European Union (Future Relationship) Act 2020

PART 2 U.K. Interim period: modifications for restricted EU PNR data that is subject to deletion

17 (1) Until the commencement of paragraph 14, the PNR regulations have effect— U.K.

(a) as if the regulation 13AA set out in sub-paragraph (2) were inserted before regulation 14, and

(b) with the modifications set out in sub-paragraphs (3) to (5).

(2) The regulation is—

“Retention and deletion of EU PNR data by the PIU: interim period U.K.

13AA (1) For the purposes of this regulation, EU PNR data is “restricted EU PNR data” if it relates to a person arriving in the United Kingdom who—

(a) is not a UK national, and

(b) resides outside the United Kingdom.

(2) For the purposes of this regulation, restricted EU PNR data relating to a person is subject to deletion if—

(a) the PIU, acting as such, knows that the person has left the United Kingdom, or

(b) the period for which the person is permitted to stay in the United Kingdom has expired.

(3) But restricted EU PNR data is not subject to deletion—

(a) if, on the basis of a risk assessment based on objectively established criteria, the PIU considers that retention of the restricted EU PNR data is necessary for the purpose described in regulation 6(3)(a), or

(b) where the restricted EU PNR data is used in the context of specific cases for a purpose described in regulation 6(3).

(4) The PIU must secure that restricted EU PNR data that is subject to deletion—

(a) is accessible only by authorised persons, and

(b) is accessed by them only for the purpose of determining whether it is subject to deletion.

(5) Where restricted EU PNR data is subject to deletion—

(a) the PIU must permanently delete it as soon as possible, using best efforts, taking into account the special circumstances referred to in [F1 Article 552(10)] of the Agreement, and

(b) an authorised person must record the date and time of deletion.

(6) Paragraphs (7) to (9) apply where the PIU receives a request for restricted EU PNR data.

(7) If the record mentioned in paragraph (9)(b)(iii) indicates that a previous request relating to that data has been refused under paragraph (9)(a), the PIU must refuse the request as a result of that record (and without further accessing the data).

(8) In any other case, the PIU must refuse the request unless an authorised person has—

(a) made a determination as to whether the data is subject to deletion, and

(b) as a result has determined that it is not subject to deletion.

(9) If the authorised person determines under paragraph (8)(a) that the restricted EU PNR data is subject to deletion, the PIU must—

(a) refuse the request, and

(b) record—

(i) the request;

(ii) the date and time that the restricted EU PNR data was accessed under paragraph (8)(a);

(iii) that the request was refused on the ground that the restricted EU PNR data was subject to deletion;

(iv) the date and time of the refusal.

(10) In this regulation, “authorised person” means a person specifically authorised by the PIU to access restricted EU PNR data.

(11) The PIU must limit the number of authorised persons to the minimum number practicable.

(12) In this regulation, “UK national” means—

(a) a British citizen,

(b) a person who is a British subject by virtue of Part 4 of the British Nationality Act 1981 and who has a right of abode in the United Kingdom, or

(c) a person who is a British overseas territories citizen by virtue of a connection to Gibraltar.

(13) Nothing in this regulation is to be taken to affect the generality of regulation 14.”

(3) Regulation 4A has effect as if—

(a) in paragraphs (5) and (6) the references to the functions of the designated independent authority under the PNR regulations included references to that authority's functions under [F2 Article 552(12)] of the Agreement, and

(b) paragraph (5) also required the PIU to make the records mentioned in regulation 13AA(5)(b) and (9)(b) available to the designated independent authority for the purposes of the authority's functions under that provision of the Agreement.

For this purpose, “the Agreement”, “designated independent authority” and “the PIU” have the same meanings as in the PNR regulations.

(4) Regulations 11A and 11B each have effect as if the following were inserted at the end—

“(3) This regulation does not apply to restricted EU PNR data that is subject to deletion (within the meaning of regulation 13AA), or to the results of processing that data or analytical information containing that data.”

(5) Regulation 13(1A) has effect as if the reference to regulation 13B were a reference to regulation 13AA.

Textual Amendments

F1 Words in Sch. 2 para. 17(2) substituted (23.7.2021) by The European Union (Future Relationship) Act 2020 (References to the Trade and Cooperation Agreement) Regulations 2021 (S.I. 2021/884), reg. 1(2), Sch. (with reg. 1(3)(a))

F2 Words in Sch. 2 para. 17(3)(a) substituted (23.7.2021) by The European Union (Future Relationship) Act 2020 (References to the Trade and Cooperation Agreement) Regulations 2021 (S.I. 2021/884), reg. 1(2), Sch. (with reg. 1(3)(a))

Commencement Information

I1 Sch. 2 para. 17 in force at Royal Assent for specified purposes, see s. 40(6)(b)

I2 Sch. 2 para. 17 in force at 31.12.2020 in so far as not already in force by S.I. 2020/1662, reg. 2(cc)