The new agreement just initialled by the United States and the European Commission on the transfer of passenger data (PNR, or passenger name record) is particularly disappointing, Dutch rapporteur Sophie in-t Veld (ALDE) toldEuropolitics upon reading the text for the first time. The Commission sees the new text as "a major improvement over the existing agreement," commented Michele Cercone, spokesman for Home Affairs Commissioner Cecilia Malmström, on 10 November. The MEP finds that it does not contain any real advances and needs to be clarified in many areas.

Globally speaking, how would you assess this draft agreement?

I am going to hold my definitive judgement until I have had the opinion of the legal experts. But the one thing that I can say for sure is that it is not unambiguous, it is not clear, it is not the solid agreement that we would have wanted. Maybe at the end the legal experts would say that it can be considered to be in line with the data protection criteria. I do not know about that. But it is not clear in my first initial assessment. You know, we always say that we have shared values across the Atlantic and that we have the same objectives. That has not become clear. But I am very disappointed that in the negotiations with our closest ally we are unable to come up with something that is is in line with EU legislation. I find this disappointing. If this is the result of negotiations with our closest ally then what are we going to achieve with other countries? It should not have to be like this, and that is really disappointing.

The draft agreement specifies a data storage period of ten years (serious transnational crime) and 15 years (terrorism), according to the Commission. What are your views on this?

It is an important element and we have to take a very close look at this since there are still open questions. First of all, it is not clear how and when this differentiation should be achieved. Furthermore, it turns out the data will be stored indefinitely and not only for 15 years, but they will be irreversibly anonymised after these 15 years. However, is not specified how they will be anonymised. We need to talk about that because these terms are much harsher than those laid down in the agreement with Australia.

The Commission indicates that the PNR data will be masked out after six months. What does that mean exactly?

That means that data can only be re-personalised by people with special access rights. In other words, it is a “reversible de-personalisation”.

Do you agree that the purposes for data use are still too broad?

Here, again, the proposal is unclear. The two main purposes that the European Parliament considers to be justified, mainly the fight against terrorism and the fight against transnational crime, are now pretty well defined. But the agreement contains clauses that may allow for other uses of PNR data, like controlling borders or other unspecified purposes. That means that the purposes are not limited as we had requested. That would mean that it is not in line with the criteria chosen by the European Parliament. But again, I am not going to make any final statement until we have a conclusive assessment by legal experts.

Is there any improvement concerning the question of judicial redress for EU citizens?

As far as I can see, nothing has changed compared to the previous agreement. So that would mean that although European citizens always have the right to go to court in the United States, we understand that they cannot go to court on the basis of the Privacy Act.

Can the EP veto this agreement? 

I do not much like the word veto but it is true that the agreement can only be concluded with the approval or the consent rather of the European Parliament.

Background

Following the 11 September 2001 terrorist attacks against the United States, Congress adopted measures obliging airlines to transfer passenger name records (PNR) to the US Customs and Border Protection office. Airlines find themselves in a situation of legal uncertainty because Article 25 of Directive 95/46/EC on data protection prohibits any data transfer to non-EU states that do not offer an adequate level of data protection

May 2004: First EU-US PRN agreement adopted (first pillar). The EP does not have a right of consultation and brings an action for annulment before the EU Court of Justice against the Commission and the Council. The court rules in the EP's favour

July 2007:A new EU-US PNR agreement is adopted (third pillar) and continues to be applied provisionally. Certain member states have not ratified it as of the entry into force of the Lisbon Treaty, which gives the EP a right of assent

May 2010: MEPs decide to make their approval of the agreement contingent on the adoption of a PNR package that provides for renegotiation of the PNR agreements with the United States, Australia and Canada

December 2010: The Justice and Home Affairs Council gives the Commission a mandate to negotiate these three agreements

October 2011:The EP approves the EU-Australia PNR agreement

November 2011: New PNR agreement is initialled by the Commission and the United States