[ParlTrack]

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Marju LAURISTIN, Anna HEDH, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Recital 11

(11) Air carriers already collect and process PNR data from their passengers for their own commercial purposes. This Directive should not impose any obligation on air carriers to collect or retain any additional data from passengers or to impose any obligation on passengers to provide any data in addition to that already being provided to air carriers. For charter, private and freighted flights, PNR data should also be collected and transferred to the Passenger Information Unit of the relevant Member State.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Josef WEIDENHOLZER, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Recital 12

(12) The definition of terrorist offences should be taken from Articles 1 to 4 of Council Framework Decision 2002/475/JHA on combating terrorism37. The definition of serous crime should be taken from Article 2 of Council Framework Decision 2002/584/JHA of 13 June 2002 on the European Arrest Warrant and the surrender procedure between Member States38. However, Member States may exclude those minor offences for which, taking into account their respective criminal justice system, the processing of PNR data pursuant to this directive would not be in line with the principle of proportionality. The definition of serious transnational crime should be taken from Article 2 of Council Framework Decision 2002/584/JHA and the United Nations Convention on Transnational Organised Crime. __________________ 38 OJ L 190, 18.7.2002, p. 1. 37 OJ L 164, 22.6.2002, p. 3. Decision as amended by Council Framework Decision 2008/919/JHA of 28 November 2008 (OJ L 330, 9.1.2.2008, p. 21).

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Marju LAURISTIN, Anna HEDH, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Recital 13

(13) PNR data should be transferred to a single designated unit (Passenger Information Unit) in the relevant Member State, so as to ensure clarity and reduce costs to air carriers and other commercial operators or non-commercial flight operators.

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Anna HEDH, Marju LAURISTIN, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Recital 16

(16) The Commission supports the International Civil Aviation Organisation (ICAO) guidelines on PNR. These guidelines should thus be the basis for adopting the supported data formats for transfers of PNR data by air carriers and other commercial operators or non- commercial flight operators to Member States. This justifies that such supported data formats, as well as the relevant protocols applicable to the transfer of data from air carriers and other commercial operators or non-commercial flight operators should be adopted in accordance with the advisory procedure foreseen in Regulation (EU) No….. of the European Parliament and the Council [……………..]

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Anna HEDH, Marju LAURISTIN, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Recital 17

(17) The Member States should take all necessary measures to enable air carriers and other commercial operators or non- commercial flight operators to fulfil their obligations under this Directive. Dissuasive, effective and proportionate penalties, including financial ones, should be provided for by Member States against those air carriers and other commercial operators or non-commercial flight operators failing to meet their obligations regarding the transfer of PNR data. Where there are repeated serious infringements which might undermine the basic objectives of this Directive, these penalties may include, in exceptional cases, measures such as the immobilisation, seizure and confiscation of the means of transport~~, or the temporary suspension or withdrawal of the operating licence.~~ .

2015/04/20
Committee: LIBE

Birgit SIPPEL, Josef WEIDENHOLZER, Marju LAURISTIN, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Recital 19

(19) Taking fully into consideration the right to the protection of personal data and the right to non-discrimination, no decision that produces a~~n adverse~~ legal effect on a person or seriously affects him/her should be taken only by reason of the automated processing of PNR data. Moreover, no such decision should be taken by reason of a person’'s race or ethnic origin, political opinions, religiousn or philosophical beliefs, ~~political opinion, trade union membership,~~sexual orientation or gender identity, trade union membership and activities, and the processing of biometric data or of data concerning health or sex~~ual~~ life.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Josef WEIDENHOLZER, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Recital 23

(23) The processing of PNR data domestically in each Member State by the Passenger Information Unit and by competent authorities should be subject to a standard of protection of personal data under their national law which is in line with ~~Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed~~ the European data protection acquis, including the ~~framework of police and judicial cooperation in criminal matters41 (‘Framework Decision 2008/977/JHA’)~~specific data protection requirements set out in this Directive. __________________ 41 OJ L 350, 30.12.2008, p. 60.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Tanja FAJON, Josef WEIDENHOLZER, Marju LAURISTIN, Emilian PAVEL

Proposal for a directive
Recital 28

(28) This Directive does not affect the possibility for Member States to provide, under their domestic law, for a system of collection and handling of PNR data for purposes other than those specified in this Directive, or from transportation providers other than those specified in the Directive, regarding internal flights subject to compliance with relevant data protection provisions, provided that such domestic law respects the Union acquis. The issue of the collection of PNR data on internal flights should be the subject of specific reflection at a future date.deleted

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Anna HEDH, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Recital 29

