2.1 Dignity, Liberty and Other Misconceptions of Privacy

It has been argued in both sides of the Atlantic, that ‘the drama that played out between the United States and the European Union over PNR-data transfers is a prominent example of the clash between conflicting philosophies on privacy protection.’¹³ An American scholar criticised the ‘strict’ pro-privacy stance adopted by the EU in the PNR negotiations noting that ‘increased information sharing is the best way of preventing terrorism, but information sharing between the public and private sector may be difficult if Americans are focused on the dangers of state surveillance and Europeans are concerned about protecting the dignity of the consumer.’¹⁴

While such a contention would raise eyebrows in Europe, it reflects a perception that is far from rare in American literature. Legal historian James Whitman, argued in Yale Law Journal in 2003, that ‘American privacy law is a body caught in the gravitational orbit of liberty values, while European law is caught in the orbit of dignity.’¹⁵ According to Whitman, European privacy law, being based on personal dignity, focuses on the protection of rights such one’s image, name, reputation, and informational self-determination.¹⁶ Whitman, therefore, identified the media as the prime enemy of the right to privacy in the European continental conception.¹⁷ By contrast, America, according to the same author, ‘is much more oriented toward values of liberty, and especially liberty against the state.’¹⁸ In essence, at the conceptual core of the American right to privacy lies ‘the right to freedom from intrusions by the state, especially in one’s own home.’¹⁹

Whitman’s argument is based on the historical analysis of the evolution of the right to privacy in Germany and France and suffers from a number of fallacies. First, it fails to acknowledge that Europe or the EU is not only Germany and France. Second, European privacy and data protection law has vertical and horizontal application, in that it applies against the state (as a non-interference protective rule) and against other individuals. To argue, therefore, that Europeans are concerned about protecting ‘the dignity of the consumer’ is, at best, an inaccurate generalisation.²⁰ Setting aside such misconceptions, a closer examination of the EU and the US privacy regimes reveals that as far as standards of protection are concerned, these are in fact two different cultures of privacy.

2.2 The EU privacy regime

The right to privacy enshrined in Article 8 of the European Convention on Human Rights (ECHR) has been recognised as a general principle of EU law and is now entrenched as a fundamental right in Article 7 of the EU Charter of Fundamental Rights (EUCFR).²¹ Furthermore, the EU legal order recognises data protection as a fundamental right in Article 8 EUCFR.²² Data protection was born out of the concerns raised in different European countries in the 1970s about the establishment of huge data banks and the increasingly centralised processing of personal data.

The EU’s data protection legislation is considered the most ambitious, comprehensive and complex regime worldwide.²³ The first data protection legal instrument in the EU, the Data Protection Directive was adopted in 1995. Since then, further legislation was enacted for the protection of privacy in the electronic communications sector (the e-Privacy Directive),²⁴ the processing of personal data by the EU institutions (Regulation 45/2001/EC),²⁵ and the retention of telecommunications metadata (the Data Retention Directive), which was (rather surprisingly) presented as a modification of EU data protection legislation.

The Data Protection Directive (Directive 95/46/EC) (the Directive) constitutes the central legislative measure of the EU data protection regime. Its aim is twofold: on the one hand, to protect privacy with respect to the processing of personal data; on the other hand, to ensure the free movement of personal data in the EU. The Directive sets out a number of principles concerning the legitimate processing of personal data, normally referred to as ‘data protection’ or ‘fair information principles’. It is the obligation of the so-called ‘controller’ to comply with these principles. The Directive provides for increased protection for ‘sensitive data’ that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and data concerning sex or health life.²⁶ Furthermore, the Data Protection Directive lays down a number of rights of the data subject, which are primarily procedural, such as the right to information,²⁷ right of access,²⁸ and right to object to the processing of their data.²⁹ Compliance of the controllers with the Directive is ensured by independent authorities in the territory of each Member State (the National Data Protection Authorities (NDPAs)). The National Data Protection Authorities are endowed with investigative powers, powers of intervention, and the power to engage in legal proceedings where the national data protection law implementing the Directive has been violated. The Directive also establishes an independent EU Advisory Body on the protection of individuals with regard to the processing of personal data, normally referred to as the ‘Article 29 Working Party’,³⁰ which is composed of representatives of NDPAs, the European Data Protection Supervisor, and the Commission. Its main task is providing expert opinions to the Commission on various data protection questions. Even though the Article 29 Working Party has only advisory competences, it has played an important role in promoting data protection issues within the EU, and has produced a significant number of reports, recommendations and opinions on ­privacy matters.

