Topic
24 November 2023
Six years ago, the Court of Justice of the European Union issued an opinion at the request of the European Parliament striking down the PNR agreement with Canada for its lack of safeguards on data protection, non-discrimination and effective remedy for individuals. In 2019, a new draft agreement was shared by the Commission with the European Parliament but no further amended version was communicated until… yesterday, on the day the negotiations are supposed to be finalised.
EU-Canada Council,Brussels, 14 June 2021. European Council
The vast amounts of data collected by private companies are of significant interest to policing, security and border agencies, and in the realm of travel, there is one type of information that has been increasingly sought by governments: Passenger Name Record (PNR) data.
PNR data is made up of a wide range of personal information shared with companies during the booking process, including name, address, travel itinerary, ticket information, contact details and means of payment, amongst other things. Where states have a PNR system in place, the data can be checked against lists of wanted or suspected individuals or run through profiling algorithms to detect individuals who may be of interest to the authorities.
The opinion of the Court of Justice in 2017 was hailed by civil society as “good news for EU citizens, as the risks associated with massive and unnecessary databases of sensitive personal data are unacceptable. Blindly collecting data, hoping it will magically protect our society, is bad for security and bad for fundamental rights.” In practice, however, an interim solution for Member States has been to transfer data directly to the Canadian authorities despite the European Council calling it a legal vulnerability. It appears to be common practice for national law enforcement to go rogue ( and unsanctioned) on European standards concerning PNR.
The new Agreement:
The first version of the agreement in 2019 was not shared with the European Data Protection Board for an opinion and it does not look like the new version was shared either to consult on potential data protection vulnerability.
We publish the draft PNR agreement between the European Union and Canada here.
Because of the little amount of time given to Statewatch to comment after receiving the draft agreement only some arguments will be touched upon here. Although, on paper, it seems like the reasons for the refusal of the original agreement are addressed in the new version, there are several exceptions in case of emergency that could tumble the legal certainty and the overall safeguards offered to individuals, all the way to the availability of an effective remedy.
No clear definition of when an automated decision is taken:
The agreement acknowledged the opinion of the Court in 2017 and introduced a clause providing that: “any automated processing of PNR data is based on non‐discriminatory, specific and reliable pre‐established models and criteria”. Since then, the CJEU issued in 2022 a judgement on the EU PNR Directive in Ligue des Droits Humains that set up more precise standards regarding automated processing of data. It precluded the use of self-learning systems “capable of modifying without human intervention or review the assessment process and, in particular, the assessment criteria on which the result of the application of that process is based as well as the weighting of those criteria.” (194)
The proposed agreement with Canada simply lays out that: “3. Canada shall not take any decisions significantly adversely affecting a passenger solely on the basis of automated processing of PNR data.”. The lack of further definitions on when an automated decision will be taken and how it could be differentiated from human intervention during a legal review might, as noted by the advocate general in Ligue des Droits Humains case, render humans “redundant [in] the individual review of positive matches and monitoring of lawfulness.” (195)
Further discussion on automated decision-making in the context of PNR can be found here, here and here.
Wide exceptions to independent and judicial supervision:
One of the main controversies on the data exchange agreement has been the role of the court and of independent authorities in controlling the decision of anti-terrorism agencies in processing data. This agreement does not move away from the rule.
On conditions for the use of PNR data:
The agreement lays out as a basic rule that PNR data should only be retained for the purpose of investigating terrorism. On this question, the agreement lays out a clear rule that even formally excludes: “lawful or unlawful advocacy, protest, dissent or stoppage of work, such as a strike” that does not intend to cause a violent terrorist act as defined in Article 3. However, it lays out some exceptions in article 17: “where new circumstances based on objective grounds indicate that the PNR data of one or more passengers might make an effective contribution” to the commission of a terrorist act. This derogation is subject to prior review by a court or by an independent administrative body.
Article 17 continues by providing for two exceptions in case of “validly established urgency;”. No further information is given on the meaning of this expression or the authority involved. There are also no indications that an independent authority or judicial authority could contest the “validity” of the emergency or even be informed of it. In practice, this leaves a huge gap for Canadian authorities to derogate from the processing standards.
Another exception is for the purpose of “of verifying the reliability and currency of the pre‐established models and criteria on which the automated processing of PNR data is based, or of defining new models and criteria for such processing.”
Transfer to third countries:
The agreement states in Article 20 that European passenger data cannot be shared with a third country that did not previously strike an agreement on data protection with the European Union. However, it lays out a significant exception to the rule in case, when “the disclosure is necessary for the prevention or investigation of a serious and imminent threat to public security”. In addition, it adds that the country should: “provides a written assurance, pursuant to an arrangement, agreement or otherwise that the information will be protected in line with the protections set out in this Agreement.” As well, Canada should notify the authorities of the Member States to which a citizen’s personal data has been disclosed at the “earliest opportunity”.
In that context, control by an independent authority is nowhere to be seen and everything is left in the hands of high-ranking law enforcement officials. Also, the European Union is effectively circumvented and only the member state is notified about the derogation which has the potential to create an enforcement “à la carte” of data protection safeguards for transfers to third countries.
Conclusion:
These points are a “hot take” by Statewatch and they are not meant to provide a general overview of the potential legal problems of the agreement.
Our researcher Romain Lanneau commented that:
“The European Parliament might have grounds to refers the agreement again to the CJEU. In any case, MEPs should at the very least complain to the EU Ombudsman about the lack of transparency of the Commission which only shared the agreement on the last days of negotiation. Moreover, the Commission did not seek an opinion of the EDPD despite an evident risk of controversy.”
Further reading
In June this year the the Court of Justice ruled that the rules governing the EU’s system for travel surveillance and passenger profiling, set out in the Passenger Name Record (PNR) Directive, must be “interpreted restrictively” to conform with fundamental rights standards. The ruling requires substantial changes to member state practices – but the Council, in time-honoured fashion, is looking at how to circumvent it, and to ensure the greatest possible freedom of manouevre for law enforcement authorities.
Last June the EU’s Court of Justice massively restricted the scope of the Passenger Name Record (PNR) Directive, which allows the mass surveillance and profiling of air passengers. According to the ruling, member states should make substantial changes to their practices in order to uphold fundamental rights. Instead, they would like to find ways to maintain maximum data collection to continue the hunt for “persons of interest” – yet such practices are incompatible with the rule of law.
