EPIC

EU-US Airline Passenger Data Disclosure

Latest News | Background | EPIC Resources | EDRi Campaign | News Items | Documents | Int'l Passenger Profiling Systems | Analysis | Previous News

Latest News

Background

The United States announced that by March 5, 2003 all international airlines had to provide the government full electronic access to detailed airline passenger data on all travelers contained in the airline's computer system. This passenger information includes among other things, name, address, flightnumber, credit card number, and choice of meal. European airlines and European officials are concerned that providing unfettered access to U.S. law enforcement authorities would violate their privacy laws and have been holding discussions with the U.S. to ensure that the privacy of their citizens is adequately protected. EPIC also submitted comments on the same issue concerning the collection of passenger information on U.S. Citizens and permanent residents and criticized the government for failing to fulfill its legal obligations under the Privacy Act (see comments (pdf)).

The European Data Protection law, which implements the framework of Fair Information Practices embodied in the Organization for Economic Cooperation and Development (OECD) 1980 Privacy Principles, allows law enforcement authorities access to passenger data only on a case-by-case basis based upon a particular suspicion. The law also requires that data collected for one purpose should not be used for another. For sensitive data such as religious, ethnic, or political affiliation there are even stricter safeguards on the use and disclosure of the information. The U.S. requirement would force European airlines to violate the Data Protection laws and therefore Europeans airlines have petitioned their governments to clarify the airlines obligations and responsibilities. European data protection authorities are also concerned about the protection of their citizens' privacy rights.

The United States and the Europeans are in the process of formulating an arrangement for the United States to obtain the passenger information while installing appropriate safeguards to protect the privacy of European citizens and to ensure that airlines comply with the data protection laws. On February 18, 2003 the European Commission brokered an interim arrangement where the Europeans agreed to not enforce their laws until a new agreement is reached. In exchange the U.S. offered some clarifications about how they would handle the data. EPIC argues that this interim solution violates EU data protection laws and the agreement itself is flawed because the European Commission is not in a position to act for data protection authorities (see our analysis for more information).

As the discussion between the Europeans and the United States moves forward the following legal and policy considerations need to be considered in any permanent arrangement:

EPIC Resources

EDRi Campaign Against Illegal Transfer of European Passenger Data to the US

News Items

Relevant Documents

International passenger prescreening systems

 

Full Analysis

On November 19, 2001, the United States adopted the Aviation and Transportation Security Act. which requires airlines flying into the United States to disclose to the Commissioner of Customs data relating to passengers and cabin crew ("Passenger Manifest Information").  The transfers must be completed before the plane takes off, or at the latest 15 minutes after departure.  As soon as the data arrive at the US Customs, the US Customs and all US federal agencies would have access to these data.

On May 14, 2002, the US adopted another law to enhance border security that requires airlines arriving and departing from the United States to transmit data relating to passengers and crew to US Immigration and Naturalization Service. (see: Article 29 Working Party's Opinion Nr. 66 of October 24, 2002 (pdf))  It stipulates that all data must be transmitted to a centralized database, known as Interagency Border Inspection System ("IBIS"), and will also be shared with other federal agencies. 

Requested data (PNR, APIS and DCS)

Through the Advanced Passenger Information System ("APIS"), the US agencies will request the name, the date of birth, the nationality, the sex, passport number and place of issue, foreign registration number (if applicable), address in the United States during the stay and any other data deemed necessary to identify the persons traveling.

In addition, the US requires to get information collected by the reservation and departure control systems ("DCS"), which is connected to the Passenger Name Record System ("PNR"). (Example of PNR.) Because this system contains all passenger data of the whole airline company, the system is not restricted to a specific flight. Thus, allowing full access to the DCS and PNR means that the US Customs would have also full access also to the data of passengers not flying from or in the United States. The momentary PNR file contains information provided to the moment of the reservation, intended to ensure the associated transport and services, and which the travel agencies, the companies or the luggage handlers reach. It can contain up to sixty fields, according to the companies and their level of service: identity of the traveller, health, paid price, banking co-ordinates, telephone number of a person to be contacted in the event of problem, place of lodging in the country of destination, name of people with whom the person travels. In certain cases it might contain the history of the preceding voyages and the choice of meal. A passenger, usually, may choose "no pref, baby, child, pure vegetarian, vegetarian (lacto), fruit, raw, seafood, high fiber, diabetic, low calorie, low fat/low cholesterol, low protein, low sodium, no lactose, Asian vegetarian, Asian, Hindu, kosher, Musli, Bland." The specifications "Asian vegetarian, Asian, Hindu, kosher, Musli, Bland" make obvious that these data must be regarded as a category of "special sensitive data" because they could reveal the religious or ethnic background of the passenger.

