The Passenger Name Record Data and Miscellaneous Amendments Regulations 2018

Explanatory Note

(This note is not part of the Regulations)

These Regulations implement, in part, the requirements of Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (“the Directive”).

Part 2 of these Regulations designates the UK's Passenger Information Unit (PIU) and makes provision for the appointment of a data protection officer by the PIU.

Part 3 of these Regulations governs the processing, storage and transfer of PNR data and makes provision as to the protection of PNR data. In particular, regulation 6 sets out the general conditions and restrictions on the processing of PNR data by the PIU; regulation 7 governs the processing of PNR data by other UK authorities competent in the prevention, detection, investigation and prosecution of terrorist offences and serious crime; and regulations 8 to 12 make provision in respect of the exchange of PNR data, and the result of processing that data, with other EU Member States and third countries. Regulation 13 governs the period for which PNR data is to be retained and sets out the requirements as to the masking of PNR data which could serve to directly identify an individual. Regulation 14 makes provision as to the specific requirements governing the protection of personal data consisting of PNR data in addition to the provisions of any enactments governing the processing of personal data by a UK competent authority for law enforcement purposes. As is made clear by regulation 16, those enactments will continue to apply to the processing of PNR data. Regulation 15 makes clear that the Information Commissioner is to be responsible for advising on and monitoring the application within the UK of the provisions adopted pursuant to the Directive.

Part 4 of the Regulations implements, in part, the requirements of articles 8 and 16 of the Directive.

Article 8 of the Directive obliges Member States to put in place measures to require air carriers to transfer PNR data in respect of flights landing in, or departing from, their territory to the database of that Member State's PIU to the extent that the carrier has already collected such data in the normal course of its business. Regulations 19 and 20 amend, respectively, Schedules 2 and 4 to the Immigration and Police (Passenger, Crew and Service Information) Order 2008 (“the 2008 Order”) to ensure that the fields of passenger information which a carrier may be required to provide to an immigration officer pursuant to paragraph 27B(2) of Schedule 2 to the Immigration Act 1971 (c. 77), or a to constable of the rank of superintendent or above pursuant to section 32(2) of the Immigration, Asylum and Nationality Act 2006 (c. 13), are consistent with the fields of information referred to in Annex I to the Directive.

Regulation 18 substitutes a new article 7 of the 2008 Order to reflect the requirements of article 16 of the Directive as to the form and manner in which passenger information is to be provided (in this case to the police). The form and manner in which passenger information is to be provided to an immigration officer, on request, is the subject of a Direction of the Secretary of State pursuant to paragraph 27B(8) of Schedule 2 to the Immigration Act 1971.

A full impact assessment has not been produced for this instrument as no significant impact on the private, voluntary or public sectors is foreseen. A copy of the transposition note for the Directive will be available from the Border Data Policy Team, Home Office, 2 Marsham Street, London, SW1P 4 DF.