Passenger Name Record data - Agreement between Canada and the European Union

Opinion of the European Data Protection Supervisor

on the Proposals for Council Decisions on the conclusion and the signature of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data

I. Consultation of the EDPS

1. On 19 July 2013 the European Commission adopted the Proposals for Council Decisions on the conclusion and the signature of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data (hereinafter: "the proposals"), which contain the text of the proposed Agreement between Canada and the European Union (hereinafter: "the Agreement"). The Proposals were sent to the EDPS on 23 July 2013.

2. The EDPS also had the opportunity to provide his advice before the adoption of the proposals. The EDPS welcomes this previous consultation. However, as it took place after the closing of the negotiations, the EDPS input could not be taken into account. The present opinion builds on the comments provided at that occasion. II. General remarks

3. As stated on earlier occasions , the EDPS questions the necessity and proportionality of PNR schemes and of bulk transfers of PNR data to third countries. Both are conditions required by the EU Charter and the European Convention of Human Rights for any limitation to fundamental rights, including to the rights respect for private life and the protection of personal data . According to the jurisprudence, not only the reasons put forward by the public authority to justify any such restriction should be relevant and sufficient , but it should also be demonstrated that other less intrusive methods are not available . To date, the EDPS has not seen convincing elements showing the necessity and proportionality of the massive and routine processing of data of non-suspicious passengers for law enforcement purposes.

4. Nevertheless, the EDPS welcomes the data protection safeguards provided in the Agreement, although he regrets the fact that the retention period has been extended in comparison with the previous PNR agreement with Canada.

5. The EDPS also welcomes the efforts undertaken by the Commission as regards oversight and redress under the constraints entailed by the nature of the Agreement. However, he is concerned about the limitations of judicial review and about the fact that administrative redress can be provided in some cases by an internal authority which is not independent. He also questions the appropriateness of an executive agreement to provide adequate and effective rights to data subjects.

6. The Agreement regulates the use by the "Canadian Competent Authority" of PNR data transferred by EU air carriers and other carriers operating flights from the EU . The EDPS recommends requiring confirmation that no other Canadian authority can directly access or request PNR data to those carriers, thus circumventing the agreement. III. Specific remarks III.1. Legal basis

7. The proposals are based on Article 82(1)(d) and Article 87(2)(a) of the TFEU on judicial cooperation in criminal matters and police cooperation, in conjunction with Articles 218(5) and 218(6)(a) of the TFEU as regards the signature and conclusion.

8. The EDPS questions the choice of the legal basis. As stated in the Explanatory Memorandum of the proposals, air carriers are obliged to provide the Canadian Border Services Agency with access to certain PNR data. According to Article 1 of the Agreement, its purpose is to set out the conditions for the transfer and use of PNR data in order to, on the one hand, "ensure the security and safety of the public" and, on the other hand, "prescribe the means by which the data shall be protected". In addition, the vast majority of provisions of the Agreement relate to the latter objective, i.e. the protection of personal data, including data security and integrity.

9. Therefore, the EDPS questions the exclusive choice of Article 82(1)(d) and Article 87(2)(a) of the TFEU as legal basis and would recommend considering Article 16 of the TFEU on the protection of personal data as a comprehensive legal basis, in conjunction with Articles 218(5) and 218(6)(a) of the TFEU. III.2. Purpose and definitions a) Preventing, detecting, investigating or prosecuting terrorist offences

10. The EDPS welcomes the fact that the proposals include a list of the offences considered as "terrorist offences". However, he questions the inclusion in Article 3(2)(a)(v) of the Agreement of acts or omissions that cause "serious interference with or serious disruption of an essential service, facility or system". The EDPS understands that this definition is based on section 83.01 of the Canadian Criminal Code, but he considers that the scope of this subparagraph is too broad.

11. In this regard, the EDPS welcomes the exclusion from this category of acts or omissions which result from "lawful or unlawful advocacy, protest, dissent or stoppage of work, such as strike" that are not intended to result in death, serious body harm, endangering an individual's life, or serious risk to the public's health or safety. However, the EDPS would recommend further narrowing the definition of the offences falling under Article 3(2)(a)(v), for example, further limiting the consideration of "terrorist offences" only to those interferences or disruptions which may endanger an individual's life.

12. In addition, in order to enhance legal certainty and ensure appropriate information to data subjects, the EDPS recommends listing in Article 3(2)(b) the relevant international conventions and protocols. b) Preventing, detecting, investigating or prosecuting serious transnational crime

13. Article 3(3) defines serious transnational crime as "any offence punishable in Canada by a maximum deprivation of liberty of at least four years or a more serious penalty and as they are defined by the Canadian law, if the crime is transnational in nature".

