Jusletter IT

Directive 2016/681 (PNR Directive)² establishes a European Passenger Name Record (EU PNR) system to assist law enforcement (LE) authorities in the fight against terrorist offences and serious crime (e.g. trafficking in human beings, narcotic drugs, weapons, nuclear materials, sexual exploitation of children, etc.), including international crimes (e.g. crimes within the jurisdiction of the International Criminal Court, such as crimes against humanity, torture or genocide). This is a decentralised system, as Member States are obliged to implement their own national PNR systems in accordance with principles and standards laid down in the PNR Directive.³ PNR data⁴ is seen by the European Commission, Member States and law enforcement authorities as an important criminal intelligence tool.⁵ It is said to track or identify unsuspected persons capable of carrying out terrorist offences or serious crimes, by checking PNR data against (non-discriminatory) pre-determined criteria, the so-called screening, or by comparing PNR data against law enforcement databases at national or EU level on persons or objects wanted or under alert, which would help LE authorities prevent, detect, investigate and prosecute terrorist acts or serious crimes.⁶ In other words, it aims at verifying if a person or an object that is about to depart or land in a Member State is not being searched by the police or if a passenger may present a risk considering his/her travel patterns. The EU PNR data must contain 19 items which are listed in Annex I of the PNR Directive. These items can contain a vast amount of personal information from an individual, such as a passenger’s name, address, telephone number, email address, billing address, frequent flyer information (which can amount to include a risk analysis of the passenger with more intrusive screenings to label the passenger as a «trusted traveller» or «high risk»),⁷ general remarks [which is a very wide term and can include any kind of information, such as meal preferences - e.g. Kosher, Halal, sensitive security information, illnesses, special (medical) service requests, or even specific benefits granted for belonging to a political or religious association], names of other travellers on the PNR and Advanced Passenger Information (API) data.⁸ These 19 items cannot contain information on a person’s race or ethnic origin, religion or belief, political or any other opinion, trade union membership, health, sexual life or sexual orientation. In the event that any such elements are transferred to the national competent authority responsible for preventing, detecting, investigating or prosecuting terrorist offences and serious crimes, that is the PIU, which could happen through the general remarks item, the latter has the responsibility and obligation to delete them.⁹

The Directive regulates the transfer of PNR data of passengers of extra-EU flights¹⁰ by air carriers (private companies) to the so-called Passenger Information Units (PIUs), and the processing operations of that data by Member States, including collection, use and retention by public authorities, exchange between Member States or with the European Union Agency for Law Enforcement Cooperation (Europol) (Art. 4(2)(b) PNR Directive) and transfer to third countries (Arts. 1(a) and (b) and 11 PNR Directive). In addition, operations identified in the «processing» definition of the Law Enforcement Data Protection Directive (LE Directive),¹¹ such as recording, consultation, organisation, structuring, restriction, etc. are also included.¹² The purpose of collecting and processing PNR data is limited to preventing, detecting, investigating and prosecuting terrorist offences and serious crime (Art. 1(2) PNR Directive). The definition of «terrorist offences» is provided by national law in relation to Arts. 1 to 4 of the Council Framework Decision 2002/475/JHA.¹³ The latter has been repealed by the Combating Terrorism Directive,¹⁴ which considerably changed the scope and dimension of the offences identified in the Framework Decision, criminalising new conducts. The absence of a correlation table in the Combatting Terrorism Directive or of a specific provision in the latter amending the PNR Directive, can raise certain questions as to whether a conduct should be qualified as criminal and as to the subsequent definition of the rights of suspects of criminal offences.¹⁵ The offences that fall under the definition of «serious crime», are identified in the exhaustive list of Annex II of the PNR Directive, which are punishable at national level by a custodial sentence or a detention order for a maximum period of at least three years (Art. 3(9) PNR Directive). By 25 May 2020, the Commission is required to review the necessity, proportionality and effectiveness of broadening the ratione personae scope of collection and transfer of PNR data to include non-carrier economic operators, such as travel agencies and tours operators, that provide travel-related services, including the booking of flights (Art. 19(3) PNR Directive). Since Member States have already expressed their intention to extend under national law the same obligations to those entities,¹⁶ such a review will be of limited interest. The material scope can also be extended to other transportation providers, such as rail, road and maritime international transport (recital 33 PNR Directive).

