US Government access to passenger data

By Toby Joseph, COO EMEA-APAC, TQ3 Travel Solutions

Following the terrorist attacks of 11 September 2001, the United States government has endeavoured to gather more information on all travellers who enter, pass through or leave the US. This has resulted in two significant developments in 2003:

PNRs – It has required access to the passenger name records of passengers on all flights entering the US from the European Union. PNRs contain travel itineraries plus personal data such as contact details, credit card information, travel preferences (e.g. dietary requirements) and medical information. The US has been accessing this information from airlines on a provisional basis since 5 March 2003.

APIS – The Advance Passenger Information System was originally designed to transmit passport information electronically to US immigration authorities before arrival. This includes passengers stating where they will stay in the US. APIS data must be transmitted within 15 minutes of a US-bound aircraft’s departure.

Why is the US taking these measures?
The US government is focusing on homeland security these days. It believes accessing PNRs helps tighten security, primarily by identifying highrisk passengers and identifying suspicious travel patterns. It also hopes these measures will speed up immigration processes.

Why are airlines and TMCs concerned?
As this issue will impede efficiency in the short term, and add costs due to additional time and energy in identifying supplementary information required, travel management companies and airlines have objected on a number of practical issues. The main practical difficulties are:

1. Delays at airport
Airlines have warned that APIS has the potential to cause chaos at airports because of the additional time that will have to be spent at check-in recording the information not found on passengers’ passports. According to British Airways, this task will add two minutes to the check-in process for each passenger. For a Boeing 747 with 450 passengers, assuming generously there are 10 lines for processing passengers on the flight that would add 90 minutes to the time taken to process each line. BA handles 5.4 million passengers on 275 weekly flights
between the UK and US. The airline says it may have to scrap some services at peak hours to handle the situation.

2. Additional cost for Travel Management Companies
Another option is for the new APIS information to be recorded by travel management companies at the time of booking a flight. However, this is not a perfect solution as:
a) At the time of booking, travellers may not know where they will be staying in the US.
b) In the case of business travel, most travel management companies charge their client on the basis of how much it costs to service them. If it takes longer to complete bookings because of the
need to record APIS information, the inevitable consequence is that fees will have to rise.
c) Not all flights to the US are booked through travel management companies.

3. Breaching EU data protection laws
The PNR issue has caused grave concern for airlines. They face punitive action from the US if they fail to pass on PNRs. On the other hand, surrendering the data contained within PNRs is widely held to breach EU data privacy laws in four different ways if they do pass them on.
The European Commission has responded by temporarily agreeing that it will not bring prosecutions against airlines. The US has therefore had the ability to access PNRs since 5 March 2003. The European Parliament condemned the Commission’s action in a vote by 414-44 but has no power to reverse the decision.

What will happen next?
US and European Commission officials are currently working on a permanent agreement on the data issue to replace the temporary accommodation that was signed in February 2003.
There is considerable pressure from the European Parliament to restrict or even scrap the measures introduced by the US. They have been joined by an EU Data Protection Working Party report, issued on 13 June 2003, which called for numerous controls to limit the access of the US to the data of European passengers.

In practice, however, the political predominance of the US usually ensures that it carries the day. Furthermore, there is arguably little use protesting because the US can access most of the information it wants in any case.

Nevertheless, it is expected that there will be some movement on this issue. The broad interim view taken by the national data protection commissions of EU member states is that they accept the adequacy of the data protection safeguards offered by the US. However, they are attempting to restrict the fields of information accessed by the US, the duration of storage of the information and the number of US agencies which can view the data. This could involve a ‘push’ solution involving airlines sending a cut-down back-up PNR to the US instead of the full original.

What is the view of TQ3 Travel Solutions?
We take a pragmatic view. It is almost certain that the US will continue to access at least some PNR data of European passengers; it will also press ahead with the enhanced version of APIS. On that basis, the travel industry will be obliged to seek solutions to the practical challenges this will create.

TQ3 is keen to work with airlines to find those solutions. We believe carriers will find it cumbersome to collect APIS details from leisure travellers and this may well lead to delays at airports. TQ3 can help to minimise the inconvenience for business travellers by processing the information in the managed travel environment and much of the rest will be handled at the time of booking. We can automate much of the required data in traveler profiles. It is inevitable, however, that additional work generates an additional cost and this is obviously something we would like to avoid. Again, we want to work with the airlines in finding suitable, efficient solutions, but we also seek clear legal guidelines as to who will get compensation for the additional cost involved.

TQ3 also believes this issue is a clarion call for the travel management industry to take action on a long-standing process inefficiency that does no one any favours: inconsistent PNRs. There is no standard agreement among travel management companies on what fields of information should be carried in a PNR.

TQ3 proposes that travel management companies should join forces once and for all to hammer out a standard for the mutual benefit of all our clients. This would have numerous additional advantages. One example is making it easier to transfer profiles when clients change their travel management company.

What action should corporate clients be taking?
We recommend companies that send employees to the US for business should inform them of the data situation. They should also discuss the issue with data protection, legal and IT advisers. We recommend that any company that takes exception to this new strategy should consider writing to airlines and to their national data protection commissioners.

Bottom Line is a TQ3 Travel Solutions Senior Management white paper on relevant travel industry topics.
For further information, contact TQ3 Travel Solutions on +44 (0)20 7153 3333 or email: [email protected]

C 2003, TQ3 Travel Solutions, Inc. All rights reserved.