Go back to the Europarl portal

Choisissez la langue de votre document :

  • bg - български
  • es - español
  • cs - čeština
  • da - dansk
  • de - Deutsch
  • et - eesti keel
  • el - ελληνικά
  • en - English (Selected)
  • fr - français
  • ga - Gaeilge
  • hr - hrvatski
  • it - italiano
  • lv - latviešu valoda
  • lt - lietuvių kalba
  • hu - magyar
  • mt - Malti
  • nl - Nederlands
  • pl - polski
  • pt - português
  • ro - română
  • sk - slovenčina
  • sl - slovenščina
  • fi - suomi
  • sv - svenska
Parliamentary questions
PDF 102kWORD 16k
20 March 2017
E-001860-17
Question for written answer E-001860-17
to the Commission
Rule 130
Jan Philipp Albrecht (Verts/ALE) , Birgit Sippel (S&D) , Sophia in 't Veld (ALDE)

 Subject:  Enforcement of the Code of Conduct for Computerised Reservation Systems
 Answer in writing 

Article 11 of the Code of Conduct for Computerised Reservation Systems (Regulation (EC) No 80/2009 of 14 January 2009) requires that ‘technical and organisational measures shall be taken … to ensure that personal data are only accessible for the specific purpose for which they were collected.’ The Commission has the power to investigate and enforce the code under Section 6 of the regulation.

Personal data in the passenger name records (PNR) hosted by Computerised Reservation Systems (CRS) are available through CRS-operated public websites, just by using a name and the short ‘record locators’ displayed on items such as boarding passes and baggage labels. Due to a lack of access logs, data subjects are unable to gather from CRSs, whether their PNR data have been disclosed and to whom. Security researchers demonstrated these and other vulnerable aspects of CRSs at the Chaos Communication Congress held on 27 December 2016.

1. Does the Commission believe that giving access to PNR data on the basis of a name and record locator, with no password nor access logging, is compliant with Article 11 of the Code of Conduct?

2. Does it intend to investigate these vulnerable aspects and possible violations of the code?

3. Has it established procedures for handling complaints from individuals about violations of the code?

Legal notice