facilitation panel (falp) · 2.1 following a discussion, the task force agreed that new and/or...

(10 pages)

FALP11.WP2-PNR SARPs.PNRTF.doc

FACILITATION PANEL (FALP)

ELEVENTH MEETING

Montréal, 13-16 January 2020

Agenda Item 3 : PNR Task Force: Recommendations for PNR SARPs

PASSENGER NAME RECORD (PNR) SARPs, Annex 9 — FACILITATION

(Presented by the Rapporteur, PNR-TF)

SUMMARY

This paper reports on the work accomplished by the Facilitation Panel’s (FALP’s) Passenger Name

Record Task Force (PNR-TF), at its meeting held in Montréal, from 3-6 December 2019, on the

development of proposals for Standards and Recommended Practices (SARPs) on the collection,

use, processing and protection of Passenger Name Record (PNR) data for inclusion in Annex 9 –

Facilitation. The Task Force’s draft proposals are in Appendix A. Appendix B reproduces the

opinion submitted by ICAO’s Legal Affairs and External Relations Bureau (LEB) on certain

related matters. The Task Force’s report itself is in an Information Paper, FALP/11-IP/1.

Action by the FAL Panel:

The FAL Panel is invited to consider the draft proposals for amendment to Annex 9 ―

Facilitation, as presented in Appendix A, and agree that the Annex be accordingly amended.

1. INTRODUCTION

1.1 On 23 January 2019, the Air Transport Committee (ATC) agreed that a Facilitation Panel

(FALP) Working Group be established to consider proposals for Standards and Recommended Practices

(SARPs) for inclusion in Annex 9 — Facilitation, on the collection, use, processing and protection of

passenger name records (PNR) data in line with United Nations Security Council resolution 2396 (2017)

(AT-WP/2161 and AT-SD/216-1 refer). Subsequently, on 21 March 2019, the Terms of Reference (ToRs)

for a PNR Task Force (PNR-TF), as well as the membership of the Task Force, were approved. Canada’s

FALP Member, Mr. Nuno Bellem, undertook the role of the PNR-TF rapporteur.

1.2 The PNR-TF undertook its work via emails, teleconferences and face-to-face meetings.

The first meeting was held in Cairo, Egypt, from 18-20 August 2019. The report of this meeting was

International Civil Aviation Organization

WORKING PAPER

FALP/11-WP/2 13/12/19

FALP/11-WP/2

- 2 -

presented to the ATC in October 2019, on the basis of AT-WP/2177, with a request that, inter alia, the

Committee endorse the proposals submitted by the PNR-TF for amendment to Annex 9. During its

consideration of the paper, the Committee noted that although the proposals in the paper improve on the

collection and use of PNR data, they do not advance on topics such as compliance and conflicts

resolution. Following a discussion, the Committee requested that another meeting of the PNR-TF be held

by the end of 2019, to review the draft SARPs resulting from the meeting in Cairo, as well as three

proposals that were made, but not considered due to lack of time, along with a legal analysis on these

latter provisions by the Legal Affairs and External Relations Bureau (LEB). The Committee also

requested that the Secretariat convene a meeting of the FAL Panel, in January 2020, to review the work of

the PNR-TF in a holistic manner and to submit the Panel’s report for the ATC’s consideration during the

219th (Spring 2020) Session (AT-SD 218/1, refers).

1.3 Accordingly, the PNR-TF met at ICAO Headquarters, Montréal, from 3-6 December

2019. Twenty-three members and advisors nominated to the PNR-TF by 8 Member States, one observer

to the TF from a Member State and eight observers from four international organizations participated in

the meeting.

2. DISCUSSION

2.1 Following a discussion, the Task Force agreed that new and/or revised draft SARPs on

PNR data for inclusion in Annex 9 ― Facilitation should be forwarded to the FALP/11 meeting, for

consideration. These proposals are at Appendix A. The report of the Task Force itself is presently

separately, in FALP/11-IP/1.

2.2 A summary of the proposed SARPs, specifically regarding compliance and conflicts

resolution, transparency and customers’ rights, PNR data retention period, and number of PNR

provisions, are presented below.

