# The Passenger Name Record Data and Miscellaneous Amendments Regulations 2018, Regulation 7: Processing of PNR data by a UK competent authority


(1) A UK competent authority must not—
(a) process PNR information for purposes other than a purpose described in regulation 6(3), or
(b) take any decision which produces an adverse legal effect on a person or otherwise significantly affects a person—
(i) only by reason of the automated processing of PNR data, or
(ii) on the basis of any of the matters described in regulation 6(5)(c) in relation to that person.
(2) Paragraph (1)(a) is without prejudice to the ability of a UK competent authority to exercise its functions —
(a) in circumstances where other offences, or indications of such offences, are detected during the course of any enforcement action taken further to the processing of PNR data, or
(b) in relation to public health.
(3) Where the PIU transfers PNR information under regulation 6(9), the UK competent authority must not transfer the PNR information to another person without the consent of the PIU.

---
Source: https://www.legislation.gov.uk/uksi/2018/598/regulation/7 (the official version)
Page: https://openlegislation.uk/passenger-name-record-data-and-miscellaneous-amendments-regulations-2018/regulation-7
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.