CRIMINAL LAW, CIVIL LAW AND DEFENCE (MISCELLANEOUS PROVISIONS) ACT 2026

• (4) Without prejudice to the law as to contempt of court, a person who makes, or causes to be made, a statement in a section 77 statement of truth without an honest belief as to the truth of that statement shall be guilty of an offence.

• (5) A person guilty of an offence under subsection (4) shall be liable—

• (a) on summary conviction, to a class A fine or to imprisonment for a term not exceeding 12 months, or both, or

• (b) on conviction on indictment, to a fine not exceeding €250,000 or imprisonment for a term not exceeding 5 years, or both.

PART 19 Passenger Name Record Data

Chapter 1 Preliminary and General

78. Interpretation (Part 19)

78. (1) In this Part—

“air carrier” means an air transport provider with a valid operating licence or equivalent permitting it to carry out carriage of passengers by air;

“API data” means advance passenger information and includes the type, number, country of issuance and expiry date of any identity document, nationality, family name, given name, gender, date of birth, airline, flight number, departure date, arrival date, departure port, arrival port, departure time and arrival time;

“competent authority” means an authority—

• (a) referred to in section 89(1), or

• (b) designated under section 89(2),

that is competent for the prevention, detection, investigation and prosecution of a terrorist offence or serious crime;

“competent authority of another Member State” means an authority of another Member State that is competent for the prevention, detection, investigation and prosecution of—

• (a) a terrorist offence (within the meaning of paragraph (b) of the definition of that term), or

• (b) a serious crime (within the meaning of paragraph (b) of the definition of that term);

“competent authority of a third country” means an authority of a third country that is competent for the prevention, detection, investigation and prosecution of a terrorist offence or serious crime under the law of that third country;

“data protection officer” shall be construed in accordance with section 86(1);

“designated intra-EU flight” shall be construed in accordance with section 79;

“Directive” means Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016⁹ on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime;

“Director” means the Director of the PIU;

“extra-EU flight” means a scheduled or non-scheduled flight by an air carrier flying—

• (a) from a third country and planned to land in the State, or

• (b) from the State and planned to land in a third country,

including a flight with any stop-overs in another Member State or in a third country;

“Independent Authority” has the meaning assigned to it by section 90(1);

“intra-EU flight” means a scheduled or non-scheduled flight by an air carrier flying—

• (a) from a Member State and planned to land in the State, or

• (b) from the State and planned to land in one or more than one Member State,

without any stop-overs in the territory of a third country;

“Minister” means the Minister for Justice, Home Affairs and Migration;

“notify” means notify in writing;

“PIU” means the Passenger Information Unit continued in being under section 83;

“PIU of another Member State” means the Passenger Information Unit established or designated by that other Member State in accordance with Article 4(1), and cognate words shall be construed accordingly;

“PNR data” means, subject to subsections (2) to (6), the passenger name record data specified in Schedule 2 collected by an air carrier;

“PNR database” means the database maintained by the PIU for the storage of PNR data;

“prescribed” means prescribed by regulations made by the Minister;

“push method” means the method whereby PNR data is transferred by an air carrier into the PNR database;

“Regulations of 2018” means the European Union (Passenger Name Record Data) Regulations 2018 (S.I. No. 177 of 2018);

“serious crime”—

• (a) in sections 92(2), 98(1), 98(2), 100(1), 100(3), 100(4) and 104(7), means—

• (i) an offence specified in Schedule 3 that is punishable by a custodial sentence or a detention order of a maximum period of at least 3 years, or

• (ii) such other offence, within the meaning of Article 3(9), as may be prescribed by the Minister,

• (b) in sections 95(9), 99(1), 99(5), 99(8) and 101(1), has the same meaning as it has in Article 3(9), and

• (c) in sections 79, 96(1) and 104(1), means an offence referred to in paragraph (a) or (b), or both;

“terrorist offence”—

• (a) in sections 92(2), 98(1), 98(2), 100(1), 100(3), 100(4) and 104(7) means—

• (i) an offence under—

• (I) section 21 or 21A of the Offences against the State Act 1939 (where committed by a terrorist group within the meaning of section 5(1) of the Criminal Justice (Terrorist Offences) Act 2005),

