Commission Decision of 14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States’ Bureau of Customs and Border Protection (notified under document number C(2004) 1914) (Text with EEA relevance) (2004/535/EC)

15. Subject to the approval of the National Archives and Records Administration (44 U.S.C. 2101, et seq.), CBP will limit online access to PNR data to authorised CBP users(1) for a period of seven (7) days, after which the number of officers authorised to access the PNR data will be even further limited for a period of three years and six months (3,5 years) from the date the data are accessed (or received) from the air carrier’s reservation system. After 3,5 years, PNR data that have not been manually accessed during that period of time, will be destroyed. PNR data that have been manually accessed during the initial 3,5-year period will be transferred by CBP to a deleted record file(2), where they will remain for a period of eight (8) years before they are destroyed. This schedule, however, would not apply to PNR data that are linked to a specific enforcement record (such data would remain accessible until the enforcement record is archived). With respect to PNR which CBP accesses (or receives) directly from air carrier reservation systems during the effective dates of these Undertakings, CBP will abide by the retention policies set forth in the present paragraph, notwithstanding the possible expiration of the Undertakings pursuant to paragraph 46 herein. U.K.

(1)

These authorised CBP users would include employees assigned to analytical units in the field offices, as well as employees assigned to the National Targeting Center. As indicated previously, persons charged with maintaining, developing or auditing the CBP database will also have access to such data for those limited purposes.

(2)

Although the PNR record is not technically deleted when it is transferred to the Deleted Record File, it is stored as raw data (not a readily searchable form and, therefore, of no use for ‘traditional’ law enforcement investigations) and is only available to authorised personnel in the Office of Internal Affairs for CBP (and in some cases the Office of the Inspector General in connection with audits) and personnel responsible for maintaining the database in CBP’s Office of Information Technology, on a ‘need to know’ basis.