The approval itself is what makes the story feel colder. In August 2015, U.S. Customs and Border Protection did not simply say its passenger-name-record filters worked. It ran a controlled test on sensitive reservation data and, years later, European officials recorded that the test happened with the approval of the CBP Deputy Commissioner. That detail sounds bureaucratic until you sit with it. If a system needs one of the agency’s highest-ranking officials to sign off before anyone can touch the most intimate fragments in an airline file, then the privacy safeguard is real. So is the danger the safeguard was built to restrain.

The Case For

The paper trail shows senior-level control was built into the system

The strongest case for taking the 2015 PNR approval test seriously is that the hierarchy is documented. In the DHS Privacy Office’s 26 June 2015 report, A Report on the Use and Transfer of Passenger Name Records Between the European Union and the United States, reviewers explained that sensitive data inside ATS-P could only be accessed in exceptional cases and that a supervisor would be prompted to confirm permission from the CBP Deputy Commissioner before approving access. The same report said any such viewing would be logged and that CBP managers received a daily email indicating whether sensitive data had been accessed. As of March 5, 2015, the report said no sensitive data had been accessed.

That matters because CBP’s own public PNR guidance acknowledges the files can contain information revealing religion or health. In other words, the system was never dealing with abstract privacy theory. It was dealing with real travel records that might contain meal codes, assistance requests, or other sensitive clues embedded in airline service fields. A senior-approval gate was a recognition that those details sat in a category apart.

The 2015 review showed Europe a directive it could not fully keep

The European Commission’s 2017 staff working document on the 2015 joint review adds another important layer. According to that 2017 report, each member of the EU review team was shown a copy of the CBP Management Directive for PNR that had been approved by the Deputy Commissioner of CBP. The document outlined how PNR was used, handled, disclosed, and accessed. The same report also said the system only allowed a DHS user to access sensitive data once the Deputy Commissioner had granted that access, and that National Targeting Center managers got an email every morning telling them whether any sensitive data had been touched.

Read plainly, that looks like an internal control regime: warning banners, automated alerts, restricted procedures, and executive-level approval.

The later record says the August 2015 test became a benchmark

The clearest reason this topic deserves its own spotlight comes from the European Commission’s 2021 joint evaluation of the agreement. That evaluation states that CBP’s February 2018 sensitive-word tests followed similar tests conducted on August 18, 2015 with the approval of the Deputy Commissioner of CBP. That links the 2015 event directly to the 2018 PNR deletion test we already examined. It suggests the 2015 exercise was not a random drill but part of the compliance backbone DHS used to reassure European counterparts that filtering and deletion safeguards were functioning.

It also connects to the hidden Article 6 code-list issue. The regime depended on a secret vocabulary, a technical filter, and a guarded chain of approval.

The Realist’s Eye

A senior signoff proves restraint, but also proves possession

This is where the realist has to resist the easy script. The Deputy Commissioner’s approval requirement does not prove abuse. If anything, it points toward caution. But it does prove something else that matters just as much: the government still received the raw record first and built its safeguard around controlled access, not zero access. Sensitive details entered the machinery. The state promised to filter, mask, and delete them. Yet the architecture still kept open a narrow door for exceptional use under high authority.

That distinction is not rhetorical. It is the difference between a system that never meaningfully holds the material and a system that holds it briefly behind administrative locks. The 2015 test may show those locks worked. It also shows the locks had to exist because the data was inside the building.

The public evidence remains mostly retrospective and internal

The other limitation is visibility. The public does not have the management directive. It has review documents describing it. The public does not have the August 18, 2015 test logs. It has later officials saying the test occurred with senior approval. Even the reassuring daily alert email belongs to a closed oversight loop inside CBP. That is still weaker than independent, publicly inspectable evidence.

The need for approval hints at the system’s real sensitivity

The darkest reading does not need to claim covert misuse. It only needs to notice what the bureaucracy is quietly admitting. A database that can expose religion, health, or other intimate travel clues is sensitive enough that the agency built a chain reaching all the way to the Deputy Commissioner before exceptional access could happen. That is not a sign of a harmless administrative file. It is a sign of a file powerful enough to demand ceremonial restraint.

And that may be the real significance of the 2015 approval test. Not that it caught a scandal, but that it revealed how seriously CBP treated the possibility that its own system could see too much.

What We Know For Certain

• The DHS Privacy Office’s June 2015 review said access to sensitive PNR data required approval tied to the CBP Deputy Commissioner and that any access would be logged.
• The 2017 European Commission report said EU reviewers were shown a CBP PNR Management Directive approved by the Deputy Commissioner of CBP.
• The same 2017 report said National Targeting Center managers received daily email notifications about whether sensitive PNR data had been accessed.
• The 2021 joint evaluation said February 2018 sensitive-data tests followed similar tests conducted on August 18, 2015 with the approval of the Deputy Commissioner of CBP.
• CBP publicly states that PNR can include sensitive information revealing religion or health, which its systems are supposed to filter and mask.

The Unanswered Questions

• What exactly did the August 18, 2015 test verify: filtering, approval workflow, deletion timing, or all three?
• Was the 2015 test reviewed by anyone outside the internal DHS and structured EU-U.S. oversight process?
• How often was senior approval ever requested for real-world access rather than functionality testing?
• What did the restricted CBP Management Directive say about edge cases, free-text remarks, and failures of the sensitive-code list?

The Closer — You Decide

Sometimes the most unsettling fact is not that a secret system lacked rules. It is that the rules reached all the way to the top. August 18, 2015 tells us CBP did not treat sensitive passenger data like ordinary paperwork. It treated it like something that required hierarchy before the machine could be tested against forbidden contents. Maybe that is evidence the safeguard worked. Maybe it is evidence the file was always more intimate than the public was meant to feel. The approvals are real. The warnings are real. The evidence is on the table. You decide.