European Union (Future Relationship) Act 2020

11 (1) Regulation 12 (transfers of PNR data to third country competent authorities) is amended as follows.

(2) In the heading—

(a) after “PNR” insert “data”;

(b) for “non-UK” substitute “third country”.

(3) For paragraph (1) substitute—

“(1) Paragraphs (1A) to (2A) apply to PNR information that is not EU PNR information.

(1A) The PIU must not transfer that PNR information to a third country competent authority except where it does so on a case by case basis where paragraph (2) or (2A) applies.”

(4) In paragraph (2)—

(a) for “The first condition is that” substitute “This paragraph applies where”;

(b) in sub-paragraph (b) for the words from “the prevention” to “crime” substitute “a purpose described in regulation 6(3)”;

(c) for “the data” substitute “the information”;

(d) in sub-paragraph (c) for “non-UK”, in both places it occurs, substitute “third country”.

(5) In paragraph (2A)—

(a) for “The second condition is that” substitute “This paragraph applies where”;

(b) omit sub-paragraph (a);

(c) for the words from “the prevention” to the end substitute “a purpose described in regulation 6(3)”.

(6) After paragraph (2A) insert—

“(2B) The PIU must not transfer EU PNR information to a third country competent authority except where it does so on a case by case basis where—

(a) paragraph (2C) applies and the PIU is satisfied that it is necessary to transfer the EU PNR information for a purpose described in regulation 6(3), or

(b) paragraph (2D) applies.

(2C) This paragraph applies where—

(a) there is an agreement in force between the third country and the EU that provides for a level of protection of personal data that is equivalent to the level of protection required under the Agreement, or

(b) the European Commission has decided that the third country ensures an adequate level of protection of personal data, and that decision has not been repealed or suspended, or amended in a way that demonstrates that the Commission no longer considers there to be an adequate level of protection of personal data.

(2D) This paragraph applies where—

(a) the PIU considers that it is necessary to transfer the EU PNR information—

(i) for the prevention or investigation of an immediate and serious threat to public security, or

(ii) to protect the vital interests of persons, and

(b) the third country competent authority provides a written confirmation to the PIU that the EU PNR information will be subject to a level of protection that is equivalent to the level of protection under these Regulations and the data protection legislation.

(2E) Where the PIU transfers EU PNR information that it received from an EU PIU to a third country competent authority under this regulation, the PIU must notify that EU PIU as soon as possible.

(2F) Where, under this regulation, the PIU transfers to a third country competent authority EU PNR data that originated in a member State, and was provided by an air carrier, the PIU must notify the EU PIU for that member State as soon as possible.”

(7) In paragraph (3)(a) for the words from “the purposes” to “case” substitute “a purpose described in regulation 6(3)”.

(8) In paragraph (4)—

(a) for “PNR data” substitute “PNR information”;

(b) for “non-UK” substitute “third country”.