Yesterday the European Parliament voted on an agreement between the EU and the United States Passenger Name Records, PNR (results here). There is a quite good summary of the agreement and the process leading up to it on EUObserver. The rapporteur, Sophie in't Veld from Dutch centre-left liberal party D66, requested to be disassociated from the report upon its approval (voting for the report, was voting for the agreement, and to vote against the agreement we had to vote against the report). Sophie in't Veld has been one of the strong advocates for privacy in the Liberal Group of the European Parliament for a number of years and bore the main responsibility for the report on the PNR agreement. The disassociation basically means her committee, and the parliament, is acting against what she feels is the best interest of the European Union citizens and that she does not want to be associated with the agreement passing into effect.

I, along with the Pirate Party delegation, participated in a political protest against the agreement with a number of other political parties. We voted against.

One of the Swedish members who voted for the agreement argued in Swedish daily news paper that the data is already transfered and that the agreement simply creates rules for transfer that is already occurring. There are certain merits to this statement.

An expert invited for a seminar by the Green Group last year, Edward Hasbrouck, suggested that the flight industry already transfers passenger name records in the way that we, as privacy advocates, want to stop since the 1980s. He also believes that transfer of passenger name records from flights inside of Europe cannot be said to be transferred to the US as part of a "legitimate business interest", which means that the PNR transfers are actually already illegal from the perspective of European Union directive on data protection from 1995. One of the problems for the airlines industry, which was already a problem in 1995, is of course that their data systems are made in such a way that this transfer occurs anyway, and that the only way they can stop these transfers is by upgrading their data systems.

One could argue, of course, that it's in the interest of the industry to upgrade their data systems if the presently active ones are from the 1980s. But the flight industry is very important for society - this is, for instance, how the European Parliament is able to convene every week in a geographical location different from the one where most of its members live - and thus is probably just waiting for some kind of public subsidy to step in and take over the costs of the upgrade. Eventually it will be so beneficial to society for the upgrade to get made, that the public institutions can't escape stepping in. What the members of parliament that voted for the agreement yesterday expressed, was actually just that this time has not yet arrived.

Of course, in making this statement they are making Europe weak. Europe wants to have a high privacy protection for data subjects located on European soil. This much is clear from the European Convention of Human Rights, the Data Protection Direction Directive from 1995 and the recently proposed Data Protection Regulation and Directive of the European Commission in January 2012. Now that the Parliament is expressing a contradictive strategy with respect to passenger name records, one could argue that internationally we will look weak. Because actually the European public institutions and our democratically elected representatives are unwilling to accept the consequences of making Europe a world leader in privacy technologies, privacy protection and the new information landscape defined as a space for users and citizens.

There are many financial interests at the back of the debate on PNR, and sooner or later we will have to move the privacy debate to those financial interests and how to deal with them. In the case of PNR, rather than signing a distressingly compromised agreement with the United States, Commissioner Malmström could be working on how to deal with European entities in Europe and how they deal with European data. Why she and her predecessors at the Commission did not start doing this already in 1995 is beyond me, but maybe it is not too late to start.