• (II) section 6 of the Offences Against the State (Amendment) Act 1998 (where committed by a terrorist group within the meaning of section 5(1) of the Criminal Justice (Terrorist Offences) Act 2005), or

• (III) section 6 or 13 of the Criminal Justice (Terrorist Offences) Act 2005,

or

• (ii) such other offence, within the meaning of Article 3(8), as may be prescribed by the Minister,

• (b) in sections 95(9), 99(1), 99(5), 99(8) and 101(1) has the same meaning as it has in Article 3(8), and

• (c) in sections 79, 94(1), 96(1) and 104(1), means an offence referred to in paragraph (a) or (b), or both.

• (2) A reference in paragraph 5 of Schedule 2 to address and contact information (telephone number, email address) shall be taken to be a reference to the postal address, telephone number and email address of the air passenger on behalf of whom a reservation for a flight is made.

• (3) A reference in paragraph 6 of Schedule 2 to all forms of payment information, including billing address shall be taken to be a reference to information relating to the payment methods for, and billing of, an air ticket, to the exclusion of any other information not directly related to a flight.

• (4) A reference in paragraph 8 of Schedule 2 to frequent flyer information shall be taken to be a reference only to data relating to the status of the passenger concerned in the context of a customer loyalty programme of a given airline or a given group of airlines as well as the number identifying that passenger as a frequent flyer.

• (5) A reference in paragraph 12 of Schedule 2 to general remarks (including all available information on unaccompanied minors under 18 years, such as name and gender of the minor, age, language(s) spoken, name and contact details of guardian on departure and relationship to the minor, name and contact details of guardian on arrival and relationship to the minor, departure and arrival agent) shall be taken to be a reference to the following information only:

• (a) the name, gender and age of, and the languages spoken by, unaccompanied minor air passengers under 18 years,

• (b) the name and contact details of the guardian on departure and his or her relationship to the minor,

• (c) the name and contact details of the guardian on arrival and his or her relationship to the minor, and

• (d) the departure and arrival agent.

• (6) A reference in paragraph 18 of Schedule 2 to any advance passenger information (API) data collected (including the type, number, country of issuance and expiry date of any identity document, nationality, family name, given name, gender, date of birth, airline, flight number, departure date, arrival date, departure port, arrival port, departure time and arrival time) shall be taken to be a reference to the following information only:

• (a) API data (the type, number, country of issuance and expiry date of any identity document, nationality, family name, given name, gender, date of birth, airline, flight number, departure date, arrival date, departure port, arrival port, departure time and arrival time), and

• (b) API data specified in Regulation 3(2) of the European Communities (Communication of Passenger Data) Regulations 2011 (S.I. No. 597 of 2011).

• (7) Unless the context otherwise requires—

• (a) a word or expression that is used in this Part and that is also used in the Directive has the same meaning in this Part that it has in the Directive, and

• (b) a reference in this Part to a numbered Article is a reference to the Article so numbered of that Directive.

79. Application (Part 19)

79. This Part applies to the use, for the prevention, detection, investigation and prosecution of a terrorist offence or a serious crime, of PNR data of a passenger of—

• (a) an extra-EU flight, and

• (b) an intra-EU flight that is designated under section 92 or 94 (in this Part referred to as a “designated intra-EU flight”).

80. Orders and regulations

80. (1) The Minister may by regulations provide for any matter referred to in this Part as prescribed or to be prescribed.

• (2) An order or regulation under this Part may contain such incidental, supplementary and consequential provisions as appear to the Minister to be necessary or expedient for the purposes of the order or regulation.

• (3) Every order and regulation made by the Minister under this Part shall be laid before each House of the Oireachtas as soon as may be after it is made and, if a resolution annulling the order or regulation is passed by either such House within the next 21 days on which that House sits after the order or regulation is laid before it, the order or regulation shall be annulled accordingly, but without prejudice to the validity of anything previously done thereunder.

