalent or comparable safeguards as set forth in the Agreement. In addition, the non-DHS requestor is required to seek the express, prior written authorization of CBP to further share the PNR data or to use the PNR data for any other purpose. All sharing of PNR data is logged and is subject to routine audits by DHS Privacy Officer. Article 16 of the Agreement requires that data may be shared only after a careful assessment of the purpose of the request to ensure that the receiving authorities afford equivalent or comparable safeguards to PNR data as set out in the Agreement. The U.S. informed the EU team that current practices are in their view consistent with the conditions of Article 16(1)(c). Disclosures of PNR data include a cover letter that specifically limits how the information may be used and what, if any, onward disclosures may occur. The restrictions provided in the cover letter are consistent with Article 16(1)(c). The EU team welcomes the procedures in place, but is of the opinion that those procedures could be enhanced to improve the quality and consistency of the checks related to the existence of comparable safeguards, as per Article 16(c). 5.7 Onward transfers According to the information received from the U.S., 70 PNR records of EU residents were disclosed to 19 countries, eight of which are EU Member States (the list of countries is available in Annex B). DHS ensures through the terms of a Memorandum of Cooperation or other written arrangement that the foreign government will treat such data as sensitive and confidential, will not provide such data to any other third party without the prior written authorisation of DHS, and that the data will be treated with equivalent and comparable safeguards as set out in the Agreement. Any access to PNR data is contingent upon an express understanding that the foreign government treat such data accordingly. In particular, U.S. law requires that DHS share information with a foreign counterpart only if DHS obtains assurances that the information will be held in confidence and used for a law enforcement purpose consistent with the reason for which it was provided (19 USC. § 1628(b)). Further, U.S. law prevents DHS from sharing further information with any foreign law enforcement agency that does not adequately protect information. DHS implements both U.S. law and the PNR Agreement through a combination of formal agreements and case-specific assurances. Also, DHS requires that a cover letter be included with the transfer of PNR data to a foreign authority that outlines the recipient’s responsibility to protect the provided PNR consistent with the Agreement among other conditions, such as prohibiting onward transfer to any third party, such as a third country, without the express prior written authorization of DHS. This letter requires the receiving country to provide specific protections in addition to the general protections afforded under any applicable international agreement, such as the Mutual Legal Assistance Treaty or Customs Mutual Assistance Agreement in place between the U.S. and the receiving country. Should a recipient fail to adhere to these terms DHS will not share further information with the country pursuant to 19 USC. § 1628(b). In addition, the U.S. illustrated by the means of examples the exchange of PNR data with the EU Member States and Europol. Examples: I. DHS used PNR data to support the investigation into a known European terrorist attack. In support of this investigation, historical PNR data led to the identification of several previously unknown suspects. The close coordination between U.S. law enforcement agencies and the EU Member State enabled security services to prevent follow-on attacks by associated individuals, similar to the follow-on attacks in Brussels in 2016 following the November 2015 attack in Paris. II. In 2017, DHS supported an EU Member State’s investigation of a terrorist attack in its territory. DHS analysis of U.S. historical PNR data dating back to 2014 identified one suspect with links to two other previously unknown individuals. DHS provided these leads to the Member State’s law enforcement partners for use in the investigation into the attacks. III. On October 20, 2018, DHS liaison officer at Europol received a request to support an EU Member State’s investigation on subjects that were identified as being involved in an armed robbery. DHS uncovered and shared additional information and leads contained only in historical PNR data to support the investigation. IV. In November 2014, DHS supported an investigation by an EU Member State by providing historical PNR data that resulted in the arrest of six criminals from Asia operating a smuggling ring in the EU. A review of historical PNR pointed to a single employee of a major European airline. Further review identified ten fraudulent identities used by the smuggling ring in fifteen smuggling attempts, thirteen of which were successful. DHS developed and provided evidence to the EU Member State, which then used the evidence to arrest the individuals through a joint operation. The EU Member State also adjusted domestic security procedures to reduce its vulnerability to the crimes identified in this investigation. More examples are available in Annex A and C. Article 17 of the Agreement requires that data is shared with third countries only after a careful assessment of the purpose of the request and when ensuring that the receiving authorities shall afford to PNR equivalent or comparable data privacy protections as set out in the Agreement. The EU team welcomes the procedures in place but it is of the opinion that those procedures could be improved regarding the checks related to the existence of comparable data privacy protections, as per Article 17 (2) of the Agreement. 6.DATA PROTECTION SAFEGUARDS AND THE COURT’S OPINION ON THE ENVISAGED CANADA PNR AGREEMENT Introduction In the course of the joint evaluation, the teams discussed the most important legal development since the entry into force of the Agreement, i.e. the Court's Opinion 1/15 on the envisaged PNR Agreement with Canada. This Opinion lays down the following requirements (summarised) in order to ensure compliance of this Agreement with the EU Charter of Fundamental Rights: ·The purposes for which PNR data may be processed should be spelled out clearly and precisely;

