NASA gathers airline passenger data.

[elektro80]

The US airline company Nothwest Airlines voluntarily handed over the personal data of possibly as much as 10 million US and European passengers to the National Aeronautics and Space Administration (NASA). Northwest Airlines has an alliance with the Dutch airline company KLM. The two companies have integrated their reservation systems and operate code-sharing flights from the USA to Amsterdam and beyond routes to Europe, Africa, the Middle East and India. Airline experts believe part of the data handed over to NASA originates from KLM passengers.

The Electronic Privacy Information Center (EPIC) in Washington publicized documents about the transfer obtained through a Freedom of Information Act procedure. NASA requested from Northwest Airlines the passenger data (PNR) from July to September 2001 for use in development and testing of passenger-profiling schemes. Northwest acknowledges the transfer. The company said in a statement that the transfer was 'appropriate' but that its current policy 'is to not provide passenger name record data to private contractors or federal government agencies for use in aviation security research projects'. EPIC has filed a complaint against Northwest Airlines with the US Department of Transport.

NASA requested Northwest to provide 'system-wide Northwest Airlines passenger data'. System-wide PNR data contains the personal data of all passengers on all flights operated by Northwest Airlines, domestic and abroad, and the data of all flights from airline companies with which Northwest operates code-sharing flights. This applies to KLM flights from Amsterdam to the US but also to many KLM flights within Europe and to destinations in Africa, the Middle East and India.

KLM can only share data with Northwest Airlines when the US company is able to comply with EU privacy standards. The American Civil Liberties Union has asked EU commissioner Bolkestein to investigate the handling of EU passenger data by Northwest. The Dutch civil liberties organisation Bits of Freedom will ask the Dutch Data Protection Authority to investigate the transfer, the role of KLM and to order KLM to notify the passengers involved.

EPIC documents: Northwest Airlines' Disclosure of Passenger Data to NASA
http://www.epic.org/privacy/airtravel/nasa/

ACLU letter to EU Commissioner Bolkestein (21.01.2004)
http://www.statewatch.org/news/2004/jan/18aclu-pnr-eu.htm

[elektro80]

MEP Marco Cappato has revealed a letter EU Commissioner Bolkestein sent to Tom Ridge, the U.S. Secretary of Homeland Security. The letter was sent on 18 December, only two days after Bolkestein had given his presentation in which he tried to mislead the European Parliament on the true nature of the agreement on the transfer of Air Passengers personal data to U.S. agencies.

Most interesting is the subtone of the letter, in which Bolkestein behaves like an ally of Ridge against the forces wanting to prevent the transfer: "On my return from Strasbourg (...), where the initial reaction from members of the European Parliament was relatively balanced, I would like to thank you once again for your personal commitment (....) to the conclusion of our discussions. I share entirely your view that we have set a good standard here for EU/U.S. cooperation and I hope we can keep it up."

Bolkestein makes it quite clear that the Commission does not object against the use of PNR-data collected in the EU in the CAPPS-II system: "This letter reflects my commitment to serious and rapid negotiations between DHS (Department of Homeland Security) and the European Commission with a view to reaching an understanding authorising the use of PNR data emanating from within the EU for the CAPPS II programme."

If the U.S. administration should stick to its plans to link CAPPS-II up with the even broader US-VISIT system, the data transfer would constitute an even more obvious offence against EU Data Protection law: US-VISIT explicitly grants access to all data to 'the Intelligence Community'. To conclude, Bolkestein expresses his regret that it is not in the Commission's power to stop national Data Protection Commissioners from enforcing EU or national DP law: "I nevertheless undertake to keep them informed on our discussions in the interest of avoiding any actions which may impact on our negotiations."

Both Bolkestein and Ridge must be disappointed by the negative advice from the Belgian Data Protection Authority against the transfer. In response to a complaint from Marco Cappato, on 19 January the Belgian DPA qualified the transfer of data raised at Brussels National Airport to the U.S. as illegal under Belgian law, paving the way for legal action to be taken against the involved airlines.

Letter from Commissioner Bolkestein to Secretary Ridge (18.12.2003)
http://www.europa.eu.int/comm/internal_market/privacy/docs/adequacy/pnr/2003-12-18-letter-bolkestein_en.pdf

Statement by MEP Marco Cappato on the letter (27.01.2004)
http://coranet.radicalparty.org/pressreleases/press_release.php?func=detail&par=6509

Belgian Privacy Commission, response to complaint about transfer of personal data to the U.S. by certain air carriers (in French):
http://www.radicalparty.org/privacy/etats_un.pdf

EU Data Protection Directive 95/46
(Article 25 defines conditions for the transfer to third countries of personal data raised in the EU)
http://www.dataprivacy.ie/6aii-3.htm#25

[seraph]

Just in case you do not know:
Marco Cappato is an Italian Member of the European Parliament elected on the list of the Transnational Radical Party
http://www.radicalparty.org/home_en.htm

[elektro80]

Is that a good thing?

[elektro80]

Seems like Cappato revealed something he was not supposed to. Will
this get him into trouble? This seems to be developing into a high profile scandal.

[seraph]

[elektro80]

Aha! Well, it seems like Cappatto has guts.