Since mid-2019, the Passenger Information Unit of the Netherlands (Pi-NL) has been collecting data on all passengers flying to and from the Netherlands. This is done on the basis of the PNR Act. That law seems to increasingly meet a need among investigative agencies. Whether the law is effective in combating terrorist and serious crimes cannot be said in such a short time. This is according to the evaluation of the law conducted by the Institute for Information Law of the University of Amsterdam and It's Public on behalf of the WODC.
The PNR Act, where PNR stands for Passenger Name Record, went into effect on June 18, 2019, as the Use of Passenger Data to Fight Terrorist and Serious Crimes Act. The law is a direct result of a 2016 EU directive. That requires member states to collect passenger data from flights outside the EU. Like other member states, the Netherlands has chosen to apply the PNR Act to flights within the EU as well. This includes data such as reservation information, previously followed travel routes, fellow passengers, baggage and payment information. The data is collected, stored and, if necessary, used to prevent, detect and prosecute terrorist crimes or other serious crime.
The evaluation study looked at the period from July 2019 to Jan. 1, 2021. It shows that the PNR law is definitely being used. For example, the Pi-NL received data on over 61 million passengers and the unit provided passenger information 20,034 times to Dutch competent authorities, such as the police and Royal Military Police. Both the average number of requests for information and the average number of times information was provided are higher in 2020 than in 2019. Remarkable because the number of flights in 2020 is significantly lower due to the Covid-19 pandemic. With that, the law seems to meet a need among competent authorities.
However, from this increased demand for passenger data, no conclusion can be drawn about the results and effects of the law. Does the law help fight terrorist and serious crimes? To properly answer that question, we lack, for example, data in registration systems of competent authorities. Moreover, the evaluation period is too short for that. When the law has been in effect for longer, there will be more opportunities to find out in how many criminal investigations and court decisions passenger data played a role.
Nevertheless, based on the experiences of the police, special investigation services, the Royal Military Police, the National Criminal Investigation Department and the Public Prosecution Service, among others, there is something to be said about the usefulness of the PNR Act. Staff of these agencies see the possibilities of the law as one of the tools in the toolbox for digital detection. According to them, the creation of a single information point, the Pi-NL, has eased the process of requisitioning this data. In addition, the PNR Act allows for pre-arrival or pre-departure assessment of passengers for possible involvement in a terrorist or serious crime. Thus, for the competent authorities interviewed, the law adds value to their investigative practice.
The review also looked at whether the collection, retention and use of passenger data is proportionate and necessary. Some countries have asked the European Court of Justice to rule on that. That ruling is likely to follow in the first half of 2022. The researchers see competent authorities and stakeholders experiencing two sides of the coin. For example, it appears that only a small proportion of passengers are provided with data. So people who have "nothing to hide" are not affected, some argue. Others, on the other hand, speak of mass surveillance and question its proportionality. A large group of people is not targeted by the PNR Act, and yet their data is collected, stored and used.
Read the full report.
