The Law Enforcement and Security (Amendment) (EU Exit) Regulations 2019

PART 19 Passenger Name Record Data

Amendment of the Immigration and Police (Passenger, Crew and Service Information) Order 2008

103.—(1) The Immigration and Police (Passenger, Crew and Service Information) Order 2008(1) is amended as follows.

(2) In regulation 7 (form and manner in which passenger and service information to be provided: police)—

(a) in paragraph (2), for “which conforms to the data formats and transmission protocols provided for in Article 1 of the Implementing Decision”, substitute “that is compatible with the technology used by the recipient of the information”;

(b) omit paragraph (7).

Amendment of the Passenger Name Record Data and Miscellaneous Amendments Regulations 2018

104.—(1) The Passenger Name Record Data and Miscellaneous Amendments Regulations 2018(2) are amended as follows.

(2) In regulation 2 (interpretation)—

(a) at the appropriate places insert—

““serious crime” has the meaning given in the Passenger Name Record Directive;”;

““terrorist offences” has the meaning given in the Passenger Name Record Directive;”;

(b) omit the following definitions—

(i) “European Commission”;

(ii) “Europol”;

(iii) “non-UK PIU”;

(c) for the definition of “non-UK competent authority”, substitute—

““non-UK competent authority” means an authority based in a third country that is competent for the prevention, detection, investigation or prosecution of terrorist offences or serious crime;”;

(d) in the definition of “PNR data”, for “Annex I to the Passenger Name Record Directive” substitute “Schedules 2 or 4 to the 2008 Order”;

(e) in the definition of “third country”, for “a Member State” substitute “the United Kingdom”;

(f) in the definition of “UK competent authority”, omit all the words that appear after “serious crime”;

(g) omit paragraph (2).

(3) In regulation 3 (designation of passenger information unit)—

(a) in paragraph (1), omit “for the United Kingdom”;

(b) in paragraph (2), for sub-paragraph (d) substitute—

“(d) where appropriate, exchanging PNR data and the result of processing that data with a non-UK competent authority”.

(4) In regulation 6 (processing of PNR data by the PIU), in paragraph (3)—

(a) for sub-paragraph (a) substitute—

“(a) carrying out an assessment of passengers prior to their scheduled arrival in, or departure from, the UK to identify persons who require further examination by a UK competent authority in view of the fact that such persons may be involved in a terrorist offence or serious crime;”;

(b) in sub-paragraph (b) omit “or, where appropriate, Europol”.

(5) Omit regulations 8 to 10 (exchange of data).

(6) In regulation 11 (requests for PNR data made by a UK competent authority to another Member State)—

(a) in the heading, for “another Member State” substitute “a non-UK competent authority”;

(b) in paragraph (1), for “non-UK PIU” substitute “non-UK competent authority”;

(c) in paragraph (2), for “non-UK PIU” substitute “non-UK competent authority”;

(d) for paragraph (3) substitute—

“(3) The conditions are that—

(a) the request is made solely for the purposes of the prevention, detection, investigation or prosecution of terrorist offences or serious crime;

(b) the request is made in respect of a specific case;

(c) the request is duly reasoned, and

(d) a copy of the request is sent to the PIU.”.

(7) In regulation 12 (transfers of PNR to third countries)—

(a) in the heading, for “third countries” substitute “non-UK competent authorities”;

(b) for paragraphs (1) and (2) substitute—

“(1) The PIU may transfer PNR data or the result of processing that data to a non-UK competent authority if either of the conditions set out in paragraph (2) or (2A) is met.

(2) The first condition is that—

(a) the request from the non-UK competent authority is duly reasoned;

(b) the PIU is satisfied that the transfer is necessary for the prevention, investigation, detection or prosecution of terrorist offences or serious crime, and

(c) the non-UK competent authority agrees to transfer the data to another non-UK competent authority only where it is strictly necessary for the purposes described in sub-paragraph (b).

(2A) The second condition is that—

(a) following the assessment referred to in regulation 6(3)(a), a person is identified by the PIU as requiring further examination, and

(b) the PIU considers it necessary for the prevention, detection, investigation or prosecution of terrorist offences or serious crime for a non-UK competent authority to be notified of that fact.”;

(c) in paragraph (4), for “third country” substitute “non-UK competent authority”.

(8) In regulation 13(8)(b) (period of data retention and depersonalisation), for “non-UK PIU” substitute “non-UK competent authority”.

(9) In regulation 14(3)(c) (protection of personal data) omit “and non-UK PIUs”.

(10) Omit regulation 15 (supervisory authority).

Revocation of Council Decisions 2012/381/EU and 2012/472/EU

105.  The following Council Decisions are revoked—

(a) Council Decision 2012/381/EU of 13 December 2011 on the conclusion of the Agreement between the European Union and Australia on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Australian Customs and Border Protection Service;

(b) Council Decision 2012/472/EU of 26 April 2012 on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of passenger name records to the United States Department of Homeland Security.

Revocation of Commission Implementing Decision 2017/759

106.  Commission Implementing Decision (EU) 2017/759 of 28 April 2017 on the common protocols and data formats to be used by air carriers when transferring PNR data to Passenger Information Units is revoked.

(1)

S.I. 2008/5. This instrument was amended by S.I. 2015/859 and 2018/598.

(2)

S.I. 2018/598.