Legal Analysis
 These requests interfere with the European Data Protection Directive (95/46/EC), the "directive."

The Directive applies when data of identified or identifiable physical persons ("personal data") are processed ("Any operation which is performed upon personal data whether or not by automatic means, such as collection, recording, organization, disclosure, collected, stored or disclosed" (see full definition in Article 2 (b)).  It imposes, in general, strict requirements on data processing.  This means mainly that every data processing must be made with a specific, explicit and legitimate purpose (Article 6 (1)(b)), which is mostly the fulfillment of contractual obligations.  For example an online bookstore may collect a client's address in order to be able to deliver the books.  In addition, the data collection must be adequate, relevant and not excessive in relation to the purposes for which the data are collected and/or for which they are further processed  (Article 6 (1)(c)).  Referring to the previous example, an excessive data collection would be the request of the bookstore to receive not only the client's address but also his telephone number.  Further, data must be accurate, kept up to date and generally only stored as long it is necessary for the given purpose (Article 6 (1)(d) and (e)).  Finally, there are several other requirements such as the right to know if data is being processed, what kind of purpose etc. (see Articles 10 and 11) or the right of access (Article 12).

National Security Exemption Clause
However, there are narrowly interpreted exemptions, such as in Article 13 to the general data processing obligations mentioned above.  Article 13 stipulates that the European Member States may restrict the scope of the obligations in the mentioned articles when such a restriction constitutes a necessary measure to safeguard national security, defense, public security, prosecution of criminal offences or other purposes not related to the US request, see: Article 29 Working Party's Opinion Nr. 66 of October 24, 2002 (pdf)

The words "necessary measure" make it clear that these exemptions are restricted only for specific investigations.  Therefore, the exemption rule of Article 13 cannot justifiably be invoked to restrict the obligations of the Directive where the transfer is systematic as it is foreseen by the US Customs.  Since Article 13 requires a case by case request, the systematic general US request does not comply with it.

Rule of data limiting to the original purpose
The US requests for data access also conflict with the general data quality principle of Article 6 (1)(b) of the Directive which stipulates that the data controller ("natural or legal person, public authority, agency or any other body which determines the purposes an means of the processing of personal data") can process personal data only as long it is compatible with the original purpose for which the data have been collected for.  Under this scope the transfer of personal data to US government agencies can hardly be seen as a fulfillment of the contractual obligations of the airlines or travel agencies vis-à-vis their passengers (see Working Party's Opinion WP 66). In other words, the airlines collect data from the passenger primarily to deliver a service, including providing tickets and serving food. The airlines did not originally intend to collect data to transfer them to US Customs.  The necessity of the transfer to fulfill a contract between the data subject and the data controller cannot expand the purpose for which the data were originally collected.  The "physical impossibility" for the airlines to fulfill their contractual obligations, is usually regarded as an insufficient ground to expand the original purpose collecting passenger data (see Working Party's Opinion WP 66). 

At any rate Article 6 cannot apply to cover the transfer of data related to persons not traveling to the US.

Transfer to "Third States"
In addition, the Directive prohibits, in general, any transfer of personal data to "third countries" (non-EU countries) if these countries do not provide an adequate level of data protection.  Article 25 clarifies the definition of an "adequate level" of safeguards.  The US is considered such a third country, since it does not offer any safeguards for the protection of personal data equivalent to the one provided by the Directive (see: Working Party's Opinion 1/99).  Thus, even if one may argue that the requested transfer were compatible with the contractual purpose of the airlines (relying on the argument that, without the transmission, the airlines would simply not be able to carry their passenger to the US), the transfer would generally be prohibited, because of the US' lack of adequate safeguards.  This prohibition could only be circumvented when the airlines get an "unambiguous" consent from their passenger for this specific disclosure (see Article 26).  This means, pursuant to the Directive, a "freely given specific and informed indication of a person's wish."  The information provided to the data subject must include the identity of the US Agency, the purpose of this request and a notification that the data will be transferred to a country that does not offer adequate privacy safeguards (Articles 10 und 11 of the Directive). 

