Regulation 14 Protection of personal data

(1)

The PIU must not process PNR data revealing a person's race, ethnic origin, political opinions, philosophical beliefs, trade union membership, health, sexual life or sexual orientation.

F1(1A)

The PIU must permanently delete any PNR data referred to in paragraph (1).

(2)

The PIU must maintain documentation relating to all processing systems and procedures under its responsibility.

(3)

The documentation referred to in paragraph (2) must contain at least—

(a)

the name and contact details of the personnel within the PIU entrusted with the processing of the PNR data;

(b)

the respective levels of authorisation of those personnel to access PNR data;

(c)

details of requests made by F2EU PIUs, Europol or Eurojust F3..., and

(d)

details of all requests for transfers of PNR data to a third country.

(4)

The PIU must make the documentation referred to in paragraph (2) available to the F4Information Commission on request.

(5)

The PIU must keep records of all processing operations for a period of five years.

Annotations

Textual amendments

F1: Reg. 14(1A) inserted (31.12.2020) by European Union (Future Relationship) Act 2020 (c. 29), s. 40(6)(b), Sch. 2 para. 15(2) (with Sch. 6 para. 9); S.I. 2020/1662, reg. 2(cc)
F2: Words in reg. 14(3)(c) substituted (31.12.2020) by European Union (Future Relationship) Act 2020 (c. 29), s. 40(6)(b), Sch. 2 para. 15(3) (with Sch. 6 para. 9); S.I. 2020/1662, reg. 2(cc)
F3: Words in reg. 14(3)(c) omitted (31.12.2020) by virtue of The Law Enforcement and Security (Amendment) (EU Exit) Regulations 2019 (S.I. 2019/742), regs. 1, 104(9) (with regs. 106A, 106B) (as inserted by S.I. 2020/1408, regs. 1, 31); 2020 c. 1, Sch. 5 para. 1(1)
F4: Words in reg. 14(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 25(4); S.I. 2026/1015, reg. 2(c)