JOINT COMMITTEE ON JUSTICE, DEFENCE AND EQUALITY díospóireacht -
Wednesday, 16 May 2012

Transfer of Passenger Name Records: Motion

Chairman

I welcome the Minister and his officials. We will first have a briefing from the Minister on the agreement between the European Union and USA, followed by a question and answer session. The same procedure will apply to the second and third items. The motion moved in the Dáil reads as follows:

That the proposal that Dáil Éireann approves the exercise by the State of the option or discretion under Protocol No. 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, to accept the following measure:

the Council Decision on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of Passenger Name Records to the United States Department of Homeland Security,

a copy of which was laid before Dáil Éireann on 6th December, 2011, be referred to the Joint Committee on Justice, Defence and Equality, in accordance with Standing Order 82A(4)(j), which, not later than 24th May, 2012, shall send a message to the Dáil in the manner prescribed in Standing Order 87, and Standing Order 86(2) shall accordingly apply.

I invite the Minister to brief the joint committee on the agreement.

Minister for Justice and Equality (Deputy Alan Shatter)

The motion before the joint committee is to enable Ireland to participate in the agreement between the European Union and the United States on the use and transfer of passenger name records, PNR, to the United States Department of Homeland Security, which has been adopted by the Council of Ministers. I propose that Ireland should exercise the option provided by Article 4 of Protocol 21 to the Treaty on the Functioning of the European Union to accept a measure after it has been adopted by the Council. The prior approval of both Houses of the Oireachtas is required to enable Ireland to exercise this option.

It is my view that sensible measures which can give law enforcement authorities an advantage in the fight against serious crime and terrorism are to be welcomed and deserve support. This agreement replaces the current EU-US agreement on passenger name records which has been operation since 2007. The agreement has been renegotiated to address concerns that had been raised about proportionality, data protection and data security aspects. A new agreement was established to cover the ongoing use and transfer of PNR data to the United States authorities. It was signed on 14 December 2011 and sent to the European Parliament, which considered it in detail. The terms of the agreement were improved by the Parliament on 19 April 2012 and it was then concluded by the Council of Justice and Home Affairs Ministers at its meeting on 26 April last.

PNR data are information about passengers' travel plans that are collected and held by air carriers as part of their reservation systems. The agreement will require the airlines to provide a portion of the information they collect to the US authorities for the purpose of combating terrorism and serious transnational crime. PNR is a tool of proven value to law enforcement services in counter-terrorism and serious crime investigations, especially in cases of trafficking in drugs and persons. A number of countries, including the United Kingdom, Canada, Sweden, Spain, the United States and Australia, have been using PNR data for some years for these purposes.

PNR data have been of benefit in cracking a number of significant transnational organised crime cases. For example, the UK authorities targeted and successfully prosecuted a Chinese gang of human traffickers bringing illegal immigrants into the UK and Ireland through other EU states. The use of PNR data was key in identifying the passengers and linking them to the trafficking facilitators.

The use of PNR data was instrumental in the prosecution and conviction of David Headley for involvement in the atrocious terrorist attacks in Mumbai in India in November 2008 in which 164 innocent people lost their lives. By entering details of the suspect's first name, his partial travel itinerary and a possible travel window into the PNR database David Headley's full name, address and passport number were obtained. He was subsequently arrested and pleaded guilty to terrorism-related charges.

While this measure is an important support to the fight against terrorism and serious crime I am very conscious of the need to ensure the rights of citizens are not subjected to unnecessary or disproportionate intrusion. It is important to strike an appropriate balance, particularly with regard to the protection of personal data and I believe this agreement does just that. The agreement provides that all air carriers operating flights between the EU and the US will continue to transmit certain PNR data for passengers flying to or from the US. The agreement contains a number of specific safeguards with regard to the use of PNR data, particularly strictly limiting the processing of the data to the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious transnational crime. These offences are defined in the agreement, including by reference to existing EU legal instruments already in force. Furthermore, the agreement sets out clearly a series of detailed provisions relating to data retention, protection and security.