Since the adoption of the Data Protection Directive, the Court of Justice of the EU (CJEU) has been called upon several times to rule on questions of interpretation and application of this instrument. If we attempt a general comment on the Court’s reading of the Data Protection Directive, this would be that the CJEU, in essence, has interpreted an internal market harmonisation instrument (the Directive) in a manner that fosters the protection of the fundamental rights to privacy and data protection within the Community.³¹ This case-law of the Court culminated with its seminal decision in the joined cases, Digital Rights Ireland and Seitlinger and others, which invalidated the Data Retention Directive on the basis that the retention of electronic communications metadata violates the rights to privacy and data protection in the EU.³²

The Data Protection Directive specifically stipulates that it does not apply to processing operations concerning public security, defence, State security, and the activities of the State in areas of criminal law (Article 3(2)). The processing of data in the area of police and judicial cooperation for the purpose of the prevention, investigation, detection or prosecution of criminal offences is currently governed by Framework Decision 2008/977/JHA. Most of the substantive provisions of the Framework Decision seek to mirror the data protection safeguards stipulated in the Data Protection Directive, but they are either fraught with exceptions or their content is significantly watered down in comparison to these of the Data Protection Directive.³³ Moreover, the scope of application of the Framework Decision is substantially limited. First, it applies only to transborder flows of data between the law enforcement authorities of the Member States, and does not cover the collection and processing of personal data at the national level. Second, it does not affect the relevant set of sector-specific data protection regimes found in the acts governing the functioning of Europol, Eurojust, the Schengen Information System (SIS) and the Customs Information System (CIS). Third, the Framework Decision applies “without prejudice to essential national security interests and specific intelligence activities in the field of national security”.³⁴ Fourth, it is also “without prejudice to any obligations and commitments incumbent upon Member States or upon the Union by virtue of bilateral and/or multilateral agreements with third States” existing at the time of its adoption.³⁵

The EU’s data protection legislation is currently under revision. This is because the current legal framework is dated and fragmented with different legal instruments applying to different pillars (the Data Protection Directive in the former first pillar and the Framework Decision in the third pillar). Despite the expectations for a new consolidated data protection framework, the Commission put forward, on 25 January 2012, a proposal package including two separate instruments: A Regulation (aimed to replace the Data Protection Directive), and a Directive (aimed to replace the Data Protection Framework Decision). This proposal package lays down rules on the protection of personal data processed for the purposes of prevention, detection, investigation or prosecution of criminal offences and related judicial activities. The proposals, which are currently been negotiated by the EU institutions, contain many innovative provisions (such as a right to be forgotten in the digital environment and a right to data portability) and will even further strengthen the EU’s privacy framework.

2.3 The US privacy regime

Describing the US privacy regime, legal scholar Gregory Shaffer noted: ‘data privacy regulation in the United States is fragmented, ad hoc, and narrowly targeted to cover specific sectors and concerns.’³⁶ US privacy law can be found in a number of different sources: the US Constitution, the Supreme Court case law, federal legislation, state legislation and the theory of torts.³⁷ The Constitutional protection of privacy is mainly based on the First Amendment (protection of free speech and freedom of assembly), the Fourth Amendment (protection from unreasonable searches and seizures), and the Fifth Amendment (privilege against self-incrimination).³⁸ The Fourth Amendment, in particular, aims in the words of the US Supreme Court, ‘to protect personal privacy and dignity against unwarranted intrusion by the State.’³⁹

The Fourth Amendment contains two clauses: the first, the substantive clause, protects against certain government activities; the second, the procedural clause, regulates government power through the process of obtaining a warrant.⁴⁰ A warrant can be obtained when there is a ‘probable cause’ for conducting a search or seizure.⁴¹ In Katz v. United States,⁴² the Supreme Court established that the protection of the Fourth Amendment against government intrusion applies when an individual has a ‘reasonable expectation of privacy.’⁴³ Justice Harlan, in his concurring opinion in Katz, articulated the twofold requirement, known as the ‘reasonable expectation privacy test’,⁴⁴ that triggers the application of the Fourth Amendment: ‘first, that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognise as “reasonable.”’⁴⁵ This means, according to Justice Harlan, that ‘conversations in the open would not be protected against being overheard, for the expectation of privacy under the circumstances would be unreasonable.’⁴⁶ A similar statement was made by the majority opinion, which held that ‘what a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection.’⁴⁷ On this basis, the Court has found that US citizens lack a reasonable expectation in anything they say to a friend,⁴⁸ their bank records,⁴⁹ and their garbage.⁵⁰