·The PNR data elements to be transferred should be determined in a clear and precise manner; ·As long as passengers are in the country or are due to leave, the systematic retention and use of their PNR data (in the case of Canada for 5 years) is allowed. However, PNR data should be deleted after passengers’ departure unless a risk assessment based on objective evidence indicates that certain passengers present, or specific categories of PNR data indicate, the existence of a risk in terms of the fight against terrorism and serious transnational crime; ·The use of PNR data for other purposes than security and border control checks should be subject to prior independent review carried out either by a court or by an independent administrative body, the decision of that court or body authorising the use being made following a reasoned request by those authorities, inter alia, within the framework of procedures for the prevention, detection or prosecution of crime; ·Individuals should be notified of the use of their PNR and informed about their right to seek administrative or judicial redress; ·The processing of sensitive data shall be prohibited; ·Automated processing of PNR data may only take place based on non-discriminatory, specific and reliable models and criteria. The databases used for matching purposes must be limited to those used in relation to the fight against terrorism and serious transnational crime. ·The onward transfer of PNR data to other government authorities should be subject to appropriate safeguards and, in case of disclosure to another third country, limited to countries which have concluded an equivalent Agreement with the EU or are subject to a decision of the Commission finding that the country ensures and adequate level of protection within the meaning of EU law (adequacy decision); ·Oversight of compliance with the Agreement shall be exercised by independent public authorities/an independent supervisory authority with effective investigative and enforcement powers. U.S. considerations of the Court’s Opinion The U.S. considers that the Court’s Opinion has no direct legal effect on other PNR instruments, including the EU-U.S. PNR Agreement. In particular, the U.S. explained that in their view the Court of Justice did not have the benefit of having the complete evidence regarding the use of PNR data – including retained PNR data – to protect the public. Thus, the U.S. further clarified that in addressing the PNR data retention provisions of the envisaged EU-Canada PNR Agreement, the Court of Justice explained that its ruling relied heavily on the information presented by the EU Council and the European Commission regarding the average lifespan of international serious crime networks. In speaking of the retention period provided in the EU-Canada PNR Agreement, the Court of Justice noted, “furthermore, the Council has not provided any justification, based on objective criteria, as regards the choice of such a period.” According to the U.S. such objective data exist with regard to the EU-U.S. PNR Agreement. In fact, DHS considers that it has demonstrated how it has successfully utilized historical PNR data to solve many high-profile counterterrorism cases in the U.S., as well as to assist EU authorities in responding to terrorist acts committed on EU soil. The U.S. stated that this evidence demonstrates the importance of retained PNR data as such data provides vital information not otherwise available to law enforcement agencies. The U.S. team also highlighted the fact that, following the Opinion, PNR data have been recognized as a useful tool for border control and fighting terrorism. The U.S. representatives also stated that, while recognizing the obligation of the EU to respect the applicable legal framework, the differences between the respective legal systems as well as the operational perspective need to be taken into account. They also reaffirmed their belief in the effectiveness of the agreement and on the PNR system in general in the light of almost 30 years of experience. The U.S. further noted that the 2017 European Court of Justice Opinion regarding the envisaged EU-Canada PNR Agreement is not only limited to the facts before the Court, but also must now be read against the backdrop of the evolving international practices involving PNR. Considering also the growing international consensus regarding the need for retention and use of stored PNR and in addition to the adoption of UNSCRs 2396 and 2482, as well as the ICAO developments discussed above, at least fifty-two countries –-- currently collect and process PNR. Assessment by the EU team The EU team remarked that, it is nonetheless important to evaluate the EU-U.S. PNR Agreement also