# Commission Decision of 14 May 2004 on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States’ Bureau of Customs and Border Protection (notified under document number C(2004) 1914) (Text with EEA relevance) (2004/535/EC), Division 15

Extent: E+W+S+N.I.

Subject to the approval of the National Archives and Records Administration (44 U.S.C. 2101, et seq.), CBP will limit online access to PNR data to authorised CBP users for a period of seven (7) days, after which the number of officers authorised to access the PNR data will be even further limited for a period of three years and six months (3,5 years) from the date the data are accessed (or received) from the air carrier’s reservation system. After 3,5 years, PNR data that have not been manually accessed during that period of time, will be destroyed. PNR data that have been manually accessed during the initial 3,5-year period will be transferred by CBP to a deleted record file, where they will remain for a period of eight (8) years before they are destroyed. This schedule, however, would not apply to PNR data that are linked to a specific enforcement record (such data would remain accessible until the enforcement record is archived). With respect to PNR which CBP accesses (or receives) directly from air carrier reservation systems during the effective dates of these Undertakings, CBP will abide by the retention policies set forth in the present paragraph, notwithstanding the possible expiration of the Undertakings pursuant to paragraph 46 herein.

---
Source: https://www.legislation.gov.uk/eudn/2004/535/annex/division/6/division/15 (the official version)
Page: https://openlegislation.uk/eu-decision-2004-535/annex/division-6/division-15
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.