2.2.1 On the proposals regarding compliance and conflict resolution (that were not considered

at the Cairo meeting), LEB’s analysis — reproduced in full in Appendix B — concluded that:

a) an obligation to file with ICAO certificates of compliance with SARPs, either in

parallel with, or as an alternative to the notification of differences, may not be

suitable to be laid down under a SARP; and

b) if any State has substantial concerns about compliance by another State with any type

of SARPs, such State can use the mechanism provided by Article 54 j) and n), and

Article 84 of the Chicago Convention or, more efficiently, make arrangements under

their bilateral air transport agreement to deal with the matter, including conflicts

resolution rules, which may refer to the Permanent Court of Arbitration or otherwise

if amicable settlement is not reached.

2.2.2 Accordingly, references to “certification of compliance” and the “Permanent Court of

Arbitration,” were dropped from the text. An observer expressed the view that the existing dispute

resolution in the Chicago Convention, identified by LEB, seems not to be an effective solution to

addressing conflicts among States, resulting from non-compliance with PNR data transfer, privacy and

other PNR data-related issues. One member expressed the view that notwithstanding the dispute

resolution provisions contained in the Chicago Convention, it is important to refer to the Chicago

Convention in the proposed SARPs on compliance and conflict resolution. Another member expressed

the view that dispute resolution provisions are contained in the Chicago Convention, and did not support

FALP/11-WP/2

- 3 -

adding exceptions to the text of the SARPs. The member stated that the Task Force should focus on

designing a system that is acceptable to everyone, and which can allow a State to identify which State

does not comply with the relevant SARPs. The PNR-TF concluded that while the provisions are included

in the Chicago Convention, it was important to include such reference in the SARPs, given the different

PNR requirements in some States and the need for a system to solve these differences.

2.2.3 On the proposal regarding transparency and consumer rights, following an exchange of

views, the PNR-TF revised the proposal (paragraph 9.25, subparagraphs (c) and (d), Appendix A, refer).

2.2.4 On the proposal regarding timelines on PNR data retention, some participants expressed

the view that it was difficult to establish a set retention period as States may have different laws that

require a longer retention period, while others expressed the view that it is important to establish a

minimum period for data retention, since the inclusion of a minimum retention period in the proposal

does not preclude a State from establishing a longer retention period within its national legislation.

Following this exchange of views, the PNR-TF revised the proposal (paragraph 9.30, Appendix A,

refers).

2.2.5 Regarding the number of proposed SARPs, a majority of participants expressed a

preference for retaining as many SARPs on PNR, as may be necessary. One member expressed the view

that multiple SARPs are needed to effectively address the requirements of UN Security Council resolution

2396 (2017) that refers to the collection, use, processing and protection of PNR data, and in order to

establish an effective international legal framework for PNR data transfer, data privacy and protection of

human rights, a variety of provisions are needed. Another member submitted a consolidated version of the

proposals, in which some proposals were revised for clarity, and some merged, based on commonality

and relevance. The PNR-TF reviewed this version, and agreed on the draft SARPs, as presented in

Appendix A.

2.3 On the matter of drafting impact assessments and implementation guidance material, the

Members of the FALP, supported by the PNR-TF, may be requested to assist in this task, as required,

once the Panel has agreed on a final set of provisions for submission to the ATC.

3. RECOMMENDATION

3.1 In light of the above, the FALP is invited to consider the draft proposals for amendment

to Annex 9 ― Facilitation, as presented in Appendix A, and agree that the Annex be accordingly

amended.

— — — — — — — —

FALP/11-WP/2 Appendix A

APPENDIX A

PROPOSALS FOR AMENDMENT TO ANNEX 9

Amend Annex 9 as follows:

CHAPTER 9. PASSENGER DATA EXCHANGE SYSTEMS

. . . . . . D. Passenger Name Record (PNR) Data

9.23 Each Contracting State requiring Passenger Name Record (PNR) data shall:

(a) develop a capability to collect, use, process and protect Passenger Name Record (PNR) data

supported by appropriate legal framework (such as, inter alia, legislation, regulation or decree),

and be consistent with all Standards contained in Section D, Chapter 9, Annex 9;

(b) align its PNR data requirements and its handling of such data with the guidelines contained in

ICAO Doc 9944, Guidelines on Passenger Name Record (PNR) Data, and in PNRGOV message

implementation guidance materials published and updated by the WCO and endorsed by ICAO

and IATA.; and 9.23.1 Contracting States requiring the transfer of PNR data shall

(c) adopt and implement the EDIFACT-based PNRGOV message as the primary method for airline-

to-government PNR data transferal to ensure global interoperability.

