Tuesday, 6 January 2004
European civil libertarians denounce USA use of EU data for CAPPS-II and other unauthorized purposes
My report here yesterday that the USA Department of Homeland Security is claiming the authority to use airline passenger data from the European Union to test the CAPPS-II passenger profiling and surveillance system has drawn immediate reaction from a leading European civil liberties coalition, the European Digital Rights initiative (EDRi).
The news release I received from EDRi isn't currently available on the EDRi Web site, so I'm reproducing it here in full:
Department of Homeland Security uses EU Air Passenger Data for Testing CAPPS-II
EU Personal Data in Maelstrom of U.S. Surveillance Networks
[European] Commission called to withdraw its finding of adequate data protection in the U.S.
Tuesday January 6th, 2004.
Personal data of EU citizens may, according to the EU Data Protection Directive, be transferred to foreign countries only if these have an adequate level of Data Protection. In the case of the Passenger Name Record (PNR) data transferred to the U.S., a senior U.S. official has now confirmed the data is already being used for purposes noncompliant with EU law.
After months of secretive negotiations with U.S authorities, EU Commissioner Frits Bolkestein announced on December 16 that the EU would transfer up to 34 fields of personal data to U.S. authorities for every passenger travelling to the United States. This decision was based on a so-called finding of adequacy in which the Commission assumes the data will be treated in a manner compatible with EU Data Protection law.
In an e-mail to Practical Nomad editor Edward Hasbrouck, Nuala O'Connor Kelly, the Chief Privacy Officer of the U.S. Department of Homeland Security, has now confirmed that this is not the case. According to O'Connor Kelly, "the language of the agreement contemplates the use of data to test -- and only to test -- CAPPS-II". She continues: "We also stated publicly that we will immediately begin follow-on discussions with the EU in order to establish a framework for the transfer of PNR data for use by CAPPS-II operations once the system has been fully developed and deployed."
According to Bolkestein, in his deliberations before two Committees of the European Parliament three weeks ago, the exclusion of the CAPPS-II system -- also known as "Total Travel Information Awareness" -- from the scope of the agreement had been prerequisite for the issuing of the finding of adequacy. Summing up his negotiations with Tom Ridge, the U.S. Secretary for Homeland Security and Bolkestein's U.S. counterpart in the negotiations on airline passenger data, the Commissioner said: "In concluding my last round of discussions with Mr Ridge, I informed him that in the light of the narrower uses for PNR, the exclusion for now of CAPPS-II and all the other improvements they had made, I was prepared to propose that the Commission make a finding of adequate protection with regard to transfers of PNR to the US Bureau of Customs and Border Protection." And Bolkestein clarified: "The arrangement will not cover the US Computer Assisted Passenger Pre-Screening System (CAPPS-II)".
Andreas Dietl, EU Affairs Director of data privacy watchdog European Digital Rights, comments: "Either Commissioner Bolkestein has been lying to the Committees of the European Parliament, or the U.S. Administration is re-interpreting the outcome of the negotiations. This is just one more indication that, once the data has reached the U.S., it will inevitably, like in a Maelstrom, end up in surveillance networks where it can never be controlled according to EU law. CAPPS-II data is fed directly into the US-VISIT database network, which grants access to a whole range of government agencies, including all secret services. If the Commission cannot assure that the data will be treated in the U.S. in a manner compliant with EU law, it has the obligation to halt its transfer immediately."
[Further addendum, 7 January 2004: The English-language version of the EDRi news release has now been posted on the EDRi home page . And there's more European reaction from Statewatch: USA to use EU PNR data for CAPPS II testing despite assurances no agreement covering it .]Link | Posted by Edward on Tuesday, 6 January 2004, 14:13 ( 2:13 PM)