Billy Tompson: Air passenger data plans in US-EU agreement are illegal, say lawyers

European commission lawyers say scheme allowing check-in data to be held for 15 years takes away a fundamental right

The European commission's own lawyers have warned that a joint US-European agreement to store the personal data, including credit card details, of millions of transatlantic air passengers for 15 years is unlawful.

The confidential legal opinion, passed to the Guardian, says the agreement to allow the US department of homeland security to store airline check-in data is "not compatible with fundamental rights".

The note by the commission's legal service, dated 16 May, says it has "grave doubts" that the passenger name record (PNR) deal, now being finalised, complies with the fundamental right to data protection.

The official legal opinion could prove crucial as the agreement, which has been negotiated by the commission with the US, needs the approval of the European parliament as well as ministers.

Leaked details of an EU ambassadors' meeting last week showed the French, Germans, Italians, Dutch and others are still strongly critical of the proposed deal, with only the British, Irish, Swedes and Estonians supporting it.

Commission officials played down the significance of the official legal opinion, which was provided to negotiators before the deal was finalised, by saying its legality could only be tested in the courts.

The European lawyers say their "most serious concerns" cover the widely-drawn limits on the use of the personal data, the disproportionate storage period of 15 years, the lack of independent oversight and proper access to the courts for those seeking redress over misuse of their details. Their concerns include:

??The US-European PNR database is being built "to prevent and detect terrorism and serious crime" but the lawyers say this definition includes any offence carrying a jail term of more than 12 months: "Given the low maximum penalty, it is likely to include a very large number of crimes which cannot be regarded as serious. This point alone puts the proportionality of the agreement in question."

??The PNR database can also be used "to ensure border security", by identifying people who should be subject to closer questioning on entering or leaving the US. The lawyers say this means the database can be used to investigate minor immigration or customs offences without any link to terrorism or serious crime.

??The 15-year retention period ? four times longer than the current deal ? includes five years on an "active" database, after which information will be archived in a "dormant" database for 10 years, though still accessible to senior law enforcement agents. The lawyers say 15 years goes "far beyond'' the five years in the EU's own proposal for internal European travel, and the five and a half years in a proposed deal with Australia: "The council legal service in its opinion on EU-PNR ... questioned the necessity of a period of more than two years. It appears highly doubtful that a period of 15 years can be regarded as proportional."

??Judicial redress for aggrieved individuals is not guaranteed, the lawyers say: "All redress is made subject to US law, while the forms of redress explicitly guaranteed are administrative only and thus at the discretion of the department of homeland security."

??Oversight to be carried out by homeland security "privacy officers" does not amount to independent oversight, say the European lawyers.

The official legal advice concludes: "Despite certain presentational improvements, the draft agreement does not constitute a sufficiently substantial improvement of the agreement currently applied on a provisional basis, the conclusion of which was refused on data protection grounds by the European parliament."

They add that the use of PNR for border security purposes is a setback from the current agreement. "For these reasons the legal service does not consider the agreement in its present form as compatible with fundamental rights."

Tony Bunyan of Statewatch, which monitors civil liberties across Europe, said the European parliament should refuse to consent to the agreement, as it is allowed to do under the Lisbon treaty. He said it did not meet EU data protection standards, nor provide judicial redress or independent oversight.

"Secret minutes of EU-US meetings since 2001 show that they have always been a one-way channel, with the US setting the agenda by making demands on the EU," said Bunyan. "When the EU does make rare requests, like on data protection, because US law only offers protection and redress to US citizens, they are bluntly told that the US is not going to change its data protection system ? as they were at the EU-US JHA ministerial meeting in Washington on 8-9 December 2010."

Jan Philipp Albrecht, a German Green party MEP and member of the European parliament's civil liberties committee, said the document showed the EU was acting against its own legal advice in pushing ahead with the proposed retention of sensitive passenger data.

"The commission cannot simply continue to stick its fingers in its ears, and it is high time that it dropped its obsession with PNR. This means going back to the drawing board and renegotiating the draft agreements with the US, Australia and Canada on passenger record retention, ensuring these agreements are in line with EU data protection law.

"It also means dropping the proposed legislation on the retention of passenger data within the EU."

Alan Travis

guardian.co.uk © Guardian News & Media Limited 2011 | Use of this content is subject to our Terms & Conditions | More Feeds