This Commission document presents the implementation plan for Directive (EU) 2016/681 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. Member States are required to transpose the Directive into national legislation by 25 May 2018.
The experience of both Member States and non-EU countries that have a functional PNR system in place or are in advanced stages of its finalisation illustrates the challenges, in terms of resources, time and technical complexity, of setting up PNR systems compliant with the Directive. This process requires (i) fully establishing and equipping the national Passenger Information Units (PIUs), (ii) testing the operation of their IT systems and (iii) making the necessary adjustments to ensure the system operates properly.
National measures required for the implementation of Directive (EU) 2016/681: the Commission identifies the most important measures that Member States introduce as being to:
- provide a legal basis for the collection and processing of PNR data that includes all the data protection safeguards provided for in the Directive and in the horizontal provisions applicable, in particular those of Directive (EU) 2016/6803 which will need to be transposed, except in exceptional circumstances, by 6 May 2018, i.e. before the deadline for transposition of the EU PNR Directive. In particular, Member States should consider providing for a clear indication of the databases against which PNR data may be compared (Art 6(3)(a)) and the main principles governing the creation, update and operation of the predetermined criteria against which PNR are processed (Art 6(3)(b) and (4);
- identify and designate the national authority or authorities that will host the PIU and how the latter will be incorporated in their administrative structure;
- equip the PIU with the required technical infrastructure allowing for the storage, processing and analysis of PNR data;
- train the PIU personnel in order to be able to perform its duties of effectively analysing PNR data for law enforcement purposes;
- identify and designate the competent authorities entitled to request and receive PNR data or the result of processing those data from the PIU;
- inform air carriers of the technical specifications concerning the transfer of PNR data and the necessary tests that must be conducted to ensure their connectivity with the technical infrastructure of the PIU;
- devise appropriate solutions to ensure that the PIUs are able to exchange PNR data effectively and in a timely manner.
Member States’ progress towards implementation: the state of the Directive’s implementation varies greatly across Member States. A number of them already either have a functional PNR system in place or are in advanced stages of its finalisation.
- currently, four Member States have both functional or almost functional PNR systems in place and a dedicated legal basis providing for the collection or processing of PNR data; amendments are however still needed to fully adjust the legislative framework to the requirements of the Directive; the experience of these four Member States provides best practice examples that should be used by other Member States;
- twelve Member States are in various stages of completion of the technical infrastructure and of the adoption of a dedicated PNR legislation;
- eleven Member States are still at a relatively early stage of the implementation process, with the concrete acquisition and development of the technical infrastructure yet to start. However, some of these Member States have already devised detailed implementation plans with concrete deadlines.
Support actions: to support and follow Member States' progress in implementing the PNR Directive, the Commission is taking the following actions:
- regular meetings with Member States and Europol to discuss legal questions linked to the interpretation and implementation of the Directive and to share queries, lessons learnt, and best practices ;
- financial assistance to Member States: the Commission has proposed to the budgetary authority to provide an additional amount of EUR 70 million to assist Member States in setting up their PIUs. This additional funding would be allocated mainly through Internal Security Fund national programmes and possibly also using Union Actions. Discussions with Member States on the practical details for benefiting from this funding will be held in due course. The Commission stands ready to provide further financial support if necessary;
- Commission implementing decision on data formats and transmission protocols: this decision provides a list of common protocols and supported data formats to be used by air carriers when transferring PNR data to the PIUs.
Possible Member State actions: the Commission has identified a number of indicative milestones that Member States should meet in order to have their PIUs up and running by May 2018. They cover aspects such as:
- ensuring the enacting legislation is compliant with the Directive;
- setting up PIUs;
- setting in place technical solutions for the processing of PNR data;
- staffing of PIUs;
- involvement of competent authorities (e.g. identifying the competent authorities entitled to request or receive PNR data);
- ensuring carrier connectivity.