against the Court’s Opinion. The joint evaluation teams assessed the relevant safeguards that the Agreement already contains for the use of PNR, in particular: ·PNR data is being used for the prevention, detection, investigation and prosecution of terrorist offences or serious transnational crime and on a case-by-case basis where necessary, in view of a serious threat and for the protection of vital interests of any individual if ordered by a Court; ·The obligation for the US to provide to competent authorities of the EU Member States and Europol and Eurojust analytical information obtained from PNR; ·Safeguards applicable to the use of PNR, including strong data security and integrity requirements; ·Rights of access, correction or rectification and erasure and the possibility for EU citizens to obtain administrative and judicial redress under the terms of the Agreement;

·Review and oversight by authorities that have proven records of autonomy and can refer cases of violation of this Agreement for prosecution or disciplinary action; ·Conditions on the processing of sensitive data. PNR data are kept in an active database for up to 5 years. After the first 6 months, all information which could be used to identify a passenger are "depersonalized", meaning that data such as the passenger's name or her/his contact information are masked to the user. After the first 5 years, the data are moved to a "dormant database" for up to 10 years, with stricter access requirements for U.S. officials. In accordance with Article 8(4), following the dormant period, data retained, must be rendered fully anonymised, by deleting all information that could serve to identify the passenger to whom PNR relate, without the possibility of repersonalisation. In addition, the U.S. authorities have explained that: ·All of the activities undertaken with PNR data are performed for the purposes outlined within the Agreement. ·No sensitive data has been accessed or used (see above under Chapter 5.2). ·Non-discriminatory targeting of individuals is based on specific and reliable pre-established models and criteria (see above) in order to identify those “who might be under a ‘reasonable suspicion’ of participation in terrorist offences or serious transnational crime.” The U.S. considers that is precisely the case under the EU-U.S. PNR Agreement. As demonstrated by the U.S., historical PNR data plays a prominent and indispensable role in the development, testing, evaluation, and approval of effective targeting rules under the EU-U.S. PNR Agreement. These rules are developed by taking account, in line with the observation of the Court of Justice, “statistical data and international research”, much of which DHS obtains from analysing historical PNR data. ·As regards onwards transfers to third countries, the U.S. reassured that through the terms of a Memorandum of Cooperation or other written arrangement with Foreign Authorities, these latter will treat such data as sensitive and confidential, they will not provide such data to any other third party without the prior written authorization of DHS, and will afford to the data equivalent of comparable safeguards as set out in the Agreement (see above, under 5.6). ·All requests for PNR data from other Government authorities are logged and auditable, with assurance activities undertaken on a regular basis by internal relevant Departments. CBP maintains records of requests for PNR data from U.S.-domestic Government and foreign Government authorities and logs all sharing of PNR data. Requests for PNR data and sharing of such data are subject to routine audits by the CBP Privacy Officer. In addition to the system-generated record of disclosures of PNR data, the CBP Privacy Officer maintains a separate record of disclosures to foreign Government authorities, which are retained to facilitate oversight, audit, and safeguarding practices. Both the original logs and the CBP Privacy Officer’s review may be audited by the DHS Chief Privacy Officer. ·DHS further stressed that it is subject to robust layered oversight and that multiple competing authorities within the Executive, Legislative, and Judicial Branches oversee the data protection and privacy of personal information held by the Department. ·In addition, the U.S. authorities provided information showing in their view, that the retention of historical PNR data also of passengers that have left their country is necessary to create and preserve the knowledge of the criminal phenomena and the possibility to detect associations between past and current known and/or unknown criminals and terrorists (please see examples provided in Chapter 3 and Annex B of the present document). The EU team recognises the efforts of the U.S. authorities in meeting the requirements of the Agreement from 2012 in both technical and organizational aspects, as well as the further improvements resulting from adopting the recommendations stemming from internal oversight activities and the joint reviews. The EU team notes that despite the numerous safeguards contained therein, several aspects of the Agreement are not fully in line with the Opinion 1/15 of the Court of Justice on the envisaged EU-Canada PNR Agreement, as the U.S Agreement was concluded before the Court delivered its Opinion. These concern the: ·retention of PNR data after the air passengers’ departure, ·limitation to databases for matching purposes only to those used in relation to the fight against terrorism and serious transnational crime, ·processing of sensitive data, ·notification to passengers in case their data is used during their stay and after their departure, ·rules for onward sharing and onward transfers, especially to other third countries, as well as ·oversight by an independent supervisory authority and ·the prior independent review of the use of PNR data. 7.Conclusions