81. Revocation

81. Subject to sections 83(1), 84(2), 85(1), 85(2), 85(3), 86(2), 89(1), 96(3) and Chapter, the Regulations of 2018 are revoked.

82. Service of notices and documents

82. A notice or other document that is required to be served on or given to a person under this Part shall be served on or given to the person in one of the following ways:

• (a) by electronic means, in a case in which the person has given notice in writing to the person serving or giving the notice or document concerned of his or her consent to the notice or document (or notices or documents of a class to which the notice or document belongs) being served on, or given to, him or her in that manner;

• (b) by delivering it to the person;

• (c) by addressing it to the person and leaving it at the address where the person ordinarily resides or, in a case in which an address for service has been furnished, at that address;

• (d) by sending it to the person by post in a prepaid registered letter to the address at which the person ordinarily resides or, in a case in which an address for service has been furnished, to that address.

Chapter 2 Passenger Information Unit

83. Continuation and functions of Passenger Information Unit

83. (1) Notwithstanding the coming into operation of section 81, the unit established under Regulation 4(1) of the Regulations of 2018 and known as the Passenger Information Unit (in this Part referred to as the “PIU”) shall continue in being as a unit in the Department of Justice, Home Affairs and Migration, in accordance with the provisions of this Part.

• (2) The functions of the PIU shall include:

• (a) the collection of PNR data from air carriers, and the storage and processing of such data;

• (b) the designation of intra-EU flights in accordance with section 92;

• (c) the transfer of PNR data, and the result of any processing of such data under paragraph (a), to a competent authority, the PIU or competent authority of another Member State, a competent authority of a third country or Europol;

• (d) the receipt of PNR data, and the result of any processing of such data, from the PIU of another Member State.

84. Director of PIU

84. (1) The Minister shall, subject to subsection (2), appoint a person to be the Director of the PIU (in this Part referred to as the “Director”).

• (2) A person who, immediately before the coming into operation of section 81, stands appointed as Director under Regulation 4(2) of the Regulations of 2018, shall, on such coming into operation, continue to be the Director.

• (3) The Director shall manage and control generally the staff, administration and business of the PIU.

• (4) The Minister shall nominate a person to perform the functions of the Director during any absence, incapacity or suspension from duty of the Director or during any vacancy in the office of Director.

• (5) The Director may delegate in writing any of his or her functions to a member of staff of the PIU and the member of staff shall be accountable to the Director for the performance of the function so delegated.

• (6) The Director may revoke a delegation made by him or her under subsection (5).

85. Staff of PIU

85. (1) A person who, immediately before the coming into operation of section 81, was a member of staff of the PIU shall, on such coming into operation, continue to be a member of staff of the PIU.

• (2) A person who, immediately before the coming into operation of section 81, stands seconded to the PIU under an arrangement entered into under Regulation 4(3) of the Regulations of 2018 shall, on such coming into operation, remain seconded to the PIU for the remainder of the period of such secondment, subject to the same terms and conditions as applied to the secondment immediately before such coming into operation.

• (3) A person who, immediately before the coming into operation of section 81, stands engaged by the PIU under Regulation 4(4) of the Regulations of 2018 for a period of temporary service with the PIU shall, on such coming into operation, continue to be engaged by the PIU for the remainder of that period, subject to the same terms and conditions as applied to the engagement immediately before such coming into operation.

• (4) The Director may enter into an arrangement with a competent authority for the secondment of a member of staff of the competent authority to the PIU.

• (5) The Director may enter into an arrangement to engage one or more than one person (on contract or otherwise) for a period of temporary service with the PIU.

86. Data protection officer

86. (1) Subject to subsection (2), the Director shall appoint a person (in this Part referred to as the “data protection officer”) who shall be responsible for monitoring the processing of PNR data under this Part and for implementing data protection safeguards.

• (2) A person who, immediately before the coming into operation of section 81, stands appointed as data protection officer under Regulation 14(1) of the Regulations of 2018 shall, on such coming into operation, continue as data protection officer as if he or she had been appointed under this section.

