INFORMAL PRIVACY CONFERENCE FOCUSES ON INTRA-EU

UNCLAS ROME 002993

SIPDIS


SENSITIVE

USEU FOR JOHN SAMMIS/STEVE CRISTINA

E.O. 12958: N/A
TAGS: ECON ECPS IT EUN
SUBJECT: INFORMAL PRIVACY CONFERENCE FOCUSES ON INTRA-EU
ISSUES


1. (SBU) On July 16, Italy,s Privacy authority hosted an
informal meeting, in preparation for a formal session in
Brussels this fall, to address PNR issues. Participants
included EU Privacy Authorities, the European Airline
Association and several European airlines. The morning
conference, which emboffs attended as observers, was entitled
"A workshop organized by the Article 29 Working Party on the
Agreement between the European Union and the United States of
America on the Processing and Transfer of PNR Data by Air
Carriers to the U.S. Department of Homeland Security, Bureau
of Customs and Border Protection, Signed on May 28, 2004."
The discussion was led by Peter Schaar, Chairman of the
Working Party. Other speakers included Waltraut Kotschy from
the Austrian DPA, carrier representatives (including Jim
Forster of British Airways, who spoke on behalf of the EAA,
and Mr. Camus of Air France and EU Commission officials).
After the public session, there was a closed afternoon
session of only Data Privacy Authorities.


2. (SBU) Beginning with Mr. Schaar, all speakers agreed
that EU airlines must provide PNR data to U.S. authorities.
There was no objection to the requirement, as embodied in the
adequacy finding and the U.S.-EU Agreement. The meeting
focused, instead, on nuts and bolts: push v. pull, from
airline data bases or a centralized EU data base; whether
data not in airline reservations systems must be provided;
who is required to pay the cost of filtering and transmitting
the data: and whether U.S. air carriers selling tickets
within the EU have the same data privacy requirements as EU
carriers. The other issue discussed was information to be
provided to EU citizens before providing PNR data or
purchasing a ticket.

Push vs. Pull
--------------


3. (SBU) EU Privacy Authorities believe that the current
"pull" system, whereby U.S. authorities access EU carrier
data banks directly (and thus have access to more than just
the agreed elements of PNR data),must be changed to a "push"
system, whereby EU entities send only the required elements
of PNR information. While concurring in principle, EU
carriers are concerned that implementing a push system will
be very expensive to develop and maintain.

Centralized vs. Decentralized Data Bases
--------------


4. (SBU) As representative of other EU carriers, British
Airways official Jim Forster said lack of a standard
procedure for providing PNR data was a problem. He called
for establishing a centralized EU processing mechanism, with
governments taking on the responsibility (and the cost) of
filtering and transmitting data to the U.S. In the airlines'
view, this would provide economies of scale, harmonize
procedures and provide greater negotiating power for the EU
and the European airlines vis-a-vis the USG.


5. (SBU) Austrian DPA Kotschy explained that the technical
proposal known as the "Austrian solution" would provide for
centralized EU processing and simplification and
standardization of procedures. However, she stressed that in
no way would this make national governments responsible for
PNR. Carriers would retain practical and legal
responsibility for filtering and transmitting data and for
paying these costs. In the discussion that followed,
representatives of EU Privacy Authorities were united in
stating that responsibility for providing PNR data remains
with the carriers, which are the "data controllers".

What Data Must Be Provided?
--------------


6. (SBU) BA's Forster raised a question for the Data
Protection Authorities regarding pushing or pulling data from
DCS. He noted that the finding and the agreement both called
for airlines to give U.S. authorities access to 34 data
items. In the U.S., these 34 data items are held in
reservations systems (PNR). However, in the EU, carriers
hold certain data in the departure control system (DCS).
None of the DCS data has been given to the U.S. authorities,
and it is not clear how technically difficult this would be.
DCS is not a "read only" system, and airlines fear that even
inadvertent altering of data could affect aircraft safety.
There has been no attempt to push or pull data from DCS.


