An EU PNR System?

Passenger Name Records (or PNR) are the data collected by an airline at the time of a passenger's reservation.  The data in a PNR is often very detailed and robust.  It may, for example, include a cell phone number for text updates or an email address.  It will typically also include an address, a credit card number, the name of the traveler, seat selection and flight data, and a link to other travelers who are in the same group or made reservations at the same time.  Beyond these basics the PNR can also include a host of other miscellaneous data, like frequent flyer numbers and such. As one can see from this brief description, PNR records are considered extremely useful as a data set for analytics.  They enable users to identify unknown links between a passenger and other data bases and have enough detail and granularity that, unlike many less detailed data sets, they can also be used for sophisticated, probabilistic forms of data analysis. For the US, PNR has been a counter-terrorism tool almost since 9/11.  All passengers who arrive in the US from international points of origin have had PNR records collected on their travel.  The records are generated by the airlines and, pursuant to the Aviation and Transportation Security Act, transmitted by the airlines to the US government.  [By contrast, for domestic travel within the US much less data is collected -- only name, gender, and date of birth, along with an identification number if a passenger has one.  This allows for a name-check against the Terrorist Screening Database, to identify known or suspected terrorists -- but it does not allow for the more detailed data analytics that are intended to identify unknown terrorist risks (so-called "clean skins")]. Because of the intrusive nature of the data collected in PNR (which might also, for example, disclose a medical condition or, through a meal choice, a traveler's religion), the American mandate to collect PNR and transmit it to the government has been an ongoing bone of contention between the US and the European Union.  The European Parliament, in particular, has been very vocal about the privacy-intrusive nature of PNR with one Member even (some what snidely) comparing the American approach to Dirty Harry, and contrasting it with the more sophisticated Hercule Poiroit-like approach of the EU. Needless to say, that mischaracterizes America's approach, but it does reflect European values. As a result of that disagreement, since 2002 no less than 4 separate negotiations have taken place (I personally participated in two of them) during which the EU has sought to have the US place internal limitations on the uses to which PNR data could be put.  By 2011, the two parties seemed to have exhausted themselves and reached a point of uneasy truce.   In the meantime, European security officials, who had proposed their own EU-version of a PNR analysis system, found themselves stymied by the Parliament, which refused to authorize the creation of such a system. All of which brings us to today, and the post-Charlie Hebdo EU.  According to the Washington Post, in the wake of the recent surge in terrorism, EU officials will revist that decision and look for authority to create an EU PNR system.  This change will accompany a broader array of security enhancements -- including a proposed EU-wide passport control system and an  EU-wide criminal data base.  As the Post put it, the fundamental problem in Europe, from a security standpoint is that: "Their citizens can move freely, but information about them does not."  The EU says it is now looking to change that paradigm. There is, of course, a small sense of irony about this -- especially for those who have participated in the seemingly endless discussions with the EU regarding security and privacy concerns.  To be candid, I remain skeptical that anything will change in the EU, even in the wake of Charlie Hebdo.  The anti-security impulse is too deeply ingrained.  But we shall see -- the EU discussion is just beginning.