Feeds

US and EU stitch up airline passenger data deal

And data protection law

The Power of One Infographic

European data protection authorities are choking on their baguettes after seeing the detail of the data-sharing agreement the EU signed with the US on Friday. The passenger name record (PNR) agreement was presented as a formality that had been passed by the respective administrations without so much as a hiccup. But it's proving hard to swallow.

On the face of it, the agreement secured the legal basis for the US to collect personal information about anyone who flies there from Europe. The European Commission, which negotiated the agreement, wanted to ensure European airline passengers were treated fairly after their personal information was collected by US authorities conducting anti-terrorist investigations.

European data protection law prevents data being sent to another country that doesn't have equivalent protections. That's made the old PNR agreement (which was scrapped on a technicality in June by the European Court of Justice) a bone of contention in Brussels, because the US has no equivalent protection.

The new agreement was supposed to have guaranteed the same level of protection, which was in effect a gentleman's agreement, in which the US promised to play ball. The EC said it "trusted" the US would honour the deal.

Indeed, Jonathan Faull, director general of the European Commission directorate for Justice, Freedom and Security, after securing the new agreement last Friday, told journalists that it offered "comparable" protections. The Commission statement on the matter said it held the US to ensuring "equivalent" protection.

But equivalent protections have not been secured, it was revealed in a letter sent by the US Department of Homeland Security to Faull and Irma Ertman, lead negotiator for the European Council's Finnish Presidency, on Friday, after the agreement was struck.

European data protection authorities said they were "amazed" when they saw the letter yesterday because it watered down the new agreement so that it was even weaker than the last.

The contradiction reflects a split in Europe over how well people's personal data should be protected from abuse by the authorities. On the one hand, the data protection authorities and the European Parliament think the US is taking liberties with our data, while they are trying to preserve our liberties with data protection law.

On the other hand, the European Council of Ministers and the Commission are prepared to accept a lower level of protection, at least when striking agreements about sharing data with other countries. It is worth noting that Faull announced on Friday that the EC is planning its own PNR regime, which will collect information about people travelling into Europe from abroad.

Still, the new agreement was only meant to be a stopgap until a proper compromise could be negotiated. The EU purports to covet its data protection law, which states roughly that any data collected about someone should be taken for good reason, only for the specified purpose and only for as long as is reasonably needed.

The US letter shows how the European position has weakened and perhaps gives an indication of how the final agreement, should one be wrought before the new one runs out next June, might be balanced.

The letter, drafted by Stuart Baker, assistant Secretary to the US Department of Homeland Security (DHS), states how the US will interpret the agreement just signed. The old provisions that prevented it sharing data with other agencies have been thrown out. As well as US border control, the FBI, CIA and unspecified other agencies will get access to the data.

The US proposes trawling through passenger data to seek out suspicious-looking characters if it doesn't have a clear idea who it's looking for. It commits to do this "judiciously and with proportionality", though there is no US law to ensure that it does, and the DHS has already announced its intention to share data between civil and security databases.

Build a Business Case: Developing Custom Apps

More from The Register

next story
UK's emergency data slurp: IT giants panicked over 'legal uncertainty'
PM says rushed-through DRIP law will 'plug holes' in existing legislation
Doctor Who season eight scripts leak online
BBC asks fans to EXTERMINATE copies before they materialise
Google went behind our backs and really HURT US, squeal upset porn kingpins
'As the pornographer here, the moral turpitude should be MINE'
Report: UK.gov wants to legislate on comms data BEFORE next election
Ministerial alarm sets in over EU court's data retention ruling
IBM's $3bn bet on next-gen computers: Carbon nanotubes, neuro chips
Big Blue exec tells El Reg what to keep an eye on
Google Ventures opens new fund in London
El Reg has a new neighbour. So. Who's for a game of knock, knock, Ginger?
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Eight steps to building an HP BladeSystem
Building your ideal BladeSystem infrastructure solution begins with eight simple steps, outlined in this whitepaper.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.
Build a Business Case: Developing Custom Apps
In this whitepaper learn how to maximize the value of custom applications by accelerating and simplifying their development.