Feeds

US and EU stitch up airline passenger data deal

And data protection law

Choosing a cloud hosting partner with confidence

European data protection authorities are choking on their baguettes after seeing the detail of the data-sharing agreement the EU signed with the US on Friday. The passenger name record (PNR) agreement was presented as a formality that had been passed by the respective administrations without so much as a hiccup. But it's proving hard to swallow.

On the face of it, the agreement secured the legal basis for the US to collect personal information about anyone who flies there from Europe. The European Commission, which negotiated the agreement, wanted to ensure European airline passengers were treated fairly after their personal information was collected by US authorities conducting anti-terrorist investigations.

European data protection law prevents data being sent to another country that doesn't have equivalent protections. That's made the old PNR agreement (which was scrapped on a technicality in June by the European Court of Justice) a bone of contention in Brussels, because the US has no equivalent protection.

The new agreement was supposed to have guaranteed the same level of protection, which was in effect a gentleman's agreement, in which the US promised to play ball. The EC said it "trusted" the US would honour the deal.

Indeed, Jonathan Faull, director general of the European Commission directorate for Justice, Freedom and Security, after securing the new agreement last Friday, told journalists that it offered "comparable" protections. The Commission statement on the matter said it held the US to ensuring "equivalent" protection.

But equivalent protections have not been secured, it was revealed in a letter sent by the US Department of Homeland Security to Faull and Irma Ertman, lead negotiator for the European Council's Finnish Presidency, on Friday, after the agreement was struck.

European data protection authorities said they were "amazed" when they saw the letter yesterday because it watered down the new agreement so that it was even weaker than the last.

The contradiction reflects a split in Europe over how well people's personal data should be protected from abuse by the authorities. On the one hand, the data protection authorities and the European Parliament think the US is taking liberties with our data, while they are trying to preserve our liberties with data protection law.

On the other hand, the European Council of Ministers and the Commission are prepared to accept a lower level of protection, at least when striking agreements about sharing data with other countries. It is worth noting that Faull announced on Friday that the EC is planning its own PNR regime, which will collect information about people travelling into Europe from abroad.

Still, the new agreement was only meant to be a stopgap until a proper compromise could be negotiated. The EU purports to covet its data protection law, which states roughly that any data collected about someone should be taken for good reason, only for the specified purpose and only for as long as is reasonably needed.

The US letter shows how the European position has weakened and perhaps gives an indication of how the final agreement, should one be wrought before the new one runs out next June, might be balanced.

The letter, drafted by Stuart Baker, assistant Secretary to the US Department of Homeland Security (DHS), states how the US will interpret the agreement just signed. The old provisions that prevented it sharing data with other agencies have been thrown out. As well as US border control, the FBI, CIA and unspecified other agencies will get access to the data.

The US proposes trawling through passenger data to seek out suspicious-looking characters if it doesn't have a clear idea who it's looking for. It commits to do this "judiciously and with proportionality", though there is no US law to ensure that it does, and the DHS has already announced its intention to share data between civil and security databases.

Security for virtualized datacentres

More from The Register

next story
Spies, avert eyes! Tim Berners-Lee demands a UK digital bill of rights
Lobbies tetchy MPs 'to end indiscriminate online surveillance'
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
How the FLAC do I tell MP3s from lossless audio?
Can you hear the difference? Can anyone?
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
4chan outraged by Emma Watson nudie photo leak SCAM
In the immortal words of Shaggy, it wasn't me us ... amirite?
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.