UK PASSENGER NAME RECOGNITION CONTINGENCY PLANNING

UNCLAS LONDON 005097

SIPDIS

SIPDIS

STATE FOR EB/TRA/OTPI (EMERY),EUR/ERA (NARDI),L/LEI
(PROPP)

E.O. 12958: N/A
TAGS: EAIR PTER PREL EU UK
SUBJECT: UK PASSENGER NAME RECOGNITION CONTINGENCY PLANNING

REF: A. HAAS-EMERY JULY 12 E-MAIL


B. LONDON 3860


1. (U) This is an action request, please see paragraph 7.


2. (U) SUMMARY: The UK is in the process of developing
contingency plans to ensure that airlines have legal cover to
provide passenger name recognition (PNR) data to Customs and
Border Protection (CBP) after September 30, even if a new
U.S.-EU agreement is not in place by then. The legal cover
consists of new UK domestic legislation as well as requests
to carriers operating UK-U.S.routes to a) change their
conditions of carriage to allow data sharing and b) seek
active consent from passengers to share data. The Department
for Transport has asked the U.S. to share this information
with U.S. carriers flying from the UK to London, and has
offered to answer their questions directly. Embassy suggests
that the Department share DfT's thinking with the Air
Transport Association. End Summary.


3. (U) We attended a July 12 meeting hosted by the Department
for Transport to learn of UK contingency planning to provide
airlines with legal cover for the transmission of PNR data
after September 30 in the event that a new EU-U.S. agreement
is not in place by that time. UK officials provided
participants with a paper (ref A) outlining their current
thinking on this issue. UK contingency planning consists of
two elements: what HMG intends to do to establish a domestic
legal basis for data sharing; and what carriers can do to
ensure compliance with UK data protection laws.


4. (U) The UK is currently developing domestic legislation
that will oblige all airlines operating from the UK to make
PNR data available to the U.S. as of September 30. Existing
legislation allows the Secretary of State for Transport to
issue regulations (without the consent of Parliament) as
needed to ensure that the UK is in compliance with the
Chicago Convention. In this instance, the UK intends to
issue an Air Navigation Order to comply with Article 13 of
the Convention, which requires compliance with a receiving
State's laws and regulations as to admission of passengers to
its territory.


5. (U) The UK is also asking carriers that fly from the UK to
the U.S. to ensure that their procedures on PNR data meet one
or more exemptions to UK domestic data protection law. The
DfT is focusing on two specific exemptions. The first allows
for the sharing of data when doing so is in fulfilment of a
contract. DfT is therefore advising carriers to review their
existing conditions of carriage to ensure that they include
the ability to share PNR data.


6. (U) Another exemption in UK data protection law allows for
the sharing of information if an individual gives his or her
"active consent" to the transmission. British Airways
already has a system similar to this on their website, where
customers must tick a box confirming that they agree that
their personal data may be shared with government authorities
for border control and aviation security purposes.


7. (U) Action requested: DfT officials indicate that, based
on their legal analysis, U.S. carriers are subject to UK data
protection laws even in cases where all PNR data was obtained
in the U.S. The DfT has therefore asked that information
regarding their contingency planning be shared with U.S.
carriers who fly from the UK to the U.S. so they can prepare
appropriately. Embassy suggests that the Department share
this information, as well as the paper prepared by the DfT
(ref A) to the Air Transport Association for distribution to
their members. Ref A also includes key DfT contacts on this
issue, both of whom have expressed their willingness to speak
directly with U.S. carriers.

Visit London's Classified Website:
http://www.state.sgov.gov/p/eur/london/index. cfm
Tuttle