On Thursday 14^th April, the European Parliament will debate and vote on a provisional agreement with member states on the use of passenger name records (PNR).

The compromise text on the long-debated proposal for an EU PNR (Passenger Name Records) Directive aims to regulate uniformly the way passenger name records are processed and shared by Member States in the fight against terrorism and serious crimes, while establishing a series of data protection safeguards.

In case the provision were approved, passenger data collected by airlines will be shared with national authorities for the prevention of terrorism and serious crime.

What is the PNR Directive about?

PNR are data on air passengers collected and held by air carriers for operational purposes. In brief, they provide information about passengers’ names, their travel dates, itinerary and payment method. In some Member States, such as the UK and Denmark, law enforcement bodies already collects them for security purposes.

Under the proposed directive, aimed at harmonising rules for the use of such data, whenever an extra-EU flight lands in an EU country or departs from it, airlines are required to transmit PNR data of those passengers to the concerned member state.

Each EU Member will determine a Passenger Information Unit (PIU), which will store and compare PNR of unsuspected persons against databases. PNR are transmitted on a case by case basis to the competent authorities, when they need to identify persons requiring further examination.

As law enforcement authorities will not have direct access to airline data systems, PIUs will also be in charge of exchanging information among Member States.

PNR data will be retained for a maximum length of five years. During the first six months, all identifying data will be fully available, then stored in a masked format.

As for sensitive data, the collection and use of racial origin, religion, political opinion, health or sexual orientation are prohibited.

The possibility for a Member State to apply the directive to intra-EU flights, as proposed by the Council, is included in the compromise text but, in this case, it must notify the Commission.

Furthermore, it would be possible for Member States to collect PNR data from travel agencies and tour operators.

The European Parliament sought to safeguards data protection

In its efforts to preserve EU Citizens’ Rights, the European Parliament tried its best to make the directive compliant with the proportionality principle and to insert as many data protection (DP) safeguards as possible, such as

• a narrow list of serious crimes justifying the use of PNR;
• the appointment of DP officers in each PIU;
• the strengthening of DP authorities’ monitoring powers;
• and strict conditions to access masked PNR data beyond six months.

In a resolution on anti-terrorism measures, the EP also urged the co-legislators to further trilogues on the Data Protection Package, in parallel with the EU PNR scheme.

A long path 

The path towards the adoption of a common EU PNR system as part of the European security strategy has been a long one.

Following an earlier proposal in 2007, the European Commission proposed a directive in 2011. Although the Council of the EU reached a general approach on this matter in 2012, the directive was rejected by the European Parliament in 2013, which questioned its necessity and proportionality.

In the aftermath of the early 2015 Paris attacks, The proposal gained momentum again. The European Council and the EU Counter-terrorism Coordinator called for an EU PNR scheme in order to counter the phenomenon of foreign fighters. As an answer, Rapporteur Timothy Kirkhope from the European Conservatives and Reformists Group presented a revised report.

After several debates, on 15 July the Committee on Civil Liberties, Justice and Home Affairs (LIBE) adopted a second report, which made possible to open negotiations with the Council of the EU.

The November Paris attacks acted as a stimulus for a compromise, endorsed by the Council and backed by the Parliament in a month’s time.

For more information on the early 2015 Paris Attacks, read  “CLASH OF CIVILIZATIONS OR CLASH OF INTEREST?“