Note 1.— UN Security Council, in Resolution 2396 (2017) at paragraph 12, decided that Member

States shall develop the capability to collect, process and analyse, in furtherance of ICAO standards

and recommended practices, passenger name record (PNR) data, and to ensure PNR data is used by

and shared with all their competent national authorities, with full respect for human rights and

fundamental freedoms, for the purpose of preventing, detecting, and investigating terrorist offenses

and related travel.

Note 21.— The PNRGOV message is a standard electronic message endorsed jointly by

WCO/ICAO/IATA. Depending on the specific aircraft operator’s Reservation and Departure Control

Systems, specific data elements which have been collected and stored by the aircraft operator for

their own operational and commercial purposes and can be efficiently transmitted via this

standardized message structure.

Note 2.— This provision is not intended to replace or supersede any messages exchanged between

aircraft operators and customs administrations to support local airport operations.

Note 3.— In addition to the mandatory EDIFACT-based PNRGOV message, Contracting States may

also, optionally, consider implementation of the XML PNRGOV message format as a supplemental

method of PNR data transfer, thereby allowing those aircraft operators with XML capability a

choice of format for the transmission of PNR data.

9.24 Recommended Practice.― Contracting States shall, with full respect for human rights and


A-2

fundamental freedoms: requiring PNR data should consider the data privacy impact of PNR data collection and electronic transfer, within their own national systems and also in other States. Where necessary, Contracting States requiring PNR data and those States restricting such data exchange should engage in early cooperation to align legal requirements.

(a) clearly identify in their legal framework the PNR data to be used in their operations;

(b) clearly set the purposes for which PNR data may be used by the authorities which should be no

wider than what is necessary in view of the aims to be achieved, in particular for law

enforcement and border security purposes to fight terrorism and serious crime; and

(c) limit the disclosure of PNR data to other authorities in the same State or in other Contracting

States that exercise functions related to the purpose for which PNR data are processed, in

particular law enforcement and border security purposes, and ensure comparable protections as

those afforded by the disclosing authority.

9.25 Contracting States shall:

(a) prevent unauthorised access, disclosure and use of PNR data and their legal framework shall

provide penalties for misuse, unauthorised access, and unauthorised disclosure;

(b) ensure the safeguards applied to their collection, use, processing and protection of PNR data

apply to all individuals without unlawful discrimination;

(c) be open and transparent about the collection, use, processing and protection of PNR data and

related privacy standards employed;

(d) take measures to ensure that aircraft operators inform their customers about the transfer of PNR

data;

(e) provide for appropriate administrative or judicial redress mechanisms to enable individuals to

seek a remedy for the unlawful processing of their PNR data by public authorities; and

(f) provide for appropriate mechanisms, established by their legal and administrative framework, for

individuals to request access to their PNR data and request corrections or notations, if necessary.

9.26 Recommended Practice.― Subject to necessary and proportionate restrictions, Contracting States

should notify individuals of the processing of their PNR data and inform them about the rights and means

of redress afforded to them as defined in their legal and administrative framework.


(a) base the automated processing of PNR data on objective, precise and reliable criteria that

effectively indicate the existence of a risk, without leading to unlawful discrimination; and

(b) not make decisions that produce significant adverse actions affecting the legal interests of

individuals based solely on the automated processing of PNR data.

9.28 Contracting States shall designate one (or more) competent domestic authority(ies) as defined in

their legal framework with the power to conduct independent oversight of the protection of PNR data and

A-3


determine whether PNR data are being collected, used, processed and protected with full respect for

human rights and fundamental freedoms.


(a) not require aircraft operators to collect PNR data that is not required as part of their normal

business operating procedures nor to filter the data prior to transmission; and

(b) not use PNR data revealing an individual’s racial or ethnic origin, political opinions, religious or

philosophical beliefs, trade union membership or data concerning their health, sexual life or

sexual orientation other than in exceptional circumstances to protect the vital interests of the data

subject or of another natural person. In circumstances where such information is transferred,

Contracting States shall delete such data as soon as practicable.


