Passenger Name Record Research Articles

Navigating the challenges of passenger name record data and the way forward

Background The TENACITy EU-funded project investigates the multifaceted challenges surrounding the utilisation of Passenger Name Record (PNR) data following the implementation of the PNR Directive (EU) 2016/681, which marks a significant shift in EU air travel intelligence. Methods This study employed a combination of research and survey methodologies to gather data from various stakeholders involved in the implementation of the PNR Directive. The survey focused on identifying the key obstacles faced by Passenger Information Units (PIUs), including the absence of standardised practices and issues of data quality. Results The findings highlight two primary obstacles confronting PIUs: the lack of standardised practices among stakeholders and the poor quality of PNR data. Additionally, fragmented implementation and regulatory barriers were identified as significant hindrances to the optimal utilisation of PNR data for counterterrorism and crime prevention efforts. Conclusions Addressing these challenges requires nuanced solutions, with technological tools presenting potential remedies to operational constraints. There is a collective call for mandating specific data elements to enhance the effectiveness of PNR data utilisation. This paper provides insights and recommendations to enhance PIUs' capabilities, contributing to the ongoing discourse on EU travel intelligence.

ENTRY-EXIT SYSTEM SCOPE, API/PNR CAPABILITY WEAKNESS

The practical recommendations for the application of Advance Passenger Information and Passenger Name Record System (API / PNR) were described in the article with the aim to use such system as a counteracting cross-border threats tool. Biometrics establishes a strong link between a document and its holder only if all electronic security features (signatures) are reviewed. That is the critical point of all system. Many EU countries don’t have Public key infrastructure in place and can’t use the mentioned security functions. There no joint EU system. Only ICAO has a commercial Public key directory, which provides PKI functions to some countries. Specific digital algorithms know and do many things better, like people, and can make a significant improvement. The order of actions for system implementing is proposed. He will be responsible for Risk assessment, Biometric verification accuracy, and Document verification. It is mandatory to improve data management, mostly to cover all fields and flows of data. Improve legislation related to data management for the mentioned purpose and GDPR. Besides, we have to invest more in automatic border control systems infrastructure. It is mandatory to centralize Public Key Infrastructure and Certificates master list management and validation. All measures will increase public security and save innocent lives from cross border crimes.

The criminalisation of travel as a global paradigm of preventive (In)justice: Lessons from the EU response to ‘foreign terrorist fighters’

This article aims to evaluate critically the evolution of the preventive paradigm of security law by focusing on the criminalisation and surveillance of mobility which has been labelled as ‘terrorist travel.’ The article will highlight the impact of the political imperative of tackling the phenomenon of ‘foreign terrorist fighters’ on the emergence of a global preventive paradigm of criminalisation of travel. The article will focus on the establishment of a preventive paradigm of criminalisation of travel in EU law, and its interactions with the global governance of counter-terrorism as renewed by the fight against ‘foreign terrorist fighters.’ The first part of the article will focus on the emergence of a multi-level paradigm of criminalisation of ‘terrorist travel’, while the second part will focus on the surveillance of travel through the collection, transfer and analysis of passenger name record (PNR) data. The article will cast light on the role of the political rhetoric on the fight against ‘foreign terrorist fighters’ in the evolution of this paradigm and highlight the challenges that this multi-faceted system of criminalisation and surveillance of travel pose for fundamental rights and the rule of law. A key challenge in this context is the extent to which the European Union is able to uphold its internal fundamental rights and rule of law safeguards in the evolution of a global paradigm of criminalisation of travel.

Flight Reservation System

Flight Reservation System

Case C-817/19, Ligue des Droits Humains v. Council of Ministers (C.J.E.U.)

On June 21, 2022, the Court of Justice of the European Union (CJEU), sitting as a Grand Chamber, rendered its decision in the preliminary ruling procedure C-817/19, Ligue des Droits Humains v. Council of Ministers. In its ruling, the CJEU held that the surveillance regime established by the Passenger Name Record Directive 2016/681 (PNR Directive) was compatible with the Charter of Fundamental Rights of the European Union (CFREU/EU Charter). Nevertheless, the CJEU strictly circumscribed the Directive's transposition within EU member states' domestic laws. While restricting permissible interpretations of the PNR Directive's provisions and imposing strict limitations on its scope to ensure its conformity with the EU Charter, for the first time the Court upheld an instrument of indiscriminate surveillance as compatible with EU primary law. This represents a significant development in the CJEU's case law on privacy rights, which is likely to affect the negotiation and development of future PNR agreements with third countries, as well as the development of the ePrivacy Regulation, discussions surrounding the regulation of AI, and negotiations for international instruments aiming to address serious crimes. Further, the ruling confirms the CJEU's increasing convergence with the European Court of Human Rights' (ECtHR) case law on the matter, thus inscribing national security as a legitimate exception to the general prohibition of indiscriminate bulk data collection and retention in Europe.

