Last week, the Council and the European Parliament finally came close enough on various points of the Passenger Name Records directive, so that the final approval by both co-legislators became a real possibility. PNR has been stuck in the EP for over 5 years. But the Paris attacks caused things to move. Latest trilogue (EC, EP, Council) produced a potentially viable compromise. The main point of contention was the length of access to unmasked data of air passengers. Initially, the Council asked for up to 24 months, while the Parliament was only willing to allow 31 days. The Council then asked for one year, and its latest negotiating proposal was 9 months. The EP raporteur of the directive, Timothy Kirkhoppe from the ECR group, made a final compromise proposal of 6 months in the beginning of last week. He indicated that although the center-right EPP and his own ECR groups supported any reasonable PNR, liberals (ALDE) and socialists (S&D) asked for a directive as privacy-friendly as possible – until the Paris attacks made them change their mind. This change of mind of left-leaning groups made the compromise proposal possible – and it makes the directive likely to pass in EP committee and then at plenary.

The Justice and Home Affairs Council, bringing together the 28 interior ministers on 4 December, approved the compromise text. The ministers agreed to allow for 6 months of unmasked access to passengers data (such as name, seat number, luggage allowance, payment method, contact details and so forth) for investigative and security-assessment purposes, with further 4 and a half years accessibility in masked form (with strict rules to access the full data in case it is needed). All flights to and from the EU will be covered, member states can also decide to include intra-EU flights inside their national legislations. The access will be governed by strict data protection rules.

The compromise PNR text has to be approved now by the Civil Liberties Committee and the Home Affairs Committee. The first vote is expected this week. Then, early next year, the text will be submitted to the EP plenary. If the MEPs agree to it, the Council´s formal approval will terminate the process and the member states will have 24 months to transpose the directive in national legislations.

One of the points that speeded the process was the risk of not having one PNR set of rules for the EU, but 28 different ones. France stated immediately after the attacks of 13 November, that should EP fail to approve it, France would adopt its own PNR law.

For more on this issue, click here, here, here and here.

The ministers last week discussed also Europol reform, where they also confirmed an informal deal with the MEPs. For more on this, click here and here.

In a related matter, MEPs in charge of the two data protection reform legislative acts (General Data Protection Regulation and Enforcement Directive) informed last Monday (30 November), that they were both optimistic about reaching an agreement with the Council on both acts by the end of this year – as promised earlier this year. For more on this, click here.