14. The EDPS welcomes the fact that the transnational nature of crimes is clearly defined. In particular, the EDPS welcomes Article 3(a-d), which is almost identical to Article 3(2) of the UN Convention against Transnational Organised Crime (hereinafter: "the UN Convention"). However, the EDPS questions Article 3(e), according to which the fact that the offender travels or intends to travel to another country is enough to consider a crime as "transnational". The EDPS recommends limiting the definition of the transnational nature of crimes to the situations provided in the UN Convention.

15. The EDPS also welcomes the fact that a threshold (offences punishable in Canada by a maximum deprivation of liberty of at least 4 years or more serious penalty) is set for crimes to be considered as "serious". In order to achieve greater legal certainty and transparency, the EDPS recommends listing the crimes that would fall under this definition according to Canadian law. This is also relevant to assess whether the definition excludes minor offences for which the transfer of PNR data to Canadian competent authorities would not be in line with the principle of proportionality. c) Other uses

16. The EDPS questions the possibility of using PNR data in case of a "significant public health risk" provided in Article 3(4)(b), especially taking into account the limited reliability of PNR data. The international standards mentioned requiring this use of PNR should be listed.

17. Article 3(5)(a) states that Canada may also process PNR data, on a case by case basis, to ensure oversight and accountability. It should be specified under which circumstances and by which authorities this processing is allowed.

18. The possibility of processing PNR data to comply with a subpoena, warrant or order, even if limited to those issued or made by a court, potentially enlarges the purposes for which PNR data can be processed. It should be added that this should only be possible for the purposes stated in Article 3(1). III.3. Non-discrimination

19. The EDPS welcomes Article 7 which prevents unlawful discrimination. The EDPS would recommend specifying that this principle applies in particular with regard to the nationality, country of residence and physical presence of passengers. It would also be useful to explicitly state in the Agreement or in the accompanying documents which types of "lawful" discrimination would be possible. III.4. Sensitive data

20. Article 8(1) of the Agreement states that the Canadian Competent Authorities shall "mask" sensitive data using automated systems. Article 8(5) sets a maximum retention period of 15 days and Articles 8(3) and 8(4) detail the exceptional circumstances and procedures that allow the processing of sensitive data on a case-by-case basis. The EDPS welcomes the safeguards provided, but recommends completely excluding the processing of sensitive data. As previously recommended by the EDPS and the Article 29 Working Party, sensitive data should be filtered by air carriers . III.5. Security and logging

21. The EDPS welcomes the measures required by Article 9 on data security and integrity and Article 17 on logging and documentation. However, he would also recommend providing for notification of data breaches to the European Commission and to Data Protection Authorities. III.6. Transparency

22. The EDPS welcomes the information to be publicised in the Canadian Competent Authorities' website and to be provided to passengers according to Article 11. This information should be easily accessible. The EDPS recommends that Article 11(2) state that the Parties shall "require" the air travel industry and other interested parties to provide the listed information to data subjects and not only "work with" them "to promote transparency". In addition, the EDPS recommends adding to Articles 11(1) and 11(2) information on the categories of data concerned, the recipient(s) of the data and the mechanisms available under Canadian law to seek judicial review. III.7. Access and rectification

23. The EDPS understands that, according to Canadian law, persons which are not present in Canada cannot exercise the rights provided by the Canadian Privacy Act and the Access to Information Act. Therefore, the EDPS welcomes the fact that Memorandum D1-16-3 of the Canada Border Services Agency (CBSA) extends the rights of access, rectification and notation to foreign nationals that are not present in Canada . The EDPS recommends mentioning this memorandum in the text of the Agreement, in the letters exchanged between the Parties or in the documents accompanying the decision.

24. In cases where, according to Article 12(3), Canada cannot disclose the data to the data subject, the possibility of indirect access, e.g. through European Data Protection Authorities, should be available. This should be specified in the Agreement. III.8. Automated processing

25. The EDPS welcomes Article 15 of the Agreement, which prevents Canada from taking decisions significantly affecting passengers solely on the basis of automated processing. However, taking into account the broad scope of automated processing foreseen in the PNR systems and in order to avoid a too restrictive interpretation of "decisions significantly adversely affecting a passenger", the EDPS recommends deleting the word "significantly". III.9. Data retention

26. The EDPS is strongly concerned about the length of the maximum retention period provided (five years), which is even longer than the one provided in the precedent Agreement (three and a half years). He is also concerned about the period during which the data will be available before being "further 13 depersonalized" (two years).