The information gathered in the context of the joint evaluation confirms the added value and operational effectiveness of the Agreement in the fight against terrorism and serious transnational crime. Τhe EU welcomes DHS’s commitment to ensure compliance with the Agreement’s terms, as noted in the 2013 and 2015 Joint Reviews, as well as the Agreement’s proven effectiveness in providing procedural and substantive safeguards to PNR data in line with the EU-U.S. PNR Agreement. Examples provided during the evaluation have shown that PNR, including historical PNR, being a unique dataset, have been critical to prevent the return of foreign terrorist fighters and to combat in particular drug crimes and child exploitation. During the joint evaluation, the U.S. authorities have provided material to show the necessity of historical PNR data to create and preserve the knowledge of how terrorists and criminals use travel to commit illicit acts, which itself further aids border inspections and investigative matters. Numerous case studies and examples have been provided to this end, many of which are included in this document. Besides having demonstrated its operational value and effectiveness, the EU-U.S. PNR Agreement objectives are consistent with the international obligations to collect, process and analyse PNR data for effective border controls to prevent terrorist travel as well as to help making connections between individuals associated to organised crime, and prosecute terrorism and organised crime. The EU team recognises the efforts made by U.S. to comply with the requirements of the Agreement from 2012 in both technical and organisational aspects, and recommends DHS to continue its efforts to i) limit the number of users who have access rights to PNR data, ii) comply with the requirements on sensitive data and to put in place mechanisms aiming at immediately deleting sensitive data if received, iii) review the necessity of keeping PNR in a dormant status, iv) improve the systems in place concerning onward case-by-case sharing to U.S. entities outside of DHS and to other third countries, v) ensure feedback concerning the effectiveness of targeting rules at a regional and local level and vi) ensure that the requirement, in specific cases, to air carriers to provide access to DHS is regularly assessed and overly minimised. As a result of the comparison of the Agreement and Opinion 1/15 of the Court of Justice on the envisaged PNR Agreement with Canada, the EU team noted that despite the numerous safeguards contained therein, several aspects of the Agreement are not fully in line with Opinion 1/15 of the Court of Justice, as the U.S Agreement was concluded before the Court delivered its Opinion. These concern the retention of PNR data, the processing of sensitive data, notification to passengers, prior independent review of the use of PNR data, rules for domestic sharing and onward transfers, independency of oversight and the sole use of databases in relation to the fight against terrorism and serious transnational crime for cross-checking of PNR data.



ANNEX A CASE STUDIES Child Abduction and Sexual Exploitation In 2015, DHS learned that a court order restricted a traveler from taking his children outside of the U.S. without prior approval from the court. DHS later saw a travel reservation via PNR for the traveler and his children to travel to a foreign country. DHS worked with local authorities to detain the traveler. Local authorities arrested the traveler and placed his children with the appropriate child protection entity. In 2018, DHS used PNR to identify a traveler traveling from a foreign country to the U.S. based on available information may be involved the sexual exploitation of children. DHS/CBP referred the traveler for secondary inspection, which led to the discovery of child sexual exploitation material. The traveler was arrested. Drug Trafficking In August 2019, DHS identified a previously unknown narcotics trafficker who had been receiving and distributing shipments of hundreds of kilograms of cocaine in the U.S. and the EU. DHS used historical and current PNR data to identify the trafficker. In October 2019, DHS and other U.S. law enforcement agencies arrested the trafficker upon return from the EU to the U.S. After the arrest, the trafficker provided information to U.S. law enforcement that he had been facilitating a 3,200-kilogram shipment of cocaine to the EU. In January 2020, a U.S. law enforcement agency requested DHS assistance in identifying an EU citizen suspected of coordinating narcotics shipments to the EU. Using information provided by the agency, DHS researched historical and current PNR data to identify the subject. DHS provided the information to the appropriate EU Member State for further investigation and support. Since the beginning of 2020, DHS has used historical PNR data along with information from international partners to identify over 40 suspected narcotics couriers. Of those couriers, 10 have already been intercepted and found carrying many kilograms of cocaine or heroin. DHS has shared information on all identified suspected couriers with appropriate international partners to assist their efforts with countering drugs trafficking.