• (3) The functions of the data protection officer shall include the following:

• (a) informing the Director and staff of the PIU of their obligations in relation to the processing of PNR data under this Part and advising them in relation to those obligations;

• (b) monitoring compliance by the Director and staff of the PIU with—

• (i) their obligations under this Part in relation to the processing of PNR data, and

• (ii) the policies of the PIU as data controller in relation to the protection of personal data, including audit activity;

• (c) providing advice to the Director and staff of the PIU on awareness-raising activities, staff training and the allocation of responsibilities in relation to data protection;

• (d) advising the Director and staff of the PIU in relation to, and monitoring the carrying out of, data protection impact assessments;

• (e) acting as a contact point for persons both within and outside the PIU in respect of issues relating to the processing of PNR data by the PIU.

• (4) The PIU shall notify the data protection officer of—

• (a) a transfer of PNR data under section 98(5), 99(4), 99(11), 101(4), 102(5) or 103(1) in advance of such transfer taking place, and

• (b) a transfer notified to the PIU in accordance with section 102(8).

• (5) Where the data protection officer is informed by the PIU under subsection (4)(a) of a transfer of PNR data, the data protection officer shall, after the transfer has taken place, carry out a review of the transfer for the purpose of monitoring compliance by the PIU with the provisions of this Part concerning the processing of PNR data.

• (6) The Director shall—

• (a) ensure that the data protection officer is involved in an appropriate and timely manner in all matters relating to the protection of personal data,

• (b) support the data protection officer in performing the functions referred to in subsection (3) by providing him or her with access to processing operations and the resources necessary to carry out those functions, and

• (c) assist the data protection officer in maintaining his or her expert knowledge in relation to data protection.

87. Director to report statistical information to Minister

87. (1) Subject to subsection (3), the Director shall, on a yearly basis, and not later than 31 May in each year, submit to the Minister a report containing statistical information on PNR data provided to the PIU.

• (2) The statistics referred to in subsection (1) shall, at a minimum, cover—

• (a) the total number of passengers whose PNR data have been collected and exchanged by the PIU, and

• (b) the number of passengers identified for further examination by a competent authority or a competent authority of another Member State.

• (3) The statistics provided under this Part shall not contain any personal data.

88. Processing of PNR data by PIU

88. (1) The PIU shall process PNR data for the purpose of the performance of its functions under this Part—

• (a) to the extent necessary and proportionate for that purpose, and

• (b) in a manner that does not discriminate against a person on any grounds.

• (2) PNR data shall not be processed by the PIU in such a manner as to reveal the race, ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation of a person.

• (3) Where PNR data revealing the information referred to in subsection (2) are received by the PIU from an air carrier, they shall be deleted immediately.

• (4) Where PNR data collected by the PIU include data other than those specified in Schedule 2, such data shall be deleted immediately and permanently upon receipt.

• (5) The storage, processing and analysis of PNR data by the PIU shall be carried out exclusively within a secure location or locations within the State.

• (6) The PIU shall put in place and implement appropriate technical and organisational measures and procedures to ensure a high level of security for the PNR data appropriate to the risks represented by the processing and nature of such data.

Chapter 3 Competent authorities, Independent Authority and Data Protection Commission

89. Competent authorities

89. (1) Notwithstanding the coming into operation of section 81, a competent authority referred to in Regulation 9 of the Regulations of 2018 and specified in Schedule 4 shall continue to be a competent authority for the purposes of this Part and the Directive.

• (2) Subject to subsection (3), the Minister may by order designate a body as a competent authority for the purposes of this Part.

• (3) The Minister shall not make an order under subsection (2) in respect of a body for which a Minister of the Government other than the Minister has responsibility and in whom functions, whether statutory or otherwise, in respect of the body are vested, other than with the consent of that Minister of the Government.

90. Designation and functions of Independent Authority

90. (1) The Minister may by order designate a person (in this Part referred to as the “Independent Authority”) as the national authority for the purposes of the performance of the functions conferred on it by this Part.