(29) As a result of the legal and technical differences between national provisions concerning the processing of personal data, including PNR, air carriers and other commercial operators or non-commercial flight operators are and will be faced with different requirements regarding the types of information to be transmitted, as well as the conditions under which this information needs to be provided to competent national authorities. These differences may be prejudicial to effective cooperation between the competent national authorities for the purposes of preventing, detecting, investigating and prosecuting terrorist offences or serious crime.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Marju LAURISTIN, Josef WEIDENHOLZER, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Recital 31

(31) This Directive respects the fundamental rights and the principles of the Charter of Fundamental Rights of the European Union, in particular the right to the protection of personal data, the right to privacy and the right to non-discrimination as protected by Articles 8, 7 and 21 of the Charter and has to be implemented accordingly. The Directive is compatible with data protection principles ~~and its provisions are in line with the Framework Decision 2008/977/JHA~~. Furthermore, and in order to comply with the proportionality principle, the Directive, on specific issues, will have stricter rules on data protection than the Framework Decision 2008/977/JHA.

2015/04/20
Committee: LIBE

Ana GOMES, Emilian PAVEL

Proposal for a directive
Recital 32

(32) In particular, the scope of the Directive is as limited as possible, it allows retention of PNR data for period of time not exceeding 5 years, after which the data must be deleted, the data must be anonymised (masked out) after a very short period, the collection and use of sensitive data is prohibited. In order to ensure efficiency and a high level of data protection, Member States are required to ensure that an independent national supervisory authority is responsible for advising and monitoring how PNR data are processed. All processing of PNR data must be logged or documented for the purpose of verification of the lawfulness of the data processing, self-monitoring and ensuring proper data integrity and security of the data processing. Member States must also ensure that passengers are clearly and precisely informed about the collection of PNR data and their rights.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Caterina CHINNICI, Josef WEIDENHOLZER, Marju LAURISTIN, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 1 – paragraph 1

1. This Directive provides conditions for the transfer by air carriers of Passenger Name Record data of passengers of ~~international flights to and from the Member States, as well as the processi~~flights between the Union and third countries, as well as the use, retention and exchange of that data~~, including its collection, use and retention by the Member States and its exchange between them~~ by Member States.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Caterina CHINNICI, Josef WEIDENHOLZER, Marju LAURISTIN, Jörg LEICHTFRIED, Péter NIEDERMÜLLER, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 1 – paragraph 1 a (new)

1a. This Directive shall not apply to flights within the territory of the Union or the means of transport other than airplanes.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Caterina CHINNICI, Josef WEIDENHOLZER, Marju LAURISTIN, Péter NIEDERMÜLLER, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 1 – paragraph 1 b (new)

1b. The PNR data that is collected pursuant to this Directive may not be used for border control purposes.

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Marju LAURISTIN, Anna HEDH, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 2 – paragraph 1 – point a a (new)

(aa) 'other commercial operator' means an undertaking, company or tour operator that may operate charter flights or book a number of seats on an airplane;

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Anna HEDH, Marju LAURISTIN, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 2 – paragraph 1 – point a b (new)

(ab) 'other non-commercial flight operator' means a private undertaking that may operate private planes or privately freighted flights;

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Marju LAURISTIN, Anna HEDH, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 2 – paragraph 1 – point b

(b) ’'international flight’' means any scheduled or non-scheduled flight by an air carrier or other commercial operator or a non-commercial flight operator planned to land on the territory of a Member State originating in a third country or to depart from the territory of a Member State with a final destination in a third country, including ~~in both cases any transfer or~~chartered flights, private planes, privately freighted flights, as well as transit flights;

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Anna HEDH, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 2 – paragraph 1 – point c

(c) ‘Passenger Name Record’ or 'PNR data' means a record of each passenger’s travel requirements which contains information necessary to enable reservations to be processed and controlled by the booking and participating air carriers and other commercial operators or non-commercial flight operators for each journey booked by or on behalf of any person, whether it is contained in reservation systems, Departure Control Systems (DCS) or equivalent systems providing the same functionalities;

2015/04/20
Committee: LIBE

Birgit SIPPEL, Jörg LEICHTFRIED, Josef WEIDENHOLZER, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 2 – paragraph 1 – point h

(h) ’serious crime’ means the offences under national law referred to in Article 2(2) of Council Framework Decision 2002/584/JHA if they are punishable by a custodial sentence or a detention order for a maximum period of at least three years under the national law of a Member State, however, Member States may exclude those minor offences for which, taking into account their respective criminal justice system, the processing of PNR data pursuant to this directive would not be in line with the principle of proportionality;deleted

