US embassy cable - 04ROME2993

UNCLAS  ROME 002993 
 
SIPDIS 
 
 
SENSITIVE 
 
USEU FOR JOHN SAMMIS/STEVE CRISTINA 
 
E.O. 12958: N/A 
TAGS: ECON, ECPS, IT, EUN 
SUBJECT: INFORMAL PRIVACY CONFERENCE FOCUSES ON INTRA-EU 
ISSUES 
 
1. (SBU)  On July 16, Italy,s Privacy authority hosted an 
informal meeting, in preparation for a formal session in 
Brussels this fall, to address PNR issues.  Participants 
included EU Privacy Authorities, the European Airline 
Association and several European airlines.  The morning 
conference, which emboffs attended as observers, was entitled 
"A workshop organized by the Article 29 Working Party on the 
Agreement between the European Union and the United States of 
America on the Processing and Transfer of PNR Data by Air 
Carriers to the U.S. Department of Homeland Security, Bureau 
of Customs and Border Protection, Signed on May 28, 2004." 
The discussion was led by Peter Schaar, Chairman of the 
Working Party.  Other speakers included Waltraut Kotschy from 
the Austrian DPA, carrier representatives (including  Jim 
Forster of British Airways, who spoke on behalf of the EAA, 
and  Mr. Camus of Air France and EU Commission officials). 
After the public session, there was a closed afternoon 
session of only Data Privacy Authorities. 
 
2.  (SBU)  Beginning with Mr. Schaar, all speakers agreed 
that EU airlines must provide PNR data to U.S. authorities. 
There was no objection to the requirement, as embodied in the 
adequacy finding and the U.S.-EU Agreement.  The meeting 
focused, instead, on nuts and bolts: push v. pull, from 
airline data bases or a centralized EU data base; whether 
data not in airline reservations systems must be provided; 
who is required to pay the cost of filtering and transmitting 
the data: and whether U.S. air carriers selling tickets 
within the EU have the same data privacy requirements as EU 
carriers.  The other issue discussed was information to be 
provided to EU citizens before providing PNR data or 
purchasing a ticket. 
 
Push vs. Pull 
------------- 
 
3.  (SBU)  EU Privacy Authorities believe that the current 
"pull" system, whereby U.S. authorities access EU carrier 
data banks directly (and thus have access to more than just 
the agreed elements of PNR data), must be changed to a "push" 
system, whereby EU entities send only the required elements 
of PNR information.  While concurring in principle, EU 
carriers are concerned that implementing a push system will 
be very expensive to develop and maintain. 
 
Centralized vs. Decentralized Data Bases 
---------------------------------------- 
 
4. (SBU)  As representative of other EU carriers, British 
Airways official Jim Forster said lack of a standard 
procedure for providing PNR data was a problem.  He called 
for establishing a centralized EU processing mechanism, with 
governments taking on the responsibility (and the cost) of 
filtering and transmitting data to the U.S.  In the airlines' 
view, this would provide economies of scale, harmonize 
procedures and provide greater negotiating power for the EU 
and the European airlines vis-a-vis the USG. 
 
5.  (SBU) Austrian DPA Kotschy explained that the technical 
proposal known as the "Austrian solution" would provide for 
centralized EU processing and simplification and 
standardization of procedures.  However, she stressed that in 
no way would this make national governments responsible for 
PNR.  Carriers would retain practical and legal 
responsibility for filtering and transmitting data and for 
paying these costs.  In the discussion that followed, 
representatives of EU Privacy Authorities were united in 
stating that responsibility for providing PNR data remains 
with the carriers, which are the "data controllers". 
 
What Data Must Be Provided? 
--------------------------- 
 
6. (SBU) BA's Forster raised a question for the Data 
Protection Authorities regarding pushing or pulling data from 
DCS.  He noted that the finding and the agreement both called 
for airlines to give U.S. authorities access to 34 data 
items.  In the U.S., these 34 data items are held in 
reservations systems (PNR).  However, in the EU, carriers 
hold certain data in the departure control system (DCS). 
None of the DCS data has been given to the U.S. authorities, 
and it is not clear how technically difficult this would be. 
DCS is not a "read only" system, and airlines fear that even 
inadvertent altering of data could affect aircraft safety. 
There has been no attempt to push or pull data from DCS. 
 
