The European Union announced Dec. 13 its parliament would sign a legislative agreement (.pdf) to share airplane passenger name record data with the United States.

Since 2007 the union has used and transferred PNR data--which can include the passenger's contact information, payment method, itinerary and baggage information--with the United States, but under the newly-negotiated agreement stronger data protections will be applied.

Under the agreement, the use of PNR data is limited to the prevention, detection, investigation and prosecution of terrorist offences or transnational crime, says an E.U. statement. The Homeland Security Department also has a legally-binding commitment to alert E.U. authorities of any "E.U.-relevant intelligence leads" resulting from PNR analysis.

PNR data will now be subject to stronger data security requirements. Under the agreement, DHS "shall" ensure data protection through the use of "encryption, authorization and documentation procedures recognized by competent authorities;" a secure physical environment; and a consistent and secure PNR query process, according to the legislation.

The agreement requires that DHS permanently delete all sensitive data within 30 days of entry, "however, sensitive data may be retained for the time specified in U.S. law for the purpose of a specific investigation, prosecution or enforcement action."

PNR data will be limited to a use period of 10 years for transnational crimes and 15 years for terrorism. Personally identifiable information must be "masked out" of PNR data after 6 months and after 5 years PNR data will be moved to a dormant database with additional controls, says the agreement.

Negotiations have been ongoing for years, and just months ago it was questionable whether the entities would reach a data-sharing agreement. In March, a U.S.-E.U. working group tasked with converting shared data exchange principles into workable standards hit a roadblock as Europeans pushed the United States to form an independent agency that is equivalent to the E.U. authority over data privacy. But despite Europeans' privacy concerns, DHS officials held that more bureaucracy was unnecessary.

The United States and European Union reached a provisional agreement in 2007 over the use of PNR data from flights with ties to E.U. countries. Though the provisional agreement is not scheduled to sunset until 2014, the European Union sought to renegotiate it in 2010 at the behest of its parliament, which was worried about privacy.

For more:
- download the agreement (.pdf)
- see the press release

Related Articles:
DHS defends passenger data collection amid E.U. privacy concerns
Adoption of E.U. data privacy laws unlikely
US-EU data sharing efforts snagged by privacy oversight debate
Napolitano: US-EU data sharing is critical