2015/04/20
Committee: LIBE

Emilian PAVEL

Proposal for a directive
Article 2 – paragraph 1 – point i – introductory part

(i) ‘serious transnational crime’ means the offences under national law referred to in Article 2(2) of Council Framework Decision 2002/584/JHA if they are punishable by a custodial sentence or a detention order for a maximum period of at least three years under the national law of a Member State, and if : trafficking in human beings, sexual exploitation of children, illicit trafficking in narcotic drugs, illicit trafficking in weapons, cybercrime and other computer related crime, illicit trafficking in munition and explosives if:

2015/04/20
Committee: LIBE

Birgit SIPPEL, Josef WEIDENHOLZER, Marju LAURISTIN, Ana GOMES, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 3 – paragraph 1

1. Each Member State shall set up or designate an authority competent for the prevention, detection, investigation or prosecution of terrorist offences and ~~serious~~certain types of serious transnational crime or a branch of such an authority to act as its ‘'Passenger Information Unit’' responsible for conducting risk assessments in accordance with Article 4 as well as collecting PNR data from the air carriers, storing them, analysing them and transmitting the result of the analysis to the competent authorities referred to in Article 5. Its staff members may be seconded from competent public authorities.

2015/04/20
Committee: LIBE

Emilian PAVEL, Ana GOMES

Proposal for a directive
Article 3 – paragraph 1 a (new)

1a. The Passenger Information Unit must implement appropriate technical and organizational measures to protect personal data against unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Caterina CHINNICI, Anna HEDH, Josef WEIDENHOLZER, Marju LAURISTIN, Ana GOMES, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 3 – paragraph 1 b (new)

1b. All members of the Passenger Information Unit who have access to PNR data shall have had received specifically tailored training on processing of PNR data in full compliance with data protection principles and fundamental rights.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Anna HEDH, Josef WEIDENHOLZER, Marju LAURISTIN, Ana GOMES, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 3 – paragraph 1 c (new)

1c. The activities specified for in Article 9a(new)(4) shall only be carried out by specifically designated personnel of the Passenger Information Unit.

2015/04/20
Committee: LIBE

Emilian PAVEL, Ana GOMES

Proposal for a directive
Article 3 – paragraph 3 – subparagraph 1 (new)

The Passenger Information Unit must notify the National Supervisory Authority referred to in Article 12 before carrying out any wholly or partly processing operation.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Christine REVAULT D'ALLONNES BONNEFOY, Josef WEIDENHOLZER, Marju LAURISTIN, Sylvia-Yvonne KAUFMANN, Hugues BAYET, Ana GOMES, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 3 a (new)

Article 3a Data Protection Officer 1. Member States shall provide that the head of the public authority responsible for monitoring the application of the provisions adopted pursuant to this Directive and for contributing to their consistent application throughout the Union, appoints a Data Protection Officer within the Passenger Information Unit. 2. Member States shall provide that the data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and ability to fulfil the tasks referred to in this Directive. 3. Member States shall provide that the Data Protection Officer shall be responsible: (a) to raise awareness, to inform and advise the members of the Passenger Information Unit of their obligations in accordance with the data protection provisions adopted pursuant to this Directive, in particular with regard to technical and organisational measures and procedures; (b) to monitor the implementation and application of the policies in relation to the protection of personal data, including the assignment of responsibilities, the training of staff involved in the processing operations and the related audits; (c) to monitor the implementation and application of the data protection provisions adopted pursuant to this Directive, in particular as to the requirements related to data protection by design, data protection by default and data security and to the information of data subjects and their requests in exercising their rights under the provisions adopted pursuant to this Directive; (d) to ensure compliance with the data protection provisions adopted pursuant to this Directive, in particular, through conducting random sampling of data processing operations; (e) to ensure that the documentation referred to in Articles 11f (new) and 11g (new) is maintained; (f) to monitor the documentation, notification and communication of personal data breaches pursuant to Articles 11l (new) and 11m (new); (g) to monitor the response to requests from the supervisory authority, and to co- operate with the supervisory authority at the latter's request or on his/her own initiative, especially on matters relating to data transfers to other Member States or to third countries; (h) to act as the contact point for the supervisory authority on issues related to the processing of PNR data and to consult with the supervisory authority, if appropriate, on his/her own initiative. 4. Member States shall provide that the data protection officer is properly and in a timely manner involved in all issues which relate to the protection of personal data within the Passenger Information Unit. 5. Member States shall ensure that the data protection officer is provided with the means to perform his/her duties and tasks referred to in this Article effectively and independently, and does not receive any instructions as regards to the exercise of the function. 6. Member States shall provide that any other professional duties of the data protection officer are compatible with that person's tasks and duties as data protection officer and do not result in a conflict of interests. 7. Member States shall provide the data subject with the right to contact the data protection officer, as a single point of contact, on all issues related to the processing of his or her PNR data. 8. Member States shall provide that the name and contact details of the data protection officer are communicated to the supervisory authority and to the public.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Jörg LEICHTFRIED, Josef WEIDENHOLZER, Marju LAURISTIN, Sylvia-Yvonne KAUFMANN, Kati PIRI, Péter NIEDERMÜLLER, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 4 a (new)

