The Federal Criminal Police Office (BKA) has had to significantly reduce the mass surveillance of passengers without cause that it has practiced for years due to European and national judgments. Last year, however, the police authority was able to draw on the full in the controversial sky grid search: In 2022, aviation companies transmitted 424,305,929 so-called Passenger Name Records (PNR) to the passenger data center located at the BKA. More than 121 million air passengers were affected, with frequent flyers being the reason for multiple entries.
The numbers come from a response from the federal government, available online from heise, to a request from the left-wing parliamentary group in the Bundestag. The numbers are around half those of 2021, when the airlines had sent 211 million data records from around 62 million air travelers to the collection point. In 2020 it was around 100 million PNR. As of June 30, 2022, there were around 575 million data records stored in the passenger data information system, as the government announced in August. But the mountain must now shrink: The trigger is the landmark judgment of the European Court of Justice (ECJ) of June 2022, with which it raised the hurdles for the previously practiced PNR retention significantly. At the end of last year, the administrative court in Wiesbaden classified the BKA dragnet search as illegal.
Longer storage only in case of suspicion
According to the answer, the Federal Ministry of the Interior (BMI) has “developed a package of measures together with the authorities concerned” in order to adapt the PNR evaluation to the ECJ requirements. Insofar as the Luxembourg judges demanded “an objective connection between a criminal offense and the carriage of passengers”, this is now being checked when processing passenger data. The “hit rejection” was restricted accordingly. The authorities are also working to implement the ECJ’s announcement that PNR may only be stored for six months. From April onwards, a corresponding deletion label will apply. Storage of up to five years should only be possible for “verified and diverted register hits”.
According to the government, the BKA only processes PNR for flights within the EU “if there are sufficiently specific circumstances to assume” that Germany “is confronted with a terrorist threat that can be classified as real and current or foreseeable”. The BMI is also currently preparing a draft for an amendment to the Passenger Data Act and will then vote on this in the departmental group. There is no concrete timeline for this yet. The draft by the EU Commission to collect more API data (Advance Passenger Information) at the same time and to transmit it to the responsible authorities via a central router must be evaluated more closely.
High costs
The number of “professionally positively checked and therefore rejected processes” based on the comparison of the PNR with other databases for people and document searches as well as a pattern recognition carried out by the BKA was again manageable in 2022 at 87,845. The police encountered 19,827 suspicious passengers on site, arresting 1,387, while in 2021 there were only 1,052. On the other hand, there are considerable expenses: By the time the passenger data center was commissioned in August 2018, the BKA had incurred costs of 13.75 million euros for setting it up, and the Federal Office of Administration (BVA) had incurred 40.55 million euros for setting up the associated information system. The ongoing operating costs in 2022 alone were 3.2 and 11.4 million euros respectively – not including the use of internal staff.
“The PNR system continues to swallow the data of millions of innocent citizens,” criticized left-wing domestic politician Martina Renner to heise online. The first attempts to restrict and delete after six months are progress, “but the basic problem persists”. Ultimately, only a fraction of the data is used at all and only a fifth of the people sought are actually found at the airport by the police. The federal government has apparently already forgotten its own plans in the coalition agreement: “Chat control, retained data or PNR show how seriously it actually takes the protection of citizens and their data.” The left faction generally considers PNR storage to be “highly disproportionate” and too labour-intensive in view of the hundreds of positions at the BVA and BKA.
(olb)
