U.S. air travel database fails own privacy tests

A DHS privacy report says that DHS remains in violation of both U.S. law and the DHS-EU agreement on the handling of Passenger Name Record (PNR) data. The report itself claims that DHS is in compliance on both counts, but according to the Identity Project, it “contains multiple admissions that support exactly the opposite conclusion.”

Register’s John Lettice writes that for several years now DHS has forced airlines carrying passengers to the United States to collect and hand over PNR data for screening purposes before flights. Data collected within the EU is subject to EU data protection legislation, and its handover is permitted — subject to “safeguards” — under the DHS-EU agreement of 2007. The operation of this is subject to joint reviews of compliance, although no such review has so far been conducted, while on the U.S. side, covering PNR data in general, is subject to U.S. review, where the U.S. Privacy Act applies.

Lettice notes that the paradoxical outcome of this is that the supposedly tougher EU privacy regime is in this case more relaxed than the U.S. one. The DHS-EU agreement allows DHS to retain EU passenger data for a period, while the Identity Project doubts that there is any legal basis for U.S. Customs and Border Protection (CBP) to retain the Automated Targeting System Passenger (ATS-P) database which contains the PNR data at all.

The Project notes that DHS report concedes that subject requests for PNR data have typically taken more than a year to answer, far more than required by the Privacy Act and Freedom of Information Act (FOIA), that responses have been inconsistent or inadequate, and inconsistently censored. Data sourced from the EU, the United States, and elsewhere is also mixed in the system with no clear way to establish its origins and, therefore, the data protection regime(s) that should apply.

According to DHS, ATS-P aids CBP officers “in frustrating the ability of terrorists to gain entry into the United States, enforcing all import and export laws, and facilitating legitimate trade and travel across our borders.” According to the EU’s Fundamental Rights Agency, which was asked in September for an opinion on the transfer of PNR data for law enforcement purposes, “data transfers to third countries are only possible if an adequate level of protection of PNR data is ensured and monitored in the recipient country.”

Next month the United States is scheduled to escalate its data-sucking activities further, with the introduction of ESTA (Electronic System for Travel Authorization). This obliges would-be travelers to supply data direct to the DHS in order to obtain a “clear-to-fly” authorization before take-off, although airlines still appear to be collecting extensive PNR data from them anyway.