I will not take up the committee's time describing all of the provisions in detail as I am sure members will have read the proposal. With regard to the retention periods, the PNR data will be retained by US authorities for up to five years in what is known as an active database with restrictions on access. After the first six months the PNR data will be depersonalised, that is to say the fields which would identify an individual would be masked out. After the initial five year period the depersonalised data will be transferred to an inactive database with additional access restrictions. In the case of terrorist offences and related crimes the data may then be retained for up to a further ten years, that is to say for a total of 15 years. In the case of serious transnational crimes the data can be retained for a further five years, that is to say for a total of ten years.

I draw attention to the specific safeguards with regard to privacy, data protection and security, oversight, accountability, transparency, the right of access to information and the correction of errors and redress. Members should note that under the terms of the agreement an individual has the right to access his or her own data, to have incorrect data corrected and to redress for violation of his or her rights under the agreement. It is also noteworthy that the agreement provides that the safeguards which are in place in the US for privacy and data protection are available to all individuals regardless of nationality, country of origin or place of residence. The agreement also provides for regular joint review of its operation by EU and US authorities and for joint evaluation of the agreement four years after its entry into force. The agreement will remain in force for a period of seven years.

This proposal is one of a number of measures being taken at EU level in the justice and home affairs field which arise from commitments set out in the 2009 Stockholm programme. The Government is determined that Ireland will have full, active and constructive engagement in bringing forward the European justice agenda given the potential value of PNR data in investigations into drug smuggling, human trafficking or international terrorism. Given the importance of giving a clear demonstration of our continued support for and solidarity with the international community in the fight against these activities I recommend Ireland's participation in this particular measure. I have no doubt the majority of members will share this view and I commend the motion to the committee.

Deputy Dara Calleary

I thank the Minister for coming before the committee. We will support this measure when it comes to the main House. If anybody needed reminding of the threat that still faces airline travel we had the incident in the United States last week, and this type of measure is to protect all of us . With regard to the ability of an individual to access his or her own data will the Minister outline how this can happen? What agency will a person use to access this information? Will there be a fee to seek information and what will be the turnaround time? If the information retained contains a difficulty or discrepancy what right of appeal or correction does a citizen have?

Deputy Alan Shatter

I refer the Deputy to Article 11 of the measure which deals with the issue of access for individuals. Paragraph 1 states that in accordance with the provisions of the Freedom of Information Act, any individual, regardless of nationality, country of origin, or place of residence is entitled to request his or her PNR data and it must be provided in a timely manner. Article 11 also states disclosure of information contained in PNR may be subject to reasonable legal limitations, applicable under US law, including any limitations that may be necessary to safeguard privacy. Any refusal or restriction of access must be set forth in writing and provided to the requesting individual on a timely basis. Such notification will include the legal basis on which information was withheld and shall inform the individual of the available options under US law for seeking redress. As I understand it the information is disclosed only to the individual concerned who seeks the information. Article 12 makes provision for the correction of this information when correction must be made to it.

Deputy Finian McGrath

Does the Minister have any concerns about the human rights record of the United States? Yesterday I came across the case of an innocent man who was kidnapped by the CIA, brought off and tortured and eventually released, but who could not press charges against the US Government because of changes in legislation in the United States. Do the Department and the Minister have an uncritical view of this? Does the Minister accept people in the State will keep a very close eye on big powers such as the US? Does the Minister have concerns about the use of Shannon Airport and the human rights issues raised there by many of my colleagues?

Deputy Alan Shatter

I do not share Deputy McGrath's paranoia about the United States.

Deputy Finian McGrath

It is not paranoia, it is reality.