Fraud In February 2017, PNR indicated that an alleged EU citizen scheduled to travel from the EU to the U.S. matched information identifying him as a high risk for fraud. DHS/CBP determined that the individual had fraudulent documents and was, in fact, a citizen of different foreign country. DHS recommended that the airline not board the traveler. In 2017, DHS identified, via PNR, two travelers scheduled to travel to the U.S. matching information to possible document fraud. Working with foreign security at the airport, DHS determined that the travelers possessed fraudulent passports. The local authorities of the foreign country apprehended the traveler who admitted to being nationals of a different foreign country. In 2017, an EU citizen arriving from the EU at a U.S. airport was referred for secondary inspection based on PNR indicating an association to a known fraud ring that uses credit card skimming machines. During the inspection, DHS discovered a picture of a credit card skimming machine. DHS/CBP found the traveler inadmissible and returned him to the EU. In 2017, an EU citizen arriving from the EU at a U.S. airport was referred for secondary inspection based on information discovered in PNR. During the inspection the traveler admitted to coming to the U.S. to work illegally. DHS/CBP refused entry of the traveler and returned him to the EU. Human Trafficking/Human Smuggling In June 2019, DHS received information about a known alien smuggler moving aliens from the EU to the United States. DHS identified two previously unknown associates of the smuggler, who were facilitating the smuggling, based solely on information contained in PNR data. DHS coordinated with the Department of State to revoke the nonimmigrant visas for the associates. Counterterrorism In 2019 a U.S. citizen travelled to the U.S. from Europe. DHS/CBP referred him for inspection because his historical PNR matched an illicit trend used by known or suspected terrorists. The subject claimed that he had been overseas for a few years attending school and working. When asked if he knew anyone involved in the Syrian conflict, he stated that he attended a mosque that was soliciting funds to support the conflict in Syria. During the inspection, DHS discovered in his electronic devices photos of weapons, of the subject aiming a gun at someone, and of a video of militants wearing ISIS patches. Based on this inspection, DHS referred him to law enforcement for further investigation. In 2016, a foreign passenger arrived at a U.S. airport was referred for secondary inspection because his PNR matched an illicit trend used by known or suspected terrorists. During the inspection, DHS discovered terrorist propaganda and videos of a known fundraiser for a terrorist organization and of an execution. DHS found him inadmissible and referred him to law enforcement for further investigation.



ANNEX B Questionnaire for the Department of Homeland Security and replies

Questions of general nature Q1: What has the wider impact of the Agreement been on the travelling public? Have less people been physically stopped as a result of the use and processing of PNR? The transfer, processing, and analysis of PNR data under the Agreement facilitates the expeditious entry of the overwhelming majority of travellers who do not pose a threat to public safety. It also contributes to the effective and accurate identification of individuals who should undergo further inspection upon arrival. It complements other information about a traveller and their journey such as Advance Passenger Information (API), visa applications, Electronic System for Travel Authorization (ESTA) applications, and biometrics to provide a complete and accurate picture of the traveller’s identity and means of travel. When processed and analysed along with other information, such as the Terrorist Screening Database (TSDB), past enforcement actions and known or suspected illicit trends, it helps the U.S. Department of Homeland Security (DHS) to limit inspections to travellers posing higher relative risk, thereby expediting the admission of all other travellers. Without PNR data, DHS Officers would need to undertake much more intrusive and time-consuming interviews and inspections of each and every traveller, significantly delaying passengers and the operation of the international air transportation system. PNR data allows DHS to focus on high-risk individuals, thereby reducing passenger wait times and inspections at ports of entry for nearly all travellers to a few minutes or less. The negative impact of not having PNR data on passengers can be seen during a recent DHS system outage which increased wait times at ports of entry nation-wide to multiple hours per passenger. Q2: What proportion of people subject to closer questioning or examination