View
1
Download
0
Category
Preview:
Citation preview
(10 pages)
FALP11.WP2-PNR SARPs.PNRTF.doc
FACILITATION PANEL (FALP)
ELEVENTH MEETING
Montréal, 13-16 January 2020
Agenda Item 3 : PNR Task Force: Recommendations for PNR SARPs
PASSENGER NAME RECORD (PNR) SARPs, Annex 9 — FACILITATION
(Presented by the Rapporteur, PNR-TF)
SUMMARY
This paper reports on the work accomplished by the Facilitation Panel’s (FALP’s) Passenger Name
Record Task Force (PNR-TF), at its meeting held in Montréal, from 3-6 December 2019, on the
development of proposals for Standards and Recommended Practices (SARPs) on the collection,
use, processing and protection of Passenger Name Record (PNR) data for inclusion in Annex 9 –
Facilitation. The Task Force’s draft proposals are in Appendix A. Appendix B reproduces the
opinion submitted by ICAO’s Legal Affairs and External Relations Bureau (LEB) on certain
related matters. The Task Force’s report itself is in an Information Paper, FALP/11-IP/1.
Action by the FAL Panel:
The FAL Panel is invited to consider the draft proposals for amendment to Annex 9 ―
Facilitation, as presented in Appendix A, and agree that the Annex be accordingly amended.
1. INTRODUCTION
1.1 On 23 January 2019, the Air Transport Committee (ATC) agreed that a Facilitation Panel
(FALP) Working Group be established to consider proposals for Standards and Recommended Practices
(SARPs) for inclusion in Annex 9 — Facilitation, on the collection, use, processing and protection of
passenger name records (PNR) data in line with United Nations Security Council resolution 2396 (2017)
(AT-WP/2161 and AT-SD/216-1 refer). Subsequently, on 21 March 2019, the Terms of Reference (ToRs)
for a PNR Task Force (PNR-TF), as well as the membership of the Task Force, were approved. Canada’s
FALP Member, Mr. Nuno Bellem, undertook the role of the PNR-TF rapporteur.
1.2 The PNR-TF undertook its work via emails, teleconferences and face-to-face meetings.
The first meeting was held in Cairo, Egypt, from 18-20 August 2019. The report of this meeting was
International Civil Aviation Organization
WORKING PAPER
FALP/11-WP/2 13/12/19
FALP/11-WP/2
- 2 -
presented to the ATC in October 2019, on the basis of AT-WP/2177, with a request that, inter alia, the
Committee endorse the proposals submitted by the PNR-TF for amendment to Annex 9. During its
consideration of the paper, the Committee noted that although the proposals in the paper improve on the
collection and use of PNR data, they do not advance on topics such as compliance and conflicts
resolution. Following a discussion, the Committee requested that another meeting of the PNR-TF be held
by the end of 2019, to review the draft SARPs resulting from the meeting in Cairo, as well as three
proposals that were made, but not considered due to lack of time, along with a legal analysis on these
latter provisions by the Legal Affairs and External Relations Bureau (LEB). The Committee also
requested that the Secretariat convene a meeting of the FAL Panel, in January 2020, to review the work of
the PNR-TF in a holistic manner and to submit the Panel’s report for the ATC’s consideration during the
219th (Spring 2020) Session (AT-SD 218/1, refers).
1.3 Accordingly, the PNR-TF met at ICAO Headquarters, Montréal, from 3-6 December
2019. Twenty-three members and advisors nominated to the PNR-TF by 8 Member States, one observer
to the TF from a Member State and eight observers from four international organizations participated in
the meeting.
2. DISCUSSION
2.1 Following a discussion, the Task Force agreed that new and/or revised draft SARPs on
PNR data for inclusion in Annex 9 ― Facilitation should be forwarded to the FALP/11 meeting, for
consideration. These proposals are at Appendix A. The report of the Task Force itself is presently
separately, in FALP/11-IP/1.
2.2 A summary of the proposed SARPs, specifically regarding compliance and conflicts
resolution, transparency and customers’ rights, PNR data retention period, and number of PNR
provisions, are presented below.
