The Law Enforcement and Security (Amendment) (EU Exit) Regulations 2019

Amendment of the Passenger Name Record Data and Miscellaneous Amendments Regulations 2018

104.—(1) The Passenger Name Record Data and Miscellaneous Amendments Regulations 2018(1) are amended as follows.

(2) In regulation 2 (interpretation)—

(a) at the appropriate places insert—

““serious crime” has the meaning given in the Passenger Name Record Directive;”;

““terrorist offences” has the meaning given in the Passenger Name Record Directive;”;

(b) omit the following definitions—

(i) “European Commission”;

(ii) “Europol”;

(iii) “non-UK PIU”;

(c) for the definition of “non-UK competent authority”, substitute—

““non-UK competent authority” means an authority based in a third country that is competent for the prevention, detection, investigation or prosecution of terrorist offences or serious crime;”;

(d) in the definition of “PNR data”, for “Annex I to the Passenger Name Record Directive” substitute “Schedules 2 or 4 to the 2008 Order”;

(e) in the definition of “third country”, for “a Member State” substitute “the United Kingdom”;

(f) in the definition of “UK competent authority”, omit all the words that appear after “serious crime”;

(g) omit paragraph (2).

(3) In regulation 3 (designation of passenger information unit)—

(a) in paragraph (1), omit “for the United Kingdom”;

(b) in paragraph (2), for sub-paragraph (d) substitute—

“(d) where appropriate, exchanging PNR data and the result of processing that data with a non-UK competent authority”.

(4) In regulation 6 (processing of PNR data by the PIU), in paragraph (3)—

(a) for sub-paragraph (a) substitute—

“(a) carrying out an assessment of passengers prior to their scheduled arrival in, or departure from, the UK to identify persons who require further examination by a UK competent authority in view of the fact that such persons may be involved in a terrorist offence or serious crime;”;

(b) in sub-paragraph (b) omit “or, where appropriate, Europol”.

(5) Omit regulations 8 to 10 (exchange of data).

(6) In regulation 11 (requests for PNR data made by a UK competent authority to another Member State)—

(a) in the heading, for “another Member State” substitute “a non-UK competent authority”;

(b) in paragraph (1), for “non-UK PIU” substitute “non-UK competent authority”;

(c) in paragraph (2), for “non-UK PIU” substitute “non-UK competent authority”;

(d) for paragraph (3) substitute—

“(3) The conditions are that—

(a) the request is made solely for the purposes of the prevention, detection, investigation or prosecution of terrorist offences or serious crime;

(b) the request is made in respect of a specific case;

(c) the request is duly reasoned, and

(d) a copy of the request is sent to the PIU.”.

(7) In regulation 12 (transfers of PNR to third countries)—

(a) in the heading, for “third countries” substitute “non-UK competent authorities”;

(b) for paragraphs (1) and (2) substitute—

“(1) The PIU may transfer PNR data or the result of processing that data to a non-UK competent authority if either of the conditions set out in paragraph (2) or (2A) is met.

(2) The first condition is that—

(a) the request from the non-UK competent authority is duly reasoned;

(b) the PIU is satisfied that the transfer is necessary for the prevention, investigation, detection or prosecution of terrorist offences or serious crime, and

(c) the non-UK competent authority agrees to transfer the data to another non-UK competent authority only where it is strictly necessary for the purposes described in sub-paragraph (b).

(2A) The second condition is that—

(a) following the assessment referred to in regulation 6(3)(a), a person is identified by the PIU as requiring further examination, and

(b) the PIU considers it necessary for the prevention, detection, investigation or prosecution of terrorist offences or serious crime for a non-UK competent authority to be notified of that fact.”;

(c) in paragraph (4), for “third country” substitute “non-UK competent authority”.

(8) In regulation 13(8)(b) (period of data retention and depersonalisation), for “non-UK PIU” substitute “non-UK competent authority”.

(9) In regulation 14(3)(c) (protection of personal data) omit “and non-UK PIUs”.

(10) Omit regulation 15 (supervisory authority).

(1)

S.I. 2018/598.