Article 4a Conditions for access to PNR data by competent authorities 1. The competent authorities referred to in Article 5 may submit, on a case-by-case basis, an electronic and duly reasoned request to the Passenger Information Unit for the transmission of specific PNR data or the results of the processing of specific PNR data, when this is strictly necessary for the purpose of prevention, detection, investigation or prosecution of a specific terrorist offence or a certain type of serious transnational crime. The request for such data may be based on any one or a combination of the PNR data elements set out in the Annex. The reasoned request shall set out reasonable grounds to consider that the transmission of PNR data or the results of the processing of PNR data will substantially contribute to the prevention, detection, investigation or prosecution of the criminal offence in question. 2. Prior to the transmission of PNR data or of the results of the processing of PNR data from the Passenger Information Unit to a competent authority in reply to a request made in accordance with paragraph 1, a court or an independent administrative body shall verify, in a timely manner, whether all the conditions set out in paragraph 1 are fulfilled. 3. In an exceptional case of urgency where there is need to prevent an immediate and serious threat to public security associated with a terrorist offence or a type of serious transnational crime, the Passenger Information Unit may transmit the PNR data or the results of the processing of PNR data immediately upon receipt of a request by a competent authority. In such an exceptional case of urgency, a court or an independent administrative body may only verify ex- post whether all the conditions set out in paragraph 1 are fulfilled, including whether an exceptional case of urgency actually existed. The ex-post verification shall take place without undue delay after the processing of the request. 4. Where an ex-post verification in accordance with paragraph 3 determines that the transfer of PNR data or the results of the processing of PNR data was not justified, all the authorities that have received such data shall erase the information communicated by the Passenger Information System. 5. Paragraphs 1 to 4 shall also apply when a competent authority referred to in Article 5 submits an electronic and duly reasoned request to the Passenger Information Unit of its Member State in order to request the transmission of PNR data or the results of the processing of PNR data from a Passenger Information Unit of another Member State in accordance with Article 7, or from a third country in accordance with Article 8. 6. The decision for transfers pursuant to paragraphs 3 and 5 shall be made by the head of Passenger Information Unit to which the request was made. The Data Protection Officer shall be informed each time a transfer is made pursuant to this Article and he/she shall inform the supervisory authority of such transfers.

2015/04/20
Committee: LIBE

Ana GOMES, Marju LAURISTIN, Emilian PAVEL

Proposal for a directive
Article 5 – paragraph 1

1. Each Member State shall adopt a list of the competent authorities entitled to request or receive PNR data or the result of the processing of PNR data from the Passenger Information Units in order to examine that information further or take appropriate action for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious transnational crime. In the framework of this Directive, Europol shall be entitled, within its mandate, to request from the Passenger Information Units PNR data or relevant analytical information obtained from PNR data that may be necessary in a specific and duly justified case to prevent, detect, investigate, or prosecute terrorist offences and certain types of serious transnational crime.

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Anna HEDH, Marju LAURISTIN, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 6 – paragraph 1 a (new)

1a. In the cases of chartered flights, air carriers shall make sure to transmit all PNR data onto the concerned Passenger Information Unit.

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Anna HEDH, Marju LAURISTIN, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 6 – paragraph 1 b (new)

1b. In the cases of private planes or privately freighted flights, Member States should adopt the necessary measures to ensure that non-commercial flight operators provide PNR data for all passengers

2015/04/20
Committee: LIBE

Emilian PAVEL, Ana GOMES

Proposal for a directive
Article 6 – paragraph 2 – introductory part

2. Air carriers ~~shall transfer PNR data by electronic means~~, other commercial operators and non-commercial flight operators shall transfer PNR data by electronic means, providing sufficient guarantees in respect of the technical and organisational security measures, using the common protocols and supported data formats to be adopted in accordance with the procedure of Articles 13 and 14 or, in the event of technical failure, by ~~any~~ other appropriate means ensuring ~~an appropriat~~the same level of data security:

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Anna HEDH, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 6 – paragraph 3

3. Member States may permit air carriers and other non-commercial flight operators to limit the transfer referred to in point (b) of paragraph 2 to updates of the transfer referred to in point (a) of paragraph 2.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Caterina CHINNICI, Josef WEIDENHOLZER, Marju LAURISTIN, Kati PIRI, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 7 – paragraph 6