27. Consistently with his previous opinions , the EDPS recommends deleting or anonymising the data immediately after analysis and 30 days after reception as a maximum. In any case, the retention period should be justified, in particular taking into account that its length was not deemed necessary in the previous Agreement. III.10. List of PNR data

28. Annex I of the Agreement contains a list of PNR data elements, which is almost identical to the list contained in the agreements currently in force with Australia and the US. These categories have already been considered disproportionate on previous occasions by the EDPS and the Article 29 Working Party , and should therefore be reduced.

29. The presence of open categories could undermine legal certainty. Data elements such as "all available contact information", "all baggage information" and "general remarks" should be better defined. In particular, the field "General remarks", including OSI, SSI and SSR information, can reveal data related to religious beliefs (e.g. meal preferences) or health (e.g. request for a wheelchair). As discussed above, the processing of sensitive data should be explicitly excluded.

30. Therefore, the list should be narrowed. In line with previous opinions of the EDPS and the Article 29 Working Party, the EDPS recommends limiting the data elements to the following categories: PNR record locator code, date of reservation, date(s) of intended travel, passenger name, other names on PNR, all travel itinerary, identifiers for free tickets, one-way tickets, ticketing field information, ATFQ (Automatic Ticket Fare Quote) data, ticket number, date of ticket issuance, no show history, number of bags, bag tag numbers, go show information, number of bags on each segment, voluntary/involuntary upgrades, and historical changes to PNR data with regard to the aforementioned items. III.11. Method of transfer

31. The EDPS supports the choice of the push method as the exclusive means to transfer PNR data by air carriers, as provided in Article 20. III.12. Onward transfers

32. The EDPS welcomes the safeguards provided in Articles 18 and 19. However, he recommends specifying which are the "other government authorities in Canada" to which PNR data can be disclosed, either in the Agreement or in accompanying documents.

33. The EDPS also welcomes the requirement that recipient authorities in Canada afford protection "equivalent" to the safeguards described in the Agreement. As regards disclosure outside Canada, Article 19 requires that the CBSA be satisfied that the recipient foreign authority applies standards that are equivalent to those set in the Agreement.

34. The EDPS recommends adding that those standards should be laid down in an agreement or arrangement, which should be as binding legally and factually as possible between Canada/ the CBSA and the recipient country/authority. In addition, such agreements should be notified to the European Commission and to EU national Data Protection Authorities.

35. Onward transfers to other countries are also possible on the basis of standards that have been agreed with the EU. This provision should not allow the circumvention of any PNR agreement concluded between the EU and a third country.

36. In addition, in order to avoid a flexible interpretation of "on a case-by-case basis", the EDPS suggests adding in Article 19(1) the requirement of prior judicial authorisation or of the existence of an immediate threat for onward transfers. III.13. Oversight and redress

37. Article 10 provides for oversight "by an independent public authority, or by an authority created by administrative means that exercises its functions in an impartial manner and that has a proven record of autonomy". The EDPS welcomes the reference to an independent public authority, but regrets the fact that oversight may take place alternatively by a (non independent) authority created by administrative means. Although internal autonomous oversight is positive and contributes to ensuring compliance and accountability, external overall oversight by an independent authority, such as the Privacy Commissioner of Canada, should also be explicitly provided in all cases.

38. The importance of full independence has been outlined by the European Court of Justice, according to which any form of State scrutiny over a data protection supervisory authority "in principle allows the government (...) or an administrative body subject to that government to influence, directly or indirectly, the decisions of the supervisory authorities or, as the case may be, to cancel and replace those decisions." The Court also stated that the mere risk that the State or an administrative body "could exercise a political influence over the decisions of the supervisory authorities is enough to hinder the latter authorities’ independent performance of their tasks".

39. The EDPS understands that, as required in Article 30, Canada will notify the EU of the identity of these authorities and their distribution of competences and that this information will be publicised together with the Agreement. As regards the "independent public authority" providing oversight, the EDPS recommends designating the Canadian Privacy Commissioner. Dissuasive sanctions should also be laid down for cases of non compliance with the Agreement.

40. As regards Article 14(1) on judicial review, the EDPS reiterates the comments made above on the independence of the authorities providing oversight. The EDPS welcomes the obligation that the relevant authority notifies complainants of the means of seeking judicial review. However, the EDPS recommends also specifying in the Agreement, in the letters exchanged between the Parties or in documents accompanying the decision which are the mechanisms available to persons not resident in Canada to seek judicial review under Canadian law.