The other exemptions of the third country prohibition listed in Article 26 do not apply.  There is neither a proof that the transmission of the specific data is necessary to safeguarding important public interests, nor that the transmission is necessary in order to protect the vital interests of the passengers.

EPIC's most important concerns and recommendations:

  1. There is no legitimate reason for requesting data of passengers not traveling to the United States.  The US is trying to use its political power to force airlines to get data of persons the US should have no concern with.  If the US needs specific information about other persons, the US could contact the competent foreign law enforcement authorities such as Europol.  Airlines should not play the role of intermediaries for US agencies.

    So far, there exist no obligations under international law to provide the US with passengers data.  The US request for passenger data might even violate international economic and trade agreements (Austrian Data Protection Organization, ARGE DATEN).  Thus, it should be up to the US to introduce its own controls for passengers traveling to the US.

  2. The Directive prohibits any processing of sensitive data such as the information of choice of meal which can reveal religious or ethnic or medical data without explicit consent or substantial public interest.  Thus, any agreement must exclude these data as long there is no specific purpose showed.

Recent Developments

THE JOINT STATEMENT OF FEBRUARY 17/18, 2003

In January the European Commission opened talks with the US Customs.  Recently, on February 17-18, 2003, both sides came to an interim arrangement, the "Statement of the European Commission/US Customs Talks".

The joint statement made address privacy concerns covering the period from March 5 (when the US Customs will start requesting passengers' data) until the European Commission makes a final decision pursuant to Article 25 (6).

During this period the Commission urges the Member States not to take enforcement actions against airlines complying with US government's requirements even if the transfer of data clearly violates the Directive.  

The Joint Statement mainly provides that:

  1. Compliance by airlines and reservation systems with US PNR requirements will not involve unlimited on-line access by US Customs to EU-based data bases, but rather the processing of PNR data for persons whose current travel itinerary includes flights into, out of, or through the US.
  2. US Customs undertakes to respect the principles of the Data Protection Directive when accessing PNR data in the territory of the Community.
  3. US Customs develops in accordance with the EU applicable law measures to protect "sensitive" data.
  4. European Data subjects may request the US Customs for disclosure of data under the American Freedom of Information Act (FOIA).
  5. There will be further discussions on a regular basis between US Customs and the European Commission about implementation of this statement and possible enhancement.
  6. US Customs may provide information to other US law enforcement authorities, who specifically request PNR information, only for purposes of preventing and combating terrorism and other serious criminal offenses.
  7. Both sides agree to work together towards a bilateral arrangement, that, in the end, would define the purposes for which the data will be used. It would contain a limitation of use to these purposes; conditions and limits of data disclosure and onward transfer; protection of data from unauthorized access; duration and conditions of data storage, additional measures for the protection of sensitive data; remedies for passengers, including possibilities to review and correct data held by US Customs; reciprocity.

Analysis of the Joint Statement:
In response to point 1.:
The promise not to allow full access appears to be a big step towards a better privacy protection. But, as it is stated in the ANNEX of the Joint Statement, the US Customs are entitled by legal statute (49 U.S.C. 44909 (c) (3)) to have full access to air carriers operating passenger flights in foreign air transportation to, from or through the United States.  Therefore it will be crucial that the access will be technically limited to the data referred to in this statement.  Otherwise, all data, even all data of passengers not flying to or from the United States would be accessible to the US Customs.  This would raise the issue of what the US Customs may do with other passengers?data and how the US Customs could be subject to control and oversight. 

To 2.): The US Customs' promises to abide by the Directive's principles when accessing PNR can hardly be fulfilled.  The agency by being entitled to look at every passenger data without having to justify of any specific purpose infringes Article 6 of the Directive.  It does not respect the narrowly interpreted "national security" clause of Article 13, it does not limit the transfer to third entities (see below) and does not give access to the data subject . Finally, since the US Privacy Act does not apply to non US citizens, how will the US Customs ensure to respect the principle of the Directive?

