A new European commission counter-terror plan will require the blanket collection and storage for up to five years of personal data records of all passengers flying in and out of Europe, the Guardian can reveal.
Civil liberty campaigners say the revised European passenger name record plan – in the aftermath of the Paris attacks – breaches a recent European court of justice ruling that blanket collection of personal data without detailed safeguards is a severe incursion on personal privacy.
The European commission plan to be published on Wednesday would require 42 separate pieces of information on every passenger flying in and out of Europe, including their bank card details, home address and meal preferences such as halal, to be stored on a central database for up to five years for access by the police and security services.
The proposal, seen by the Guardian, describes itself as a “workable compromise” between European interior ministers, who want to see its swift adoption for all flights within Europe as well as flights in and out of Europe, and the European parliament’s civil liberties committee, which blocked the plan nearly two years ago.
European interior ministers, including the home secretary, Theresa May, who has been pushing the issue most strongly, agreed in Paris on the day of the “Je Suis Charlie” unity march that their main counter-terrorism priority in tracking foreign fighters was to overturn the European parliament’s opposition to the plan.
They issued a joint statement saying there was a “crucial and urgent need to move toward an European passenger name record system” and immediate progress will be on the agenda when EU interior ministers meet in Riga on Thursday.
The revised plan includes stronger data protection rules and safeguards, but civil liberty campaigners say that its blanket approach to the retention and storage of the personal details of millions of passengers is still unacceptable.
Jan Philipp Albrecht, vice-chairman of the European parliament’s civil liberties committee, said: “The commission plans are an affront to the critics of the European parliament and the European court of justice who have said that data retention without any link to a certain risk or suspicion isn’t proportionate.
“It is an open breach of fundamental rights to blanketly retain all passenger data,” he added.
“Instead of a full take of PNR [passenger name record] data, we need a focus on suspects and risk flights. The Paris attacks have shown that mass retention was not effective in fighting jihadis.
“The proposed surveillance of all travellers is a symbolic measure on the cost of EU citizens’ civil liberties and effective security.”
The EU has already concluded agreements with the US, Canada and Australia for passenger name record data to be handed over in advance for flights from the EU to and from those countries so that no-fly lists can be enforced, but there is no such agreement covering the rest of the world, including Asia, Turkey and Pakistan, and Africa.
So far, 14 out of the 28 EU member states are in the process of setting up their own national passenger name record system covering flights in and out of their own country, but an EU directive would mean the creation of a super-database of air passenger movements across the entire external EU border.
The EU commission’s plan includes several key revisions since it was last put forward in 2011. It includes:
• Reducing the retention period of the full PNR data to seven days instead of 30 days in the 2011 plan before it is “depersonalised”. It would then be retained for five years and would be accessible for four years for criminal cases and five years for cases linked to terrorism. Depersonalisation means that the identity of the passenger is masked, but not removed on the database and can be revealed on application.
• Narrowing the purpose to include terrorism and “serious transnational crime” rather the previous definition of “terrorism and serious crime” so that it can only be used for a shorter list of offences relevant to international travel.
• Stricter conditions for access to the passenger records, including the appointment of data protection officers to oversee the use of the personal data and its possible international transfer to third countries. In some member states this may be a role for a judge.
• Spelling out the rights of passengers to access their data and request modifications or erasure.
In points for discussion, a note says legal questions and the strong opposition of the European parliament to the collection of passenger data on all flights within the EU as well means it “could be optional, not mandatory”.
So it leaves open the possibility of each member state introducing the system on all flights in and out of their countries but it adds that the possibility of a Europe-wide agreement on tracking internal flights can be reviewed within two years.
Albrecht said the proposed changes were just window dressing on the blanket collection of everyone’s flight data: “It is a joke. They are not safeguards. Depersonalisation does not make the data anonymous. All they have to do is ask a senior officer for the identity to be revealed.
“What is needed is a targeted approach based on a proper risk assessment of flights to and from different regions and different groups of people,” he said.
But Timothy Kirkhope, a Conservative member of the European parliament’s civil liberties committee, said a majority could be found for a revised proposal.
“I want an agreement that safeguards lives and liberties by offering stronger data protection rules whilst also making it much harder for a radicalised fighter to slip back into Europe undetected,” he said earlier this month.
“EU heads of government and home affairs ministers would not ask for this agreement unless there were a clear and present need for it.”
Data targets
The House of Lords has said the 42 pieces of passenger data that airlines need to hand over to the police and security services enable aspects of a passenger’s history, conduct and behaviour to be deduced
The 42 categories are:
• passport number
• country which issued passport
• passport expiry date
• given names
• last name
• gender
• date of birth
• nationality
• passenger name record locator code
• date of reservation
• date(s) of intended travel
• name
• other names on passenger name record (PNR)
• address
• all forms of payment information
• billing address
• contact telephone numbers
• all travel itinerary for specific PNR
• frequent flyer information
• travel agency
• travel agent
• code share PNR information
• travel status of passenger
• split/divided PNR information
• email address
• ticketing field information
• general remarks
• ticket number
• seat number
• date of ticket issued
• no-show history
• bag tag history
• go-show information
• other service-related information
• special service requests, such as meal preferences
• received from information
• all historical changes to PNR
• number of travellers on PNR
• seat information
• one-way tickets
• any collected advanced passenger information system information
• automatic ticketing fare quote
