thoughts and observations of a privacy, security and internet researcher, activist, and policy advisor

Monday, April 11, 2016

Minutes from EU Court of Justice on #CanadaPNR

On 5th April, I attended the oral hearing of the Court of Justice of the European Union (CJEU) on the draft agreement between the EU and Canada on the transfer, use, and retention of air passenger data (EU-Canada PNR agreement). The European Parliament has submitted this agreement to the Court in November 2014.

It was my first time at the Court, and the Grand Chamber is really impressive. However, I watched the hearing from the press room next door in order to be able to use the laptop and wifi.

Colleague Thomas van der Valk was also tweeting.

Here are my tweets in chronological order and with some typos corrected:

EU Court of Justice hearing on EU-Canada PNR agreement about to start. I'll tweet from there.
"The Court is in session". Two short judgements are announced first, then #CanadaPNR hearing in a few minutes. #CJEU
hearing started. First: legal service of @Europarl_EN, which submitted the agreement to the Court.
.: 2 questions: lack of data protection rights, wrong legal basis of the agreement. Candadian law only allows Canadians remedy.
 . questions compatibility with Art. 8 of the Charter of Fundamental Rights (data protection): independent oversight?
. is also live-tweeting from the hearing at the . 
.: Article 47 of the Charter (judicial redress / legal remedies) not met with the PNR agreement?
.@Europarl_EN: Article 52 of the Charter (proportionality and necessity) not met either, see judgement?
. lists the several typed of processing of PNR data: transfer, access, analysis, retention, onward transfer.
 .: systematic analysis of all passenger data (profiling) not yet covered by case law such as or .
.: Canadian privacy Commissioner has been critical about large-scale PNR data analysis. "mega-data" not "meta-data"
.: PNR data will be transferred to US authorities under the "beyond the border" agreement,
Now: Council legal service, defending the agreement. " also accepted PNR agreements with USA and Australia."
(Reason for to submit agreement was CJEU judgement. It came after USA and Australia PNR agreements.)
Council now on legal arguments about opt-out options for Denmark, Ireland and UK, Court had asked about this as well.
Council: Canadian general law allows for legal remedies for anyone, not just people in Canada.  
Funny to see the agents sitting behind the Council agent who is speaking now. They shake their heads quite often.  
Council: Legal basis for agreement (Art. 82 TFEU, judicial cooperation) is correct, we maintain our position.
Council: did not contest same legal basis for EU-Australia PNR agreement.  
. conclusion: All is fine with the agreement.
 . quotes EU anti-terror coordinator: number of convictions based on PNR "irrelevant". Court had asked about those!
.: The data is "anonymised" after 30 days. judgement is not applicable here.
.: agreement provides for legal remedies and independent oversight: Passengers can complain with EU DPAs.
.: Dispute settlement mechanism in Art. 25 of agreement is sufficient. If no solution, EU DPAs can act, cf
. on legal basis: Art. 16 TFEU () cannot ovver-rule all provisions on police / judicial cooperation.
.: Existing data exchange agreements (Europol etc.) Can't out-rule this agreement, because we need data exchange
.: Critical report by Canadian privacy commissioner shows that independent oversight works.