have led to a detention / arrest / seizure or further action? Such statistics are Law Enforcement Sensitive and cannot be publicly released as part of this survey. During the Evaluation meeting, the U.S. Delegation provided additional information about PNR’s contribution to security. Q3: In order to assess the necessity and proportionality of PNR processing under the Agreement, can you please indicate to what extent is the EU-U.S. agreement still relevant for the fight against terrorism and serious transnational crime? The collection, processing, and analysis of PNR data remains a critical tool for effective national border security and controls, as recognized by the United Nations Security Council in Resolution 2396 and Resolution 2482. PNR data serves at least four critical functions. First, PNR data helps border officials to identify individuals traveling to or from their territory who may have a nexus to terrorism or transnational crime. Second, PNR data contributes to the accumulation of important historical information for use in border inspections and criminal investigations. Third, PNR data improves the government’s understanding of how terrorists and criminals use travel to commit illicit acts, which then further aids border inspections and investigative matters. Fourth, PNR data often contains contact information that government health officials may need to notify travellers in an emergency, such as exposure to deadly diseases during a pandemic. Because the Agreement provides air carriers with a legal basis under EU law for complying with the U.S. legal requirement to transfer PNR data to DHS, the Agreement remains vital. Q4: What is the specific added value obtained through the PNR collection which is not available through other type of data collections? PNR data contains elements that are not available through other means, such as API. Some of these elements include additional data and other identifiers that are used in risk assessments as well as to validate the travel of law-abiding travellers. These additional data points assist DHS in identifying high risk travellers who are not otherwise known to law enforcement agencies and are critical in carrying out the anti-terrorism and law enforcement mission of DHS. Example 1: In December 2009, unbeknownst to the U.S. Government, Faisal Shahzad received explosives training in Waziristan, Pakistan from individuals affiliated with Tehrik-e-Taliban (TTP), a militant extremist group based in Pakistan. In February 2010, Shahzad arrived in the U.S. from Pakistan. Immediately following a failed detonation of a vehicle-born improvised explosive device at Times Square in New York City on May 1, 2010, DHS at the FBI’s request used PNR data to link Shahzad to information uncovered early in the time-sensitive investigation of the failed detonation. DHS also quickly discovered that Shahzad had just booked a flight to Dubai. DHS apprehended Shahzad at New York’s JFK Airport as he was about to board the aircraft for the flight to Dubai. On June 21, 2010, Shahzad pleaded guilty to all ten offenses related to his attempt to detonate a car bomb in Times Square and he received a life sentence in prison. Example 2: In a 2003 case, PNR data alerted DHS to an airport insider-threat scheme to smuggle drugs into the U.S.. The critical information in this case was not personally identifiable information nor did it implicate the specific travellers associated with the PNR, but illustrated that the travellers were unwitting victims of the scheme. DHS’s detection of the scheme allowed it to identify the actual criminals. Example 3: In December 2014, during a routine review of PNR data, DHS matched elements only available in the PNR to a second individual known to law enforcement as an alleged terrorist. Further research validated the connection between the two individuals. Based on all available information, DHS requested revocation of his non-immigrant visa (NIV) from the Department of State (DOS). DHS determined that the traveller would likely be found inadmissible to the US if permitted to travel, and the traveller was denied boarding by the airline. U.S. Example 4: In December 2018, an individual travelled from the U.S. to an African country through the EU. The PNR record showed that he checked a weapon and ammunition in his bags. DHS determined that the individual attempted to export multiple firearms, ammunition, and accessories without an export license, and confiscated the items because the individual failed to obtain an export license. DHS seized the items. Example 5: In January 2019, an EU citizen sought to travel from the U.S. to the EU with a weapon in his checked baggage. DHS learned that the individual had checked several rifles in his luggage but had not obtained an export license. DHS seized the items.