• (2) The functions of the Independent Authority shall include—

• (a) the review of—

• (i) in accordance with section 93, the process for designation by the PIU of an intra-EU flight under section 92, and

• (ii) an authorisation for the transfer of PNR data under section 103,

and

• (b) the approval of—

• (i) an application for the transfer of PNR data under section 98, 99, 101 or 102, and

• (ii) a request for PNR data under subsection (1) of section 100 to which subsection (5) of that section applies.

• (3) The Independent Authority shall have all powers necessary or expedient for the performance of its functions under this Part.

• (4) The Independent Authority shall be independent in the performance of its functions.

91. Data Protection Commission

91. The Data Protection Commission shall be responsible for advising on and monitoring the application of this Part within the State with a view to protecting fundamental rights in relation to the processing of personal data under this Part.

Chapter 4 Designation of intra-EU flights by PIU and Minister

92. Designation by PIU of intra-EU flight

92. (1) Subject to subsection (2), the PIU may designate in writing an intra-EU flight for the purposes of this Part for a period not exceeding 6 months from the date of designation.

• (2) A designation under subsection (1) may only be made where the PIU carries out an assessment and determines, having due regard to the risks to the fundamental rights and freedoms of data subjects which may result from the designation, that—

• (a) the designation is necessary and proportionate for the purpose of preventing, detecting, investigating and prosecuting a terrorist offence or serious crime, and

• (b) there is an objective link, whether of a direct or an indirect nature, between the offence or crime and the carriage of passengers by air.

• (3) The PIU shall, before the expiry of the period of 6 months following the designation of an intra-EU flight under subsection (1), carry out an assessment for the purpose of determining whether the designation of the designated intra-EU flight concerned is, having due regard to the risks to the fundamental rights and freedoms of data subjects which may result from the designation, necessary and proportionate for the purpose referred to in subsection (2).

• (4) Where, on the basis of an assessment under subsection (3), the PIU determines that the continued designation of an intra-EU flight is necessary and proportionate for the purpose referred to in that subsection, the PIU may extend the designation of the intra-EU flight concerned for a further period not exceeding 6 months.

• (5) Where, on the basis of an assessment under subsection (3), the PIU determines that the continued designation of an intra-EU flight is not necessary and proportionate for the purpose referred to in that subsection, the PIU shall not extend the designation of the intra-EU flight concerned.

• (6) Without prejudice to subsection (3), the PIU may, at any time, where it considers it appropriate to do so, carry out an assessment of a designation in force under this section for the purpose referred to in that subsection.

• (7) Where, on the basis of an assessment carried out under subsection (6), the PIU determines that the designation of an intra-EU flight is no longer necessary and proportionate for the purposes for which it was so designated, the PIU shall revoke the designation.

93. Review by Independent Authority

93. (1) Subject to subsection (5), the Independent Authority shall conduct a review of the process for designation of an intra-EU flight under section 92 in order to determine whether the PIU, in carrying out an assessment of an intra-EU flight under subsection (2), (3) and, where applicable, (6) of that section (in this section referred to as a “relevant assessment”), complied with those provisions.

• (2) In conducting a review under subsection (1), the Independent Authority may—

• (a) consider the criteria applied by the PIU in determining whether the designation of an intra-EU flight is necessary and proportionate for the purpose referred to in section 92(2), and

• (b) examine a relevant assessment carried out in respect of one, or more than one, intra-EU flight designated under section 92, whether or not the designation is in force at the time of the review.

• (3) Without prejudice to subsection (4), a review under subsection (1) shall be conducted—

• (a) in respect of the first review, not later than 12 months from the date on which the first intra-EU flight is designated under section 92 following the coming into operation of this Part, and

• (b) once in every 12 month period thereafter.

• (4) The Independent Authority may, at any time, conduct a review under subsection (1) where it has reasonable grounds for believing that a relevant assessment was not carried out by the PIU in accordance with section 92.

• (5) Before commencing a review under subsection (1), the Independent Authority shall notify the Director of its proposal to conduct the review, which notice shall specify—

• (a) the matters referred to in subsection (2) to which the review shall relate,

• (b) the date on which the review shall commence, which shall not be earlier than 10 working days from the date on which the notice is given, and

• (c) any documents, records or other information within the possession or control of the PIU that are relevant to, or required for, the conduct of the review, including details of the criteria referred to in subsection (2)(a).

