EUROPEAN COMMISSION Brussels, 24.7.2020 COM(2020) 305 final REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL On the review of Directive 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime

{SWD(2020) 128 final}



REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL On the review of Directive 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime

1.The review – scope and process Directive 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (henceforth ‘the PNR Directive’) was adopted by the European Parliament and the Council on 27 April 2016. The Directive regulates the collection, processing and retention of PNR data in the European Union and lays down important safeguards for the protection of fundamental rights, in particular the rights to privacy and the protection of personal data. The deadline for the Member States to transpose the Directive into their national law was 25 May 2018. This report is in response to the obligation of the Commission under Article 19 of the PNR Directive to conduct a review by 25 May 2020 of all the elements of the Directive and to submit that report to the European Parliament and the Council. The report sets the PNR Directive in its general context and presents the Commission’s findings in reviewing its application two years from the transposition deadline. As required by Article 19 of the Directive, the review covers all the elements of the Directive, with a particular focus on the compliance with the applicable standards of protection of personal data, the necessity and proportionality of collecting and processing PNR data for each of the purposes set out in the Directive, the length of the data retention period, the effectiveness of the exchange of information between the Member States and the quality of the assessments including with regard to the statistical information gathered pursuant to Article 20.It also draws a preliminary analysis of the necessity, proportionality and effectiveness of extending the mandatory collection of PNR data to intra-EU flights and the necessity of including non-carrier economic operators within the scope of the Directive. In addition, the review describes the main issues and challenges encountered in the implementation and practical application of the Directive. In preparing the review, the Commission gathered information and feedback through a variety of sources and targeted consultation activities. These include the deliverables of the compliance assessment of the PNR Directive, based on the analysis of national transposition measures; discussions with the national authorities responsible for the implementation of the Directive and with the travel industry within the framework of regular meetings and dedicated workshops; statistical data submitted by the Member States pursuant to Article 20 of the Directive; and field visits to six Member States. In order to illustrate how PNR data are used in practice to combat terrorism and serious crime, where possible, the report refers to real life examples provided by national authorities drawing on their operational experience. The accompanying Staff Working Document provides more detailed information and a comprehensive analysis of all the matters covered by this report. 2.General context In recent years, an increasing number of countries – not limited to the Member States – and international organisations have recognised the value of using PNR data as a law enforcement tool. The establishment of a PNR mechanism and the implementation of the PNR Directive should be seen against the background of this broader international trend. The use of PNR data has been an important element of the EU’s international cooperation against terrorism and serious crime for almost twenty years. The 2010 Communication on the global approach established a set of general criteria which were to be fulfilled by future bilateral PNR agreements, including, in particular, a number of data protection principles and safeguards. These formed the basis of the renegotiations of the PNR agreements with Australia, Canada and the U.S., leading to the conclusion of new PNR agreements with Australia and the U.S. Further to a request by the European Parliament, on 26 July 2017 the Court of Justice of the EU issued an Opinion declaring that the envisaged agreement with Canada could not be concluded in its intended form because some of its provisions did not meet the requirements stemming from the Charter of Fundamental Rights. To address the Court’s concerns, the EU and Canada proceeded to renegotiate the agreement. These negotiations concluded at the technical level in March 2019 and the finalisation of the agreement is currently pending Canada’s legal review and political endorsement of the text. In addition, on 18 February 2020 the Council authorised the Commission to open negotiations with Japan for the conclusion of an agreement on the transfer of PNR data. The negotiations with Mexico, launched in July 2015, are currently at a standstill. At EU level, the adoption of the PNR Directive in April 2016 constituted an important milestone in the internal policy on PNR. As indicated above, the Directive lays down a harmonised framework for the processing of PNR data transferred by air carriers to the Member States. The Commission has supported the Member States in implementing the Directive by coordinating regular meetings, facilitating the exchange of best practices and peer-to-peer support, and providing financial assistance. In particular, the Budgetary Authority reinforced the 2017 Union budget with EUR 70 million for the Internal Security Fund-Police (ISF-Police), specifically for PNR-related actions. The Commission has also funded four PNR-related projects under the Union Actions of the ISF-Police. These projects aimed to ensure that Passenger Information Units of the Member States developed the capabilities needed to exchange PNR data or the results of processing such data with each other and with Europol. In 2016, the EU also modernised its legislation on the protection of personal data through the adoption of Regulation (EU) 2016/679 (the General Data Protection Regulation or GDPR) and Directive (EU) 2016/680 (the Directive on data protection in the law enforcement sector, also known as the Law Enforcement Directive). On 24 June 2020, the Commission adopted a Communication on aligning the former third pillar instruments with the data protection rules and published the results of the first review and evaluation of the GDPR. In the context of this review, it should be noted that the Belgian Constitutional Court has made a reference for a preliminary ruling to the Court of Justice on the Directive’s compliance with the Charter of Fundamental Rights and