The Law Enforcement and Security (Amendment) (EU Exit) Regulations 2019

PART 19 U.K. Passenger Name Record Data

Amendment of the Immigration and Police (Passenger, Crew and Service Information) Order 2008 U.K.

103.—(1) The Immigration and Police (Passenger, Crew and Service Information) Order 2008 M1 is amended as follows.

(2) In regulation 7 (form and manner in which passenger and service information to be provided: police)—

(a) in paragraph (2), for “which conforms to the data formats and transmission protocols provided for in Article 1 of the Implementing Decision”, substitute “ that is compatible with the technology used by the recipient of the information ”;

(b) omit paragraph (7).

Commencement Information

I1 Reg. 103 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1

Marginal Citations

M1 S.I. 2008/5. This instrument was amended by S.I. 2015/859 and 2018/598.

Amendment of the Passenger Name Record Data and Miscellaneous Amendments Regulations 2018 U.K.

104.—(1) The Passenger Name Record Data and Miscellaneous Amendments Regulations 2018 M2 are amended as follows.

(2) In regulation 2 (interpretation)—

(a) at the appropriate places insert—

““serious crime” has the meaning given in the Passenger Name Record Directive;”;

““terrorist offences” has the meaning given in the Passenger Name Record Directive;”;

(b) omit the following definitions—

(i) “European Commission”;

(ii) “Europol”;

(iii) “non-UK PIU”;

(c) for the definition of “non-UK competent authority”, substitute—

““non-UK competent authority” means an authority based in a third country that is competent for the prevention, detection, investigation or prosecution of terrorist offences or serious crime;”;

(d) in the definition of “PNR data”, for “Annex I to the Passenger Name Record Directive” substitute “ Schedules 2 or 4 to the 2008 Order ”;

(e) in the definition of “third country”, for “a Member State” substitute “ the United Kingdom ”;

(f) in the definition of “UK competent authority”, omit all the words that appear after “serious crime”;

(g) omit paragraph (2).

(3) In regulation 3 (designation of passenger information unit)—

(a) in paragraph (1), omit “for the United Kingdom”;

(b) in paragraph (2), for sub-paragraph (d) substitute—

“(d) where appropriate, exchanging PNR data and the result of processing that data with a non-UK competent authority”.

(4) In regulation 6 (processing of PNR data by the PIU), in paragraph (3)—

(a) for sub-paragraph (a) substitute—

“(a) carrying out an assessment of passengers prior to their scheduled arrival in, or departure from, the UK to identify persons who require further examination by a UK competent authority in view of the fact that such persons may be involved in a terrorist offence or serious crime;”;

(b) in sub-paragraph (b) omit “or, where appropriate, Europol”.

(5) Omit regulations 8 to 10 (exchange of data).

(6) In regulation 11 (requests for PNR data made by a UK competent authority to another Member State)—

(a) in the heading, for “another Member State” substitute “ a non-UK competent authority ”;

(b) in paragraph (1), for “non-UK PIU” substitute “ non-UK competent authority ”;

(c) in paragraph (2), for “non-UK PIU” substitute “ non-UK competent authority ”;

(d) for paragraph (3) substitute—

“(3) The conditions are that—

(a) the request is made solely for the purposes of the prevention, detection, investigation or prosecution of terrorist offences or serious crime;

(b) the request is made in respect of a specific case;

(c) the request is duly reasoned, and

(d) a copy of the request is sent to the PIU.”.

(7) In regulation 12 (transfers of PNR to third countries)—

(a) in the heading, for “third countries” substitute “ non-UK competent authorities ”;

(b) for paragraphs (1) and (2) substitute—

“(1) The PIU may transfer PNR data or the result of processing that data to a non-UK competent authority if either of the conditions set out in paragraph (2) or (2A) is met.

(2) The first condition is that—

(a) the request from the non-UK competent authority is duly reasoned;

(b) the PIU is satisfied that the transfer is necessary for the prevention, investigation, detection or prosecution of terrorist offences or serious crime, and

(c) the non-UK competent authority agrees to transfer the data to another non-UK competent authority only where it is strictly necessary for the purposes described in sub-paragraph (b).

