# The Passenger Name Record Data and Miscellaneous Amendments Regulations 2018, Regulation 14: Protection of personal data


(1) The PIU must not process PNR data revealing a person's race, ethnic origin, political opinions, philosophical beliefs, trade union membership, health, sexual life or sexual orientation.
(1A) The PIU must permanently delete any PNR data referred to in paragraph (1).
(2) The PIU must maintain documentation relating to all processing systems and procedures under its responsibility.
(3) The documentation referred to in paragraph (2) must contain at least—
(a) the name and contact details of the personnel within the PIU entrusted with the processing of the PNR data;
(b) the respective levels of authorisation of those personnel to access PNR data;
(c) details of requests made by EU PIUs, Europol or Eurojust ..., and
(d) details of all requests for transfers of PNR data to a third country.
(4) The PIU must make the documentation referred to in paragraph (2) available to the Information Commission on request.
(5) The PIU must keep records of all processing operations for a period of five years.

---
Source: https://www.legislation.gov.uk/uksi/2018/598/regulation/14 (the official version)
Page: https://openlegislation.uk/passenger-name-record-data-and-miscellaneous-amendments-regulations-2018/regulation-14
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.