the Treaty. More recently, the Cologne District Court also made a request for a preliminary ruling relating to the PNR Directive. The Commission has submitted observations in the first of these proceedings and will do the same in the second in due course. At the global level, in December 2017 the United Nations adopted Security Council Resolution 2396 requiring all UN States to develop the capability to collect, process and analyse PNR data and to ensure PNR data are used by and shared with all their competent national authorities. To support States in developing such capabilities, in March 2019 the International Civil Aviation Organisation (ICAO) launched the process to draft new PNR standards. These standards, which will be binding on all ICAO member countries unless they file a difference, were adopted by the ICAO Council on 23 June 2020. The Commission has actively engaged in this process, as an observer representing the EU, to ensure the compatibility of these standards with the EU legal requirements, so that they can contribute to facilitate transfers of PNR data. 3.Main findings The main findings of the review process can be summarised as follows: 3.1.Establishment of an EU wide PNR system The Commission welcomes the efforts made by national authorities to implement the PNR Directive. At the end of the review period, 24 out of 26 Member States had notified the Directive’s full transposition to the Commission. Of the two remaining Member States, Slovenia has notified partial transposition and Spain, which has not notified any transposition measures, was referred to the Court of Justice on 2 July 2020 for failure to implement the Directive. The vast majority of Member States established fully operational Passenger Information Units, which are the designated units responsible for collecting and processing PNR data. These Passenger Information Units developed good levels of cooperation with other relevant national authorities and the Passenger Information Units of other Member States. All the Member States designated their competent authorities entitled to request and receive PNR data from their Passenger Information Unit only for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, such as the police and other authorities responsible for fighting against crime.

3.2.Compliance with data protection standards in the Directive The analysis of national transposition measures points to an overall compliance with the data protection requirements of the PNR Directive, even though some Member States have failed to fully mirror all of them in their national laws. In addition, the overview of their application confirms the commitment of national authorities to respect these safeguards and to implement them in practice. The Commission will continue to encourage the dissemination of best practices developed in this regard through its regular meetings with the Member States and the projects financed under the ISF-P Union actions. At the same time, the Commission will not hesitate to use its powers as guardian of the treaties, including by launching infringement procedures if necessary, to ensure that Member States fully respect the requirements set out in the Directive, in particular on the protection of personal data. The data protection safeguards contained in the Directive, where implemented correctly, which is the case in the majority of Member States, guarantee the proportionality of PNR data processing and aim to prevent abuse on the part of national authorities or other actors. The purpose limitation ensures that data processing is only carried out for the objectives of fighting terrorism and serious crime. The prohibition of the collection and processing of sensitive data constitutes an important safeguard to make sure that PNR will not be used in a discriminatory manner. The fact that Member States maintain records of processing operations, as required by the Directive, enhances transparency and allows to control the lawfulness of data processing in an effective manner. Data Protection Officers can independently control the lawfulness of data processing, in particular when they are not members of the staff of the Passenger Information Unit and are not subordinated to the Head of the Passenger Information Unit. In addition, their presence in the Passenger Information Unit ensures that a data protection perspective is embedded in the daily functioning of these units. On a practical level, the interaction between the Passenger Information Units and their Data Protection Officers appears to be working well and the role of the Data Protection Officer is seen as adding value to the operations of the Passenger Information Unit. The Data Protection Officers play a particularly important role in monitoring data processing operations, approving and reviewing pre-determined criteria and providing advice on data protection matters to the staff of the Passenger Information Unit. In most Member States, the Data Protection Officers have been designated by law as the contact point for data subjects and contacting them is also facilitated in practice. 3.3.Other elements of the review The necessity and proportionality of collecting and processing PNR data The review shows several elements confirming the necessity and proportionality of collecting and processing PNR data for the purposes of the PNR Directive. In the limited time since the transposition deadline, PNR has proven to be effective in achieving its aims, which correspond to an objective of general interest, i.e. to protect public security by ensuring the prevention, detection, investigation and prosecution of serious crime and terrorism in the Union’s area without internal borders. According to the Member States, the different means of processing of PNR data available to them (i.e. real time, reactive and proactive) have already delivered tangible results in the fight against terrorism and crime. Without claiming to be exhaustive, Member States have provided the Commission with qualitative evidence that illustrates how the comparison of PNR data against databases and pre-determined criteria has contributed to the identification of potential terrorists or persons involved in other serious criminal activities, such as drug trafficking, cybercrime, human trafficking, child sexual abuse, child abduction and participation in organised criminal groups. In some instances, the use of PNR data has resulted in the arrest of persons previously unknown to the police services, or allowed for the further examination by the competent authorities of passengers who would not have been checked otherwise. The assessment of passengers prior to their departure or arrival has also helped to prevent crimes from being committed. National