In a press release dated December 6, 2007, the Article 29 Working Party expressed serious concerns over the Commission’s proposal for a European PNR regime. In its view, the legislative proposal is still in its early stage and far from fulfilling data protection requirements. It will nonetheless be submitted to the European Council for implementation. In particular, the Working Party highlights the following shortcomings: (1) the proposal does not substantiate any legitimate basis for the collection of passenger data; (2) the amount of personal data collected is unreasonable; and (3) the retention period of 13 years seems to be excessive. Additional shortcomings include inadequate filtering mechanisms and possible third-country transfers.
The press release is available at: http://ec.europa.eu/justice_home/fsj/privacy/news/docs/pr_05_12_07_en.pdf
The European Data Protection Supervisor (EDPS) was consulted by the European Commission regarding this new proposal, and issued an opinion critical of the following elements: (1) insufficient justification of the legitimacy of the measures in view of the purpose of combating terrorism; (2) serious lack of legal certainty; (3) lack of clarity about the identification of the data recipients; and (4) potential data transfers to third countries.
The full Opinion is available (in English) at: http://www.edps.europaeu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2007/07-12-20_EU_PNREN.pdf