Terrorism and Crime (EUC Report)

My Lords, perhaps I may get back in writing to the noble Baroness on that specific point. I am not clear on it myself. The noble Lord, Lord Wright, also mentioned the view of the Commission and the presidency. The Commission and the presidency, which led the negotiations, were well aware of the views of the European Parliament and the European data protection supervisor. A copy of the Select Committee’s report was given to the Commission. As the Article 29 working party on data protection acknowledged, these were extremely tough negotiations, in which the United States had a strongly held position. The noble Baroness, Lady Ludford, mentioned the incentive for the US to move to a push system. A push system is obviously much better than a pull system for the reason that she gave. A deadline of 1 January 2008 obliges the DHS to move to a push system for all carriers operating out of the European Union that have implemented a system that complies with the DHS technical requirements. Noble Lords mentioned the use of PNR data. The purpose set out in the previous interim agreement was retained in this new agreement. The US receives only that PNR that is necessary to prevent and combat, "““Terrorism and related crimes … Other serious crimes, including organized crime, that are transnational in nature; and … Flights from warrants or custody””," for these crimes. The agreement also states that PNR data may be used, where necessary, for the protection of the vital interests of the data subject or other persons, for any criminal judicial proceedings or as otherwise required by law. This use of PNR data is not a new concept; it was mentioned in former undertakings. I do not have the statistics for the agreement between the EU and the US on what has been achieved by PNR data. I would just cite Project Semaphore, which we have talked about in this House before. For example, on the very small quantity of PNR data that we have gathered on specific routes, we found that, as opposed to the one in 2,200 people whom in the past we were able to do anything about, we are able to get something like one in 12 of those people in whom we believe we have a legitimate interest. That shows the extent to which the data safeguard and enhance the rights of legitimate travellers who do not need to be subject to such detailed scrutiny, while successfully detecting the very small proportion of travellers who are breaking the law. A number of speakers asked about profiling. By using PNR, we can build up a picture of suspect passengers; it is more their patterns of travel than a profile of the person. This enables us to identify individuals conducting those patterns of travel and to see whether they share common characteristics. That has enabled us to identify people who are more of a risk to us. It can also be used to facilitate legitimate travel and allow us not to have to bother with people who are travelling legitimately. A number of speakers asked about the retention of data for longer. All I will say on that is that terrorist groups often operate over a long period and the recruitment and training of their personnel may be spaced over several years. It is therefore important that data be retained to allow retrospective analysis of intelligence to identify links between known operatives and others. The noble Baroness, Lady Harris, asked whether passengers were aware of what personal data were held and under what conditions. The main United Kingdom airlines already provide passengers with information about how their data will be used; the EU and the US work with the aviation industry to publicise PNR systems and to raise awareness among passengers. In terms of redress, the new agreement allows people to seek redress if they think their PNR data are inaccurate or have been used. Passengers can also ask for their PNR data from the Department of Homeland Security under the US Privacy Act and Freedom of Information Act. I cannot talk much more about that on the Floor of the House, but if the noble Baroness would wish, I can write to her, setting out the interface between the US Privacy Act and Freedom of Information Act. The noble Baroness, Lady Neville-Jones, asked about a proper mechanism for reviewing the workings of the agreement. The details of how the review will be carried out have yet to be agreed. For the European Union, the review will be undertaken by the commissioner responsible for justice, freedom and security or by somebody who he designates. Finally, there was a question about PNR data elements and their purpose. The data will be received only to the extent to which carriers collect those data as part of their normal business, as they already collect a lot of data under the EU borders scheme. The agreement specifically limits the purposes for which they may be used. I hope that I have answered all the questions on the PNR side. This particular agreement is a proportionate measure. It provides certainty to air carriers that they may transfer passenger name record data to US authorities in compliance with their data protection obligations. The Department of Homeland Security has made a policy decision to extend administrative Privacy Act protections to non-US citizens. That is an improvement over the previous agreement. Furthermore, as I have already mentioned, greater visibility for notices describing the PNR system will enhance transparency. Turning now to Prüm, the Government expect substantial benefits from this proposal for the work of UK law enforcement authorities. It will offer an enhanced UK law enforcement ability to search across the whole EU to establish matches of crucial forensic evidence in quicker time. This will allow officers to determine whether to pursue or eliminate lines of inquiry. The Prüm model returns a hit or no hit on average in 50 seconds, but it can take up to a maximum of 24 hours. I know that during the course of the committee’s inquiry, and in the report which preceded this