Matthias Monroy

In an EU-wide survey, the German Interior Ministry is examining how passenger data could be processed in the fight against the Covid 19 pandemic. This would require a change in the PNR directive. Possibly this would also affect bus and train travel.

On 1 July, Germany took over the EU Council Presidency in rotation. As one of the first initiatives in the area of Justice and Home Affairs, the German Ministry of the Interior is proposing to use passenger name records (PNR) collected from airlines to track Covid-19 infections. To this end, the government has sent a questionnaire to all other EU member states.

PNR data includes all information that travellers leave behind when booking and checking in with an airline, including names and contact details, credit card numbers, IP and e-mail addresses, hotels booked, fellow travellers and food preferences. This information is transmitted twice by the airlines to the relevant authorities in the destination country: when booking and when boarding the aircraft.

Limited scope of the EU PNR Directive

With the questionnaire, the German Federal Ministry of the Interior first of all wants to gain an overview of the use of PNR data for “ public health purposes“ in the Member States. Of interest are the previous travel movements of persons who are later found to be infected. The PNR data could then be used to notify other travellers as contact persons.

Currently, the data referred to in Article 1(2) may only be used for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. In order to combat the corona pandemic, the scope of the EU PNR Directive may need to be amended. For this reason, Member States should indicate the conditions under which national data protection authorities have agreed to the possible transfer of PNR data to health authorities. Governments should also specify to what extent the data may be shared with other Member States for health purposes.

It also asks whether the competent authorities are satisfied with the quality of the PNR data. This is not only important in relation to processing for public health purposes. Often the data sets do not contain contact details of passengers, including telephone numbers, but these are essential for tracing corona infection. Also of interest is the PNR data format, which must be compatible with the IT systems of public health authorities.

Unused „exit cards“

Finally, Member States should also provide information on the use of „exit cards“. By order of the German Federal Police, since March passengers have had to fill in such „exit cards“ on arrival by plane and also by train in Germany, but in practice these have hardly been used. At Frankfurt airport alone, 280,000 unused „exit cards“ are said to have piled up by the end of March.

The German questionnaire on the use of PNR data for public health purposes is also likely to influence the planned assessment of the PNR directive. Even before the Corona crisis last year, the Austrian Presidency had proposed to extend the scope of application to land-based travel.

This may be countered by a lawsuit filed by the German Society for Civil Liberties with the Austrian organisation epicenter.works against the mass storage and non-transparent processing of passenger data by criminal investigation offices. Now the European Court of Justice is examining the question of whether this interference violates private life and fundamental rights.

Newly established Council working group on information exchange

In addition to PNR data, the so-called Advanced Passenger Information (API) could also be used to combat Covid 19 infections. These API data contain limited information about passengers, such as names, addresses, departure and arrival times and itineraries. Since 2008, the German Federal Police have been requesting API data from certain departure countries, including those where Islamist-motivated attacks have frequently occurred. The API Directive of the European Union is also currently being evaluated and revised.

The ideas on the use of passenger data in the health sector will be further discussed in the newly established Council Working Party on Information Exchange (IXIM) on 16 July. Among other things, Belgium is to give a presentation at this meeting. Belgian authorities now also require PNR data from bus and train passengers from Great Britain.

Image: Ethan Wilkinson on Unsplash.