To 4.): Europeans do not have the same rights under the FOIA as Americans have.   Further, it is unclear, whether data subjects may request data in every cases, because the US Customs is stating only two paragraphs later in the Annex that it will regard the PNR data as exempted from FOIA.

To 6.): The limitation processing data to other US law enforcement authorities has to be seen as a significant step towards more data protection.  The Annex clearly stipulates that other US federal, local agencies and law enforcement entities have no direct access to the US Customs data. This promise offers much more security than for other data.  However, the purpose of requesting data is not limited to the investigation and prevention of terrorism, but to all "serious criminal offenses."  Therefore the allegation remains that the US is using foreign private companies as data collectors for law enforcement purposes.  This is a perfidious way to circumvent the higher requirements European law enforcement agencies have to follow before disclosing law enforcement relevant data to the US.


The implementation of the Joint Statement:

In addition to the aforementioned issues with the Directive principles by the US Customs, the implementation of the Joint Statement itself is legally insecure.  The EU Commission urged, in return to the promises given by the US, the national data protection authorities not to take enforcement actions against airlines complying with the US requirements after March 5, 2003.

"In view of the above process, the Commission side considered that EU data protection authorities may not find it necessary to take enforcement actions against airlines complying with US requirements." (Joint Statement of 17-18 February)

This behavior of the Commission is unique as it urges national authority to violate their national law.  See Mr. Rodota's comment (pdf).

The Commission is "not legally in a position to convene, even for reasons of urgency, prior to the very close deadline of March 5, 2003 – when the APIS/PNR legislation is expected to take effect . . . In fact, national data protection supervisory authorities and judicial authorities of  Member States are not free to apply or not national laws merely on the basis of the relevant advisability, and it has not yet been clarified how the Joint Statement might provide a sound legal base to justify an exception to that rule," Mr. Rodota concluded.

In addition, even the procedure considered in the Joint Statement for the period running after March 5 is legally questionable.  The EC Commission promised to make a decision under the exemption clause of Article 25 (6) of the Directive to give the data access a strong legal basis.

The European Commission exemption clause Article 25 Section 6
Article 25 Section 6 of the Directive opens up the strict regime of the Directive for decisions given by the EC Commission stating that a specific third country ensures an adequate level of protection.  In this case, all Member States shall take the measures necessary to comply with the Commission's decision.  According to Article 25 Section 2, the adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer.  Although Section 2 gives further instructions for this consideration, the final decision allows a broad discretion to the Commission.

Thus, the EC Commission pursues to declare the requested access of the US Customs with the given promises of data protection as consistent with the adequate level clause of Article 25. 

Still, this way would be very disputable for of the following reasons:

  1. The Directive mainly applies to the collection of data among individuals and companies or among companies and themselves, but not among law enforcement agencies (see Article 3 "Scope" of the Directive which stipulates that the Directive shall not apply to the processing of personal data in any case to processing operations concerning public security, defense, State security).  Therefore, in general, Article 25, which contains the assurance that personal data transferred to companies located in other countries meet the same level of data protection as within the EU, does not apply to data sharing between public law enforcement agencies and individuals or companies.  The requested access is therefore not a matter of the regulation of data flow among companies for which the EU is solely competent for.  It is a matter of  cooperation with foreign law enforcement agencies which mainly still remains in the sole competence of the European Member States.  As an illustration, one could have a closer look at what airlines have to do in order to fulfill the US Customs' request.  They are transferring data not for their own contractual purpose but solely at US government's request. The US could ask every passenger for the same data on their own.  Instead of this, the US Customs force private companies to do so.  Therefore it does not appear an exaggeration to conceive the airline companies as agencies of the US Customs.  
  2. But, even if Art 25 Section 6 would in general apply, access to data for US Customs would still violate the principles of the "limitation of the purpose" as it is set forth in Article 6 (see above) of the Directive.  The airlines did not originally collect data with the purpose of transferring them to US Customs and there is no specific freely given consent by passengers (see Legal Analysis).

Previous News

EPIC International Privacy Page | EPIC Air Travel Privacy Page | EPIC Home Page

Last Updated: November 13, 2007
Page URL: http://www.epic.org/privacy/intl/passenger_data.html