(2A) The second condition is that—

(a) following the assessment referred to in regulation 6(3)(a), a person is identified by the PIU as requiring further examination, and

(b) the PIU considers it necessary for the prevention, detection, investigation or prosecution of terrorist offences or serious crime for a non-UK competent authority to be notified of that fact.”;

(c) in paragraph (4), for “third country” substitute “ non-UK competent authority ”.

(8) In regulation 13(8)(b) (period of data retention and depersonalisation), for “non-UK PIU” substitute “ non-UK competent authority ”.

(9) In regulation 14(3)(c) (protection of personal data) omit “and non-UK PIUs”.

(10) Omit regulation 15 (supervisory authority).

Commencement Information

I2 Reg. 104 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1

Marginal Citations

M2 S.I. 2018/598.

Revocation of Council Decisions 2012/381/EU and 2012/472/EU U.K.

105.  The following Council Decisions are revoked—

(a) Council Decision 2012/381/EU of 13 December 2011 on the conclusion of the Agreement between the European Union and Australia on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Australian Customs and Border Protection Service;

(b) Council Decision 2012/472/EU of 26 April 2012 on the conclusion of the Agreement between the United States of America and the European Union on the use and transfer of passenger name records to the United States Department of Homeland Security.

Commencement Information

I3 Reg. 105 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1

Revocation of Commission Implementing Decision 2017/759 U.K.

106.  Commission Implementing Decision (EU) 2017/759 of 28 April 2017 on the common protocols and data formats to be used by air carriers when transferring PNR data to Passenger Information Units is revoked.

Commencement Information

I4 Reg. 106 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1

[F1 Savings provision - requests received before commencement day U.K.

106A.— (1) This regulation applies to requests received by the PIU in accordance with Article 9 or 10 of the Directive 2016/681/EU of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime on or before commencement day (and see Article 63(1)(g) of the withdrawal agreement and sections 7A and 7C of the Withdrawal Act).

(2) The following provisions of the Passenger Name Record Data and Miscellaneous Amendments Regulations 2018 (“the 2018 Regulations”) continue to have effect in relation to those requests as if the amendments made to the provisions by regulation 104 did not apply–

(a) regulation 6(3) (processing of PNR data by the PIU);

(b) regulation 9 (requests for PNR data made to the PIU by a non-UK PIU);

(c) regulations 2 (interpretation) and 3(2)(d) (responsibilities of the PIU), but only for the purposes of the other provisions which continue to have effect by virtue of this paragraph.

(3) In this regulation, “the PIU” has the same meaning as in the 2018 Regulations.

Textual Amendments

F1 Regs. 106A, 106B inserted (31.12.2020 immediately before IP completion day) by The Law Enforcement and Security (Separation Issues etc.) (EU Exit) Regulations 2020 (S.I. 2020/1408), regs. 1, 31

Commencement Information

I5 Reg. 106A in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1

Savings provision – information received by virtue of the PNR Directive U.K.

106B.— (1) This regulation applies to PNR data which was received by the PIU by virtue of Directive 2016/681/EU of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection investigation and prosecution of terrorist offences and serious crime (including that Directive as it applies by virtue of Article 63(1)(g) of the withdrawal agreement).

(2) The PIU may only transfer PNR data to which this regulation applies, or the result of processing of such data, under regulation 12(2A) of the 2018 Regulations on the basis that the second condition is met if the transfer is being made to a non-UK PIU which is an authority of a member State.

(3) In this regulation—

“the 2018 Regulations” means the Passenger Name Record Data and Miscellaneous Amendments Regulations 2018;

“non-UK PIU”, “the PIU” and “PNR data” have the same meaning as in the 2018 Regulations.

(4) In respect of regulation 106A (savings provision – requests received before commencement day) and this regulation, see Article 63(1)(g) and Title VII of Part 3 of the withdrawal agreement and sections 7A and 7C of the Withdrawal Act.]

Textual Amendments

F1 Regs. 106A, 106B inserted (31.12.2020 immediately before IP completion day) by The Law Enforcement and Security (Separation Issues etc.) (EU Exit) Regulations 2020 (S.I. 2020/1408), regs. 1, 31

Commencement Information

I6 Reg. 106B in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1