EU counter-terror bill is 'indiscriminate data collection'

Legislators are rushing through a counter-terrorism bill described by the EU's top data protection chief as one of the largest indiscriminate collections of personal data in the European Union.

MEPs on Thursday (10 December) are set to rubber stamp the EU's passenger name record (PNR) bill following intense pressure from French authorities in the aftermath of the Charlie Hebdo killings earlier this year and the Paris attacks in November.

Giovanni Buttereli, the European data protection supervisor, remains highly critical.

"The establishment of a new large-scale database will require years and an unbelievable about of money,” he told this website on Wednesday (9 December).

"[PNR] is the first large-scale and indiscriminate collection of personal data in the history of the European Union.”

The bill, described by French interior minister Bernard Cazeneuve as "indispensable in the fight against terrorism,” will add to the ever-expanding list of counter-terrorism measures in Europe.

88 laws on EU books

Some 239 specific EU laws and policy documents have been adopted in the name of “counter-terrorism” between 11 September 2001 and 2013. Of those, 88 are legally binding.

One EU-funded study said the lack of any systematic review of the laws and documents undermines their legitimacy as well as their effectiveness.

Buttereli, for his part, is also questioning the PNR legislation's stated objectives.

"To identify if someone is travelling outside the EU, we don't need an EU PNR. This data are already easily available in the airline reservation system,” he said.

EU governments want more information in the belief it will help law enforcement in tracking down terrorists and are demanding access to information, such as travel dates, travel itinerary, ticket information, contact details, baggage information, and payment information of anyone flying in or out of the EU.

Algorithms designed to match suspects and profiles have been proven in the past to create mismatches.

EU PNR data would be retained for up to five years. The parliament's lead negotiator on the bill, British conservative Timothy Kirkhope i, says the proposal has built in privacy safe guards.

But civil right defenders warn it may still end up in the scrap heap of EU laws.

"Adopting a measure that undermines the right to non-discrimination, freedom of movement, and privacy is the worst possible message at the worst possible time,” said Joe McNamee, executive director of European Digital Rights, a Brussels-based NGO.

Trains, planes, and automobiles

The European Court of Justice recently invalidated an EU-US data transfer agreement known as Safe Harbour. The decision was taken, in part, because of revelations about US-led mass surveillance of EU citizens. And last year, it tossed out the EU data retention directive over similar concerns.

Such warnings have not prevented the European Commission from co-financing around a dozen national PNR systems. France received the largest EU grant.

First proposed in 2011, the EU PNR scheme has gained momentum amid a sense of urgency to crack down on EU nationals who leave to go fight alongside Islamic State in Syria.

Estimates by the EU police agency, Europol, say there are 2,000 European foreign fighters. Others like the EU's counter-terrorism coordinator, Gilles de Kerchove i, put the figure closer to 5,000.

Buttereli said the attackers in Paris were already known to police weeks and months before they shot dead 130 people. He said a more effective plan would entail improving intelligence sharing and investing “in the human dimension” to analyse information.

Some intelligence experts say the PNR proposal may help authorities crack down on minor crimes but won't have an impact on tracking potential terrorists and foreign fighters.

Once the law is passed, they may simply opt to drive or take a train to their destination.

"As a member of the judiciary with a solid background on organised crime, anti-terrorism, anti-mafia legislation, for me this kind of databases are not smart databases,” said Buttereli.