6. Exchange of information under this Article ~~may~~shall take place using any existing channels for European and international law enforcement cooperation, in particular Europol and national units under Article 8 of Council Decision 2009/371/JHA of 6 April 2009. The language used for the request and the exchange of information shall be the one applicable to the channel used. Member States shall, when making their notifications in accordance with Article 3(3), also inform the Commission with details of the contacts to which requests may be sent in cases of urgency. The Commission shall communicate to the Member States the notifications received.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Caterina CHINNICI, Anna HEDH, Josef WEIDENHOLZER, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 8 – paragraph 1 – introductory part

A Member State may transfer PNR data and the results of the processing of PNR data to a third country~~, only~~ on a case-by- case basis, only on the basis of an international agreement between the Union and that third country and if:

2015/04/20
Committee: LIBE

Birgit SIPPEL, Caterina CHINNICI, Anna HEDH, Josef WEIDENHOLZER, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 8 – paragraph 1 – point a

~~(a) the conditions laid down in Article 13 of Council Framework Decision 2008/977/JHA are fulfill~~deleted,

2015/04/20
Committee: LIBE

Birgit SIPPEL, Caterina CHINNICI, Anna HEDH, Josef WEIDENHOLZER, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 8 – paragraph 1 – point b

(b) the transfer is strictly necessary for the purposes of this Directive specified in Article 1(2)~~, and~~.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Josef WEIDENHOLZER, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 8 – paragraph 1 – point c

(c) the third country agrees to transfer the data to another third country only where it is necessary for the purposes of this Directive specified in Article 1(2) and only with the express authorisation of the Member State.deleted

2015/04/20
Committee: LIBE

Birgit SIPPEL, Josef WEIDENHOLZER, Caterina CHINNICI, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 8 – paragraph 1 a (new)

A Member State may transfer PNR data and the results of the processing of PNR data to a third country only if: (a) the third country receiving the data agrees not to transfer the PNR data and the results of the processing of PNR data to another country. (b) the third country submits a duly reasoned request to a competent authority referred to in Article 5 of the Member State concerned; (c) the reasoned request sets out reasonable grounds to consider that the transmission of the PNR data or the results of the processing of the PNR data will substantially contribute to the prevention, detection, investigation or prosecution of the terrorist offence or a serious transnational crime in question; and (d) a court verified, in a timely manner, that all conditions set out in paragraphs (a) and (e) are fulfilled.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Christine REVAULT D'ALLONNES BONNEFOY, Josef WEIDENHOLZER, Péter NIEDERMÜLLER, Tanja FAJON, Emilian PAVEL

Proposal for a directive
Article 8 a (new)

Article 8a Derogations 1. Where an international agreement between the Union and a third country exists, PNR data may not be transferred to the third country in question if, in the case in question, the legitimate interests of the data subject in preventing any such transfer outweigh the public interest in transferring such data. 2. By way of derogation from Article 8, Member States shall provide that a transfer of personal data to a third country, where no international agreement exists, may take place only on condition that: (a) the transfer is necessary in order to protect the vital interests of the data subject or another person; or (b) the transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third country. 3. Any transfers of PNR data and the results of the processing of PNR data to a third country on the basis of this Article may take place only on condition that: (a) the third country submits a duly reasoned request to a competent authority referred to in Article 5 of the Member State concerned; (b) the reasoned request sets out reasonable grounds to consider that the transmission of the PNR data or the results of the processing of the PNR data will fulfil the condition set out in paragraph 2; and (c) a court verified, in a timely manner, that all conditions set out in paragraph 2 and subparagraphs 3(a) and 3(b) are fulfilled. 4. The decision for transfers pursuant to this Article shall be made by the Head of Passenger Information Unit to which the request was made. The Data Protection Officer shall be informed each time a transfer is made pursuant to this Article and he/she shall inform the supervisory authority of such transfers. 5. All transfers pursuant to this Article shall be documented and the documentation shall be made available to the supervisory authority on request, including the date and time of the transfer, information about the recipient authority, the justification for the transfer and the data transferred.

2015/04/20
Committee: LIBE

Emilian PAVEL

Proposal for a directive
Article 9 a (new)

Article 9a Depersonalisation of data 1. Upon expiry of the period of 30 days, specified in Article 9, all data elements which could serve to identify the passenger to whom PNR data relate, shall be depersonalised through masking at the user interphase. For the purposes of this Directive, the data elements which could serve to identify the passenger to whom PNR data relate and which shall be filtered and depersonalised are: (a) name(s), including the names of other passengers on the PNR and number of travellers on the PNR travelling together; (b) address and contact information, including the IP address; (c) general remarks to the extent that it contains any information which could serve to identify the passenger to whom the PNR relate; and (d) any collected Advance Passenger Information. 2. The obligation to depersonalise data through masking in accordance with paragraph 1 shall be without prejudice to cases where the processing of PNR data in accordance with Article 4(2)(a) and (b) resulted in a positive match, in which case such data shall not be depersonalised through masking until it has been subject to human intervention by a member of the Passenger Information Unit in order to verify whether a competent authority needs to take action.