Deputy Alan Shatter

I am concerned about ensuring maximum co-operation between this State, EU member states and the United States in fighting terrorism and organised crime. There is a need to recognise the internationalisation of serious crime. There are no real borders in the minds of those engaged in international crime and terrorism. We have seen appalling atrocities committed by people engaged in terrorism, from the appalling atrocities of 11 September 2001 to the events in Mumbai to which I made reference. We have a duty and an obligation to ensure we co-operate with other states in the provision of information that will either prevent such atrocities or ensure where they occur that they are adequately investigated and information is made available. The proposal before the committee is balanced and measured and has been subject to detailed examination by the European Commission, the Council of Ministers and the elected Members of the European Parliament. I am satisfied it is an appropriate measure. I believe it is important we protect the human rights of innocent individuals who want to go about their lives without fear of bombs exploding or aircraft being used as weapons.

We have an obligation to protect individuals who are exploited by human traffickers. We also have an obligation to ensure that in the event of women being trafficked so that their bodies might be sold for sexual purposes and to the benefit of those who control them, adequate co-operative investigations can take place on an international and transnational basis. I find it extraordinary that Deputy McGrath would use this committee, as he has frequently done, for the usual anti-American diatribe without giving any recognition of any description or nature-----

Deputy Finian McGrath

The Minister has not yet answered one question that I asked him. He has gone off message.

Chairman

One moment.

Deputy Finian McGrath

With respect, he has not answered the question.

Chairman

I will allow the Deputy to respond in a moment.

Deputy Finian McGrath

A senior Minister of this House has no regard for human rights.

Deputy Alan Shatter

Deputy McGrath does not give any recognition of any nature to the reality that this is a measure-----

Deputy Finian McGrath

I raised the issue of human rights. I will take no guff like that from the Minister.

Chairman

The Deputy will have his chance in a moment.

Deputy Finian McGrath

He has no authority. He did not answer one of my questions. It is a disgrace.

Deputy Alan Shatter

This measure is designed to protect the human rights of the general community and individuals across the EU and the US against those engaged in organised crime and terrorism. If Deputy McGrath wishes to present it as something different by raising issues that are totally extraneous to the particular measure, he is free to do so.

Deputy Finian McGrath

My question, which the Minister refused to answer, was whether he had concerns about the human rights record of the USA. I provided examples of the issue. My point has nothing to do with the broad support by the House for tackling human trafficking and international violence and terrorism. Many open-minded people have concerns about the human rights record of this major power. My question was simple, yet the Minister fudged it as usual. He was selective in his answer.

Chairman

Through the Chair, please.

Deputy Alan Shatter

I understand that we are dealing with this issue and not a general issue about the human rights record of the US or any other country. I am dealing with the matter that is on the agenda of the committee. If the Deputy wishes to have a general discussion on foreign policy and human rights issues, I would be happy as the Minister for Justice and Equality over the Department with responsibility for human rights issues in this State to engage in that area. However, this is a specific, discrete issue that we are dealing with today. I find it surprising and very interesting that the Deputy is incapable of expressing any support for this measure or of recognising its benefits to people throughout this country and to people in the rest of Europe as an instrument to protect people in Europe, Ireland and the United States by maximising information about matters relating to organised crime and terrorism and by ensuring, as best we can with these sorts of co-operative instruments, the various police and security forces can utilise crucial information to protect communities.

Senator Ivana Bacik

I welcome the Minister. I apologise in advance, as I must return to the Seanad at 3.30 p.m. This is an important issue for the committee to debate. There has been a request in the Upper House that the matter also be debated on the floor of the Seanad if the committee recommends the motion to the Houses.

Each of us takes the Minister's point about vigilance, particularly in terms of airport security. We were all pleased to hear about the need for a balance between the rights of people to be free from terrorist attack and harm and their right to privacy and about the need to ensure adequate safeguards were in place. Concerns were raised in the European Parliament about safeguards and the length of the data retention periods provided for in this measure.

I wish to ask about the safeguards, a matter referred to in Articles 5 and 6 of the Council decision. What is entailed in oversight? Article 5(4) provides that the Department of Homeland Security, DHS, would inform the relevant European authorities about cases of significant privacy incidents. Is there any comeback from European authorities? Article 6 addresses the point of sensitive data. This is the area in which privacy rights are most likely to be involved, in that personal data or information can be included within the passenger name record, PNR. I presume this would be a relatively rare occurrence. In such a situation, the DHS would employ automated systems to filter out and mask sensitive data. The European Commission has a role under Article 6(2) in monitoring this masking and filtering. Is there a mechanism for the European Commission to revert to the DHS when it believes masking and filtering has not been conducted? That provision may be contained elsewhere in the document.