2.2.1 On the proposals regarding compliance and conflict resolution (that were not considered
at the Cairo meeting), LEB’s analysis — reproduced in full in Appendix B — concluded that:
a) an obligation to file with ICAO certificates of compliance with SARPs, either in
parallel with, or as an alternative to the notification of differences, may not be
suitable to be laid down under a SARP; and
b) if any State has substantial concerns about compliance by another State with any type
of SARPs, such State can use the mechanism provided by Article 54 j) and n), and
Article 84 of the Chicago Convention or, more efficiently, make arrangements under
their bilateral air transport agreement to deal with the matter, including conflicts
resolution rules, which may refer to the Permanent Court of Arbitration or otherwise
if amicable settlement is not reached.
2.2.2 Accordingly, references to “certification of compliance” and the “Permanent Court of
Arbitration,” were dropped from the text. An observer expressed the view that the existing dispute
resolution in the Chicago Convention, identified by LEB, seems not to be an effective solution to
addressing conflicts among States, resulting from non-compliance with PNR data transfer, privacy and
other PNR data-related issues. One member expressed the view that notwithstanding the dispute
resolution provisions contained in the Chicago Convention, it is important to refer to the Chicago
Convention in the proposed SARPs on compliance and conflict resolution. Another member expressed
the view that dispute resolution provisions are contained in the Chicago Convention, and did not support
FALP/11-WP/2
- 3 -
adding exceptions to the text of the SARPs. The member stated that the Task Force should focus on
designing a system that is acceptable to everyone, and which can allow a State to identify which State
does not comply with the relevant SARPs. The PNR-TF concluded that while the provisions are included
in the Chicago Convention, it was important to include such reference in the SARPs, given the different
PNR requirements in some States and the need for a system to solve these differences.
2.2.3 On the proposal regarding transparency and consumer rights, following an exchange of
views, the PNR-TF revised the proposal (paragraph 9.25, subparagraphs (c) and (d), Appendix A, refer).
2.2.4 On the proposal regarding timelines on PNR data retention, some participants expressed
the view that it was difficult to establish a set retention period as States may have different laws that
require a longer retention period, while others expressed the view that it is important to establish a
minimum period for data retention, since the inclusion of a minimum retention period in the proposal
does not preclude a State from establishing a longer retention period within its national legislation.
Following this exchange of views, the PNR-TF revised the proposal (paragraph 9.30, Appendix A,
refers).
2.2.5 Regarding the number of proposed SARPs, a majority of participants expressed a
preference for retaining as many SARPs on PNR, as may be necessary. One member expressed the view
that multiple SARPs are needed to effectively address the requirements of UN Security Council resolution
2396 (2017) that refers to the collection, use, processing and protection of PNR data, and in order to
establish an effective international legal framework for PNR data transfer, data privacy and protection of
human rights, a variety of provisions are needed. Another member submitted a consolidated version of the
proposals, in which some proposals were revised for clarity, and some merged, based on commonality
and relevance. The PNR-TF reviewed this version, and agreed on the draft SARPs, as presented in
Appendix A.
2.3 On the matter of drafting impact assessments and implementation guidance material, the
Members of the FALP, supported by the PNR-TF, may be requested to assist in this task, as required,
once the Panel has agreed on a final set of provisions for submission to the ATC.
3. RECOMMENDATION
3.1 In light of the above, the FALP is invited to consider the draft proposals for amendment
to Annex 9 ― Facilitation, as presented in Appendix A, and agree that the Annex be accordingly
amended.
— — — — — — — —
FALP/11-WP/2 Appendix A
APPENDIX A
PROPOSALS FOR AMENDMENT TO ANNEX 9
Amend Annex 9 as follows:
CHAPTER 9. PASSENGER DATA EXCHANGE SYSTEMS
. . . . . . D. Passenger Name Record (PNR) Data
9.23 Each Contracting State requiring Passenger Name Record (PNR) data shall:
(a) develop a capability to collect, use, process and protect Passenger Name Record (PNR) data
supported by appropriate legal framework (such as, inter alia, legislation, regulation or decree),
and be consistent with all Standards contained in Section D, Chapter 9, Annex 9;
(b) align its PNR data requirements and its handling of such data with the guidelines contained in
ICAO Doc 9944, Guidelines on Passenger Name Record (PNR) Data, and in PNRGOV message
implementation guidance materials published and updated by the WCO and endorsed by ICAO
and IATA.; and 9.23.1 Contracting States requiring the transfer of PNR data shall
(c) adopt and implement the EDIFACT-based PNRGOV message as the primary method for airline-
to-government PNR data transferal to ensure global interoperability.