In Smith v. Maryland,⁵¹ the Court applied this reasoning on phone records. The police, without a warrant, asked the telephone company to install a pen register⁵² to record the numbers dialled from the defendant’s home.⁵³ The Court agreed that there was no reasonable expectation of privacy regarding the numbers someone dials on her phone, because ‘[t]elephone users... typically know that they must convey numerical information to the phone company; that the company has facilities for recording this information; and that the phone company does in fact record this information for a variety of legitimate business purposes. Although subjective expectations cannot be scientifically gauged, it is too much to believe that telephone subscribers, under these circumstances, harbour any general expectation that the numbers they dial will remain secret.’⁵⁴

Smith v. Maryland established, therefore, a general rule, according to which, ‘if information is in the hands of third parties, then an individual can have no reasonable expectation of privacy in that information, which means that the Fourth Amendment does not apply.’⁵⁵ In the context of the present discussion, the decision is illuminating for the PNR case. Applying the Smith v. Maryland reasoning, PNR data cannot be covered by the Fourth Amendment protection since travellers cannot enjoy any reasonable expectation of privacy of data they, themselves, gave to the airline companies in order to effectuate the ticket reservation.

At the federal level, statutes are ‘narrowly tailored to specific privacy problems’.⁵⁶ The most significant and the only federal omnibus piece of privacy legislation is the Privacy Act of 1974.⁵⁷ The Privacy Act embodies fair information principles in a statutory framework governing the means by which federal agencies collect, maintain, use, and disseminate personally identifiable information. The Privacy Act applies to information that is maintained in a ‘system of records.’ A system of records is a group of any records under the control of an agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. While the Privacy Act applies to government records it is ambiguous as to whether it applies to ‘commercial data brokers who supply information to the government’.⁵⁸ Furthermore, the Privacy Act applies to US citizens and lawful permanent residents. The Privacy PNR Act safeguards were extended administratively by the EU-US PNR agreements to EU citizens concerning their PNR data. However, the Privacy Act is significantly limited by the so-called ‘routine use’ exception, according to which information may be disclosed for any ‘routine use’ if disclosure is ‘compatible’ with the purpose for which the agency collected the information.⁵⁹ PNR data is disclosed by the DHS for ‘routine use’.

Finally, another important piece of federal legislation is the Freedom of Information Act (FOIA) adopted in 1966.⁶⁰ FOIA permits any person (regardless of nationality or country of residence) access to a US federal agency’s records, except to the extent such records (or a portion thereof) are protected from disclosure by an applicable exemption under the FOIA. In the 2007 PNR Agreement, FOIA was also extended to apply to individuals travelling with European airlines. According to DHS, PNR data is not disclosed to the public, but to the data subjects or their agents in accordance with US law.

2.4 The need for a comprehensive framework?

The seriously limited US privacy regime discussed above, creates problems to unimpeded transatlantic data flows. As the PNR experience proved, negotiations were difficult, with data protection differences being at the heart of the conflict.⁶¹ A solution would, therefore, be an international agreement setting down certain data protection guarantees that would govern data exchanges between the two parties in order to raise restrictions on data flows.

On 6 November 2006, the EU-US Justice and Home Affairs Ministerial Troika decided to establish an informal high level advisory group⁶² to start discussions on privacy and personal data protection in the context of the exchange of information for law enforcement purposes. On 28 May 2008, the Presidency of the Council of the European Union announced to the Permanent Representatives Committee (COREPER), that the EU-US High Level Contact Group (hereafter HLCG) on information sharing and privacy and personal data protection had finalised its report.