Case C-817/19, Ligue des Droits Humains v. Council of Ministers (C.J.E.U.)

On June 21, 2022, the Court of Justice of the European Union (CJEU), sitting as a Grand Chamber, rendered its decision in the preliminary ruling procedure C-817/19, Ligue des Droits Humains v. Council of Ministers. In its ruling, the CJEU held that the surveillance regime established by the Passenger Name Record Directive 2016/681 (PNR Directive) was compatible with the Charter of Fundamental Rights of the European Union (CFREU/EU Charter). Nevertheless, the CJEU strictly circumscribed the Directive's transposition within EU member states' domestic laws. While restricting permissible interpretations of the PNR Directive's provisions and imposing strict limitations on its scope to ensure its conformity with the EU Charter, for the first time the Court upheld an instrument of indiscriminate surveillance as compatible with EU primary law. This represents a significant development in the CJEU's case law on privacy rights, which is likely to affect the negotiation and development of future PNR agreements with third countries, as well as the development of the ePrivacy Regulation, discussions surrounding the regulation of AI, and negotiations for international instruments aiming to address serious crimes. Further, the ruling confirms the CJEU's increasing convergence with the European Court of Human Rights' (ECtHR) case law on the matter, thus inscribing national security as a legitimate exception to the general prohibition of indiscriminate bulk data collection and retention in Europe.

INNOVATIONS IN DATA EXCHANGE FOR LAW ENFORCEMENT TASKS

Information systems are becoming increasingly important in the functioning of law enforcement authorities. In addition to border control in the area, the exchange of information between national competent services is of particular importance. This process is ensured in the European Union through a number of tools, some of which the Schengen Information System, Passenger Name Record, the Europol’s Secure Information Exchange Network Application are. Legal instruments such as the Prüm Decisions and the Swedish Initiative have been adopted to reduce legal barriers and accelerate the exchange of information between national competent services. However, criminal threats force to reassessment of the effectiveness of existing cooperation and for even more targeted action. Although existing resources and technological capabilities allow information to be searched online, to perform cross-checks for match detection and rapid data exchange, modern options have not been fully implemented yet. The aim of this article is to analyse the existing instruments for information exchange and to assess the novelties of the Directive of the European Parliament and of the Council on information exchange between law enforcement authorities of Member States, repealing Council Framework Decision 2006/960/JHA. Empirical research methods were used in the study. The author of the study comes to the conclusion that the implementation of the Directive requires significant improvements in national regulation.

Passenger name record (PNR) data: How the EU is promoting (virtual) security by actually limiting Passengers' fundamental rights

AbstractThe use for security purposes of airline passenger data (PNR) has gradually come to the fore especially in EU‐US relations because of the tension between those who considered the use of PNR an effective tool in the fight against terrorism and those who considered the interference in citizens' privacy disproportionate. The Court of Justice intervened decisively on the issue in June 2022 with the “Ligue des Droits Humains” Judgment C‐817/19. This ruling should have been followed by a review of the national legislations that transposed the Directive. On the contrary, the Member States are still going in the opposite direction to that indicated by the Court.

Наказателноправно сътрудничество след Брекзит и парадоксът с резервационните данни на пътниците – по-всеобхватно сътрудничество при по-ниска защита на личните данни?

After Brexit, a certain paradox can be observed in the cooperation between the EU and the UK on passenger name record (PNR) data. While Brexit leads by definition to fewer possibilities for criminal law cooperation between the EU and the UK and to a narrower level of cooperation achieved so far, it seems to have led to an increase in the possibilities for processing PNR data of EU citizens and to lower standards of personal data protection. The question arises as to whether this is compatible with the EU Charter and with the case law of the CJEU.

Fluggastdatenspeicherung: Die Zukunft von Vorratsdatenspeicherung und automatisierter Verdachtsgenerierung

In <italic>Ligue des droits humains,</italic> the CJEU declared the EU Directive on Passenger Name Record (PNR) data to be compatible with Articles 7 and 8 CFR. The Court therefore declined to invalidate the PNR Directive, but significantly curtailed almost all of its central tenets. This contribution analyzes what the decision entails for the PNR system. It argues that the German transposition law, the <italic>Fluggastdatengesetz,</italic> can no longer function as a suitable legal basis for the German PNR system since it is in flagrant violation of EU law, as interpreted by the Court. Hence, the German PNR system must be stopped until the <italic>Fluggastdatengesetz</italic> has undergone parliamentary reform. Since <italic>Ligues des droits humains</italic> also represents a landmark decision on predictive policing, this contribution critically dissects how it is significant for the future of European security law beyond the PNR context. In so doing, it focusses firstly on the evolving doctrinal standards for the mass retention of personal data and secondly, on the technology-induced, automated generation of suspicion pertaining to threats to public security. Regarding the first point, the decision is situated in an evolving jurisprudence prescribing a situation-specific reduction of the objective criteria for mass surveillance as put forth in <italic>Digital Rights Ireland.</italic> Regarding the second point, this contribution contrasts the CJEU’s approach – which is characterized by a lack of substantive boundaries, and an abundance of technology-specific procedural guarantees with many delegations to Member States – with the stricter approach taken by the German Constitutional Court. It argues that the current doctrinal framework is insufficient in addressing the rule-of-law concerns raised by the reliance on modern technologies for the purposes of the automated generation of suspicions. Based on the aim of stabilizing relationships of mutual recognition through human interventions, this contribution makes some tentative doctrinal proposals for bridging the gap between automated hits and concrete threats. It then concludes with an outlook to the ETIAS Regulation.