debate, and in today’s debate, there have been a number of what could be termed ““process-related”” issues and questions. I want to reiterate that, despite my short time in this post, I am none the less more than aware of the importance of the parliamentary processes and seek to ensure that we work within them. The Government have endeavoured to keep Parliament informed of events as they have unfolded. The negotiations did move fast, but that is not necessarily a bad thing if it means that we see the benefits in quicker time. The negotiations did not however bypass the usual requirements. All member states were offered opportunities in the relevant council committee and at the JHA Council to question and propose amendments to the text, and indeed the UK secured three significant changes to meet UK concerns, including concerns raised by the European Union Committee. Specifically, we secured the deletion of the provision on hot pursuit, which was an issue that the committee felt particularly concerned about; we secured a limitation to vehicle registration data to serious crime; and secured data protection provisions that were both robust and consistent with national law and sought to include a council declaration on the application of existing non-automated data searching between member states. It was unfortunate that it was not possible to clear the proposal from scrutiny before it was agreed. In responding to the committee’s report within a week, we hoped to be in a position to have this debate before the June JHA Council. That did not prove possible. As such, after much consideration, the then Home Office Minister decided to override the parliamentary scrutiny reserve and agree the Prüm Council decision. The reasons for that were set out in a letter to the committee dated 11 June 2007. As noble Lords will be aware, we have recently participated in a general approach to the Prüm implementing agreement. I am aware of the committee’s views on the use of general approaches, but place on record that the Government do not consider this to be an override, given that work is continuing at expert level on the detailed accompanying technical annexe. Coming to the data protection issues, I reiterate that the Government secured specific data-sharing provisions to be included in the Council decision to ensure a balance between the rights of the individual and the need to share data for public security purposes. We believe that the Prüm Council decision and implementing agreement provide such provisions and safeguards. The noble Lord, Lord Wright, asked why we had been browbeaten into accepting Prüm without cost analysis. We were not browbeaten. There was a full discussion of the text. However, it was not accompanied by full and proper cost analysis—in that, he is completely right. I have to say that that was extremely unfortunate. During the negotiation, there was an expert seminar to explore the experience of the seven original Prüm states, which allowed us to assess resource and cost implications—it was not fully satisfactory, I have to say, but it gave us a baseline. The noble Lord asked why we accepted that before a data protection framework was in place. Prüm has its own data protection framework, which is robust and tailored to the specific system. It is a bespoke system. The noble Lord also asked why we agreed to implement the agreement while it was under scrutiny. The Government do not accept that the general approach at the November JHA Council—the ongoing negotiations are detailed in the annexe—is an override, because we reserve the right to reopen the text at any time. A number of speakers asked about access to our own databases and the complexities of our databases compared with those in the European Union. It would not be appropriate to allow direct access to our databases; indeed, that is not intended. We would allow a search on data from reference or shadow DNA or fingerprint databases, but that would be only to ascertain whether there was a hit or no hit on the data. Further information would have to go through the current secure police channels, including mutual legal assistance, once we knew that there had been a hit. Consequently, any disclosure of personal information about individuals whose profiles are on the UK databases would be under existing conditions. That provides for a case-by-case consideration of the legal basis, as well as the necessity for proportionality and justification of disclosure, taking into account data protection and ECHR considerations. In closing, I stress the importance that the Government attach to these initiatives. The UK Government take data protection very seriously. It is paramount to ensure that when we share information proper measures are in place to protect the data shared. Data sharing is a key part of keeping our communities safe and protected. With ever-increasing travel by offenders and the transnational nature of organised crime, the necessity to share information increases accordingly. Prüm is a new system for tackling organised transnational crime in a more modern way, allowing for a speedier and more efficient data-sharing mechanism. An important element in ensuring that we are able to share, retain and use data is the data protection standards and safeguards that the Prüm Council decision provides, with which the Government are satisfied. The agreement between the EU and the US on the exchange of PNR also strikes that balance between the need to combat terrorism and serious and organised crime and the need to provide data protection safeguards. We all agree that the collection of PNR data is a valuable weapon in the fight against terrorism. However, we should not lose sight of the immense value of PNR in combating serious crime, including human trafficking and drug smuggling, as well as its value in securing borders. I hope that I have addressed all your Lordships’ concerns satisfactorily, but I am willing to write on any issues that I have failed to cover in my speech.