The report, which was made public on 26 June 2008,⁶³ aimed to identify a set of core principles on privacy and personal data protection, acceptable as ‘minimum standards’ when processing personal data for law enforcement purposes.⁶⁴ These should be included preferably in an international agreement binding both the EU and the US,⁶⁵ instead of non-binding instruments or political declarations.⁶⁶ Both sides recognised that a binding instrument would provide the greatest level of legal security and certainty, and ‘the advantage of establishing the fundamentals of effective privacy and personal data protection for use in any future agreements relating to the exchange of specific law enforcement information that might arise between the EU and the US.’⁶⁷

The HLCG, indeed, agreed on a number of principles. These are: 1) purpose specification and purpose limitation; 2) integrity/data quality; 3) necessity and proportionality; 4) information security; 5) sensitive data; 6) accountability; 7) independent and effective oversight; 8) individual access and rectification; 9) transparency and notice; 10) redress; 11) automated individual decisions; and 12) restrictions on onward transfers to third countries.⁶⁸

The main problem was that the two sides seemed to understand differently ‘law enforcement purposes’,⁶⁹ which is central for the agreement. For the EU ‘law enforcement purposes’ meant use of the personal data ‘for the prevention, detection, investigation or prosecution of any criminal offense’. For the US, ‘law enforcement purposes’ was a somewhat broader notion that comprised ‘the prevention, detection, suppression, investigation, or prosecution of any criminal offense or violation of law related to border enforcement, public security, and national security, as well as for non-criminal judicial or administrative proceedings related directly to such offences or violations.’⁷⁰ Nevertheless, the HLCG did not seem to find these differences important. For the HLCG, these two different ways of describing ‘law enforcement purposes’ ‘reflect respective domestic legislation and history but may in practice coincide to a large extent.’⁷¹

In May 2010, the European Commission, taking up the work done by the HLCG, asked the Council to authorise the opening of negotiations with the United States for an agreement, based on Article 16 TFEU, when personal data is transferred and processed for the purpose of preventing, investigating, detecting or prosecuting criminal offences, including terrorism, in the framework of police cooperation and judicial cooperation in criminal matters.⁷² The Commission noted that the aims of the future EU-US agreement should be fourfold. First, the agreement should ensure a high level of protection of the fundamental rights and freedoms of individuals, in particular, the right to protection of personal data, in line with the requirements of the EUCFR.⁷³ Second, it should provide a clear and coherent legally binding framework of personal data protection standards. Such a framework should remove the uncertainties and bridge the gaps in protection created in the past because of significant differences between EU and US data protection laws and practices. The agreement itself should therefore, according to the Commission, provide enforceable data protection standards and establish mechanisms for implementing them effectively.⁷⁴ Third, the agreement should provide a high level of protection for personal data transferred to and subsequently processed in the US for law enforcement purposes.⁷⁵ Finally, the agreement would not do away with the requirement for a specific legal basis for transfers of personal data between the EU and the US, with specific data protection provisions tailored to the particular category of personal data in question.⁷⁶ On 29 March 2011, it was announced that the EU and the US opened negotiations on an agreement to protect personal information exchanged in the context of fighting crime and terrorism.⁷⁷

2.5 ‘Spillovers of privacy’ or ‘spillovers of security’?

The European privacy model has influenced privacy regulations worldwide.⁷⁸ As Professor Graham Greenleaf has aptly noted, ‘something reasonably described as “European standard” data privacy laws are becoming the norm in most parts of the world.’⁷⁹ In an article in 2000, legal scholar Gregory Shaffer argued that US privacy standards were ‘ratcheting up to the level of European data protection standards’.⁸⁰ Shaffer explained that this was due to cross-border economic exchange that can help ‘leverage standards upward, even in a powerful state such as the United States.’⁸¹ In fact, Shaffer was referring to the US-EU Safe Harbour programme, under which US-based companies may avoid EU data protection restrictions on data transfers if they self-certify that they abide with certain data protection principles.⁸² Shaffer contended that in this way, Europe’s regulatory approach may have ‘spillover effects within the United States, leading to some convergence in data privacy practices, despite differing US and EC regulatory systems.’⁸³

It seems, however, that the privacy regulatory convergence suggested by Shaffer finds its limits when interests such as policing and national defence come into play.⁸⁴ A close look to the on-going negotiations between the EU and the US on the conclusion of a binding international agreement on data protection principles in the field of law enforcement shows that even if such an agreement is concluded sometime in the future it is highly unlikely that it will have spillovers in the US privacy regime and result in a levelling up of its privacy standards in the area. There are several points that support this. In its report on the negotiations with the US in 2011, the Commission noted, first, that regarding the purpose of the agreement the US has a mandate for no more than an ‘Executive agreement’ that does not change existing US law, nor create any new rights.⁸⁵ On the material scope of the agreement, the US has rejected the idea to also apply the agreement to data transferred from private parties in the EU to private parties in the US and subsequently processed for law enforcement purposes by US competent authorities. The fear of potential European privacy spillovers in the other side of the Atlantic is also evident when it comes to the data subjects’ rights in the negotiated agreement. Their content is clearly watered down in comparison to EU standards. Regarding the right to information and the right to access of the data subjects, the US side has defended its existing system and opposed the idea of changing its legislation in order to provide for such rights in the law enforcement context. The same goes regarding the right to redress, for which the US has argued that it is adequately safeguarded in its current legislation and in any case the creation of any individual rights will not be accepted.⁸⁶

