UK PASSENGER NAME RECOGNITION CONTINGENCY PLANNING

UNCLAS LONDON 005097 SIPDIS SIPDIS STATE FOR EB/TRA/OTPI (EMERY),EUR/ERA (NARDI),L/LEI (PROPP) E.O. 12958: N/A TAGS: EAIR PTER PREL EU UK SUBJECT: UK PASSENGER NAME RECOGNITION CONTINGENCY PLANNING REF: A. HAAS-EMERY JULY 12 E-MAIL ¶B. LONDON 3860 ¶1. (U) This is an action request, please see paragraph 7. ¶2. (U) SUMMARY: The UK is in the process of developing contingency plans to ensure that airlines have legal cover to provide passenger name recognition (PNR) data to Customs and Border Protection (CBP) after September 30, even if a new U.S.-EU agreement is not in place by then. The legal cover consists of new UK domestic legislation as well as requests to carriers operating UK-U.S.routes to a) change their conditions of carriage to allow data sharing and b) seek active consent from passengers to share data. The Department for Transport has asked the U.S. to share this information with U.S. carriers flying from the UK to London, and has offered to answer their questions directly. Embassy suggests that the Department share DfT's thinking with the Air Transport Association. End Summary. ¶3. (U) We attended a July 12 meeting hosted by the Department for Transport to learn of UK contingency planning to provide airlines with legal cover for the transmission of PNR data after September 30 in the event that a new EU-U.S. agreement is not in place by that time. UK officials provided participants with a paper (ref A) outlining their current thinking on this issue. UK contingency planning consists of two elements: what HMG intends to do to establish a domestic legal basis for data sharing; and what carriers can do to ensure compliance with UK data protection laws. ¶4. (U) The UK is currently developing domestic legislation that will oblige all airlines operating from the UK to make PNR data available to the U.S. as of September 30. Existing legislation allows the Secretary of State for Transport to issue regulations (without the consent of Parliament) as needed to ensure that the UK is in compliance with the Chicago Convention. In this instance, the UK intends to issue an Air Navigation Order to comply with Article 13 of the Convention, which requires compliance with a receiving State's laws and regulations as to admission of passengers to its territory. ¶5. (U) The UK is also asking carriers that fly from the UK to the U.S. to ensure that their procedures on PNR data meet one or more exemptions to UK domestic data protection law. The DfT is focusing on two specific exemptions. The first allows for the sharing of data when doing so is in fulfilment of a contract. DfT is therefore advising carriers to review their existing conditions of carriage to ensure that they include the ability to share PNR data. ¶6. (U) Another exemption in UK data protection law allows for the sharing of information if an individual gives his or her "active consent" to the transmission. British Airways already has a system similar to this on their website, where customers must tick a box confirming that they agree that their personal data may be shared with government authorities for border control and aviation security purposes. ¶7. (U) Action requested: DfT officials indicate that, based on their legal analysis, U.S. carriers are subject to UK data protection laws even in cases where all PNR data was obtained in the U.S. The DfT has therefore asked that information regarding their contingency planning be shared with U.S. carriers who fly from the UK to the U.S. so they can prepare appropriately. Embassy suggests that the Department share this information, as well as the paper prepared by the DfT (ref A) to the Air Transport Association for distribution to their members. Ref A also includes key DfT contacts on this issue, both of whom have expressed their willingness to speak directly with U.S. carriers. Visit London's Classified Website: http://www.state.sgov.gov/p/eur/london/index. cfm Tuttle