Note 1.— UN Security Council, in Resolution 2396 (2017) at paragraph 12, decided that Member
States shall develop the capability to collect, process and analyse, in furtherance of ICAO standards
and recommended practices, passenger name record (PNR) data, and to ensure PNR data is used by
and shared with all their competent national authorities, with full respect for human rights and
fundamental freedoms, for the purpose of preventing, detecting, and investigating terrorist offenses
and related travel.
Note 21.— The PNRGOV message is a standard electronic message endorsed jointly by
WCO/ICAO/IATA. Depending on the specific aircraft operator’s Reservation and Departure Control
Systems, specific data elements which have been collected and stored by the aircraft operator for
their own operational and commercial purposes and can be efficiently transmitted via this
standardized message structure.
Note 2.— This provision is not intended to replace or supersede any messages exchanged between
aircraft operators and customs administrations to support local airport operations.
Note 3.— In addition to the mandatory EDIFACT-based PNRGOV message, Contracting States may
also, optionally, consider implementation of the XML PNRGOV message format as a supplemental
method of PNR data transfer, thereby allowing those aircraft operators with XML capability a
choice of format for the transmission of PNR data.
9.24 Recommended Practice.― Contracting States shall, with full respect for human rights and
FALP/11-WP/2 Appendix A
A-2
fundamental freedoms: requiring PNR data should consider the data privacy impact of PNR data collection and electronic transfer, within their own national systems and also in other States. Where necessary, Contracting States requiring PNR data and those States restricting such data exchange should engage in early cooperation to align legal requirements.
(a) clearly identify in their legal framework the PNR data to be used in their operations;
(b) clearly set the purposes for which PNR data may be used by the authorities which should be no
wider than what is necessary in view of the aims to be achieved, in particular for law
enforcement and border security purposes to fight terrorism and serious crime; and
(c) limit the disclosure of PNR data to other authorities in the same State or in other Contracting
States that exercise functions related to the purpose for which PNR data are processed, in
particular law enforcement and border security purposes, and ensure comparable protections as
those afforded by the disclosing authority.
9.25 Contracting States shall:
(a) prevent unauthorised access, disclosure and use of PNR data and their legal framework shall
provide penalties for misuse, unauthorised access, and unauthorised disclosure;
(b) ensure the safeguards applied to their collection, use, processing and protection of PNR data
apply to all individuals without unlawful discrimination;
(c) be open and transparent about the collection, use, processing and protection of PNR data and
related privacy standards employed;
(d) take measures to ensure that aircraft operators inform their customers about the transfer of PNR
data;
(e) provide for appropriate administrative or judicial redress mechanisms to enable individuals to
seek a remedy for the unlawful processing of their PNR data by public authorities; and
(f) provide for appropriate mechanisms, established by their legal and administrative framework, for
individuals to request access to their PNR data and request corrections or notations, if necessary.
9.26 Recommended Practice.― Subject to necessary and proportionate restrictions, Contracting States
should notify individuals of the processing of their PNR data and inform them about the rights and means
of redress afforded to them as defined in their legal and administrative framework.
9.27 Contracting States shall:
(a) base the automated processing of PNR data on objective, precise and reliable criteria that
effectively indicate the existence of a risk, without leading to unlawful discrimination; and
(b) not make decisions that produce significant adverse actions affecting the legal interests of
individuals based solely on the automated processing of PNR data.
9.28 Contracting States shall designate one (or more) competent domestic authority(ies) as defined in
their legal framework with the power to conduct independent oversight of the protection of PNR data and
A-3
FALP/11-WP/2 Appendix A
determine whether PNR data are being collected, used, processed and protected with full respect for
human rights and fundamental freedoms.
9.29 Contracting States shall:
(a) not require aircraft operators to collect PNR data that is not required as part of their normal
business operating procedures nor to filter the data prior to transmission; and
(b) not use PNR data revealing an individual’s racial or ethnic origin, political opinions, religious or
philosophical beliefs, trade union membership or data concerning their health, sexual life or
sexual orientation other than in exceptional circumstances to protect the vital interests of the data
subject or of another natural person. In circumstances where such information is transferred,
Contracting States shall delete such data as soon as practicable.