While any spillovers of privacy seem very unlikely even if the agreement is concluded in the future, the other side of the coin is that in its counter-terrorism fight the EU is looking more towards the US than the other way round. As an American author predicted already in 2002 ‘since EU and US political interests are largely aligned […] against terrorism, it is possible that the European Union will move closer to the United States as a result of the [September 11] attacks, rather than the United States moving away from the European Union. To the extent that Europeans feel vulnerable as a result of terrorism, they may shift their emphasis away from data privacy and toward protective anti-terrorist surveillance programmes.’⁸⁷

PNR is a prominent example of this. Despite the apparent clash, the EU is already moving towards the establishment of its own PNR system. While potential ‘spillovers of privacy’ are not visible yet, ‘spillovers of security,’ looking in the opposite direction, are certainly here.

3.1 The Proposal for an EU PNR Framework Decision

The European Council in the Stockholm Programme invited the Commission to present a proposal on the establishment of an EU PNR system.⁸⁸ Following this, on 6 November 2007, the Commission introduced its proposal for a Council Framework decision on the use of PNR for law enforcement purposes under the then third pillar.⁸⁹ The draft Framework decision had as its purpose ‘the making available by air carriers of PNR data of passengers of international flights to the competent authorities of the Member States, for the purpose of preventing and combating terrorist offences and organised crime.’⁹⁰ For this reason, the Framework decision required each Member State to designate a competent authority (‘Passenger Information Unit’ (‘PIU’)), which would be responsible for collecting the PNR data of international flights arriving or departing from its territory.⁹¹ The PIU would further be responsible for analysing the PNR data and for carrying out a risk assessment of the passengers, in order to: identify persons, and their associates, who are or may be involved in a terrorist or organised crime offence; create and update risk indicators for the assessment of such persons; provide intelligence on travel patterns and other trends relating to terrorist offences and organised crime; use the risk assessment in criminal investigations and prosecutions of terrorist offences and organised crime.⁹²

The PNR data to be transmitted according to the draft Framework decision were almost identical to the categories listed in the then EU-US PNR Agreement.⁹³ The draft Framework decision required nineteen data fields exactly as the 2007 PNR Agreement, which appeared to be its model legislation. Air carriers would be required to make available the data to the relevant PIU twice—24 hours before the scheduled flight departure, and immediately after flight closure.⁹⁴ The PNR data would be retained for a period of thirteen years in total: for five years in a PIU database and subsequently for another eight years, during which access would be limited to exceptional circumstances.⁹⁵ Concerning the data protection principles applicable to the EU PNR system, the draft Framework decision could not be briefer. Two articles referred to data protection, one of which one was dedicated to data security.⁹⁶ The other prohibited any enforcement action to be taken by the PIUs or the Member States based only on the the automated processing of PNR data or by reason of a person’s race or ethnic origin, religious or philosophical belief, political opinion or sexual orientation.⁹⁷

3.2 Behind the proposal: Why an EU PNR system?

It is, at the very least, puzzling that the EU is envisaging establishing its own PNR scheme.⁹⁸ This is all the more if one recalls the EU objections to the relevant US initiatives and the controversies that surrounded the EU-US PNR negotiations. Furthermore, when the proposal for an EU PNR was tabled, the EU already had a system in place for collecting the so-called API data.⁹⁹ In particular, Directive 2004/82/EC requires air carriers to transmit the information included in the machine-readable part of a passport (API data), in order to combat illegal immigration and improve border control.¹⁰⁰ The use of API data for law enforcement purposes is also permitted by the Directive under certain conditions.¹⁰¹ Personal data, therefore, such as name, gender, data of birth, nationality, type of travel document, departure and arrival time of transportation, the border crossing point of entry into the territory of the EU Member States, and the initial point of embarkation of passengers entering the EU were already available through the API system.