Member States are not given direct access to the airlines database. The PNR data is sent by air carriers to the PIU of the Member State concerned, the so-called «push method» (deliberate transfer),¹⁷ 24 to 48 hours before the scheduled flight departure time and immediately after flight closure (Art. 8(3) PNR Directive). The data is then processed and assessed by the Member State’s PIU for the sole purpose of identifying persons requiring further examination by competent authorities and by Europol (where relevant and if within its competence).¹⁸ Further examination implies that the person in question may be involved in or is a suspect of a terrorist offence or serious crime, or that the crime is being committed with the journey itself (e.g. drug smuggling or money laundering through cash transport). The exchange of information between Member States’ PIUs is the general rule (Art. 9(1) and (3) final sentence PNR Directive), although in case of urgency a national competent authority may, if duly reasoned, request information directly to the PIU of another Member State (Art. 9(3) PNR Directive). If a person is identified for further examination, this information needs to be shared with the PIUs of other Member States, who in turn will share it with their national competent authorities in due time to allow border controls (recital 13 and Art. 9 PNR Directive). Data provided by airline carriers can be stored in the PIU’s database for 5 years after being transferred to the PIU of another Member State, after which it must be deleted. PNR data is «depersonalised» after 6 months to mask out any information that can serve to identify directly the passenger.¹⁹ Access to the full PNR data after this period is only admitted when it is reasonably believed to be necessary to respond to requests made, on a case-by-case basis, by competent authorities or Europol, and is approved by a judicial authority or another national authority competent under national law to verify whether the conditions for PNR data disclosure are met (recital 37 and Art. 12 PNR Directive). Any subsequent transfer of data between LE and judicial authorities is regulated by national legislation and the period of retention is no longer under the scope of the PNR Directive (recital 26 PNR Directive). Any decision having an adverse legal effect on or that significantly affects a person cannot be taken by automated processing of PNR data. The PNR Directive provides that an «individual review» by a «human» is mandatory (recital 20 and Arts. 6(5)(6) and 7(6) PNR Directive). The extent of the review is not specified further, giving a wide margin of manoeuvre for LE authorities to decide.²⁰ The only limit introduced was the prohibition of taking decisions based on a person’s race, ethnic origin, political opinions, religion, philosophical beliefs, trade union membership, health, sexual life or sexual orientation.²¹ Another important guarantee established in the PNR Directive is the assurance that any assessment made before the arrival of a flight or its departure from a Member State cannot jeopardise the free movement principle and the right of entry of EU citizens in the EU (Art. 6(9) PNR Directive ) or be used to deny asylum or the statute of a refugee to non-EU nationals (recital 21 PNR Directive). A Member State may transfer PNR data to a third country, on a case-by-case basis and in accordance with the provisions laid down by Member States pursuant to Council Framework Decision 2008/977/JHA.²² Transfers of PNR data without prior consent of the Member State from which the data was obtained are permitted in exceptional circumstances (Art. 11 PNR Directive). All processing of PNR data should be logged or documented for verifying its legality, self-monitoring and ensuring proper data integrity and secure processing (recital 37 PNR Directive). This is key to detect and track who had access for subsequent control. Passengers must be informed that their PNR data is being collected and about their rights (recital 37 PNR Directive). The PIU must keep records of several processing operations, in particular collection, consultation, disclosure and erasure (Art. 13(6) PNR Directive).

This section considers which legal instrument the entities who process PNR data in the context of the EU PNR system are subject to and must comply with when they process personal data. This illustrates the variety of processing activities taking place and the different applicable data protection regimes. I point out two types of access: «primary access», where the legitimacy to process such data stems directly from the PNR Directive; and «secondary access», where other entities in the LE and border management area might have access to personal PNR data indirectly, through other legal instruments, e.g. Europol Regulation, LE Directive, EPPO Regulation and national legislation, or even the TFEU [Art. 86(2)] and TEU [Art. 4(3)]. Entities with primary access are air carriers, PIUs, national competent authorities under Art. 7 of the PNR Directive (which could be LE and judicial authorities, such as police, courts and customs), Europol and third countries’ competent authorities pursuant to Art. 11 of the PNR Directive. Entities with secondary access can be the European Union Agency for Criminal Justice Cooperation (Eurojust), the European Anti-Fraud Office (OLAF), the European Public Prosecutor’s Officer (EPPO) and the International Criminal Police Organisation (Interpol).

