ARTICLE 29 Data Protection Working Party

02318/09/EN
WP167

Opinion 8/2009
on the protection of passenger data collected and processed by duty-free
shops at airports and ports

Adopted on 1 December 2009

This Working Party was set up under Article 29 of Directive 95/46/EC. It is an independent European advisory body on data
protection and privacy. Its tasks are described in Article 30 of Directive 95/46/EC and Article 15 of Directive 2002/58/EC.

The secretariat is provided by Directorate D (Fundamental Rights and Citizenship) of the European Commission, Directorate
General Justice, Freedom and Security, B 1049 Brussels, Belgium, Office No LX-46 01/190.

Website: http://ec.europa.eu/justice_home/fsj/privacy/index_en.htm
The Working Party on the protection of individuals with regard to the
processing of personal data

set up by Directive 95/46/EC of the European Parliament and of the Council of 24

October 1995,
having regard to Articles 29 and 30 paragraphs 1 (a) and 3 of that Directive, and Article
15 paragraph 3 of Directive 2002/58/EC of the European Parliament and of the Council
of 12 July 2002,
having regard to Article 255 of the EC Treaty and to Regulation (EC) no 1049/2001 of
the European Parliament and of the Council of 30 May 2001 regarding public access to
European Parliament, Council and Commission documents,
having regard to its rules of procedure,

has adopted the following

Opinion 8/2009 on the protection of passenger data collected and processed by duty-
free shops at airports and ports

Introduction

Community law allows for the exemption of excise duties for purchases made in duty-
free shops at airports and ports by passengers. Such purchases, however, are subject to
certain conditions.

To fulfil these conditions, most shops in EU Member States collect and process data
including passenger data when items are purchased.

However, the practice with regard to the processing and collection of such passenger data
across Europe varies considerably in duty-free shops.

No information at all is given to passengers about the collection of data including their
personal data, the purpose for the collection, their rights and the use of these details by
public bodies if such data are transferred to them.

In accordance with Article 30 of the Directive 95/46/EC the European Commission has
asked the Art. 29 WP to look into this matter and review the current practice in EU
Member States with regard to data protection questions to come up, if necessary, with
recommendations on a uniform application of the general data protection principles to be
respected in duty free shops at airports and ports.

This opinion analyses the legal and practical issues surrounding the collection and
processing of passenger data in duty-free shops and aims to give guidance to shop
keepers and customs authorities charged with supervising the implementation of
Community law with a view to coming to a more harmonised application of existing
provisions.

- 2-
The regulatory framework

The exemption of excise duties is based on the following Community laws which have
been transposed and implemented by all Member States.

a) Council Directive 92/12/EEC of 25 February 1992

to be replaced by

b) Council Directive 2008/118/EC of 16 December 2008 concerning the general

arrangements for excise duty and repealing Directive 92/12/EEC (Excise Duty
Directive). It shall be transposed by Member States with effect from 1 April 2010.

While Directive 92/12/EEC keeps silent on exemptions, Directive 2008/118/EC provides

a clear legal basis on which merchandise might be exempted in so-called tax-free or
duty-free shops in the European Union.

Article 14 of the Excise Duty Directive lays down the conditions under which goods
submitted to excise may be exempted from payment of excise duty by eligible travellers.

This regulation applies to goods supplied by tax-free shops which are carried in the
personal luggage of travellers to a third country (or territory) taking a flight or sea
crossing.

For the purpose of said Directive, the following definition of Article 14(5)(b) applies:
“traveller to a third territory or to a third country” means any passenger holding a
transport document, for air or sea travel, stating that the final destination is an airport or
port situated in a third territory or a third country.

As a result of these provisions a fairly limited quantity of merchandise can only be

exempted from excise duties if the traveller is in possession of a transport document such
as a boarding pass or a ferry ticket and in addition he or she must leave the European
Union for a port of arrival outside the Community. It is, however, not required that the
traveller resides outside the EU.

To avoid abuse of exemptions the Directive lays down in Article 14 (3) that Member
States shall take the necessary measures to ensure that the exemptions are applied in such
a way as to prevent any possible evasion, avoidance or abuse.

Neither Directive 92/12/EEC nor Directive 2008/118/EC contain any mention of data
protection provisions. For that reason the general provisions of Directive 95/46/EC have
to be applied.