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Anna HEDH, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 10 – title

Penalties against air carriers and non- commercial flight operators

2015/04/20
Committee: LIBE

Ana GOMES, Christine REVAULT D'ALLONNES BONNEFOY, Anna HEDH, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 10 – paragraph 1

Member States shall ensure, in conformity with their national law, that dissuasive, effective and proportionate penalties, including financial penalties, are provided for against air carriers and other non- commercial flight operators which, do not transmit the data required under this Directive, to the extent that they are already collected by the them, or do not do so in the required format or otherwise infringe the national provisions adopted pursuant to this Directive.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Caterina CHINNICI, Jörg LEICHTFRIED, Josef WEIDENHOLZER, Kati PIRI, Péter NIEDERMÜLLER, Hugues BAYET, Emilian PAVEL, Tanja FAJON, Vilija BLINKEVIČIŪTĖ

Proposal for a directive
Article 11 a (new)

Article 11a Processing of special categories of data 1. Member States shall prohibit the processing of PNR data revealing race or ethnic origin, political opinions, religion or philosophical beliefs, sexual orientation or gender identity, trade-union membership or activities, and the processing of biometric data or of data concerning health or sex life. 2. In the event that PNR data revealing such information are received by the Passenger Information Unit, they shall be deleted without delay. To that end, upon the receipt of PNR data from air carriers, Member States shall apply automated and manual controls to identify and delete sensitive data from PNR data obtained. 3. In order to identify and delete any sensitive data from PNR data retained, members of the Passenger Information Unit shall undertake manual checks before any further manual processing and prior to any transfer of PNR data to competent authorities in accordance with Article 4(2), to the Passenger Information Unit or another Member State in accordance with Article 7, or to a third country in accordance with Article 8.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Christine REVAULT D'ALLONNES BONNEFOY, Caterina CHINNICI, Jörg LEICHTFRIED, Anna HEDH, Marju LAURISTIN, Josef WEIDENHOLZER, Kati PIRI, Péter NIEDERMÜLLER, Hugues BAYET, Emilian PAVEL, Tanja FAJON, Vilija BLINKEVIČIŪTĖ

Proposal for a directive
Article 11 f (new)

Article 11f Documentation 1. Member States shall provide that the Passenger Information Unit maintains documentation of all processing systems and procedures under their responsibility. 2. The documentation shall contain at least the following information: (a) the name and contact details of the organisation and personnel in the Passenger Information Unit entrusted with the processing of PNR data, the different levels of access authorisation and the personnel having such authorisations; (b) a description of the category or categories of data subjects and of the data or categories of data relating to them; (c) the recipients of the personal data; (d) all transfers of data to a third country, including the identification of that third country and the legal grounds on which the data are transferred, a substantive explanation shall be given when a transfer is based on Article 8a (new) of this Directive; (e) the time limits for retention and erasure of the different categories of data; (f) the results of the verifications of the measures that the processing of PNR data is performed in compliance with applicable data protection provisions; (g) an indication of the legal basis of the processing operation for which the data are intended. 3. The Passenger Information Unit shall make all documentation available, on request, to the supervisory authority.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Christine REVAULT D'ALLONNES BONNEFOY, Caterina CHINNICI, Jörg LEICHTFRIED, Anna HEDH, Marju LAURISTIN, Josef WEIDENHOLZER, Kati PIRI, Péter NIEDERMÜLLER, Hugues BAYET, Emilian PAVEL, Tanja FAJON, Vilija BLINKEVIČIŪTĖ

Proposal for a directive
Article 11 g (new)

Article 11g Keeping of records 1. Member States shall ensure that records are kept of at least the following processing operations: collection, alteration, consultation, disclosure, combination or erasure. The records of consultation and disclosure shall show in particular the purpose, date and time of such operations and as far as possible the identification of the person who consulted or disclosed PNR data, and the identity of the recipients of such data. 2. The records shall be used solely for the purposes of verification of the lawfulness of the data processing, self-monitoring and for ensuring data integrity and data security, or for purposes of auditing, either by the Data Protection Officer or by the supervisory authority. 3. The Member State shall ensure that the Passenger Information Unit shall make the records available, on request, to the supervisory authority.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Christine REVAULT D'ALLONNES BONNEFOY, Caterina CHINNICI, Jörg LEICHTFRIED, Anna HEDH, Josef WEIDENHOLZER, Kati PIRI, Péter NIEDERMÜLLER, Hugues BAYET, Emilian PAVEL, Tanja FAJON, Vilija BLINKEVIČIŪTĖ

