Terrorism and Crime (EUC Report)

rose to move, That this House takes note of the report of the European Union Committee, Prüm: An Effective Weapon against Terrorism and Crime? (18th Report, Session 2006-07, HL Paper 90). The noble Lord said: My Lords, in speaking to this Motion, I shall also, with your Lordships’ leave, speak to the second Motion standing in my name on the Order Paper. The two reports that are the subject of the debate were prepared by Sub-Committee F of the European Union Select Committee in May and June this year while I was still chairman. I am grateful to my successor, the noble Lord, Lord Jopling, for agreeing that I should open this debate. I also thank the noble Lord and other noble Lords on the committee, our clerk Michael Collon and our specialist adviser Annelise Baldaccini. I am delighted to see that my predecessor as chairman of Sub-Committee F, the noble Baroness, Lady Harris of Richmond, will also be speaking in the debate. Both reports relate to systems for the exchange of information that is or may be of use to the security services and the police in the prevention of terrorism and serious crime. Both are critical of those systems and more particularly of the manner in which they were set up. Owing to that, and because in this speech I, too, shall be critical, I should like to make one thing clear from the outset: I accept, as did the whole committee, that the exchange of information between the security services and police of different countries can be vital in the fight against terrorism and other serious crime. However, the exchange of information about individuals also carries with it risks. The problem is to strike the balance between public security and individual privacy. In the case of both inquiries, the view of the committee was that the rights of the individual have come off worse. Before I turn to that question, let me give a summary of the background to each report, starting with Prüm. Prüm is a small town less than 50 miles from Schengen and it shares with Schengen the distinction of having been virtually unknown until a treaty was signed there. Both treaties were the initiatives of member states that felt that matters at EU level were proceeding too slowly for their liking. However, while at the date of the Schengen agreement in 1985 there was no alternative procedure, by the time Germany began negotiations with some of its neighbours in 2004 to improve cross-border co-operation, the procedure of enhanced co-operation was available under the treaties. It had never been used; it still never has. Instead, negotiations took place with very little publicity and led to the signature of the Prüm treaty in May 2005. That treaty provided a mechanism for seven states to exchange among themselves information on DNA profiles, vehicle registrations and what are called dactyloscopic data— though I prefer the Anglo-Saxon term, ““fingerprints””. The treaty ignored work already being done at EU level. In evidence to the committee, Mr Peter Hustinx, the European data protection supervisor, said that the states party to the Prüm treaty had, "““evaded the substantive and procedural requirements of enhanced cooperation””." He thought it arguable that the treaty breached the law of the European Union. The German presidency began in January this year. Within a fortnight, the German Interior Minister started his attempt to have the main provisions of the treaty incorporated into EU law and, within six months, he had succeeded. Yet that was achieved only because the proposal was put forward with no consultation, no explanatory memorandum, no impact assessment, no overall evaluation of the operation of the treaty, no estimate of the cost to member states and minimal involvement of the European Parliament and national parliaments. The only involvement of this Parliament was the Select Committee’s report. In such negotiations as there were, the only achievement of this Government of any significance was the removal of the provisions on hot pursuit across national borders. The decision incorporating the treaty into EU law was adopted at the end of June, but much of the detail was left to an implementing decision. This, too, was brought out in June, again without consultation, explanatory memorandum, impact assessment or cost assessment. The committee considered it in July and raised questions with the Government. Last week, the committee considered it again, but now it is too late for our comments to have any effect, as last month the Justice and Home Affairs Council agreed the decision. This, the Home Office tells us, does not amount to a scrutiny override because only a general approach was agreed, not the final text of the decision. That, I submit, is an unreal distinction to draw. Any agreement, whatever name is given to it, that is reached on a document not cleared from scrutiny amounts to a scrutiny override if the result is that negotiations cannot in practice be reopened. That has for some time been the view of your Lordships’ committee, and that view is now shared by the European Scrutiny Committee in another place. The result is that this country has, in effect, been made party to a multilateral treaty with almost no involvement in its terms, let alone the involvement of Parliament. That is no way to legislate in a democracy. The second report concerns the agreement between the European Union and the United States on passenger name records, or PNR. PNR consists of detailed personal information about airline passengers that has to be transferred to the country of destination if a passenger is to be allowed to land, or even to overfly, that country. The country that is understandably most anxious to be certain of the precise identity of passengers, and hence requires most detail, is the United States, which regards the exchange of personal information as a vital element of the fight against terrorism and serious crime. The purpose of PNR agreements is to ensure that only essential information is disclosed, that it is used only for the purposes intended and that it is