Some laughter in the press room on the last argument by . (I am here, so I can use the laptop.)
Estonia starts their argument with an analogy of two piles of hay. Seems to boil down to "We can eat the cake and still have it".  
Estonia: data is limited. Helps police to determine criminal intent of travellers. not comparable, based on 1995/46/EC.
Estonia: PRISM programme was covert, allowed unlimited data sharing. Completely different for : Protects against covert processing
Estonia: We can't limit (target) the amount of passengers, but the profiling limits the group of suspicious passengers anyway.  
Estonia: PNR data is broader than API (passport) data. But any border agent could ask you about your credit card number as well.  
Estonia: No reason to believe that Canada would process data without good faith. will pass "eye of the needle" test.
Estonia: We cannot allow the risk of having potentially dangerous people board airplanes. is "unavoidably necessary".
Now Ireland on : International problems demand international responsed. Agreement is necessary.
Ireland: has agreed to PNR agreements with USA and Australia!
Ireland: Choice of legal basis important for us because of our opt-in choice for judicial cooperation. (We'll participate anyway)  
 Ireland: Data and number of people affected is much more limited than data in DRI and Schrems cases.  
Ireland: is endangering international cooperation by its challenge of .
Next in hearing is Spain: We must regard the specific circumstances of the case.
Spain: period of 5 years is absolutely necessary for criminal investigations.  
Spain: Charter requirement of "independent" DPAs is different than "total independence" under 1995/46/EC. guarantees independence
(re last argument: is overseen in Canada by an ombudsperson, not by the Canadian DPA.)
After short break, now France on : Canada provides essentially equivalent data protection rights. PNR data not intrusive anyway.
France: Judicial approval of transfer of data would make the whole approach meaningless. Agreement necessary and proportionate.
Impression so far: Everybody refers to "necessary and proportionate", but hardly anyone except is giving criteria.  
France: Investigations into crimial networks take 4 to 5 years, therefore we need 5 years . Useful.  
France: Terrorist groups exist some years before they actually become active.  
France insisting that recent CJEU and ECtHR case-law on mass surveillance was about communications, not PNR.  
Now UK, their agent in full "Queen's Counsel" style with a wig: We must check purpose, nature of data, safeguards.  
UK: There are things we know, and there are things we don't know. We need PNR data to find unknown terrorists and trafficers.  
UK says it provided examples to Parliament. Anekdotal yes, not evidence. UK now again providing an example
UK: Use of term "profiling" by is wrong. PNR relates to travel pattern, not person's character. [well: "terrorist"?]  
UK: Vast majority of data will never be subject to human review, only sifted through by computers.
UK attacks legal service agent: "His assertions about Canadian law are just wrong".
UK repeats : Critical report by Canadian DPA shows that independent oversight works. .
Last statement by , agent is . Refers to PNR data demands by other countries, incl. Saudi-Arabia, Russia.  
. Art. 5 of agreement presumes adequacy for Canada without additional safgeguards. No judicial remedy for Europeans.
. argues that PNR data can as well be very intrusive, including revealing religious beliefs by means of food preferences.  
.: Use of data is about predictive policing, based on abstract definitions of what is "suspicious" & big data. Like US.
. Profiling of similar to "Rasterfahndung" (pattern searches) in DE after 9/11. Ruled out by consitutional court in 2006.
. dissects claims by Member States & Comission about oversight in . Not equivalent to independent authority, EU DPAs out.
Statements in hearing are over. Thomas von Danwitz, judge rapporteur, now summarising for Q&A.
Danwitz: Passengers are not informed about collection & consequences when they book a flight. Therefore, implies purpose change.
.: "As Article 11 of provides..." Danwitz: "We're still at the travel agency now, not in the agreement!"
.: Well, that is far-fetched. Countries can demand anything from people entering their territory.  
Danwitz: DRI judgement requires clear guarantees for data subjects. Should data categories be clarified by law, not in annex?
Danwitz: What exactly does "frequent flyer information" mean? All my previous flights under a given loyalty programme?  
Danwitz: What does "etc." stand for in point 5 of agreement? Is that sufficiently precise?
. lawyers are cracking up in the background.
Danwitz now really grilling on the annex. They already have two agents at the bar in order to deal with it.
.: We were told that all the data can be used for finding terrorists or criminals.  
Danwitz: That's not my question. My question is about precision of the annex of , and "mandatory" vs "optional" data. Inequality?
Danwitz: Nothing in the agreement limits databases for cross-checking to Canadian databases. Is that correct?
.: Data is used for profiling first, only suspicious data compared with other databases. Danwitz: It's not in the agreement!