Deputy Alan Shatter

Yes. To be of assistance to the Senator, Article 19 relates to the implementation and final provisions. It reads:

In consideration of this Agreement and its implementation, DHS shall be deemed to provide, within the meaning of relevant EU data protection law, an adequate level of protection for PNR processing and use. In this respect, carriers which have provided PNR to DHS in compliance with this Agreement shall be deemed to have complied with applicable legal requirements in the EU related to the transfer of such data from the EU to the United States.

There is also a provision on a review of how matters are working in the context of dealing with data, namely, Article 23, entitled "Review and Evaluation". It reads:

The Parties shall jointly review the implementation of this Agreement one year after its entry into force and regularly thereafter as jointly agreed. Further, the Parties shall jointly evaluate this Agreement four years after its entry into force.

It is envisaged that there will be ongoing co-operation between the relevant authorities in Europe and the United States to monitor and review the workings of the system.

What are relevant in all of this are issues surrounding the retention of data and the form in which they are retained. These particular issues gave rise to substantial discussion at European Parliament level and within the Council of Ministers. The DHS will retain PNR data in an active database for up to five years. I made reference to this in my speech at the commencement. I stated that, after the first six months of this period, the data are depersonalised by masking out aspects that could identify an individual. In practical terms, this relatively short period in which the data will be fully available was considered an important protection for personal data and privacy terms. The depersonalisation is not permanent at this point, however, and the personal aspects may be unmasked where needed for specific investigations, prosecutions or threats. Access to it is restricted to a limited number of specifically authorised officials. There is a range with regard to dealing with data. For a period, they are available in a particular manner and then they are retained in a manner in which the identities of those to whom they apply are generally masked out but can, in very specific and particular circumstances, be made available to a limited number of individuals. Thereafter, the data are transferred to a dormant database. Only in particular circumstances, which are basically cases of terrorist offences or very serious transnational crimes, can they be accessed.

It is important to say to members of the committee that, in working through the provisions of this arrangement, there was substantial discussion and negotiation with a view to ensuring, firstly, that, where necessary, inaccurate information could be corrected and, secondly, that the information would be retained in a general database for a limited period of time and thereafter would only be available to a discrete number of authorised individuals in particularly serious circumstances. This effectively summarises it.

The other article that is relevant is Article 8(6), which reads: "The Parties agree that, within the framework of the evaluation as provided for in Article 23(1), the necessity of a 10-year dormant period of retention will be considered". That is something that is effectively up for review at a later point as well.

Chairman

Does Deputy Ó Snodaigh wish to ask a question?

Deputy Aengus Ó Snodaigh

A number of questions. I have attended committee meetings under previous Governments at which we dealt with PNRs. They were initially debated in 2007, when the scheme was more flawed. There are still major questions about this, which is basically a data retention and sharing regime. One of the key problems is that the protections for data retained do not fall under the same harmonised protection process. For example, in one jurisdiction there may be very stringent data protection criteria that may not be equalled in another jurisdiction. I note the comments to Senator Bacik on the periods of six months and five years before removal to a dormant database. Nevertheless, databases, by definition, can be accessed. In the United States, legislation around homeland security supersedes most legislation so there is nothing preventing data which is supposedly depersonalised or held in a dormant database being extracted by an agency in America to use at will. The same would apply in other countries, so this is not an attack on the systems of the United States. It does not have the same protections as most European countries with regard to data retention.

One of the other key concerns I had over the years relates to the sharing of information. If a mistake is spotted - for example, if a person's data is inaccurate - how could it be guaranteed that the data would be corrected thereafter? Once the data is passed to another member state or country, it is out of the hands of the originating country, and although a nation can try to ensure the record is corrected, there is no guarantee that would happen.