(a) retain PNR data for a set period as defined in their national laws and policies which shall be that

period necessary and proportionate for the purposes for which the PNR data is used;

(b) depersonalise retained PNR data, which enable direct identification of the data subject, through

masking out of personal data elements no later than two years after the transfer of PNR data,

except when used in connection with an identifiable ongoing case, threat or risk related to the

purposes identified in 9.24b;

(c) only depersonalise (unmask) PNR data when used in connection with an identifiable case, threat

or risk for the purposes identified in 9.24b; and

(d) delete or anonymise PNR data at the end of the retention period.

Note. – Depersonalization of PNR data is the masking of information which enables direct

identification of an individual, without hindering law enforcement use of PNR data, whereas PNR

data anonymization is the permanent removal of identity information of a person from the PNR

record.

9.31 Recommended Practice.― Contracting States should retain PNR data for a maximum period of

five years after the transfer of PNR data, except when required in the course of an investigation,

prosecution, or court proceeding.

9.32 Recommended Practice.― Contracting States should depersonalise PNR data within six months of

the transfer of PNR data.


(a) as a rule acquire PNR data using the 'push' method in order to protect the personal data that is

contained in the operators' systems and that operators remain in control of their systems;

(b) seek, to the greatest extent possible, to limit the operational and administrative burdens on aircraft

operators, while enhancing passenger facilitation;


A-4

(c) not impose fines and penalties on aircraft operators for any unavoidable errors caused by a

systems failure which may have resulted in the transmission of no, or corrupted, PNR data; and

(d) minimise the number of times the same PNR data is transmitted for a specific flight.

Note.— In exceptional circumstances and when a PNR ‘push’ transfer method is not feasible, such as

when an aircraft makes an emergency landing, alternative means of PNR data acquisition can be

used by a Contracting State in order to maintain operational continuity.


(a) not inhibit or prevent the transfer of PNR data by an aircraft operator or other relevant party, nor

sanction, impose penalties or create unreasonable obstacles on aircraft operators or other relevant

parties that transfer PNR data to another Contracting State provided that Contracting States’ PNR

data system is compliant with the Standards contained in Section D, Chapter 9 of Annex 9; and

(b) retain the ability to introduce or maintain higher levels of protection of PNR data, in accordance

with their legal and administrative framework;

(c) in line with the above, retain the ability to negotiate additional arrangements with other

Contracting States in particular to: promote collective security; achieve higher levels of

protection of PNR data, including on data retention; or establish more detailed provisions

relating to the transfer of PNR data, provided those measures do not otherwise conflict with the

Standards contained in Section D, Chapter 9 of Annex 9; and

(d) in any instance where Contracting States have determined they must inhibit, prevent or otherwise

obstruct the transfer of PNR data or must penalize an aircraft operator, they will do so with

transparency and with the intent of resolving the situation which caused that determination.

Note 1.— Under 9.34a, Contracting States are expected to allow other Contracting States compliant

with the PNR Standards to receive PNR data, at least provisionally, while engaging in consultations

or negotiations, as necessary. In these instances, Contracting States are expected to demonstrate, to

any requesting Contracting State, their compliance with these Standards and under 9.34b and 9.34c

take into consideration any additional measures requested by another Contracting State. A

demonstration of compliance with the PNR Standards, upon request, should take place as soon as

possible, and, among other things, could occur based on bilateral consultations and/or the

information in the ICAO online compliance checklist for Annex 9 – Facilitation contained in the

Electronic Filing of Differences (EFOD) system. Further, Contracting States are expected to work

through this process in good faith and in a timely manner. Under 9.34d, when a Contracting State

assesses that another Contracting State is non-compliant with these PNR Standards, the Contracting

State making that assessment may inhibit the transfer of PNR data to another Contracting State.

Note 2.— When entering information in the ICAO online compliance checklist for Annex 9 –

Facilitation contained in the EFOD system, Contracting States are able to utilize the National Air

Transport Facilitation Committee (NATFC).