7. (SBU) A discussion of this point ensued. The Austrian


DPA rep stated that, because the Agreement refers to PNR, any
of the 34 data elements not included in airline PNR systems
should not be given to U.S. Customs. Schaar declared the
adequacy decision and the U.S.-EU Agreement differed in
defining PNR. The Adequacy decision (para 4) defined PNR as
"data in the PNR system". However, the U.S.-EU Agreement
(para 2) defines PNR as "data in the PNR and DCS systems."
From the data protection standpoint, the adequacy finding is
more pertinent. Therefore, Schaar agreed that only data in
the PNR system need be transferred. Another participant then
challenged this statement and pointed out that Annex 1 of the
adequacy finding includes a statement that PNR data includes
data in both the PNR and DCS systems. Thus, the adequacy
finding also requires transfer of those 34 data elements
found within the DCS system. Schaar then referred back to
the flight safety implications of allowing access to DCS data
bases. This, he stressed, underlines the need to change to a
push system as soon as possible.

Who Should Pay?
--------------


8. (SBU) EU carriers protested that it was unfair to impose
on them the cost of filtering and transmitting data. EU
airlines would prefer that EU governments take the
responsibility for either paying the costs or forcing the
U.S. to pay. The DPAs were unwilling to enter into a
discussion on moving costs to others besides the airlines.

Are U.S. Carriers in the EU Subject to the Same
-------------- --
Requirements?
--------------


9. (SBU) Carriers also said they were disadvantaged relative
to the non-EU carriers not subject to the same privacy
requirements. BA's Forster asked for a final decision from
EU authorities on the legal position of U.S. airlines. He
recalled that, in May, Commission officials stated that U.S.
carriers were not subject to these requirements, but then
airlines heard they were subject. He asked for
clarification. The Austrian DPA rep responded that, if U.S.
carriers collect data in the EU, they fall under the EU data
protection law. The U.S. airlines are required to meet the
same requirements as EU airlines, since this is also an issue
of competition. The U.S. must take EU data the same way from
U.S. and EU carriers. Schaar declared that the EU privacy
directive is applicable to U.S. airlines, if data is
processed using technical means in Europe. "Any airline
flying to the U.S. from the EU uses technical means in the
EU. There is no question, no discussion." The discussion
ended with Schaar's statement that this issue would be
discussed at the autumn meeting.

Passenger Notification
--------------


10. (SBU) Passenger notification was a key focus of the
meeting. Schaar called for "comprehensive and very readable"
passenger information, to be provided to all airline
passengers flying from Europe to the U.S. Forster (BA)
explained that as airline web sites are increasingly
important in selling tickets (from four percent in 2003 to 25
percent in 2004),the Internet is efficient and permits
direct contact with customers. BA ensures that its customers
receive notice of their rights before reserving or buying
tickets. On the other hand, DPAs complained that most travel
agents had not yet begun to provide any passenger
notification. The Lufthansa rep protested that the airlines
could not be held responsible for travel agents' behavior.
The EU airlines stated that they are preparing to include
texts in tickets and the "conditions of carriage" document.
IATA will vote on these texts is in the autumn: Forster (BA)
noted that: "we have been waiting for the Commission to
provide us with the short, long and very long texts."

Comment
--------------


11. (SBU) As discussion ensued, it became obvious that there
were two groups working on different texts of passenger
notification documents. Airlines were working with IATA and
the Commission. The DPAs were developing a different type of
notification. When the airlines pointed out this
contradiction, Schaar responded that there would -- in the
end -- be only one set of notifications, and it would be
that of the Data Protection Authorities. Only the DPAs, he


stressed, had the authority to approve such passenger
notifications. He added that, as there was a Commission
representative in the Working Party, the Commission was well
aware of this. End comment.

Visit Rome's Classified Website:
http://www.state.sgov.gov/p/eur/rome/index.cf m

SEMBLER


NNNN
2004ROME02993 - Classification: UNCLASSIFIED