Danwitz: The asked you to exclude sensitive data. No explicit exclusion in agreement, however. Reason (except "useful")?
.: See Article 8. Danwitz: Hmh, ok.
Danwitz: Why do you not demand statistics in agreement, as in the EU directive? .: Canadians still do statistics.
Danwitz: So you don't have any data on how many convicted passengers were, let's say, muslims? - No.  
Danwitz: Can all data be freely exchanged with other Canadian authorities, subject to Art. 18? - COM: Yes, but case-by-case only  
Danwitz: Should adequacy finding better be made by EU institutions (c.f. ), not negotiated with the third country?  
Danwitz: Art. 19 only limits 3rd country transfer for "Canadian Competent Authority". What about other Canadian authorities?  
Danwitz: The whole "a posteriori" approach of rights enforcement worries me.  
Danwitz: Could I object to the algorithm that sifted through my data? - COM: No. Danwitz: Why not? COM: "Prevention"  
Danwitz: Even when I leave Canada again, my data stays with their authorities for five years. Why? I have a difficulty with this.  
Danwitz: Are all 28 Mio passengers who go to Canada each year subject to such measures, even if completely unsuspicious? COM: yes  
hearing now into lunch break until 15:00.
hearing has started again. to answer question from before lunch - "should we all be subject to surveilance"?
. also now claims there is no "profiling". And then explains what kind of profiling is done with data. m(
. to answer on lack of statistics on use of data, but merely makes false claims on "anonymous" and "deleted".  
Judge von Danwitz lectures COM that data are actually not "anonymised" after 30 days. "It bothers me when you're not precise"  
Danwitz: You could really anonymise data after 30 days. Or delete data of non-suspicious persons at after they leave Canada.  
Danwitz now lecturing on ECtHR case-law re possible discrimination of persons by data stored about them.  
Danwitz: Does the data "stigmatise" everyone or just some? That's the question. . Now questions from AG and other judges.
Now Paolo Mengozzi, advocate-general for this case, with questions on the legal basis of . "COM can rest, but just for a bit"
Council legal service on special carve-out protocols for UK, Ireland and Denmark on judicial cooperation. Q: Have they voted on ?
AG Mengozzi with Q for COM: Why limitation on sensitive data only for "competent authority", not Canada as a whole? - COM: "..."  
Mengozzi: Why limitations for transfers to 3rd countries also only for "competent authority", and no limitations for recipients?  
.: 3rd country authorities not really a concern for us, as they only receive already "filtered" data case-by-case.  
AG Mengozzi: "This seems absurd to me." Chance for survival of getting slimmer by the minute.
Mengozzi now with question to on : Legal basis: data protection or judicial cooperation? Could it be both?  
.: We think it's data protection (Art. 16 TFEU), but could be both. One reason we submitted to you.
Mengozzi: Article 4(1) of : "EU shall ensure air carriers are not prevented from transferring PNR data" But there are limits!
Mengozzi: Where does the /obligation/ for transfers come from then? 
.@Europarl_EU: Our problem is that we don't know Canada's or even the EU's interpretation of this. Canadian law not referenced.  
.: We also don't know who will be the supervisory authority / body in Canada either. Should be specified!  
.: Art. 4(1) would neutralise any EU data protection legislation with regards to data transfers.  
Judge Rosas to Council with question on legal basis: Should certain Member States vote on instruments that do not bind them?  
Council: Well, on the new directive for law enforcement, Denmark will vote, but still unclear if and how it is bound.  
Q: Has a link to the Schengen acquis been considered, including to cover Norway, Switzerland, Iceland?  
Council (other lawyer): Schengen link was not considered. Re DK, IE, UK: They are bound to a certain extent, therefore can vote.  
Judge Regan to @Europarl_EU: How do you reconcile your dataprotection arguments with your declared comittment to fight terrorism?  
.@Europarl_EU: You can have general rules, but you can also have special DP rules for anti-terror instruments.  
.: Look at Art. 5 : Canadian authoriy "is deemed to provide an adequate level of protection" - problematic!
Judge Rosa to COM: Which PNR data in the annex are sensitive? Art. 2(e) (sensitive data) doesn't refer to specific data types.  
.: Only point 17, Special Service Request Information etc. Judge: How can we be sure none of the others? Unclear.  
Judge Rosas grilling COM now: Why is Art. 2(e) then not directly referencing point 17 of annex?  
Judge von Danwitz: What about point 18 annex? "API data collected for reservation purposes"? COM: No. Judge: How can we be sure?  
Closing statements now. ., pretty deperate: Data protection must not turn into an area of fear!  
UK lawyer by far with strongest and most well-informed arguments in favour of . Must be the wig.
UK: WHole purpose of is to ensure that Canada has equivalent protections. Not to install EU DPA oversight over Candian DPA.
Advocate-General Paolo Mengozzi will present his opinion on on 30th June. Session is closed.
The inofficial twitter team says thanks for RTs and favs!

Labels: , , , , ,

posted by Ralf Bendrath at 01:03 | permalink
digg this | bookmark at del.icio.us | 1 comments