Air carriers are private entities who initially process PNR data for commercial purposes and are now legally obliged to handover that data to PIUs. The processing operations related to personal data, including appropriate technical and organisational measures to ensure data security and confidentiality of processing are governed by the GDPR.²³ This is due to the fact that the main and original purpose of collection by air carriers is not the same as the one established in Art. 1(2) of the PNR Directive, which is to prevent, detect, investigate and prosecute terrorist offences and serious crime. The express mention to the application of the GDPR reinforces the distinction between processing operations (and consequently of legal regimes) of EU PNR data by private entities and by public authorities. As a result, individuals wishing to enforce their rights to privacy and protection of personal data against air carriers will be subject to the rules and safeguards of the GDPR.

PIUs and competent authorities that fit the definition of Art. 7(2) of the PNR Directive are namely public authorities with LE competences (e.g. police, customs), but also judicial authorities, or even any other body or entity entrusted by Member States to exercise public powers under the PNR Directive, namely prevention, detection, investigation or prosecution of terrorist offences and serious crime. These entities, when processing personal PNR data, are subject to Art. 13 of the PNR Directive, which then refers to Arts. 17 to 22 of Council Framework Decision 2008/977/JHA. The latter has been repealed by the LE Directive, which has considerably changed some of those rights.²⁴ Despite the absence of a correlation table concerning both legal instruments, Art. 59 of the LE Directive provides that the applicable law should be the LE Directive. One could either adopt a restrictive interpretation, applying to the data subject only the precise rights that still coincide with the repealed Framework Decision, or adopt an extensive interpretation, applying new and extended rights which are more favourable to the data subject. Since the processing of personal PNR data can have negative consequences for the data subject, legal certainty requires defending an extensive interpretation. In short, individuals wishing to enforce their right of privacy and protection of personal data against PIUs and competent authorities falling under the definition of Art. 7 of the PNR Directive will be subject, by reference of Art. 13 of the PNR Directive, to the new and extended rights of the LE Directive.

Established in 1995, Europol became an EU agency in 2009 to support and strengthen Member States’ actions and their cooperation in preventing and combating organised crime, terrorism and other forms of serious crime affecting two or more Member States (recitals 1 and 6 Europol Regulation). Its main tasks include the collection, storage, processing, analysis and exchange of information and intelligence, assistance with investigations, and provision of intelligence and analytical support to Member States. Its processing operations are governed by the Europol Regulation.²⁵ The processing of personal data by Europol is under the supervision of the European Data Protection Supervisor (recital 50 Europol Regulation) and has specific and autonomous rules regarding the protection of personal data.²⁶ Europol can request access to PNR data or analytical information to the PIUs of Member States through the Europol National Unit under strict conditions: case-by-case basis, electronic and duly reasoned request, when strictly necessary to support and strengthen Member States’ action, respecting the purpose limitation principle of the transfer to prevent, detect or investigate a specific terrorist offence or serious crime which falls within the scope of Europol’s competences. Europol’s request should still demonstrate that the access to the data will substantially contribute to the prevention, detection or investigation of those offences (Art. 10 PNR Directive). Europol’s right of access can still be restricted by Member States’ PIUs to ensure the respect of the principle of ownership of data and the protection of personal data (recitals 26 and 27 Europol Regulation). Consequently, an individual wishing to enforce his/her right to privacy and protection of personal data against Europol, will have to do so under the Europol Regulation (Art. 47 and onwards Europol Regulation). If Europol processes non-operational data, which is not related to criminal investigations (e.g. staff data, visitors, service providers), then the processing of such data is subject to Regulation (EU) 2018/1725, ²⁷ which entered into force on 11 December.

