Feeds

US and EU stitch up airline passenger data deal

And data protection law

Internet Security Threat Report 2014

European data protection authorities are choking on their baguettes after seeing the detail of the data-sharing agreement the EU signed with the US on Friday. The passenger name record (PNR) agreement was presented as a formality that had been passed by the respective administrations without so much as a hiccup. But it's proving hard to swallow.

On the face of it, the agreement secured the legal basis for the US to collect personal information about anyone who flies there from Europe. The European Commission, which negotiated the agreement, wanted to ensure European airline passengers were treated fairly after their personal information was collected by US authorities conducting anti-terrorist investigations.

European data protection law prevents data being sent to another country that doesn't have equivalent protections. That's made the old PNR agreement (which was scrapped on a technicality in June by the European Court of Justice) a bone of contention in Brussels, because the US has no equivalent protection.

The new agreement was supposed to have guaranteed the same level of protection, which was in effect a gentleman's agreement, in which the US promised to play ball. The EC said it "trusted" the US would honour the deal.

Indeed, Jonathan Faull, director general of the European Commission directorate for Justice, Freedom and Security, after securing the new agreement last Friday, told journalists that it offered "comparable" protections. The Commission statement on the matter said it held the US to ensuring "equivalent" protection.

But equivalent protections have not been secured, it was revealed in a letter sent by the US Department of Homeland Security to Faull and Irma Ertman, lead negotiator for the European Council's Finnish Presidency, on Friday, after the agreement was struck.

European data protection authorities said they were "amazed" when they saw the letter yesterday because it watered down the new agreement so that it was even weaker than the last.

The contradiction reflects a split in Europe over how well people's personal data should be protected from abuse by the authorities. On the one hand, the data protection authorities and the European Parliament think the US is taking liberties with our data, while they are trying to preserve our liberties with data protection law.

On the other hand, the European Council of Ministers and the Commission are prepared to accept a lower level of protection, at least when striking agreements about sharing data with other countries. It is worth noting that Faull announced on Friday that the EC is planning its own PNR regime, which will collect information about people travelling into Europe from abroad.

Still, the new agreement was only meant to be a stopgap until a proper compromise could be negotiated. The EU purports to covet its data protection law, which states roughly that any data collected about someone should be taken for good reason, only for the specified purpose and only for as long as is reasonably needed.

The US letter shows how the European position has weakened and perhaps gives an indication of how the final agreement, should one be wrought before the new one runs out next June, might be balanced.

The letter, drafted by Stuart Baker, assistant Secretary to the US Department of Homeland Security (DHS), states how the US will interpret the agreement just signed. The old provisions that prevented it sharing data with other agencies have been thrown out. As well as US border control, the FBI, CIA and unspecified other agencies will get access to the data.

The US proposes trawling through passenger data to seek out suspicious-looking characters if it doesn't have a clear idea who it's looking for. It commits to do this "judiciously and with proportionality", though there is no US law to ensure that it does, and the DHS has already announced its intention to share data between civil and security databases.

Providing a secure and efficient Helpdesk

More from The Register

next story
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
Apple SILENCES Bose, YANKS headphones from stores
The, er, Beats go on after noise-cancelling spat
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.