It is not only the EU PNR system proposal that surprises; it is also that this is in many areas almost ‘the exact mirror of the transatlantic PNR system.’¹⁰² The data categories to be retained, the retention arrangements that recall the US ‘active’ and ‘dormant’ database distinction, the periods of the retention,¹⁰³ and the purposes of the PNR collection uncannily remind one of the EU-US PNR Agreement.¹⁰⁴ The question is therefore: why is an EU PNR system which all the more looks like a replica of the US Agreement so vigorously opposed?

The reasons that the Commission gave in its Explanatory Memorandum seem ‘a little ambiguous’.¹⁰⁵ It started by explaining that only a limited number of Member States had adopted a PNR system, and thus ‘the potential benefits of an EU wide scheme in preventing terrorism and organised crime [were] not fully realised.’¹⁰⁶ At the time of the proposal, the UK was the only country in the EU collecting PNR data.¹⁰⁷ According to the Commission’s Explanatory Memorandum, ‘the UK was able to report numerous arrests, identification of human trafficking networks and gaining of valuable intelligence in relation to terrorism in the two years of the operation of its pilot [PNR] project.’¹⁰⁸ A more specific account of these alleged successes of PNR in the UK was, however, missing in the Explanatory Memorandum. Denmark and France had also laid down relevant legislation, but they were not collecting any data yet. Surprisingly enough, the Commission spoke then of the need for a harmonised approach concerning PNR: ‘Action by the EU will better achieve the objectives of the proposal because a harmonised approach makes it possible to ensure EU wide exchange of the relevant information.’¹⁰⁹

Furthermore, the Commission appeared convinced of the necessity of a PNR system as a counter-terrorism tool because of its ‘worldwide acceptance’: the use of PNR data is ‘increasingly seen as a mainstream and necessary aspect of law enforcement work.’¹¹⁰ This trend is, according to the Commission, the result of three parameters. First, international terrorism and crime are serious threats to society that should be dealt with. Second, recent technological developments have rendered access and analysis of travel data possible, and lastly, with the rapid increase of international travel and the volume of passengers, electronic data processing in advance of passengers’ arrivals ‘largely facilitates and expedites security and border control checks since the risk assessment process is done before arrival’. According to the Commission, the analysis of PNR data provides the opportunity to law enforcement to focus only ‘on those passengers for whom they have a fact-based reason to believe that they might pose an actual risk to security, rather than making assessments based on instinct, pre-conceived stereotypes or profiles.’¹¹¹

These justifications are not very convincing as empirical evidence on PNR system effectiveness is lacking and, in any case, the need for a harmonised approach regarding the collection of PNR data in the EU is far from proven. So, what are the true reasons behind the development of an EU PNR system?

First of all, one should not underestimate the EU’s quest for reciprocity. All the three EU-US PNR Agreements concluded by the time of the Commission’s PNR proposals contained a reciprocity clause, according to which the EU might develop its own PNR system in the future.¹¹² The wording was almost identical: ‘In the event that a PNR system is implemented in the European Union … [the] DHS shall, strictly on the basis of reciprocity, actively promote the cooperation of the airlines within its jurisdiction.’¹¹³

Since 2003, the Commission aspired to develop an EU PNR scheme.¹¹⁴ The rationale was that such a system would form the basis for the establishment of an information policy for law enforcement authorities, which would become the backbone for a prevention policy in the field of organised crime and terrorism.¹¹⁵

Moreover, one cannot disregard the fact that all the EU-US PNR Agreements display an asymmetry of power¹¹⁶ or some form of ‘unilateralism’. In practice, the agreements are not about the exchange of PNR data, but only the ‘one-way access of US government agencies to European data.’¹¹⁷ The quest for reciprocity seems, therefore, justifiable for the EU. As eloquently put by one Commission official ‘it would have been difficult to explain to European passengers that US authorities would receive more information than their own national services.’¹¹⁸ In his Oral Evidence to the House of Lords Jonathan Faull, the then Director-General for Justice, Freedom and Security, stated: ‘The Commission›s view is that it would make sense to have a PNR system for ourselves in the European Union on the basis of which we would then have very good grounds for saying to our American partners, “This must be completely reciprocal. We have our PNR system, you have yours”.’¹¹⁹