9.35 Recommended Practice.― Contracting States establishing a PNR program, or making significant

changes to an existing program, pursuant to these SARPs should proactively notify other Contracting

States maintaining air travel between them prior to receiving data, including whether they are complying

with these SARPs, to encourage or facilitate rapid consultation where appropriate.

A-5


9.36 Recommended Practice.— While attempting to resolve PNR data transfer disputes Contracting

States should not penalize aircraft operators.

— — — — — — — —

FALP/11-WP/2 Appendix B

English only

APPENDIX B

Analysis of PNR SARPS (not Agreed on at Cairo meeting) by

ICAO’s Legal Affairs and External Relations Bureau

As set out in paragraph 9.1 of Appendix B to AT-WP/2177, the proposed amendment with

regard to compliance is the following:

“A Contracting State’s PNR program shall be deemed to comply with the Standards contained in

this section upon that Contracting State’s deposit of a certification of compliance with the ICAO

Facilitation Panel.

Note 1.— When depositing a certificate of compliance, the self-certifying contracting State

should provide documentation describing its compliance for each PNR Standard contained in

this section”

As regards conflicts resolution, it is proposed that:

“If a Contracting State has substantial doubts or concerns regarding another Contracting State’s

self-certification of compliance referenced in Standard 9.xx, the States concerned shall first seek

to resolve such doubts or concerns through bilateral negotiations. If negotiations are

unsuccessful, the States concerned shall engage the dispute resolution services of the Permanent

Court of Arbitration, The Hague.”

The views of LEB are as follows:

With respect to compliance with any SARP, the Chicago Convention provides for a self-

standing legal regime to address issues related to possible non-compliance. While Article 37

aims at uniformity of Standards, constituting therefore the rule, Article 38 recognizes that States

may (exceptionally) adopt different standards provided that they notify ICAO thereof.

Accordingly, a State would only be found in a situation of non-compliance if it has adopted a

different standard and has not notified ICAO thereof. ICAO has put in place mechanisms to

audit, monitor and address such a situation. In the case of Annex 9, such mechanism is entailed

in USAP-CMA.

To LEB’s knowledge, there is no existing SARP providing for an additional system imposing on

States the obligation to file with ICAO certificates of compliance with SARPs which have not

been the object of notification of differences by the State concerned, as it is now being proposed.

Such a system would be redundant, considering that if a State does not file a difference it is to be

deemed as compliant unless the audit programmes implemented by ICAO reveal otherwise.

The propose standard would be an innovation and create a precedent which could lead to the

question as to whether each State should be required not only to notify differences, i.e. non-

FALP/11-WP/2 Appendix B

B-2

compliance, but also to file certificates of compliance with all SARPs in relation to which it has

not filed a difference. While theoretically such a system could be envisaged as an alternative to,

or in concomitance with the USOAP/USAP system, it would most probably be considered

unpractical.

As regards conflicts resolution, Article 54 j) and n), and Article 84 of the Chicago Convention

provide for a mechanism within ICAO to address inter alia any disagreement between

Contracting States relating to the interpretation or application of the Annexes which cannot be

resolved by direct negotiation between the States concerned.

On the basis of Article 83 of the Chicago Convention, States are free to make arrangements not

inconsistent with the provisions of the Convention. The same principle applies in relation to the

Annexes. In fact, States have for long time made arrangements under their bilateral (and possibly

multilateral) air transport agreements to deal on a reciprocal basis with matters of facilitation,

safety and security, as well as with the resolution of conflicts arising from such agreements.

In conclusion, from a legal viewpoint, LEB is of the view that:

a) an obligation to file with ICAO certificates of compliance with SARPs, either in parallel

with, or as an alternative to the notification of differences, may not be suitable to be laid

down under a SARP; and

b) if any given State has substantial concerns about compliance by another State with any

type of SARPs, such States can use the mechanism provided by Article 54 j) and n), and

Article 84 of the Chicago Convention or, more efficiently, make arrangements under their

bilateral air transport agreements to deal with the matter, including conflicts resolution

rules which may refer the matter to the Permanent Court of Arbitration or otherwise if

amicable settlement cannot be reached.

—END—

facilitation panel (falp) · 2.1 following a discussion, the task force agreed that new and/or...

Documents