Given the level of international crime and increasing globalisation, we need greater co-operation, although it should not come with the loss of protection through interference with people's privacy. The "nothing to hide, nothing to fear" argument should not be used just to force through measures; it is not just this but other unnecessarily intrusive processes affecting data and rights to privacy. The original proposal we dealt with failed, as the scope was extended, with discussion of custodial sentences. I am thankful we have seen some sense in that regard. Nevertheless, the process is still flawed as the guarantees do not exist and we should not create legal vacuums where unaccountable intelligence agencies have more say than nations in the rights of people.

Are we approaching the end of these proposals or will they extend beyond air travel? There have been suggestions the process will extend to people travelling via ferry or between countries by tunnel or train. There is the Channel tunnel between Britain and the rest of Europe. Will this directive result in passengers being subjected to more extensive tracking, tracing and screening than with the current regimes?

When the Commission put forward this proposal, it was indicated that it was required to tackle international crime. The Minister listed some of the horrendous crimes that he hopes this will address but there has been no evidence of the usefulness of collecting this data over and above other preventative and intelligence-gathering measures employed by nations' police forces. I have not attended these committee meetings in recent months but has there been any new evidence or reports justifying the usefulness of this directive, which is a major change in the retention of personal data in Europe? Will this process comply with the European Convention on Human Rights and the Charter of Fundamental Rights, particularly as they relate to the protection of privacy and data?

Deputy Alan Shatter

The Deputy asked a series of questions and I might take them in reverse order as the later questions can be more succinctly answered. This complies with the European Convention on Human Rights and there is no issue in that regard. Passengers will not be subject to any more extensive disclosure of information than they are now, and this provision is better than the one that has been there since 2007. It provides greater protection for individuals with regard to information issues compared to what was the case in the past.

The Deputy asked if this would be successful and the Deputy was not here when I referred to the investigation into the dreadful atrocity in Mumbai, and how access to passenger name record information led to identifying the individual who committed the atrocity. Once identified, the individual acknowledged responsibility for the atrocity. There are various examples of passenger name records in action and being successfully used. In August 2009, the research of this data linked to an ongoing human trafficking investigation identified pending travel of an individual with an Interpol red notice for trafficking women from eastern Europe. The Department of Homeland Security co-ordinated with Interpol and the subject was interdicted during travel from the Dominican Republic. Research of passenger name records associated with this individual led to the identification of five previously unidentified eastern European human trafficking victims, based on the form of airline ticket payment, address and e-mail in the passenger information. Additional research identified three additional subjects suspected of being involved with the trafficking of human beings for the purpose of prostitution.

I referred previously in a reply to Deputy McGrath to the usefulness in the context of such operations. On 22 June 2010, there was US-EU co-operation when the Department of Homeland Security identified a Nigerian travelling from Dallas to John F. Kennedy Airport to London who was suspected of being a narcotics courier. The Department of Homeland Security was unable to interdict the individual in New York but shared the individual's passenger name information with UK border agencies. Upon arrival, the individual was detained, admitted to swallowing 60 pellets of cocaine and was arrested before pleading guilty to narcotics smuggling. There is a series of additional examples showing the usefulness of this system in providing protection for communities and co-operation between law enforcement agencies across the world in seeking to ensure that those who engage in international criminality are apprehended.

Other queries were raised. I refer the Deputy to Article 13 because his first question was in the context of legislation by the United States. The Department of Homeland Security does not effectively have overriding powers over everything. The Department of Homeland Security has very substantial powers and I will not pretend that I have expertise in all of its areas of legislation. It has very substantial powers to address a broad range of areas in the United States, particularly dealing with terrorism, counter-terrorism and international criminality issues that create risks to the United States. It does not have a free run to violate an international agreement. This is an international agreement between the European Union and the United States which is subject to monitoring and review by the European and the United States. This is an agreement whose terms have to be complied with.