PNR also provides insight into the travel of the individual, including multiple legs of the journey, prior to and after arrival that is not available from other information. For example, in January 2015, DHS referred an individual for a secondary inspection, because information in his PNR matched the modus operandi of known terrorists. During the secondary inspection, a review of the traveller’s electronic device revealed disturbing images related to terrorist activities. The traveller could not explain why he had these images. Based on this secondary inspection, DHS referred him to another law enforcement agency for further investigation. Q5: In order to assess the necessity and proportionality of the retention of PNR data, can you please illustrate by means of examples how PNR has been the key piece of intelligence in a law enforcement investigation? Example 1: One large-scale and important example of the usefulness of retained PNR relates to the investigation of transnational criminal networks. In 2019, historical PNR data retained over many years provided investigators with leads that resulted in the identification of previously unknown co-conspirators who had committed home burglaries, theft, and fraud across the U.S. Example 2: In August 2019, DHS identified a previously unknown associate of a known or suspected terrorist based on matches to PNRs belonging to the previously unknown associate. DHS’s ability to validate the association between the two individuals proved critical to establishing reasonable suspicion. DHS referred the individual to law enforcement for further investigation. Example 3: In January 2014, a U.S.. law enforcement agency asked for DHS’s assistance in locating a criminal fugitive, wanted since 2004 and believed to have fled the country. Using historical PNR, DHS identified the probable residence of the subject in a foreign country. The U.S. law enforcement agency, with assistance from the foreign country, located the subject in the other country in June 2014, and successfully had the subject extradited back to the U.S.. Example 4: In 2004, U.S.. authorities detained a woman who had smuggled children into the U.S.. A transnational criminal organization recruited her to smuggle the children into the U.S. where the organization’s operatives sold them. Through information gained during her interview about the organization’s routine operations, DHS used historical and current PNR data to identify additional potential smugglers and victims previously unknown to U.S. law enforcement. The U.S. and a foreign government conducted joint law enforcement operations to shut down two transnational criminal organizations who used the same technique to smuggle children into the U.S.. The joint operations resulted in the arrest of dozens of criminals and the return of dozens of children to their parents in foreign countries. The modus operandi discovered by this case supported law enforcement investigations and interdictions for many years, leading to additional arrests and rescued children. Example 5: In 2012, the U.S. investigated an individual for child sex tourism. Similar allegations about the subject had been made since the 1970’s, and he had been previously charged in the U.S., the UK, and Egypt. DHS provided certified copies of historical PNR data to the Assistant U.S. Attorney for use at trial. The historical PNR data showed the subject’s travel, his use of aliases, and the identity of third parties who paid for his tickets. On February 28, 2013, a U.S. district court found the individual guilty of child sex tourism charges. Example 6: In October 2013, DHS inspected a traveller’s luggage after reviewing the person’s PNR, which revealed a possible link to illicit activity. A single PNR data element linked the subject to a person who had previously been arrested with 5.82 pounds of crystal methamphetamine. DHS searched the subject’s luggage and found amphetamine. Example 7: In the 1990s, an individual joined al Qaeda and fought in Afghanistan. When he returned to the U.S., U.S. authorities arrested him for planning to set off bombs in the U.S. and Europe. DHS provided U.S. prosecutors with historical PNR data of his travel to various countries with a significant terrorist presence, data which DHS retained at a time when the individual was not under suspicion of any criminal activity. The retained PNR contributed to his conviction and 15-year prison term for conspiring to use weapons of mass destruction and providing support to terrorists. Q6: Does the Agreement sufficiently define mechanisms to ensure transparency, access, correction and redress? How is the U.S. ensuring transparency so that all passengers are aware of the redress mechanisms in place?

Yes. Transparency is the first of eight principles and a core tenet of DHS’s implementation of the Fair Information Practice Principles The E-Government Act of 2002 requires DHS to “make the Federal Government more transparent and accountable,” as well as “to provide enhanced access to Government information and services in a manner consistent with laws regarding protection of personal privacy, national security, records retention, access for persons with disabilities, and other relevant laws.” This law requires all federal agencies to conduct a privacy impact assessment (PIA) for all new or substantially changed technology that collects, maintains, or disseminates personally identifiable information (PII), or for a new aggregation of information that is collected, maintained, or disseminated using information technology. PIAs for the ATS, the system that maintains PNR, are posted to the DHS public website Additional information specific to DHS’s collection and use of PNR is also available on various DHS public websites (i.e., the DHS Privacy Office) as well as on websites of U.S. Embassies located in the EU. The Department of Homeland Security Traveller Redress Inquiry Program (DHS TRIP) is a single point of contact for individuals, regardless of nationality, country of origin, or place of residence, who have inquiries or seek resolution regarding difficulties they experienced during their travel screening at transportation hubs - like airports - or crossing U.S. borders. DHS TRIP is a widely-used resource for EU travellers. Indeed, DHS TRIP receives on average 236 inquiries from EU travellers each month, approximately two of which mention PNR. Q7: Have there been any cases in which the Department of Homeland Security pulled PNR data from the air carriers? If so, for what reasons? All 63 air carriers covered by the U.S.-EU PNR Agreement push PNR to DHS on a regular schedule, beginning 96 hours prior to departure. If DHS requires the transmission of PNR outside of the covered carrier’s normal push schedule, DHS will send the carrier a request for an additional push. Such requests are made on a case-by-case basis only after a supervisor has confirmed the need for the additional push. Should a carrier be unable to send a timely push, DHS may pull the data from the airline. This may occur to meet immediate operational needs, such as when a flight is diverted due to weather or other emergency, the itinerary suddenly changes without an associated pus