authorities highlight that these results could not have been achieved without the processing of PNR data, e.g. by using exclusively other tools such as Advance Passenger Information. Under the PNR Directive, the processing of PNR data concerns all passengers on inbound and outbound extra-EU flights. The assessment shows that such broad coverage is strictly necessary to achieve the Directive’s intended objectives. As to the data collected, the categories in Annex I reflect internationally agreed standards, in particular at the level of ICAO. National authorities have confirmed that the possibility to collect such categories of PNR data corresponds to what is strictly necessary to achieve the objectives pursued. Concerning the level of interference with the fundamental rights to privacy and to the protection of personal data, the following considerations are relevant. Importantly, the PNR Directive strictly prohibits the processing of sensitive data. While PNR data may reveal specific information on a person’s private life, such information is limited to a specific aspect of private life, namely, air travel. In addition, the PNR Directive contains strict safeguards to further limit the degree of interference to the absolute minimum and ensure the proportionality of the methods of processing available to national authorities, including as regards the performance of automated processing. As a result of these safeguards, only the personal data of a very limited number of passengers are transferred to competent authorities for further processing. This means that PNR systems deliver targeted results which limit the degree of interference with the rights to privacy and the protection of personal data. Finally, PNR data are not used to establish an individual profile of everyone, but to establish risk and anonymous scenarios or ‘abstract profiles’. The length of the data retention period The retention of PNR data of all passengers for a period of five years is necessary to achieve the objectives of ensuring security and protecting the life and safety of persons by preventing, detecting, investigating and prosecuting terrorist offences and serious crime. Firstly, the need to retain data for five years stems from the nature of PNR as an analytical tool aimed not only at identifying known threats but also at uncovering unknown risks. Travel arrangements recorded as PNR data are used to identify specific behavioural patterns and make associations between known and unknown persons. By definition, the identification of such patterns and associations calls for the possibility of a long-term analysis. Indeed, such an analysis requires that a sufficient pool of data are available to the Passenger Information Unit for such a relatively long period. Such data can then be transferred to the competent authorities only in response to ‘duly reasoned’ requests, on a case-by-case basis, within the framework of criminal investigations. Secondly, the retention of PNR data for five years is needed to ensure the effective investigation and prosecution of terrorist offences and serious crime. Investigating and prosecuting such offences usually involves months and, often, years of work. In this vein, Member States have confirmed that the five-year retention period is necessary from an operational point of view. The availability of historical data ensures that, when an individual is accused of having committed a serious crime or being involved in terrorist activities, it is possible to review the travel history and see who travelled with him or her, identifying potential accomplices or other members of a criminal group, as well as potential victims. In addition, the safeguards provided in the PNR Directive concerning access by the competent authorities to the data stored by the Passenger Information Unit and in relation to the depersonalisation and re-personalisation of data have shown to be sufficiently robust to prevent abuses. The Court of Justice examined the time limits for the retention of PNR data in its Opinion 1/15 on the envisaged EU-Canada PNR agreement and, to address the Court’s concerns, the Commission negotiated a new draft agreement with Canada. In this respect, it is important to note that the Commission considers the factual and legal circumstances of the PNR Directive are different from the ones considered by the Court of Justice in that case. In particular, the PNR Directive clearly seeks the objective of ensuring security in the Union and its area without internal borders, where the Member States share responsibility for public security. In addition, unlike the draft agreement with Canada, the Directive does not concern data transfers to a third country, but the collection of passenger data on flights to and from the EU by the Member States. In this respect, the nature of the PNR Directive as secondary law means that it is applied under the control of the national courts of the Member States and, in the final instance, of the Court of Justice. Furthermore, national laws implementing the Law Enforcement Directive also apply to the processing of data provided for in the PNR Directive, including any subsequent processing by competent authorities. The effectiveness of exchange of information between the Member States The cooperation and exchange of PNR data between the Passenger Information Units is one of the most important elements of the Directive. While the exchange of data between the Member States based on duly-reasoned requests functions effectively, the possibility to transfer PNR data on the Passenger Information Unit’s own initiative is much less prevalent. The information provided by the Member States suggests that law enforcement authorities are more willing to use cooperation procedures based on clear and precise regulations, such as those concerning transfers in response to a request. In contrast, the broad and relatively unclear formulation of the Directive’s provision on spontaneous transfers has led to a certain reticence in its application. The quality of the assessments including with regard to the statistical information gathered pursuant to Article 20 Article 20 of the PNR Directive requires Member States to collect, as a minimum, statistical information on the total number of passengers whose PNR data have been collected and exchanged, and the number of passengers identified for further examination. The analysis of this information shows that only the data of a very small fraction of passengers are transferred to competent authorities for further examination. Thus, the statistics available indicate that, overall, PNR systems are working in line with the objective of identifying high risk passengers without impinging on bona fide travel flows.