Proposal for a directive
Article 11 h (new)

Article 11h Security of processing 1. Member States shall provide that the Passenger Information Unit implements appropriate technical and organisational measures and procedures to ensure a high level of security appropriate to the risks represented by the processing and the nature of the PNR data to be protected, having regard to the state of the art and the cost of their implementation. 2. In respect of automated data processing, each Member State shall provide that the Passenger Information Unit, following an evaluation of the risks, implements measures designed to: (a) deny unauthorised persons access to data-processing equipment used for processing PNR data (equipment access control); (b) prevent the unauthorised reading, copying, modification or removal of data media (data media control); (c) prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored PNR data (storage control); (d) prevent the use of automated data- processing systems by unauthorised persons using data communication equipment (user control); (e) ensure that persons authorised to use an automated data-processing system only have access to the data covered by their access authorisation (data access control); (f) ensure that it is possible to verify and establish to which bodies PNR data have been or may be transmitted or made available using data communication equipment (communication control); (g) ensure that it is subsequently possible to verify and establish which PNR data have been input into automated data- processing systems and when and by whom the data were input (input control); (h) prevent the unauthorised reading, copying, modification or deletion of PNR data during transfers of the data or during transportation of the data media (transport control); (i) ensure that installed systems may, in case of interruption, be restored (recovery); (j) ensure that the functions of the system perform, that the appearance of faults in the functions is reported (reliability) and that stored PNR data cannot be corrupted by means of a malfunctioning of the system (integrity). 3. Member States shall provide that the Passenger Information Unit observes the requisite technical and organisational measures under paragraph 1.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Christine REVAULT D'ALLONNES BONNEFOY, Caterina CHINNICI, Jörg LEICHTFRIED, Anna HEDH, Josef WEIDENHOLZER, Kati PIRI, Péter NIEDERMÜLLER, Hugues BAYET, Emilian PAVEL, Tanja FAJON, Vilija BLINKEVIČIŪTĖ

Proposal for a directive
Article 11 i (new)

Article 11i Right to judicial remedy 1. Without prejudice to any available administrative remedy, including the right to lodge a complaint with a supervisory authority, Member States shall provide for the right of every natural person to a judicial remedy if they consider that that their rights laid down in provisions adopted pursuant to this Directive have been infringed as a result of the processing of their personal data in non- compliance with these provisions. 2. Member States shall ensure that final decisions by the court referred to in this Article will be enforced.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Christine REVAULT D'ALLONNES BONNEFOY, Caterina CHINNICI, Jörg LEICHTFRIED, Marju LAURISTIN, Josef WEIDENHOLZER, Kati PIRI, Péter NIEDERMÜLLER, Hugues BAYET, Emilian PAVEL, Tanja FAJON, Vilija BLINKEVIČIŪTĖ

Proposal for a directive
Article 11 j (new)

Article 11j Liability and the right to compensation Member States shall provide that any person who has suffered damage, including non-pecuniary damage, as a result of an unlawful processing operation or of an action incompatible with the provisions adopted pursuant to this Directive shall have the right to claim compensation for the damage suffered.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Christine REVAULT D'ALLONNES BONNEFOY, Caterina CHINNICI, Jörg LEICHTFRIED, Josef WEIDENHOLZER, Kati PIRI, Péter NIEDERMÜLLER, Hugues BAYET, Emilian PAVEL, Tanja FAJON, Vilija BLINKEVIČIŪTĖ

Proposal for a directive
Article 11 l (new)

Article 11l Notification of a personal data breach to the supervisory authority 1. Member States shall provide that in the case of a personal data breach, the Passenger Information Unit, without undue delay and, where feasible, not later than 24 hours, the personal data breach to the supervisory authority. The Passenger Information Unit shall provide, on request, to the supervisory authority a reasoned justification in cases of any delay. 2. The notification referred to in paragraph 1 shall at least: (a) describe the nature of the personal data breach including the categories and number of data subjects concerned and the categories and number of data records concerned; (b) communicate the identity and contact details of the Data Protection Officer referred to in Article 3a (new) or other contact point where more information can be obtained; (c) recommend measures to mitigate the possible adverse effects of the personal data breach; (d) describe the possible consequences of the personal data breach; (e) describe the measures proposed or taken by the Passenger Information Unit to address the personal data breach and mitigate its effects. In case all information cannot be provided without undue delay, the Passenger Information Unit can complete the notification in a second phase. 4. Member States shall provide that the Passenger Information Unit documents any personal data breaches, comprising the facts surrounding the breach, its effects and the remedial action taken. This documentation must be sufficient to enable the supervisory authority to verify compliance with this Article. The documentation shall only include the information necessary for that purpose. 5. The supervisory authority shall keep a public register of the types of breaches notified.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Christine REVAULT D'ALLONNES BONNEFOY, Caterina CHINNICI, Jörg LEICHTFRIED, Josef WEIDENHOLZER, Kati PIRI, Péter NIEDERMÜLLER, Hugues BAYET, Emilian PAVEL, Tanja FAJON, Vilija BLINKEVIČIŪTĖ