The access by third countries’²⁸ competent authorities to EU PNR data can be regulated either by the PNR Directive, with the subsidiary application of the LE Directive, or by the GDPR. The difference depends on who transfers the EU PNR data to the third country, either Member States or air carriers. For air carriers, as mentioned in subsection 2.3.1.1, the legal regime applied is the GDPR (Art. 21(2) PNR Directive). Hence, transfers of EU PNR data by air carriers directly to third countries’ competent authorities are subject to the GDPR rules on transfers of personal data to third countries.²⁹ For Member States, the transfer of EU PNR data to a third country is made pursuant to Art. 11 of the PNR Directive, which is not clear as to who is responsible within the Member State to carry out the transfer – Member States’ PIU or competent authorities under Art. 7 of the PNR Directive. The transfer must be necessary and can only occur on a case-by-case basis for the same purpose as that of Art. 1(2) of the PNR Directive. It must be duly reasoned and comply with the conditions set out in Art. 9(2) of the PNR Directive as well as with the general principles for transfers of personal data under the LE Directive.³⁰ These principles establish a three-step protocol to be followed by the transferring Member State. First, consider the existence of an adequacy decision, recognised by the Commission, applied to the third country (this requirement is constantly monitored by the Commission). Second, in its absence, verify if appropriate safeguards have been provided or exist regarding the protection of personal data. Third, if the previous two conditions are absent, derogations can be allowed in specific circumstances. In short, Member States need to ensure that the same conditions and safeguards set out in the PNR Directive are observed by the third country, and that the level of protection of personal data is «essentially equivalent»³¹ to that guaranteed within the EU, including in cases of onward transfers by the third country to competent authorities of another third country, where express authorisation of the Member State is required. It is important to note that the third country can have access not only to the EU PNR data, but also to the result of processing such data by the PIU (a feature that does not exist in the GDPR).

The question in this subsection is whether Eurojust, OLAF, Interpol and the EPPO can have access to EU PNR data via the cooperation they have with Europol and with national competent authorities.³² If so, which legal framework should be applicable in connection to the enforcement by an individual of his/her right to privacy and data protection? Or should it be considered that the PNR Directive does not allow such subsequent transfers to international organisations, Union bodies or agencies at all? Art. 11 of the PNR Directive regulates the transfers of PNR data to third countries and is silent regarding possible transfers (or subsequent transfers) to international organisations, union bodies or agencies. No express general permission or prohibition exists in the PNR Directive in relation to international organisations, Union bodies or agencies (with the exception of Europol). However, several EU legal instruments, including the TFEU [Art. 86(2)] and the TEU, under the principle of sincere cooperation [Art. 4(3) TEU], encourage the exchange of information and collaboration between Union agencies or bodies as well as with national competent authorities in order to improve efficiency in combatting crime and avoid duplication of resources.

Art. 21 of the Europol Regulation provides access to Eurojust³³ and to OLAF³⁴ to information held by Europol, within their respective mandates. The access is indirect, based on a hit/no hit system, and is subject to possible restrictions, including authorisation and degree of right of access, indicated by the entity providing the information in question, that is Member States, Union bodies, third country or international organisation.³⁵ A question that could be raised in connection to Eurojust is whether through its unique structure one could consider that National Members, who are also heads of the respective national desks offices (submitted to the national law of their Member State), holding a double «hat» of national judicial authority,³⁶ fit the category of national competent authorities under Art. 7 of the PNR Directive, having access to PNR data in that capacity. Either way, there are reasons to believe that Eurojust will be able to have access and process PNR data for the purposes of investigating and prosecuting crimes and offences in which Europol is competent to act. At first sight, it seems that only four offences under Annex II the PNR Directive are not included in Annex I of the Europol Regulation. Those criminal offences are rape, unlawful seizure of aircrafts/ships, sabotage and industrial espionage. Rape could however be subsumed to sexual abuse and sexual exploitation under Annex I of the Europol Regulation, reducing then the list to three. OLAF can conduct external investigations, carrying out on-the-spot checks and inspections in Member States, including access to all information and documents relating to the matter under investigation (Art. 3(1) and (5) OLAF Regulation). The cooperation and exchange of information, including personal data and classified information, with Eurojust and Europol is recognised by Art. 13 of the OLAF Regulation. Being a Union body, it is subject to Regulation (EU) 2018/1725. Hence, the processing operations and protection of personal data will be governed by the OLAF Regulation (Art. 10) and by Chapter IX of Regulation (EU) 2018/1725.³⁷ The offences for which it may have access to and process PNR data are limited to its mandate.³⁸ Pursuant to Annex II of the PNR Directive, those offences may include i) participation in a criminal organisation, ii) corruption, iii) fraud, including against the financial interests of the Union, iv) laundering of the proceeds of crime and counterfeiting of currency, including the euro, and v) forgery of administrative documents and trafficking therein.