Varying European practices

Following the request of the European Commission, in summer 2009 the Art. 29 WP
launched an investigation into the way passenger data are collected by duty free shops
and how they are processed by the shops themselves and by others. The emerging picture
shows that the practice in duty-free shops across Europe varies greatly, which might be
due to different interpretations of Community law or national legislation or due to the
fact that the Excise Duty Directive will only enter into force on 1 April 2010.

- 3-
During its investigation the Art. 29 WP found the following four general patterns which
might be different in some Member States.

1 The purchase of duty-free articles is not possible without indicating the flight number.
To check whether a passenger is eligible for an exemption of excise duties and to avoid
misunderstandings or discussions with passengers, all travellers have to show to the
cashier their boarding pass which is electronically scanned to identify an eligible flight.
No other data such as name or passport number are collected and stored. If the flight is
indeed to a destination outside the EU the cash register indicates the reduced price to be
paid by the customer.

The data of the flight and the purchased items taken on board are stored for a period of
10 years to allow for a control of the duty-free shop at a later stage by competent customs
authorities.

2 In another Member State the duty-free shops at airports collect a lot of data about
passengers. In the case of purchases of merchandise exempted from excise duties, a
respective customs legislation foresees that, in order to allow for inspections, all sellers
must keep a detailed receipt which mentions, among other information, the first five
letters of the surname of the buyer, the first five letters or digits of the flight number, the
destination and the date of the transaction.

Airport shops collect these data either by scanning the boarding passes through optical
readers or by typing in the data manually. In addition, they collect even more data, such
as the nature, number and value of the purchased items, the identity of the buyers on a
15-letter basis, and they keep all these details electronically in a central database for as
long as three years. No sensitive data, however, are collected. In doing so it is easy to
identify certain passengers and to build up databases of duty-free items bought by
individual travellers over a certain period of time.

3 In other Member States duty-free shops only collect information on the destination of
the flight (flight number) to check if it is an intra EU or extra EU flight without
registering the flight number. No additional data are collected and stored.

In all these cases the Art. 29 WP noticed that no duty-free shop provided any information
to passengers, no indication of why flight numbers are collected or how data are stored.

4 In one Member State no data at all are collected from passengers by the duty-free shop
regardless of whether they buy merchandise exempted or not or whether the flight is an
intra European or extra European one.

The examples given here clearly show that the current practice in Europe is not uniform
and despite the explicit provisions of the Excise Duty Directive Member States have
developed varying methods of how to deal with duty-free purchases. While in some
instances, as shown above, no data at all are collected; in other Member States a lot of
information has to be provided by the traveller and is stored. Also the retention periods
show great differences.

- 4-
Apart from data protection issues these varying practices raise the question of whether
they are in line with the provisions of the Excise Duty Directive which clearly mandates
Member States to take all measures necessary to avoid abuse and tax evasion.

Data protection principles

As mentioned before, these Directives don’t contain any data protection provisions and
for that reason the general principles of Directive 95/46/EC have to be applied, as
personal data might be processed by duty-free shops and by customs authorities which
has to be considered as an activity belonging to the first pillar.
These general principles comprise among others:

• Lawfulness
• Purpose limitation
• Data must be non excessive, adequate and accurate
• No further processing with incompatible purposes
• Proportionate retention period
• Sufficient information given to data subjects

Furthermore, a prior notification procedure may be required in certain Member States.

Rights of the data subject

The rights of data subjects as laid down in Articles 10, 11 and 13 and 14 of the Directive
also have to be applied when passengers buy goods in duty-free shops and their personal
data are collected and processed. Where sensitive data are collected Article 8 of the
Directive applies.

Applicability of data protection principles

The practice mentioned under no 3 where limited information on the destinations of

flights is collected, and no 4 where duty-free shops in one Member State don’t collect
personal data at all are certainly from a data protection point of view the most privacy
friendly and should be supported as far as they effectively allow for the effective
application of the Excise Duty Directive. The Directive indeed charges Member States
with taking the necessary measures to prevent and combat abuse and tax evasion. Any
such measures might include the collection of some data as an appropriate and necessary
means to fulfil these tasks.

In the case mentioned under no 2 where one Member State collects a lot of personal
information the Art. 29 WP questions how this practice is compatible with the principles
of data minimisation and proportionality. The amount of data collected seems excessive
and not necessary for the purposes of determining whether a passenger is eligible for
exemptions of excise duties.

