{
  "url": "https://openlegislation.uk/draft-law-enforcement-and-security-amendment-eu-exit-regulations-2019/regulation-104",
  "json_url": "https://openlegislation.uk/draft-law-enforcement-and-security-amendment-eu-exit-regulations-2019/regulation-104.json",
  "legislation": "ukdsi/2019/9780111178102",
  "legislation_title": "The Law Enforcement and Security (Amendment) (EU Exit) Regulations 2019",
  "legislation_url": "https://openlegislation.uk/draft-law-enforcement-and-security-amendment-eu-exit-regulations-2019",
  "path": "regulation/104",
  "kind": "regulation",
  "number": "104",
  "heading": "Amendment of the Passenger Name Record Data and Miscellaneous Amendments Regulations 2018",
  "text": "(1) The Passenger Name Record Data and Miscellaneous Amendments Regulations 2018 are amended as follows.\n(2) In regulation 2 (interpretation)—\n(a) at the appropriate places insert—\n““serious crime” has the meaning given in the Passenger Name Record Directive;”;\n““terrorist offences” has the meaning given in the Passenger Name Record Directive;”;\n(b) omit the following definitions—\n(i) “European Commission”;\n(ii) “Europol”;\n(iii) “non-UK PIU”;\n(c) for the definition of “non-UK competent authority”, substitute—\n““non-UK competent authority” means an authority based in a third country that is competent for the prevention, detection, investigation or prosecution of terrorist offences or serious crime;”;\n(d) in the definition of “PNR data”, for “Annex I to the Passenger Name Record Directive” substitute “Schedules 2 or 4 to the 2008 Order”;\n(e) in the definition of “third country”, for “a Member State” substitute “the United Kingdom”;\n(f) in the definition of “UK competent authority”, omit all the words that appear after “serious crime”;\n(g) omit paragraph (2).\n(3) In regulation 3 (designation of passenger information unit)—\n(a) in paragraph (1), omit “for the United Kingdom”;\n(b) in paragraph (2), for sub-paragraph (d) substitute—\n“(d) where appropriate, exchanging PNR data and the result of processing that data with a non-UK competent authority”.\n(4) In regulation 6 (processing of PNR data by the PIU), in paragraph (3)—\n(a) for sub-paragraph (a) substitute—\n“(a) carrying out an assessment of passengers prior to their scheduled arrival in, or departure from, the UK to identify persons who require further examination by a UK competent authority in view of the fact that such persons may be involved in a terrorist offence or serious crime;”;\n(b) in sub-paragraph (b) omit “or, where appropriate, Europol”.\n(5) Omit regulations 8 to 10 (exchange of data).\n(6) In regulation 11 (requests for PNR data made by a UK competent authority to another Member State)—\n(a) in the heading, for “another Member State” substitute “a non-UK competent authority”;\n(b) in paragraph (1), for “non-UK PIU” substitute “non-UK competent authority”;\n(c) in paragraph (2), for “non-UK PIU” substitute “non-UK competent authority”;\n(d) for paragraph (3) substitute—\n“(3) The conditions are that—\n(a) the request is made solely for the purposes of the prevention, detection, investigation or prosecution of terrorist offences or serious crime;\n(b) the request is made in respect of a specific case;\n(c) the request is duly reasoned, and\n(d) a copy of the request is sent to the PIU.”.\n(7) In regulation 12 (transfers of PNR to third countries)—\n(a) in the heading, for “third countries” substitute “non-UK competent authorities”;\n(b) for paragraphs (1) and (2) substitute—\n“(1) The PIU may transfer PNR data or the result of processing that data to a non-UK competent authority if either of the conditions set out in paragraph (2) or (2A) is met.\n(2) The first condition is that—\n(a) the request from the non-UK competent authority is duly reasoned;\n(b) the PIU is satisfied that the transfer is necessary for the prevention, investigation, detection or prosecution of terrorist offences or serious crime, and\n(c) the non-UK competent authority agrees to transfer the data to another non-UK competent authority only where it is strictly necessary for the purposes described in sub-paragraph (b).\n(2A) The second condition is that—\n(a) following the assessment referred to in regulation 6(3)(a), a person is identified by the PIU as requiring further examination, and\n(b) the PIU considers it necessary for the prevention, detection, investigation or prosecution of terrorist offences or serious crime for a non-UK competent authority to be notified of that fact.”;\n(c) in paragraph (4), for “third country” substitute “non-UK competent authority”.\n(8) In regulation 13(8)(b) (period of data retention and depersonalisation), for “non-UK PIU” substitute “non-UK competent authority”.\n(9) In regulation 14(3)(c) (protection of personal data) omit “and non-UK PIUs”.\n(10) Omit regulation 15 (supervisory authority).",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "footnote",
      "label": "f1",
      "text": "S.I. 2018/598."
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukdsi/2019/9780111178102/regulation/104",
    "retrieved_at": "2026-10-30T15:02:04.715497+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}