9.30 Contracting States shall:
(a) retain PNR data for a set period as defined in their national laws and policies which shall be that
period necessary and proportionate for the purposes for which the PNR data is used;
(b) depersonalise retained PNR data, which enable direct identification of the data subject, through
masking out of personal data elements no later than two years after the transfer of PNR data,
except when used in connection with an identifiable ongoing case, threat or risk related to the
purposes identified in 9.24b;
(c) only depersonalise (unmask) PNR data when used in connection with an identifiable case, threat
or risk for the purposes identified in 9.24b; and
(d) delete or anonymise PNR data at the end of the retention period.
Note. – Depersonalization of PNR data is the masking of information which enables direct
identification of an individual, without hindering law enforcement use of PNR data, whereas PNR
data anonymization is the permanent removal of identity information of a person from the PNR
record.
9.31 Recommended Practice.― Contracting States should retain PNR data for a maximum period of
five years after the transfer of PNR data, except when required in the course of an investigation,
prosecution, or court proceeding.
9.32 Recommended Practice.― Contracting States should depersonalise PNR data within six months of
the transfer of PNR data.
9.33 Contracting States shall:
(a) as a rule acquire PNR data using the 'push' method in order to protect the personal data that is
contained in the operators' systems and that operators remain in control of their systems;
(b) seek, to the greatest extent possible, to limit the operational and administrative burdens on aircraft
operators, while enhancing passenger facilitation;
FALP/11-WP/2 Appendix A
A-4
(c) not impose fines and penalties on aircraft operators for any unavoidable errors caused by a
systems failure which may have resulted in the transmission of no, or corrupted, PNR data; and
(d) minimise the number of times the same PNR data is transmitted for a specific flight.
Note.— In exceptional circumstances and when a PNR ‘push’ transfer method is not feasible, such as
when an aircraft makes an emergency landing, alternative means of PNR data acquisition can be
used by a Contracting State in order to maintain operational continuity.
9.34 Contracting States shall:
(a) not inhibit or prevent the transfer of PNR data by an aircraft operator or other relevant party, nor
sanction, impose penalties or create unreasonable obstacles on aircraft operators or other relevant
parties that transfer PNR data to another Contracting State provided that Contracting States’ PNR
data system is compliant with the Standards contained in Section D, Chapter 9 of Annex 9; and
(b) retain the ability to introduce or maintain higher levels of protection of PNR data, in accordance
with their legal and administrative framework;
(c) in line with the above, retain the ability to negotiate additional arrangements with other
Contracting States in particular to: promote collective security; achieve higher levels of
protection of PNR data, including on data retention; or establish more detailed provisions
relating to the transfer of PNR data, provided those measures do not otherwise conflict with the
Standards contained in Section D, Chapter 9 of Annex 9; and
(d) in any instance where Contracting States have determined they must inhibit, prevent or otherwise
obstruct the transfer of PNR data or must penalize an aircraft operator, they will do so with
transparency and with the intent of resolving the situation which caused that determination.
Note 1.— Under 9.34a, Contracting States are expected to allow other Contracting States compliant
with the PNR Standards to receive PNR data, at least provisionally, while engaging in consultations
or negotiations, as necessary. In these instances, Contracting States are expected to demonstrate, to
any requesting Contracting State, their compliance with these Standards and under 9.34b and 9.34c
take into consideration any additional measures requested by another Contracting State. A
demonstration of compliance with the PNR Standards, upon request, should take place as soon as
possible, and, among other things, could occur based on bilateral consultations and/or the
information in the ICAO online compliance checklist for Annex 9 – Facilitation contained in the
Electronic Filing of Differences (EFOD) system. Further, Contracting States are expected to work
through this process in good faith and in a timely manner. Under 9.34d, when a Contracting State
assesses that another Contracting State is non-compliant with these PNR Standards, the Contracting
State making that assessment may inhibit the transfer of PNR data to another Contracting State.
Note 2.— When entering information in the ICAO online compliance checklist for Annex 9 –
Facilitation contained in the EFOD system, Contracting States are able to utilize the National Air
Transport Facilitation Committee (NATFC).
