Last week the European Commission unveiled its proposal for a Directive that allows for the interchange of Passenger Name Records (PNR) relating to all air travellers flying internationally within the European Union. Surprisingly, the drafting of the Directive reveals that it is disproportionate!
When you first look at the Directive, with its emphasis on the use of PNR records in relation to “terrorist offences” or “serious transnational crime”, the first response is: “that’s OK with me”. Even when there is a reference to “serious crime” you instinctively say – “well that use is still OK”.
Well this natural response assumes you have not read the definition of “serious crime” in Article 2(h). This defines “serious crime” to mean a crime that has to be punishable by a custodial sentence for a maximum period of at least three years.
The definition then provides an option so that “Member States may exclude those minor offences for which, taking into account their respective criminal justice system, the processing of PNR data pursuant to this directive would not be in line with the principle of proportionality” (my emphasis).
Now consider that “may exclude” and then think of the world famous recipe for my “Grandma’s Apple Pie” (patents pending). Suppose it advises chefs who possess the culinary skills to attempt this unique dish that they “may exclude the curry powder or the baked beans as ingredients”.
Now I am going to ask you a simple question: “can a chef’s “Grandma’s Apple Pie” contain curry powder or baked beans?”. The answer is, of course, that it can! The use of “may exclude” infers “include” (i.e. the opposite) and that is an object lesson as to why some lawyers are very well paid.
However suppose a Member State chooses not to exclude these “minor offences”. Then the second part of the definition kicks in. Such a Member State has not taken “into account their respective criminal justice system” which avoids that “processing of PNR data pursuant to this directive would not be in line with the principle of proportionality”.
Ergo the use of the word “may” in the definition suggests to Member States that their implementation of the Directive can breach Article 8. To correct this, that “may” has to be changed to a “must”.
A “must” read section rather than a “may read”
However, even with a “must” rather than a “may” some “serious crimes” are really very minor. In the UK, the Daily Mail has reported cases of European Arrest Warrants being issued (Warrants are issued using the same definition of “serious crime”), where the “serious crimes” subject to extradition proceedings include: a “man who shoplifted about 20 Milka bars”; a case of “a carpenter who fitted wardrobe doors and then removed them when the client refused to pay him”, and “a person suspected of “theft of a dessert”.
The Daily Telegraph reports that “Many (subject to a Warrant) are accused of trivial crimes overseas such as possessing cannabis or leaving petrol stations without paying. No evidence need be presented in British courts of the alleged offence and judges have few powers to resist the person’s extradition. Those affected can spend long periods in jail here and abroad for crimes which might not even be prosecuted in this country and they can also be seized for offences which are not even crimes in Britain” (see references).
Data sharing and “serious crime”
It is important to understand that “serious crime” should not be interpreted in the way the “man on the Clapham omnibus” would interpret these words and that any provision in the current Directive text that refers to “serious crime” is now seriously tainted.
For instance, Article 7, dealing with “Exchange of information between Member States”. In the context of “serious crime” this permits the authorities to “...compare PNR data against relevant databases, including international or national databases or national mirrors of Union databases, where they are established on the basis of Union law, on persons or objects sought or under alert...”.
Then there is Article 8, which deals with the transfer of PNR data or the results of the processing of PNR data to a third country law enforcement agency on a case-by-case basis in the context of “serious crime”. Additionally, these third countries can also transfer the data to another third country for “serious crime” purposes with the “express authorisation of the Member State”.
With all this data sharing going in the context of “serious crime”, the problems outlined above have the potential to be, how shall I put it, “very serious”.
What do the data protection authorities say?
The Preamble to the Directive provides details of the consultation process. This states that “The Article 29 Data Protection Working Party considered that the proposal was disproportionate and that it might violate the right to data protection”. The European Data Protection Supervisor (EDPS) “questioned whether the necessity and proportionality of the proposal had been demonstrated since the proposal concerns the collection of data of innocent persons”. The EDPS also “criticised the proposal as contributing towards a surveillance society”.
By contrast, the Directive now boasts that “its provisions are compatible with fundamental rights, and especially the right to protection of personal data enshrined in Article 8 of the Charter of Fundamental Rights of the EU”. And I suspect this sentence provides the reason why the “serious crime” definition includes the words “may exclude”.
I think it has been added for a simple reason: to allow the Eurocrats to deflect any criticism from the European Parliament.
I am not a clairvoyant, but I am pretty sure that the EDPS and Working Party do not think that the proportionality problem has been resolved. This is because their concerns about proportionality are different.
From their perspective, the Commission has failed to answer a simple question: why it wants to keep records for 5 years on the millions of Mr & Mrs Ordinary Citizens and their 2.4 children going to the Algarve for a two week holiday? Whereas a data protection analysis might produce a granulated retention criteria for PNR data, this Directive adopts the Henry Ford approach: “one retention period fits all” (and that is why it is likely to be disproportionate).
Note that if data protection authorities were explicitly empowered to assess legislation in the context of proportionality and Article 8, this would not be a problem (I keep banging on about this: see the section on lawful processing in my blog of 25/1/2011). Indeed, if the European Commission is so sure of its grounds in respect of Article 8 - as it says - then it has nothing to fear from legislating to provide data protection commissioners a power of this kind.
The fact that it hasn’t speaks volumes.
References
Examples of European Arrest Warrants: http://www.dailymail.co.uk/news/article-1352337/British-police-hit-20-times-number-EU-arrest-warrants-make.html#ixzz1DBvT4CAz; http://www.telegraph.co.uk/news/uknews/law-and-order/7969981/Britain-left-to-count-cost-of-European-Arrest-Warrant.html
The PNR Directive: from http://ec.europa.eu/home-affairs/news/intro/news_intro_en.htm#20110202
Adverts re Data Protection courses
Our Spring UPDATE session is on 11th April in London: follow the link for details of speakers and content on our web-site (at £195+VAT for the day it is a real double dip recession busting snip). We are also running a Privacy Impact Assessment Course, a RIPA course and a Data Protection Audit on consecutive dates (21st to 23rd March) in London.
We are starting a 5-day intensive data protection course in Edinburgh (beginning 24th February) and in Leeds (beginning 3rd March). These courses cover the DP ISEB syllabus and prepare delegates for the examination in April 2011, although you do not need to be seeking the qualification to attend.
Details from the Amberhawk website (www.amberhawk.com)
I have just realised that I made a mistake in the first sentence. Please remove the word "within" and replace it with "to". The PNR Directive text does not deal with internal flights.
The Article 8 argument is not affected by this change. Nor are the issues relating to minor crime.
However, the impact of this error has been reduced by the fact that the European Union are likely to extend the PNR agreement to flights within Europe (see blog of 7th April 2011 which updates this blog).
CP
Posted by: MD | 07/04/2011 at 10:25 AM