The EPPO is a Union body established in 2017 under the mechanism of enhanced cooperation referred to in Art. 20(2) TEU and Art. 329(1) TFEU, but its foundations rely on Art. 86 TFEU.⁴⁰ It will be responsible for investigating, prosecuting and bringing to judgment perpetrators and accomplices of criminal offences affecting the financial interests of the Union.⁴¹ The offences for which it may have access and process PNR data, according to its mandate, seem identical to OLAF’s. EPPO’s investigations and prosecutions will be governed by the EPPO Regulation. The principles and rules related to the protection of personal data are extensively specified in Art. 47 and onwards of the EPPO Regulation. According to recital 93 of the EPPO Regulation, such rules should be interpreted and applied in accordance with the interpretation and application of the LE Directive. National law will be applied only to the extent that the matter is not governed by the Regulation. In case of conflict, the EPPO Regulation prevails.⁴² The exchange of information between Eurojust, OLAF and Europol are governed respectively by Arts. 3(3), 100, 101 and 102 of the EPPO Regulation.⁴³ Exchange of information can also take place with other Union institutions and bodies (Art. 103), with third countries and international organisations (Art. 104) as well as with Member States that do not take part in the enhanced cooperation mechanism (Art. 105). Regulation (EU) 2018/1725 applies to the processing of administrative personal data performed by the EPPO.⁴⁴ Hence, in the performance of its tasks, the EPPO might have secondary access to PNR data not only through its relations with Europol, but also with national competent authorities, as per Art. 99(1) and (2) on common provisions for EPPO relations with its partners of the EPPO Regulation.

Interpol is an international police organisation composed by 194 member countries, each represented by a National Central Bureau.⁴⁵ Interpol developed special relations with several partners, including the European Union. All EU Member States are affiliated to Interpol. Specific recitals in each regulation governing Europol, OLAF, EPPO and Eurojust, address the transfers of personal data to Interpol. The reason is that police cooperation, mutual assistance and exchange of information to prevent and fight crime between criminal law enforcement authorities are core activities of Interpol.

An example: the possibility to exchange personal data between Europol and Interpol is recognised under recitals 32 and 33 of the Europol Regulation and further regulated by Art. 25 of the Europol Regulation on international transfers. Art. 25(1) of the Europol Regulation provides a flexible regime to Europol since the transfer can be based on one of the three conditions below:

• an «adequacy decision» issued by the Commission, meaning that the country or international organisation offers an adequate level of protection to personal data. This decision allows the free flow of personal data from the EU without further need to implement additional safeguards or being subject to further conditions;
• an international agreement providing «adequate safeguards»⁴⁶ concluded between the Union and the international organisation pursuant to Art. 218 TFEU; or,
• a cooperation agreement between Europol and the third country or the international organisation allowing the exchange of personal data if concluded before 1 May 2017.

In this case, Interpol has signed a cooperation agreement with Europol on 5 November 2001, which continues to be in force.⁴⁷ Therefore, there are reasons to believe that Interpol could have access to PNR data not only via Europol, within their respective mandates, but also via national LE authorities under Art. 35 of the LE Directive, where national LE authorities receive PNR data from the Member State PIUs and then transfer it to international organisations via the LE Directive. Member States, as members of Interpol, have certain duties of cooperation and information sharing with this entity (e.g. respond to Interpol notices or information requests). This can be a point for the CJEU to clarify in the future.

This paper illustrated the variety of processing activities and applicable data protection regimes that the EU PNR data will be subject to, creating a degree of complexity which is not desirable when data subjects wish to enforce their rights. It further demonstrated that the access to EU PNR data is not limited to entities that have primary access, as provided by the PNR Directive. Through other EU legal instruments and under the principle of sincere cooperation, national competent authorities and Europol are encouraged to exchange information with Union agencies and bodies in the area of police and judicial cooperation in criminal matters (Eurojust, OLAF, EPPO), as well as Interpol. This secondary access was not considered and therefore not tackled in the PNR Directive. The review of the PNR Directive by the Commission (Art. 19) should also address the consistency between these legal instruments. Moreover, the PNR Directive does not clearly reflect on the different access and use that LE authorities (police and customs) and judicial authorities (court and prosecutors) have in relation to PNR data. They are treated the same way, although their access and use will vary substantially.⁴⁸ As a result, Member States can be clearer and stricter about the degree of access by competent authorities and their staff to PNR data, in order to reduce the interference with the right to privacy and protection of personal data.⁴⁹ Transparency, responsibility and accountability for the processing operations of personal data are critical to avoid abuse and misuse.