6(1)Regulation 6 (processing of PNR data by the PIU) is amended as follows.U.K.
(2)In paragraph (1)—
(a)for “5” substitute “ 5(1) ”;
(b)omit “personal”;
(c)omit “immediately”.
(3)In paragraph (2), at the end insert “ , subject to regulation 4A (6) ”.
(4)For paragraphs (3) and (4) substitute—
“(3)The purposes are—
(a)preventing, detecting, investigating and prosecuting terrorist offences or serious crime, and
(b)protecting the vital interests of persons.
(4)Where the PIU compares PNR data against a database, the PIU must ensure that the database is—
(a)reliable and up to date, and
(b)used for a purpose described in paragraph (3).”
(5)In paragraph (5)—
(a)at the beginning insert “ Where the PIU processes PNR data against pre-determined criteria, ”;
(b)omit “referred to in paragraph (4)(b)”;
(c)in sub-paragraph (a), at the beginning insert “ reliable, ”.
(6)After paragraph (5) insert—
“(5A)The PIU must not take any decision which produces an adverse legal effect on a person or otherwise significantly affects a person—
(a)only by reason of the automated processing of PNR data, or
(b)on the basis of any of the matters described in paragraph (5)(c) in relation to that person.”
(7)Omit paragraphs (6) to (8).
(8)In paragraph (9)—
(a)for “PNR data or the result of processing that data” substitute “ PNR information ”;
(b)for the words from “otherwise” to the end substitute “except where it does so on a case by case basis where it is satisfied that—
“(a)it is necessary to transfer that PNR information for a purpose described in paragraph (3); and
(b)the UK competent authority has arrangements in place for the protection of personal data that are equivalent to the arrangements for the protection of personal data required of the PIU under these Regulations.”
Commencement Information
I1Sch. 2 para. 6 in force at Royal Assent for specified purposes, see s. 40(6)(b)
I2Sch. 2 para. 6 in force at 31.12.2020 in so far as not already in force by S.I. 2020/1662, reg. 2(cc)