Passenger name records (PNR) for the prevention of terrorist offences and serious crime [European Parliament impact 2014-2019]

In April 2016, after five years of legislative work and lengthy negotiations, the co-legislators adopted the Directive on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. The adoption took place on the same day as that of the General Data Protection Regulation and the Data Protection Police Directive, as insisted on by the European Parliament in order to ensure that data protection safeguards included in the PNR Directive were in line with the new data protection rules.

‘Passenger name record’ (PNR) is information on passengers collected by air carriers for operational purposes. It can include data related to the identity of a person (name, surname, date of birth, nationality, gender, contact details, etc.) and to their travel (itinerary, date of travel/reservation, number of passengers in the same reservation, payment details), but may also contain more sensitive information such as type of meal ordered on board or medical information.

PNR data is considered a valuable tool for combating terrorism and other forms of serious crime, as it allows law enforcement authorities to conduct analysis in order to identify possible high-risk individuals. However, the processing of PNR data for law enforcement purposes interferes with a number of rights, especially those regarding privacy and data protection, enshrined in the EU Charter of Fundamental Rights, and must thus respect the principle of proportionality, i.e. to ‘genuinely meet objectives of general interest’.

The EU PNR Directive was proposed by the European Commission in 2011, with the aim of establishing EU-wide rules for the use of PNR data for security purposes. Under the Commission proposal, airlines should transfer PNR data of passengers of extra-EU flights to the competent authorities of the Member State in which the flight will land or from which it will depart. Member States should create dedicated ‘Passenger Information Units’ to store and analyse data. In 2013, the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE) voted to reject the draft directive, on the basis of privacy and proportionality concerns. However, a few months later, Parliament decided in plenary to refer the file back to committee in order to find a compromise. In 2015, in the context of a growing terrorist threat, the LIBE Committee adopted its second report. The interinstitutional trilogue negotiations were concluded in the same year.

Throughout the legislative process, the European Parliament sought to ensure that the future directive would comply with the proportionality principle and contain strong data protection safeguards. The majority of its proposals were taken on board. The Parliament managed to strike a compromise on the data retention period – data will be stored for a period of six months (instead of two years proposed by the Council) and then up to five years in ‘masked-out’ form.

Several data protection safeguards have been added at the insistence of the Parliament: prohibition to use sensitive data; obligation to appoint a data protection officer in each Passenger Information Unit; obligation to inform passengers about collection of their personal data as well as on their rights; stricter conditions for data transfer to third countries.

The Parliament also insisted on including a stronger review clause: the Commission should review the directive two years after its transposition into national laws and could propose to amend it if appropriate.

Moreover, the Parliament succeeded in ensuring that PNR data would be used only in relation to a fixed list of serious crimes (such as terrorism, drug, weapons or human trafficking, child sexual exploitation, cybercrime, etc.) and that mechanisms are in place for sharing data between Member States and with Europol.

The EU PNR Directive had to be transposed into national laws by 25 May 2018. However, as of December 2018, several Member States still had to notify transposition to the Commission.

Law-making powers

Together with the Council, the Parliament participates in the shaping of European laws in what may be seen as a bicameral legislature at EU level. The nature of the Parliament’s involvement depends on the area in question and may mean Parliament being consulted (consultation procedure), giving its consent (consent procedure), or legislating on an equal footing with the Council (the ordinary legislative procedure, or co-decision).

The latter procedure consists of the joint adoption of an act by the European Parliament and the Council on the basis of a proposal by the Commission. Here, both legislators need to agree on an identical text before it becomes law, which may take up to three readings in each of the two institutions. On average, it takes about 22 months for legislators to agree on a legislative file, starting from the Commission proposal until the signature of the final act.

The number of areas in which the Parliament co-legislates has expanded greatly over time and now includes the EU internal market, environment, consumer protection, food safety, regional development, agriculture, transport, energy and many others. Indeed, most legislative acts are now adopted following the ordinary legislative procedure.

Besides the power of consent with regard to legislative acts, the Parliament’s consent is required in many other instances not related to legislative acts in the strict sense. For example, it is needed before any new country joins the EU (Article 49, Treaty on European Union, TEU), but also before any withdrawal treaty can be concluded when a country decides to leave it (Article 50 TEU). The Parliament’s consent is also required before concluding agreements with third countries, for example association agreements, as well as before the Council determines that an EU Member State is breaching – or is about to breach – EU values (Article 7 TEU).

Read the complete study on ‘The power of the European Parliament: Examples of EP impact during the 2014-19 legislative term‘ in the Think Tank pages of the European Parliament.