From an individual's perspective, Article 13 and following articles, of the US legislation, are particularly relevant as follows:

Article 13: Redress for Individuals

1. Any individual regardless of nationality, country of origin, or place of residence whose personal data and personal information has been processed and used in a manner inconsistent with this Agreement can seek effective administrative and judicial redress in accordance with U.S. law.

2. Any individual is entitled to seek to administratively challenge DHS decision related to the use and processing of PNR.

3. Under the provisions of the Administrative Procedure Act and other applicable law, any individual is entitled to petition for a judicial review in U.S. federal court of any final agency action by DHS. Further, any individual is entitled to petition for judicial review in accordance with applicable law and relevant provisions of:

(a) the Freedom of Information Act,

(b) the Computer Fraud and Abuse Act,

(c) the Electronic Communications Privacy Act; and

(d) other political provisions of U.S. law.

4. In particular, DHS provides all individuals an administrative means (currently the DH Traveler Redress Inquiry Program (DHS, TRIP) to resolve travel-related inquiries including those related to the use of PNR. DHS TRIP provides a redress process for individuals who believe that they have been delayed or prohibited from boarding a commercial aircraft because they were wrongly identified as a threat. Pursuant to the Administrative Procedure Act and Title 49, United States Code, Section 46110, any such aggrieved individual is entitled to petition for judicial review in U.S. federal court.

The following oversight provisions in Article 14 are particularly important:

Article 14: Oversight

1. Compliance with the privacy safeguards in this Agreement shall be subject to independent review and oversight by Department Privacy officers, such as DHS Chief Privacy Officer, who:

(a) have a proven record of autonomy;

(b) exercise effective powers of oversight, investigation, intervention and review; and

(c) have the power to refer violations of law related to this Agreement for prosecution or disciplinary action, when appropriate.

They shall, in particular, ensure that complaints relating to non-compliance with this Agreement are received, investigated, responded to, and appropriately redressed. These complaints may be brought by any individual, regardless of nationality, country of origin, or place of residence.

An important aspect of this is contained in subparagraph 2 and it states:

2. In addition, application of this Agreement by the United States shall be subject to independent review and oversight by one or more of the following entities:

(a) the DHS Office of Inspector General;

(b) the Government Accountability Office as established by Congress;

(c) the U.S. Congress.

Such oversight may be manifested in findings and recommendations of public reports, public hearings, and analyses.

I want to particularly emphasise the last few words "of public reports, public hearings, and analyses."

There is, in the context of this particular agreement, extensive provision designed to ensure that the rights of individuals are protected. They are copper-fastened by the review process that the European Union can engage in on an annualised, effective basis. Of course, if this agreement was abused that information could immediately be given by any individual, so affected, to a Member State of the European Union, to the European Parliament or the relevant committee of the European Parliament that focusses on justice related issues. There is a broad range of protections in place which are detailed in the architecture of the agreement designed to address the concerns that the Deputy, quite properly, raised. They are genuine issues that deserve to be raised and discussed and the oversight provision is particularly important.

Deputy Aengus Ó Snodaigh

I also asked a question on an extension. I think it was the British that sought to extend the agreement to include sea and rail travel.

Deputy Alan Shatter

Sorry, Deputy. This agreement only applies to air travel. There was some discussion during the course of the deliberation on the agreement as to whether there should be a similar provision that extends beyond air travel. Is the Deputy talking about the objective of the legislation in the context of travel by sea, for example? It would make some sense to have similar arrangements in place. One has the adequate protection, by providing for this for air travel but not for other types of travel, where it would be practical. There is not an instrument at the moment addressing or that puts in place a similar measure in the context of sea travel. I presume the perspective is that primarily those engaged in criminality like to travel to locations with some speed and that air travel offers that. Certainly, if one was the Nigerian gentleman who had consumed 60 pellets of cocaine one would not necessarily want to be at sea for two weeks travelling across an ocean from one side of the world to another to effect one's delivery. The perspective, I think, is essentially in the area of air travel where there is the greatest need. Certainly, at some future date, it may be considered in other contexts. This instrument does not apply to any other context.

Chairman

Is any other member offering? No. We have concluded our consideration of the motion.