41. Article 14(2) ensures that any individual be able to seek effective judicial redress "in accordance with Canadian law" by way of judicial review. The EDPS welcomes the reference to "any individual" but he suggests confirming that this right is available under Canadian law regardless of the nationality, country of origin, residence of the individual or presence in Canada, either in the Agreement or at least in the letters exchanged between the Parties or in the documents accompanying the decision.

42. In addition, it is not clear whether the right to judicial review could be exercised if the relevant decision or action has not been communicated to the individual concerned , in particular if provisions of the Agreement other than those related to access and rectification/notation are infringed. The EDPS recommends clarifying this. He also suggests specifying which "other remedy which may include compensation" Article 14(2) refers to.

43. The EDPS welcomes the effort undertaken by the Commission as regards oversight and redress. However, he notes the limitations of judicial review with respect to judicial redress, and of administrative redress by an internal "autonomous authority" which depends on the State or an administrative body and thus cannot act fully independently. On a more general level, the EDPS understands that executive agreements cannot create new rights for EU citizens not present in Canada, which are not available under Canadian law, such as full administrative redress by an independent authority. Therefore, he questions the appropriateness of this type of agreements to protect fundamental rights such as privacy and data protection. III.14. Review of the implementation of the Agreement

44. Article 26(2) states that the Parties shall jointly review the implementation of the Agreement one year after its entry into force and then "at regular intervals". The EDPS recommends specifying the frequency of these additional reviews.

45. Furthermore, the content of the review should be further specified. The EDPS suggests that the review focus not only on the implementation of the Agreement but also on the evaluation of its necessity and proportionality. In particular, it could involve the collection of statistics on the number of individuals affected and effectively convicted or otherwise dealt with on the basis of the transfer of PNR data, and on the exercise of data subjects' rights.

46. According to Article 26(4), the review teams shall include data protection experts. The EDPS recommends explicitly stating that European Data Protection Authorities should be included in the EU review team. IV. Conclusions

47. As previously stated, the EDPS questions the necessity and proportionality of PNR schemes and of the bulk transfers of PNR data to third countries. He also questions the choice of the legal basis and recommends that the proposals be based on Article 16 of the TFEU, in conjunction with Articles 218(5) and 218(6)(a) of the TFEU.

48. The EDPS is also concerned about the limited availability of independent administrative redress and full judicial redress for EU citizens not present in Canada and questions the appropriateness of an executive agreement to achieve them. He also recommends requiring confirmation that no other Canadian authority can directly access or request PNR data to the carriers covered by the Agreement.

49. As regards the specific provisions of the agreement, the EDPS welcomes the data protection safeguards included. However, the Agreement should:  completely exclude the processing of sensitive data;  provide for deletion or anonymisation of the data immediately after analysis and 30 days after reception as a maximum and, in any case, reduce and justify the proposed retention period, which has been extended in comparison with the previous PNR Agreement with Canada;  limit the categories of PNR data to be processed;  explicitly mention that overall oversight will be carried out by an independent authority.

50. In addition, the EDPS recommends specifying the following, either in the Agreement or in the accompanying documents:  further narrowing and clarifying the concepts defining the purposes of the Agreement;  clarifying which types of "lawful" discrimination would be possible;  providing for an obligation to notify data breaches to the European Commission and to Data Protection Authorities;  completing the provisions on transparency;  extending the prohibition of deciding solely on the basis of automated processing to all decisions affecting passengers on the basis of the Agreement;  specifying to which authorities in Canada PNR data can be further transferred, adding the requirement of prior judicial authorisation or of the existence of an immediate threat, providing for an obligation of including adequate data protection safeguards in agreements or arrangements with other recipient countries or authorities and for their notification to the European Commission and to EU Data Protection Authorities;  naming the relevant authorities and laying down dissuasive sanctions for non compliance with the Agreement;  specifying which are the mechanisms available to persons not resident in Canada to seek judicial review under Canadian law;  clarifying if the right to judicial review could be exercised even if the relevant decision or action has not been communicated to the individual concerned, in particular if provisions of the Agreement other than those related to access and rectification/notation are infringed;  specifying to which "other remedy which may include compensation" Article 14(2) refers;  specifying the frequency of reviews of the implementation of the Agreement, their content (which should include on the evaluation of its necessity and proportionality) and explicitly including EU Data Protection Authorities in the EU review team. Done in Brussels, 30 September 2013 (signed) Peter HUSTINX European Data Protection Supervisor