kept for no longer than absolutely necessary. The first agreement with the United States was concluded in 2004. It left much to be desired, but was far better than nothing. However, it very shortly became nothing, for it was annulled by the European Court of Justice in May 2006 for technical reasons with which I shall not weary your Lordships. Suffice it to say that the EU had three months to negotiate a new agreement. The Commission negotiators thus started from a position of weakness. The US was not under any pressure of time, but the EU was. The interim agreement that they concluded repeated all the undertakings in the 2004 agreement but was accompanied—and this is a significant point—by a letter from the United States Department of Homeland Security, the DHS, which, "““is intended to set forth our understandings with regard to the interpretation of a number of provisions of the ... Undertakings””." This letter reduced the value of the undertakings until they were scarcely worth the paper that they were written on. However, the 2006 agreement was, as I have said, only an interim agreement. It expired in July this year. The EU thus had until then to negotiate an agreement with provisions that meant what they said. We suggested in our report what those provisions might be: limits on the data elements transferred to the US; limits on the uses to which they could be put; and limits on the time for which the data could be kept. All these matters, we argued, should be limited to what was essential to the fight against terrorism and should all be subject to effective safeguards. We called on the Government to use their considerable influence with the United States to help to achieve this aim. We hoped for an agreement that, even if it was not ideal, would at least mean what it said. We said that, in our view, the worst possible conclusion would be an agreement that again was accompanied by a letter allowing the United States to disregard its provisions almost at will. Yet this is precisely what emerged in July from the negotiations: an agreement that, taken alone, should and would have been a triumph for the Commission negotiators, accompanied by a letter from the DHS, agreed by the Commission negotiators, allowing the United States to interpret its provisions as broadly as it liked. The vital provisions are in the letter, not the agreement. It is the letter and not the agreement that lists the PNR data to be transferred, a list that appears to be shorter than the one in the previous agreement but in fact contains only two data elements fewer. It is the letter that states that the data will be retained for seven years instead of three and a half years as previously. It is the letter that explains that the United States will use the data strictly for the listed purposes, "““or otherwise as required by law””—" United States law, that is, which the United States is, of course, free to change. The security of the public is the security of the individual members of the public. The competing interests are their public interests and their private interests. In opening, I said that in the case of the Prüm decision and the PNR agreement the view of the committee is that the private rights of the individual have lost out. That is not just our view. In the case of Prüm, the chief defect was to have yet another EU instrument with its own tailor-made data protection provisions that, in the absence of an overarching data protection framework decision covering all Third Pillar matters, were plainly inadequate. But at least an attempt was made to protect the privacy of individuals. No such thing can be said of the PNR agreement. Our views were and are shared by the equivalent committee of the European Parliament, by the European data protection supervisor and his deputy, who gave us written and oral evidence, and by the working party of national data protection supervisors, which, of course, includes among its members this country’s Information Commissioner, Mr Richard Thomas. He is now conducting one of the inquiries into the case of the missing disks, an episode that serves to remind us of the consequences that can follow if sensitive data are handled with insufficient safeguards. The consequences are not only financial. Mistakes over PNR can and do lead to individuals being wrongly banned from flying. Our report describes the fate of Maher Arar, a Canadian citizen born in Syria, who, on the basis of wrong information, was sent by the United States authorities in chains to Syria where he was kept for over a year in appalling conditions, beaten and tortured. The Canadian Government have awarded him compensation of 10.5 million Canadian dollars. The United States authorities still keep him on their no-fly list. Both reports contain strong criticism of the way in which these issues have been handled, but I hope that the Minister can assure the House that the lessons of both reports have been learnt. I have, however, a number of questions to put to the Government. In the case of Prüm, why did they allow themselves to be browbeaten into accepting a proposal with no sort of cost-benefit analysis? Why did they accept the proposal before an adequate data protection framework had been agreed? Why have they quite unnecessarily agreed an implementing decision that is still subject to scrutiny? In the case of PNR, the questions are still more serious. To what extent, if at all, did they make use of our special relationship with the United States to attempt to influence the negotiations? Why are they content to be party to an agreement that, like the bilateral extradition treaty, is so biased in favour of the United States? What steps are they taking to protect the interests of those British subjects who inevitably will suffer from the misuse of their personal information? I commend both reports to the House and I beg to move. Moved, That this House takes note of the report of the European Union Committee, Prüm: An Effective Weapon against Terrorism and Crime? (18th Report, Session 2006-07, HL Paper 90).—(Lord Wright of Richmond.)