Security Union: EC reports on the implementation of the EU-US TFTP and PNR Agreements

20 Jan 2017 10:17 AM

The EC has presented two implementation reports on the EU-US Terrorist Finance Tracking Programme (TFTP) Agreement and EU-US Passenger Name Records (PNR) Agreement.

The Commission welcomes the increased transparency of the US authorities regarding the functioning and added value of the TFTP and highlights the importance of the Agreement as an instrument to provide timely, accurate and reliable information to help identify and track terrorists and their support networks around the world. The Commission also notes the continued implementation by the US authorities of the conditions set out in the EU-US PNR Agreement, in particular in relation to passenger access rights and the masking and deletion of sensitive data.

EU-US TFTP joint review report

The Commission is satisfied that the Agreement, including its essential safeguards and controls, is being properly implemented and welcomes the fact that the US authorities have followed up on the findings of the previous joint review. The US authorities have made extensive use of the possibility to spontaneously provide information from the TFTP to EU authorities.

The Agreement proved instrumental in moving forward specific investigations relating to terrorist attacks on EU soil, including the January 2015 Charlie Hebdo attack and the November 2015 Paris attacks, and in providing information on the EU-based recruiting of terrorist fighters for Syria. TFTP-related data gave key insights into the financial support for networks of terrorist organisations, helping to identify persons involved in the US, the EU and elsewhere. The use of the mechanism by Member States and the EU has increased significantly, generating 8,998 investigative leads provided to Member States and Europol as compared to 3,929 leads in the previous reporting period.

In addition, the report underlines the important role of Europol in carrying out its verification tasks of requests for data from the EU and proactively initiating a series of requests, thus helping to raise awareness of the TFTP among EU authorities.

The Commission also makes some suggestions to Member States to provide regular feedback on the TFTP data received from the US authorities to further improve the quality and quantity of information exchanged and encourages Europol to further continue its efforts in providing support to Member States. The next review will be conducted at the beginning of 2018.

EU-US PNR joint-review report

The Commission found that the US authorities have been implementing the Agreement in accordance with the standards and conditions agreed. The US authorities respect the obligations regarding the access rights of passengers and have regular oversight mechanism in place to guard against unlawful discrimination. The Commission also welcomes the continued efforts to ensure reciprocity and pro-active sharing of analytical information obtained from PNR data with Member States and, where appropriate, with Europol and Eurojust. The masking and deletion of sensitive data are also respected. Finally, both the sharing of data with domestic US agencies and with third countries is in line with the important safeguards provided for in the Agreement.

However, despite the positive implementation of the Agreement, some improvements remain necessary. Amongst other measures, the US authorities should monitor more closely the number of staff with access rights to PNR data as well as regularly monitor the list of sensitive data codes to ensure that any sensitive data is automatically blocked by the system. In addition, the US authorities should ensure that PNR data which is no longer required is masked out, anonymised or deleted as soon as possible. The next joint evaluation of the Agreement is due to take place later in 2017.

Background

 EU-US TFTP Agreement

The TFTP agreement between the European Union and the United States came into force on 1 August 2010. It concerns the transfer and processing of data for purposes of identifying, tracking and pursuing terrorists and their networks. The agreement contains guarantees that ensure protection of EU citizens' data and foresees a regular review of "the safeguards, controls, and reciprocity provisions”.

In accordance with Article 13, the first joint review took place in February 2011 and covered the period of the first six months after the entry into force of the Agreement (1 August 2010 until 31 January 2011). The second joint review conducted in October 2012 covered the subsequent period of twenty months (1 February 2011 until 30 September 2012). The third joint review conducted in April 2014 covered a period of seventeen months (1 October 2012 until 28 February 2014). On 27 November 2013, the Commission adopted the Communication on the Joint Report from the Commission and the U.S. Treasury Department regarding the value of TFTP Provided Data pursuant to Article 6 (6) of the Agreement.

This report concerns the fourth joint review of the Agreement since it entered into force and covers a period of 22 months between 1 March 2014 and 31 December 2015.

 EU-US PNR Agreement

Following the terrorist attacks on 11 September 2001, the United States enacted a statute and accompanying regulations, requiring all air carriers operating passenger flights to and from the US to provide access to certain Passenger Name Records (PNR) information to US Customs and Border Protection – a component of the US Department of Homeland Security. In June 2002 the Commission informed the US authorities that these requirements could conflict with European and Member States' legislation on data protection which imposes conditions on the transfer of personal data to third countries.

As a result, the EU and the US entered into negotiations aimed at reaching agreement on sharing PNR data while securing an adequate level of data protection. The current EU-US PNR agreement on the transfer of air passengers' data for flights from the EU to the US entered into force on 1 July 2012.

The first joint review of the Agreement was carried out in Washington one year after its entry into force on 8 and 9 July 2013. This joint EU-US review took place 1 and 2 July 2015, covering the period 10 July 2013- 5 May 2015. A joint evaluation of the Agreement is due to take place in 2017.

For More Information

Report on the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of passenger name records to the United States Department of Homeland Security

Report on the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program

Press contacts:

Natasha BERTAUD (+32 2 296 74 56)

Tove ERNST (+32 2 298 67 64)

Markus LAMMERT (+ 32 2 298 04 23)

Kasia KOLANKO (+ 32 2 296 34 44)

General public inquiries: Europe Direct by phone 00 800 67 89 10 11 or by email