Bolkestein verdedigt akkoord over uitwisseling persoonsgegevens met VS (en)

Mr Chairmen, Honourable Members,

When I addressed the LIBE Committee in September, I quoted an American author, H.L. Mencken. Today, let me start with a quote from a recent and very relevant opinion of the Article 29 Working Party which, as you know, advises the Commission on data protection matters.

In its opinion of 13 June 2003 on PNR transfers to the US, the Working Party, after outlining its numerous data protection concerns, recognised that "ultimately political judgements will be needed".

Since June, the Commission has frequently had occasion to refer to this opinion, especially in its talks with the US.

Those talks have now been completed as I promised Parliament they would be "before Christmas". And today the Commission exercised its "political judgement" in deciding how to take matters forward.

By referring to political judgement, the Working Party acknowledged that there were many considerations at stake, in addition to data protection. In particular, it has called for a more global approach regarding the conditions of the use of PNR data for security purposes ideally in a multilateral context.

The package of measures that my colleagues and I are going to set out before you today reflects the complexity of the issue. There is no single answer. It requires a balanced, integrated, multi-strand approach.

In some cases, the actions will take time to come to fruition. But at least one thing is urgent. Namely to provide a sound legal framework for PNR transfers to the US that ensures the best possible protection to EU citizens.

Some believe that there was a quick fix possible here. Simply by telling the airlines that they had to obtain the unambiguous consent of all passengers, we could have solved the problem. This regardless of whether protection in the US was adequate or not, because consent allows you to make an exception. Indeed this way, we could have solved most of the legal problems. And the underlying proposition that people must be informed and have the opportunity to make a choice is certainly a very valid one that the Commission fully supports.

But relying on consent alone would have been bad data protection, even if it resolved the legal problems. We would have been saying to people: it is up to you to decide whether to go to the US, but we are washing our hands entirely of what happens to your personal data once it gets to the US.

We rejected this path.

In its handling of the dossier, the Commission has been criticised for not caring enough about breaches of Community law. In fact, we have cared not only about applying Community law, but also about ensuring that it has the desired effects.

So the Commission took the high road and sought improvements from the US in the way they process PNR.

This was by no means easy. It has taken protracted discussions at both officials' and political level. But the US leadership were finally persuaded of the need for flexibility. I might say here that Parliament's strong pressure has played a very important role.

In the end, the US has made a number of important concessions. It is to their credit that they attached sufficient importance to obtaining our co-operation that they were prepared to do this. I outlined most of these changes to you already on 1 December, and they are of course enumerated in the Communication that the Commission has just adopted. So I shall mention only briefly the main improved undertakings that have been secured since the beginning of the talks:

Firstly, clear limits on the amount of data to be transferred with a closed list of 34 elements. Furthermore, the US has undertaken not to require airlines to collect any data where any of these 34 elements would be empty. In practice, most PNRs consist of no more than 10-15 items.

Secondly, a significant movement on the length of data storage. The US has agreed to cut its initially proposed fifty year period to 3 ½ years. This is related to the expiry of the whole arrangement after 3 ½ years. We have thus managed to link the lifetime of the agreement with the duration of the retention period.

This sunset clause will give us the opportunity to revisit all the questions and decide in the light of experience what should continue and what not. Hopefully, the EU will have developed by then its own policy on the use of PNR for law enforcement purposes. The US debate on data privacy will also have evolved.

The third important success we achieved is that the arrangement will not cover the US Computer Assisted Passenger Pre-Screening System (CAPPS II). The latter will only be considered in a second round of discussions yet to come. In any case, such discussions can only conclude once Congress' privacy concerns have been met, and so far they have not.

Fourthly, we obtained stronger guarantees with respect to overall US compliance. The US finally accepted after refusing it earlier in our talks an important safeguard in the form of a joint review, to be carried out together with EU authorities at least every year. We have thus secured a way to ascertain how well the US implements its Undertakings.

The fifth useful development regards redress for individual EU passengers. Passengers whose complaints to the Department of Homeland Security have not been satisfactorily resolved by the DHS or its Privacy Office. Parliament has rightly so stressed this issue in its October Resolution. The US is now ready to recognise the right of EU data protection authorities to represent EU citizens.

Finally, all categories of sensitive data will be deleted, and there will be no bulk sharing of data with other agencies.

Last time I addressed these Committees, I said that I would continue my discussions with the Americans on one issue: the question of purpose limitation. We had insisted since the start that the unusually intrusive nature of this new information instrument could only be justified in relation to the threat posed by terrorism.

When I last reported to you, the US side was still adamant that they wanted to use PNR data also for fighting serious domestic crime. This was the issue that I wanted to raise one last time with US Department of Homeland Security Secretary Tom Ridge.

I can now report to you that the US side has agreed to make the deletion we sought from the purpose limitation text. It now only refers to "terrorism and related crimes" and to "other serious crimes, including organized crime, of a trans-national nature". Domestic crime is thus excluded.

Honourable Members will agree with me that this is an extremely important improvement.

May I once again pay tribute to Secretary Ridge and the wisdom he has shown in his leadership of the discussions on the US side.

In concluding my last round of discussions with Mr Ridge, I informed him that in the light of the narrower uses for PNR, the exclusion for now of CAPPS II and all the other improvements they had made, I was prepared to propose that:

The Commission make a finding of adequate protection with regard to transfers of PNR to the US Bureau of Customs and Border Protection. The Commission gave its agreement to this proposal today.

The Commission believes the adequacy finding is now the right solution for a combination of reasons:

• The final important progress agreed by the US means that 3 of the 4 major issues we had sought from them back in June have been delivered.

• On the fourth, which was the need for an independent redress mechanism, the Department of Homeland Security is the first US government department to appoint a Chief Privacy Officer. This officer, though part of the Department and not strictly independent, has a good measure of organisational autonomy and will in particular report annually to Congress. Secretary Ridge has said, moreover, that the Privacy Officer's rulings on complaints will be binding on the Department. I think a reasonable response to this is "Let us see how all this works in practice."

This brings me to another important point on which we have agreement with the US side: that the present arrangement should be time-limited. The adequacy finding will expire after three and a half years unless the two sides agree on terms for their prolongation.

This will allow us not only to test the solidity of the arrangements we have agreed with the US to see how it works in practice but also to review matters in the light of other developments.

My colleagues will explain to you in a moment the steps put in hand for the establishment of a global EU policy on the use of international travellers data for security purposes, for substituting "push" for "pull" as a means of data transmission and so on.

Conclusion

Mr Chairmen, Honourable Members,

You will be able to study the full picture in the document that the Commission has adopted and that will be transmitted to the Parliament immediately. I would sum it up as follows:

The EU cannot refuse to its ally in the fight against terrorism an arrangement that Member States would be free to make themselves. EU Member States may make exceptions in accordance with Article 13 of the Directive.

The US authorities have moved quite significantly from their initial position. They have made important changes to their proposed handling of PNR changes which, in the Commission's view, bring them within these limits.

In addition, as I have said before, I do not see any solution which serves our objectives better. I see in any case no justification at all for pursuing policies which risk producing negative outcomes for passengers and negative impacts for airlines.

Parliament will be consulted on both components of these proposed arrangements. I am confident that Parliament will exercise its political judgement by weighing all the different policy issues at stake.

The Commission also fully supports the objective of Parliament to reinforce the contacts between its Members and Members of the US Congress.

Thank you for your attention.