Some political scientists¹²⁰ have argued that the negotiation processes with the US authorities had an impact on the EU institutions, such as the Commission, taking part in them. This might also be the case. As the Commission admitted in the Explanatory Memorandum, on the basis of an exchange of information with the US, ‘the EU has been able to assess the value of PNR data and to realise its potential for law enforcement purposes.’¹²¹ This could be further illustrated by the fact that an EU PNR system was supported by the EU negotiating agents (i.e. the Commission and the Presidency), but not by other EU actors, such as the EP or the Article 29 Working Party and the European Data Protection Supervisor (EDPS), who had been kept almost excluded from the negotiations with the US.¹²²

3.3 The reaction of the outsiders

The proposal of a Framework decision establishing an EU PNR regime was received with fierce criticisms by the Article 29 Working Party, the EDPS, the Fundamental Rights Agency (FRA), and the European Parliament. In particular, the Article 29 Working Party in its joint opinion with the Working Party on Police and Justice characterised the proposal as ‘a further milestone towards a European surveillance society in the name of fighting terrorism and organised crime.’¹²³

In fact, the reaction of the above institutions and bodies was even more severe than the criticisms they voiced for the EU-US PNR Agreements. Both the Working Party and the EDPS demanded that an EU PNR system must be ‘demonstrably necessary.’¹²⁴ The necessity of the EU-US PNR Agreements was also questioned, but given the position of the European airlines and the pressure exercised by the US authorities for the prompt conclusion of an agreement, the Working Party, the EDPS, and the Parliament were focusing more on the substantial assessment of the relevant provisions interfering with the right to data protection. Having to deal with an EU measure this time, their position became clearly stricter: the Commission had to prove beyond doubt the added value of an EU PNR system.¹²⁵

Another criticism raised against the proposal by all four institutions concerned the profiling aspirations of the EU PNR regime. As the EDPS noted eloquently, contrary to the API data that are supposed to help identify individuals, PNR data ‘would contribute to carrying out risk assessments of persons, obtaining intelligence and making associations between known and unknown people.’¹²⁶ The purpose of a PNR system does not only cover the catching of known persons but also the locating of persons that may be of interest for law enforcement reasons.¹²⁷ A substantial part of FRA’s Opinion concerning the draft PNR Framework decision is dedicated to a human rights assessment of the ‘profiling purposes’ of the proposal, mainly on the basis of the prohibition of discrimination found in Article 21 EUCFR.¹²⁸ The European Parliament also raised similar concerns in its Resolution.¹²⁹

Finally, there were numerous problems identified in the proposal: the excessive categories of data to be retained,¹³⁰ the disproportionate retention periods,¹³¹ the uncertainty on the individuals’ rights,¹³² the questions on the applicable legal framework,¹³³ and the role of PIUs and intermediaries.¹³⁴

3.4 The proposal for an EU PNR Directive: A step forward?

Upon the Lisbon Treaty’s entry into force on 1 December 2009, the Commission’s proposal of 6 November 2007 for a Framework decision on PNR, which had not been adopted by the Council by that date, became obsolete. On 2 February 2011, the Commission introduced a new proposal on the establishment of an EU PNR system – this time for a Directive.¹³⁵ The proposal was based once again on the need for harmonisation of the Member States relevant provisions. This time, however, the Commission seemed slightly more convincing. According to the Explanatory Memorandum, the UK already had its PNR system, while France, Denmark, Belgium, Sweden and the Netherlands had either enacted relevant legislation or were testing using PNR data. The Commission explained that it carried out an impact assessment for the development of an EU PNR system which concluded that a legislative proposal with decentralised PNR data collection for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and other serious crime was the best policy option.¹³⁶

Under the proposed Directive, Member States are, once again, required to establish a single designated unit (PIU) responsible for handling and protecting the data.¹³⁷ The categories of PNR data to be transmitted are the same 19 elements found in the draft Framework decision. Air carriers are obliged to transmit the PNR data 24 to 48 hours before the scheduled time for flight departure, and immediately after flight closure.¹³⁸ The data is to be retained for a period of five years: initially for 30 days after their transfer to the relevant PIU, and subsequently, after being masked out and made anonymous they will be held for another five years.¹³⁹ The draft Directive prohibits the collection and use of sensitive data, such as data revealing racial or ethnic origin, political and religious beliefs, health and sexual life.¹⁴⁰ It obliges carriers to transmit PNR data exclusively by the “push” method, meaning that the Member States will not have direct access to the carriers’ IT systems.¹⁴¹ The result of the processing of PNR data by a PIU should be exchanged, where necessary, with the PIUs of other Member States.¹⁴² The national data protection authorities will be responsible for advising and monitoring how PNR data is processed.¹⁴³