7. (SBU)  A discussion of this point ensued.  The Austrian 
 
 
DPA rep stated that, because the Agreement refers to PNR, any 
of the 34 data elements not included in airline PNR systems 
should not be given to U.S. Customs.   Schaar declared the 
adequacy decision and the U.S.-EU Agreement differed in 
defining PNR.  The Adequacy decision (para 4) defined PNR as 
"data in the PNR system".  However, the U.S.-EU Agreement 
(para 2) defines PNR as "data in the PNR and DCS systems." 
From the data protection standpoint, the adequacy finding is 
more pertinent.  Therefore, Schaar agreed that only data in 
the PNR system need be transferred.  Another participant then 
challenged this statement and pointed out that Annex 1 of the 
adequacy finding includes a statement that PNR data includes 
data in both the PNR and DCS systems.  Thus, the adequacy 
finding also requires transfer of those 34 data elements 
found within the DCS system.  Schaar then referred back to 
the flight safety implications of allowing access to DCS data 
bases.  This, he stressed, underlines the need to change to a 
push system as soon as possible. 
 
Who Should Pay? 
--------------- 
 
 8. (SBU)  EU carriers protested that it was unfair to impose 
on them the cost of filtering and transmitting data.  EU 
airlines would prefer that EU governments take the 
responsibility for either paying the costs or forcing the 
U.S. to pay.   The DPAs were unwilling to enter into a 
discussion on moving costs to others besides the airlines. 
 
Are U.S. Carriers in the EU Subject to the Same 
--------------------------------------------- -- 
Requirements? 
------------- 
 
9. (SBU)  Carriers also said they were disadvantaged relative 
to the non-EU carriers not subject to the same privacy 
requirements.  BA's Forster asked for a final decision from 
EU authorities on the legal position of U.S. airlines.  He 
recalled that, in May, Commission officials stated that U.S. 
carriers were not subject to these requirements, but then 
airlines heard they were subject.  He asked for 
clarification.  The Austrian DPA rep responded that, if U.S. 
carriers collect data in the EU, they fall under the EU data 
protection law.  The U.S. airlines are required to meet the 
same requirements as EU airlines, since this is also an issue 
of competition.  The U.S. must take EU data the same way from 
U.S. and EU carriers.  Schaar declared that the EU privacy 
directive is applicable to U.S. airlines, if data is 
processed using technical means in Europe.  "Any airline 
flying to the U.S. from the EU uses technical means in the 
EU.  There is no question, no discussion."   The discussion 
ended with Schaar's statement that this issue would be 
discussed at the autumn meeting. 
 
Passenger Notification 
---------------------- 
 
10. (SBU)   Passenger notification was a key focus of the 
meeting.  Schaar called for "comprehensive and very readable" 
passenger information, to be provided to all airline 
passengers flying from Europe to the U.S.   Forster (BA) 
explained that as airline web sites are increasingly 
important in selling tickets (from four percent in 2003 to 25 
percent in 2004), the Internet is efficient and permits 
direct contact with customers.  BA ensures that its customers 
receive notice of their rights before reserving or buying 
tickets.  On the other hand, DPAs complained that most travel 
agents had not yet begun to provide any passenger 
notification.  The Lufthansa rep protested that the airlines 
could not be held responsible for travel agents' behavior. 
The EU airlines stated that they are preparing to include 
texts in tickets and the "conditions of carriage" document. 
IATA will vote on these texts is in the autumn:  Forster (BA) 
noted that: "we have been waiting for the Commission to 
provide us with the short, long and very long texts." 
 
Comment 
------- 
 
11.  (SBU) As discussion ensued, it became obvious that there 
were two groups working on different texts of passenger 
notification documents.   Airlines were working with IATA and 
the Commission.  The DPAs were developing a different type of 
notification.  When the airlines pointed out this 
contradiction, Schaar responded that there would -- in the 
end  -- be only one set of notifications, and it would be 
that of the Data Protection Authorities.  Only the DPAs, he 
 
 
stressed, had the authority to approve such passenger 
notifications.   He added that, as there was a Commission 
representative in the Working Party, the Commission was well 
aware of this. End comment. 
 
Visit Rome's Classified Website: 
http://www.state.sgov.gov/p/eur/rome/index.cf m 
 
SEMBLER 
 
 
NNNN 
	2004ROME02993 - Classification: UNCLASSIFIED