Epistemic fusion: Passenger Information Units and the making of international security

AbstractThis article focuses on the control of international mobility through the gathering, processing, and sharing of air travellers’ data. While a lot has been written about pre-emptive rationalities of security translated into the functionalities of IT systems used for border controls, we take a step further and investigate how these rationalities are operationalised through data transfer, screening, validation, discarding, profiling, contextualisation, calibration, and adjustment practices. These practices may seem banal and technical; however, we demonstrate how they matter politically as they underpin the making of international security. We do so by analysing the work of Passenger Information Units (PIUs) and retracing how they turn Passenger Name Record (PNR) data into actionable intelligence for counterterrorism and the fight against serious crime. To better understand the work of PIUs, we introduce and unpack the concept of ‘epistemic fusion’. This explicates how security intelligence comes into being through practices that pertain to cross-domain data frictions, the contextualisation of data-driven knowledge through its synthesis with more traditional forms of investigatory knowledge and expertise, and the adjustment of the intelligence produced to make it actionable on the ground.

Passenger Name Record Data Protection under European Union and United States Agreement: Security over Privacy?

Privacy should become a key component in the IT system. It is not something to be considered at last but from the very early stages. Almost no nation has a greater sense of personal data security which could be equivalent to the European level. Since 9/11, the United States has declared to utilize PNR as a method for combating terrorism by associating PNR data with criminal records. Nevertheless, in fact, the majority of data found in the PNR is immense and most of this data is of a confidential nature. The paper used doctrinal legal research methodology utilizing the case and comparative law approach. It elaborates particular cases in relation to data protection issues. It also explores the differences between EU and US law which hinder the idea of data protection in particular on PNR. The study revealed that security is one of the most critical issues which hinder the agreement between the EU and the US on PNR data protection. As the EU promotes the highest standard to the data protection referring to the European community history and GDPR provisions, while the US places national security as a main priority beyond the privacy issues.

The European PNR Directive as an instance of pre-emptive, risk-based algorithmic security and its implications for the regulatory framework1

The Passenger Name Record (PNR) Directive has introduced a pre-emptive, risk-based approach in the landscape of European databases and information exchange for security purposes. The article contributes to ongoing debates on algorithmic security and data-driven decision-making by fleshing out the specific way in which the EU PNR-based approach to security substantiates core characteristics of algorithmic regulation. The EU PNR framework appropriates data produced in the commercial sector for generating security-related behavioural predictions and does so in a way that gives rise to a paradoxical normativity directly dependent on empirical states. Its ‘securitisation move’ is moreover characterised by an inherent tendence to expand. As a result, the PNR Directive poses challenges for existing check and balance mechanisms and for human autonomy. These challenges could be partially addressed by strengthening ex-post control procedures and independent auditing. Yet in the decision to adopt a risk-based security model, something more fundamental seems to be at stake, namely, the preservation of the idea of human beings as moral agents able to direct and modify their behaviour in accordance with an intelligible, reliable and predictable normative order.

Ceci n’est pas un contrôle: PNR Data Processing and the Reshaping of Borderless Travel in the Schengen Area

Abstract Can national authorities perform systematic checks on persons engaged in cross-border travel in the Schengen area without these checks being considered as border checks or as having an equivalent effect to border checks? The present article investigates a specific set of measures that involve the harnessing of “new technology” to enact systematic controls on persons traveling across the internal borders of Schengen states, through the processing of Passenger Name Record (PNR) data and in the framework of the EU PNR Directive. It argues that PNR data processing should at the same time be understood as part of the alternatives to border checks available for Member States to regulate cross-border mobility in the Schengen area and as a standout among these measures. PNR data processing challenges the existing legal framework of Article 23(a) of the Schengen Borders Code (SBC) as well as the assessment framework developed by the CJEU in its relevant case-law, not because it contravenes Schengen rules, but because it stretches and overflows them. Ultimately, PNR data processing puts into question the very understanding of what checks performed in relation to the act or intention of crossing a border actually stand for or whether controls related to border crossings can be characterised as border controls.