9.35 Recommended Practice.― Contracting States establishing a PNR program, or making significant
changes to an existing program, pursuant to these SARPs should proactively notify other Contracting
States maintaining air travel between them prior to receiving data, including whether they are complying
with these SARPs, to encourage or facilitate rapid consultation where appropriate.
A-5
FALP/11-WP/2 Appendix A
9.36 Recommended Practice.— While attempting to resolve PNR data transfer disputes Contracting
States should not penalize aircraft operators.
— — — — — — — —
FALP/11-WP/2 Appendix B
English only
APPENDIX B
Analysis of PNR SARPS (not Agreed on at Cairo meeting) by
ICAO’s Legal Affairs and External Relations Bureau
As set out in paragraph 9.1 of Appendix B to AT-WP/2177, the proposed amendment with
regard to compliance is the following:
“A Contracting State’s PNR program shall be deemed to comply with the Standards contained in
this section upon that Contracting State’s deposit of a certification of compliance with the ICAO
Facilitation Panel.
Note 1.— When depositing a certificate of compliance, the self-certifying contracting State
should provide documentation describing its compliance for each PNR Standard contained in
this section”
As regards conflicts resolution, it is proposed that:
“If a Contracting State has substantial doubts or concerns regarding another Contracting State’s
self-certification of compliance referenced in Standard 9.xx, the States concerned shall first seek
to resolve such doubts or concerns through bilateral negotiations. If negotiations are
unsuccessful, the States concerned shall engage the dispute resolution services of the Permanent
Court of Arbitration, The Hague.”
The views of LEB are as follows:
With respect to compliance with any SARP, the Chicago Convention provides for a self-
standing legal regime to address issues related to possible non-compliance. While Article 37
aims at uniformity of Standards, constituting therefore the rule, Article 38 recognizes that States
may (exceptionally) adopt different standards provided that they notify ICAO thereof.
Accordingly, a State would only be found in a situation of non-compliance if it has adopted a
different standard and has not notified ICAO thereof. ICAO has put in place mechanisms to
audit, monitor and address such a situation. In the case of Annex 9, such mechanism is entailed
in USAP-CMA.
To LEB’s knowledge, there is no existing SARP providing for an additional system imposing on
States the obligation to file with ICAO certificates of compliance with SARPs which have not
been the object of notification of differences by the State concerned, as it is now being proposed.
Such a system would be redundant, considering that if a State does not file a difference it is to be
deemed as compliant unless the audit programmes implemented by ICAO reveal otherwise.
The propose standard would be an innovation and create a precedent which could lead to the
question as to whether each State should be required not only to notify differences, i.e. non-
FALP/11-WP/2 Appendix B
B-2
compliance, but also to file certificates of compliance with all SARPs in relation to which it has
not filed a difference. While theoretically such a system could be envisaged as an alternative to,
or in concomitance with the USOAP/USAP system, it would most probably be considered
unpractical.
As regards conflicts resolution, Article 54 j) and n), and Article 84 of the Chicago Convention
provide for a mechanism within ICAO to address inter alia any disagreement between
Contracting States relating to the interpretation or application of the Annexes which cannot be
resolved by direct negotiation between the States concerned.
On the basis of Article 83 of the Chicago Convention, States are free to make arrangements not
inconsistent with the provisions of the Convention. The same principle applies in relation to the
Annexes. In fact, States have for long time made arrangements under their bilateral (and possibly
multilateral) air transport agreements to deal on a reciprocal basis with matters of facilitation,
safety and security, as well as with the resolution of conflicts arising from such agreements.
In conclusion, from a legal viewpoint, LEB is of the view that:
a) an obligation to file with ICAO certificates of compliance with SARPs, either in parallel
with, or as an alternative to the notification of differences, may not be suitable to be laid
down under a SARP; and
b) if any given State has substantial concerns about compliance by another State with any
type of SARPs, such States can use the mechanism provided by Article 54 j) and n), and
Article 84 of the Chicago Convention or, more efficiently, make arrangements under their
bilateral air transport agreements to deal with the matter, including conflicts resolution
rules which may refer the matter to the Permanent Court of Arbitration or otherwise if
amicable settlement cannot be reached.
—END—
Recommended