Concerning the data protection safeguards, the draft Directive is even more economical than the draft Framework decision: it merely states that every passenger would have the same right to access, rectification, erasure and blocking, compensation and judicial redress as those adopted under national law in implementation of Articles 17, 18, 19 and 20 of the Framework Decision on the Protection of Personal Data Processed in the Framework of Police and Judicial Co-operation in Criminal Matters.¹⁴⁴ Member States are further required to ensure that passengers are clearly and precisely informed about the collection of PNR data and their rights.¹⁴⁵ Finally, the draft Directive prohibits the transfer of PNR data by PIUs and competent authorities to private parties in Member States or in third countries.¹⁴⁶ It must be acknowledged that the Commission has been very careful concerning the drafting of the Directive on PNR in an attempt to address the severe criticisms raised against the draft Framework decision. In this respect, it has taken great pains to prove that a PNR system at the EU level has indeed an added value. However, its analysis on the necessity of an EU PNR system, despite being clearly more elaborate than the one provided in the draft Framework decision, fails, once again, to convince.¹⁴⁷

Regarding the substance, despite some visible improvements compared to the draft Framework decision, such as, for instance, the reduced retention period, the implementation of a ‘push’ system, and the exclusion of any collection and processing of sensitive data, the draft Directive does not add much. In particular, it is lamentable that the data protection legal framework applicable to the PNR Directive is the Framework Decision on the Protection of Personal Data Processed in the Framework of Police and Judicial Cooperation in Criminal Matters, even in the post-Lisbon context.

The proposal is currently being debated by the Council and the EP. The Council has introduced two further restrictive amendments. First, the collection of PNR data should not be limited to flights from and to third countries, but should also cover flights operating within the EU. Such possibility should be given to the Member States that would require these data as well. Second, the Council considers that an initial retention period of 30 days, as provided in the Commission’s proposal, is ‘too short from an operational point of view’ and this should be prolonged to two years.

The debate of the draft Directive on an EU PNR system has not been concluded in the Parliament yet, but the LIBE Committee voted on 29 April 2013 against the proposal and called the European Parliament to reject it and the Commission to withdraw it. In particular, the LIBE Committee voiced its concerns regarding the compatibility of an EU PNR scheme with the fundamental right to data protection enshrined in Article 8 EUCFR and the principle of proportionality. Also, the Committee was not convinced of the effectiveness of the PNR data in order to fight terrorism.¹⁴⁸ The EP has not voted on the proposed PNR Directive yet and it seems that the issue has stalled at least temporarily.

However, it seems that the political institutions of the EU have not forgotten it. In its Special Meeting of 30 August 2014, the European Council called the Council and the EP to finalise work on the EU PNR proposal before the end of 2014.¹⁴⁹ The European Council deemed that this was necessary in the context of the action that needs to be taken in order to detect and disrupt suspicious travel and investigate and prosecute foreign fighters.

3.5 The paradox of the EU’s approach to fighting terrorism

The EU’s proposals to create a Passenger Name Record system shows a fundamental paradox emerging in the EU’s fight against terrorism. The EU itself maintains that it is an entity based on the rule of law that respects human rights.¹⁵⁰ As some commentators have observed, the EU has successfully constructed the image of itself as a ‘moral leader of good’¹⁵¹ in the fight against terrorism due to its alleged higher respect to human rights standards compared to the US. Taking this into account as well as the severe criticisms that have been raised against the EU-US PNR system, one would expect increased constitutional and human rights safeguards to be adopted by the EU as a response to the US’ struggle against terrorism in order to counteract the constitutional challenges posed by the international counterterrorism pressures. Instead, it seems that the contrary is taking place, in that external security measures are followed by proposals for the internalisation of the same or similar internal security measures that erode further the EU’s constitutional framework. Moreover, the PNR proposal does not contain strict human rights mechanisms but rather appears to be a poor copy of the much-criticised international agreement. This paradox illuminates the new dynamics that arise in the EU’s fight against terrorism. Privacy and data protection as well as human rights in general are now taking a back seat to the new security initiatives that normally go hand in hand with security spillovers. In this respect, the EU seems to be following ‘an eye for an eye’ approach in its fight against terrorism. If European PNR data is transferred to the US or other countries, the EU should request the same data from these countries as well. A race to the bottom concerning the right to privacy appears, therefore, to be taking place in the name of the fight against terrorism, with the US leading and the EU following suit.