In those cases where no direct personal information is collected (examples no 1 and no 3)

the passenger might only be identified in an indirect way. This practice is in line with
accepted data protection principles as only a very limited amount of data is collected i.e.
the flight number/destination and this information is, if retained, only stored for a limited
period of time to allow for government control to avoid abuses.

- 5-
When it comes to retention periods the examples mentioned here vary considerably as
well. While in the cases mentioned under no 3 and no 4 no data are stored at all, in the
cases of no 1 and no 2 the retention periods amount to three years and ten years
respectively.

According to Article 6 (e) of the Directive 95/46/EC data should be stored no longer than
necessary to fulfil the purposes for which they were collected.

Given that Member States shall take the measures necessary to avoid abuse and tax
evasion it might be required to store some data to allow for control and analyses of the
way duty-free shops conduct their businesses.

While a three-year retention period is sufficient for some authorities, it is questionable

why other authorities need a ten-year retention period. Consideration should be given to
shortening this period and in any case it should be no longer than any other retention
periods in comparable circumstances such as keeping invoices for tax purposes. It is also
advisable to harmonise the retention periods across Europe as it affects all travellers who
are subject to the same Directive 2008/118/EC.

The further processing of personal data collected by customs authorities in the course of
their lawful activities is in line with both the Directive 2008/118/EC and data protection
principles. Any other processing of personal data collected in the course of purchasing
duty-free items should be subject to strict limitations in line with the principles of
Directive 95/46/EC.

Conclusion and recommendations

Duty-free shops at airports and ports collect and process data, including personal data, to
verify whether their customers are eligible for exemptions of excise duties. In most cases
they keep the data for customs authorities as proof of their rightful doing. Customs
authorities might also process and keep the data for their own purposes including
statistical ones.

The above mentioned Directives provide for a clear legal basis as to the collection,
processing and storage of certain data contained in the transport documents of passengers
without containing specific data protection provisions, so the principles of Directive
95/46/EC have to be applied.

Nevertheless, shops and customs authorities should be aware that data collection should
be restricted to what is strictly necessary, applying the principle of data minimisation. In
the example under no 2 the principles of necessity and proportionality are not respected.
In most cases, shops should only need to collect the flight number/destination mentioned
on the boarding pass to determine the appropriate excise duties as mentioned in example
3 of this opinion. This would be proportionate and non-excessive. Where more data are
collected there should be a clear need of such data in specific cases.

Data should not be used for law enforcement purposes unless they are necessary as
evidence of abuse in specific cases (no bulk transfers to police).

- 6-
Data should not be used for other purposes incompatible with the original purpose
(disclosing data to third parties without information or consent, for example, to carriers)
unless they are used for statistical purposes.

There shouldn’t be any systematic compilation of customers’ purchases to allow for

analysis of their behaviour and buying habits.

The retention period should be limited to the strictest necessary and should be
harmonised across Europe.

One of the main results of the Art. 29 WP’s investigation is that information provided to
passengers is insufficient. Even if data are only collected but not stored by duty free
shops the customer should be made aware of this. If data, however, are stored it is all the
more necessary to provide information about which data are stored, for which purpose,
for how long and how to get more details. In this field more could to be done by the
interested parties, for instance by putting signs in duty-free shops or distributing leaflets.
How such information can be provided to passengers can be found in WP 100 and its
annexes adopted by the Art. 29 WP in November 20041.

The current varying practices as described in this opinion give rise to concern that neither
the provisions of the Excise Duty Directive nor data protection provisions are uniformly
applied and respected across Europe by duty-free shops. There seems to be a need to
further harmonise the current practice and to raise awareness among travellers as to the
collection and processing of data when purchasing duty-free items.

The data protection authorities of the EU Member States are encouraged to engage with
shop owners and airport authorities to remedy any existing shortcomings to bring the
current practice in line with applicable law and data protection provisions. Passenger
notices in the field of duty-free purchases can and should be improved. Shops, airports,
ports, consumer organisations and other stakeholders should strive to provide travellers
with relevant information so that they can exercise their rights when buying duty-free
articles.

Done in Brussels, on 1 December 2009

For the Working Party

The Chairman
Alex Türk

1
http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2004/wp100_en.pdf
- 7-