SOME ASPECTS OF USING PASSENGER DATA (API/PNR) IN SUPPORT OF BORDER SECURITY

The article reveals with the logic, mechanism and main parameters for using passenger data (API/PNR). The interrelation of the concepts of “Advance Passenger Information” and “Passenger Name Record” has been revealed. It has been determined that the systems of simplification of formalities also have a positive effect on security. For example, the purpose of data collection in the EU is to effectively combat illegal migration and strengthen border control, as well as to prevent, detect, investigate and prosecute terrorist and serious crimes. This applies to both the Passenger Information System (API) and additional passenger data, such as Passenger Name Record (PNR) data. There is no doubt that the successful application of API and PNR data exchange depends on a unified approach of all participants in information relations (both border agencies and airlines in different countries) regarding the question of data standard and standard of their transmission. Ensuring such a unified approach is a problem even when there is unity of legal regulation on data format and data exchange procedures. There are no special regulations in the national legislation that would regulate the relationship regarding the circulation of passenger registration data, nor is there a specific entity that processes this type of information. Thus, there is a need for special legal regulation of the circulation of information about airline passengers crossing the state border of Ukraine. In particular, the legislation must regulate the procedure, grounds, purpose of obtaining, processing, transmission, storage and destruction of information about passengers (its content), protection of the right to confidential information of persons operating international flights, establish a responsible controller of such information.

Beyond data protection concerns – the European passenger name record system

ABSTRACT In this article, we examine the European framework of collecting and analysing flight passenger name record (PNR) data for the purpose of combating terrorism and serious crime. The focus is mainly on the EU PNR Directive of 2016, but we also consider the specific legislative framework in Germany and Denmark. In light of the recent review of the Directive, the article aims at exploring the policy-related, legal and technological challenges. In doing so, it goes beyond established data protection concerns. In particular, we debunk the popular claim that PNR analysis in and of itself entails the risk of discrimination of certain groups – a claim commonly levelled against algorithmic analysis. We also provide useful insights into the specific legal safeguards vis-à-vis automated profiling and decision-making through human review.

Politicising European counter-terrorism: the role of NGOs

ABSTRACT The article examines the role of NGOs in the politicisation of EU security. The focus of the empirical analysis lies on the field of EU counter-terrorism. The cases selected are two different types of legal acts, adopted in the aftermath of serious terrorist attacks in EU member states: The EU data retention directive and the EU passenger name record (PNR) directive. These policies present intrusiveness and relevance for Brussels-based and national civil rights NGOs since they both aim to touch upon individual liberties, like privacy rights or the right to protect personal data. The article goes further by opening up the black box of politicisation. It does so by assuming that politicisation is characterised by a certain level of salience, actor range and polarisation. The paper links politicisation literature to research on the influence of interest groups that are discussing, for example, voice, access or litigation as strategies. Therewith, the paper contributes to the scientific debate on politicisation in two ways: First, it sheds light on the so far disregarded role of NGOs in politicisation. Second, it builds a bridge to interest group literature by examining repertoires of NGOs in politicisation.

Legitimizing pre-emptive data surveillance under the EU law: the case of the PNR Directive

The paper analyses the PNR Directive as pre-emptive data surveillance practice. The 2016/681 Directive regulates the use of Passenger Name Record (PNR) data in the EU for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. It obliges airlines to hand national authorities passengers’ data for all flights from third countries to the EU and vice versa, but Member States can also extend it to ‘intra-EU’ ones (i.e. from an EU country to one or more other EU countries), provided that they notify the EU Commission. Thus, PNR Directive affects all passengers who arrive in the territory of one Member State originating from a third country, or who depart from a Member State’s territory to a non-EU country, including any transfer or transit flights. Using PNR data, the individual is profiled and encoded in terms of degrees of risk.

Data protection and passenger name record in judicial criminal matters under the EU–UK Trade and Cooperation Agreement

The submission discusses the provisions in the EU–UK Trade and Cooperation Agreement on data protection as well as the consequences for the exchange of passenger name record data in the field of criminal and judicial cooperation. The author concludes that the impact of the Agreement will depend on the resolvement of the United Kingdom to uphold the standards of protection of personal data equivalent to the EU’s in order to reach an adequacy decision.

Police cooperation and exchange of information under the EU–UK Trade and Cooperation Agreement

Brexit has led to a realignment of police cooperation and information exchange between the EU and the UK. This has been affected by Titles II-V and IX of Part III of the Trade and Cooperation Agreement. The terms governing the exchange of DNA, fingerprint and vehicle registration data, the transfer and processing of passenger name record data, cooperation on operational information, membership of Europol and the exchange of criminal record information are henceforth governed by that instrument. This article describes the changes and comments upon how future EU-UK police cooperation may be impacted.