Proposal for a directive
Article 11 m (new)

Article 11m Communication of a personal data breach to the data subject 1. Member States shall provide that when the personal data breach is likely to adversely affect the protection of the personal data and/or the privacy of the data subject, the Passenger Information Unit shall, after the notification referred to in Article 11l (new), communicate the personal data breach to the data subject without undue delay. 2. The communication to the data subject referred to in paragraph 1 shall be comprehensive and use clear and plain language. It shall describe the nature of the personal data breach and contain at least the information and the recommendations provided for in points (b), (c) and (d) of Article 11l (new) and information about the rights of the data subject, including redress. 3. The communication of a personal data breach to the data subject shall not be required if the Passenger Information Unit demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures, and that those measures were applied to the PNR data concerned by the personal data breach. Such technological protection measures shall render the data unintelligible to any person who is not authorised to access it. 4. The communication to the data subject may be delayed or restricted, in a specific case, to the extent that such a delay or restriction constitutes a necessary and proportionate measure: (a) to avoid obstructing official or legal inquiries, investigations or procedures; (b) to protect public security; (c) to protect the rights and freedoms of others.

2015/04/20
Committee: LIBE

Emilian PAVEL, Ana GOMES

Proposal for a directive
Article 13 – paragraph 1

1. All transfers of PNR data by air carriers, other commercial operators and non- commercial flight operators to the Passenger Information Units for the purposes of this Directive, shall be made by electronic means ~~or, in the event of technical failure, by any other appropriate means,~~and carried out via a processor of data that provides sufficient guarantees in respect of the technical security measures and organizational measures governing the processing to be carried out. In the event of technical failure, the PNR data shall be transferred by other appropriate means whilst maintaining the same level of security. All transfers of PNR data shall be made for a period of one year following the adoption of the common protocols and supported data formats in accordance with Article 14.

2015/04/20
Committee: LIBE

Birgit SIPPEL, Marju LAURISTIN, Josef WEIDENHOLZER, Kati PIRI, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 17 – paragraph 1 – point a

(a) review the feasibility and necessity of including internal flights in the scope of this Directive, in the light of the experience gained by those Member States that collect PNR data with regard to internal flights. The Commission shall submit a report to the European Parliament and the Council within two years after the date mentioned in Article 15(1);deleted

2015/04/20
Committee: LIBE

Birgit SIPPEL, Marju LAURISTIN, Josef WEIDENHOLZER, Kati PIRI, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 17 – paragraph 1 – point b

(b) ~~undertake a~~ review of the ~~operation of this Directive and submit a report to the European Parliament and the Council within four years after the date mentioned in Article 15(1)~~feasibility, necessity and proportionality of this Directive, in the light of the experience gained by the Member States. Such review shall cover all the elements of this Directive, with special attention to the compliance with standard of protection of personal data, the length of the data retention period ~~and~~, the quality of the assessments and the effectiveness of the sharing of the data between the Member States. It shall also contain the statistical information gathered pursuant to Article 18. The Commission shall submit a report to the European Parliament and the Council within two years after the date mentioned in Article 15(1);

2015/04/20
Committee: LIBE

Birgit SIPPEL, Caterina CHINNICI, Jörg LEICHTFRIED, Marju LAURISTIN, Josef WEIDENHOLZER, Kati PIRI, Sylvia-Yvonne KAUFMANN, Péter NIEDERMÜLLER, Ana GOMES, Emilian PAVEL, Tanja FAJON

Proposal for a directive
Article 17 a (new)

Article 17a Limitation This Directive shall loose its effect after a period of seven years. The Commission may propose to extend the effect of this Directive for further seven-year-periods. The decision of extension shall be taken by ordinary legislative procedure after the approval by the European Parliament and the Council.

2015/04/20
Committee: LIBE

54 Amendments of Emilian PAVEL related to 2011/0023(COD)

ParlTrack - 2011-2024