• (6) The Independent Authority shall, as soon as practicable after the completion of a review under subsection (1), notify the PIU of the outcome of the review.

• (7) Where the Independent Authority, having carried out a review under subsection (1), determines that the PIU, in carrying out a relevant assessment, did not comply with the requirements of section 92, the Independent Authority may issue a direction in writing to the Director specifying—

• (a) the measures which the PIU is required to take in order to comply with the requirements of section 92 in the carrying out of a relevant assessment under that section, and

• (b) the timeframe within which such measures are to be completed.

• (8) The Director shall comply with a direction issued under subsection (7).

• (9) The Director shall, within the timeframe specified in the direction, notify the Independent Authority of the measures taken by the PIU to comply with the direction.

• (10) The Independent Authority may, where it is not satisfied that the Director has complied with a direction under subsection (7), issue such further direction under that subsection as it considers appropriate.

• (11) A direction issued under subsection (7) may, where the Independent Authority considers it appropriate, require the PIU to revoke a designation of an intra-EU flight that is in force under section 92 at the time of the issuing of the direction.

• (12) The Independent Authority may communicate with the Minister on any matter concerning a review under this section, including where it considers that the PIU has failed to comply with a direction under subsection (7).

• (13) The Minister may, where he or she receives a communication under subsection (12), direct the PIU to comply with a direction issued under subsection (7) within such timeframe as the Minister may specify.

94. Application to relevant judge by Minister for designation of all intra-EU flights

94. (1) The Minister may, where he or she is satisfied, on the basis of an assessment conducted in accordance with subsection (2), that there exists a genuine and present or foreseeable threat related to a terrorist offence, make an application to a relevant judge for an order requiring the PIU to designate all intra-EU flights as designated intra-EU flights for such period as may be specified in the order.

• (2) Before making an application under subsection (1), the Minister shall assess whether the threat referred to in that subsection exists and, for that purpose, shall—

• (a) have regard to the necessity and proportionality of the designation of all intra-EU flights for the purpose of the prevention, detection, investigation and prosecution of the terrorist offence, taking into account the risks to the fundamental rights and freedoms of data subjects which may result from the designation, and

• (b) be satisfied of the existence of an objective link, whether of a direct or an indirect nature, between the offence and the carriage of passengers by air.

• (3) An application under subsection (1) shall—

• (a) be made ex parte,

• (b) be upon information on oath specifying the grounds on which the order is sought, which information shall include the results of the assessment conducted under subsection (2),

• (c) specify the period of time, being a period not exceeding 12 months, for which the designation referred to in subsection (1) is, in the view of the Minister, necessary and proportionate for the purposes referred to in subsection (2), and

• (d) be heard otherwise than in public.

• (4) A relevant judge, as respects an application under subsection (1), may make an order directing the PIU to designate all intra-EU flights as designated intra-EU flights only if satisfied that the making of the order is necessary for, and proportionate to, the purposes referred to in subsection (2).

• (5) Where a relevant judge makes an order under subsection (4), that order shall—

• (a) require the PIU to designate all intra-EU flights as designated intra-EU flights for such period as is specified in the order, and

• (b) specify—

• (i) the period for which the order shall have effect, and

• (ii) any conditions and directions to which the designation is subject.

• (6) Where an order is made under subsection (4), the Minister shall, without delay, arrange for—

• (a) service of the order on the PIU, and

• (b) publication of—

• (i) the order in the national media, and

• (ii) a notice of the making of the order in Iris Oifigiúil.

• (7) The President of the High Court shall, at the request of the Minister, designate one or more than one judge of the High Court to perform the functions of a relevant judge under this section, and a reference in this section to a “relevant judge” shall be construed as a reference to a judge so designated.

Chapter 5 Transfer and exchange of PNR data

95. Obligations of air carriers regarding transfer of PNR data

95. (1) An air carrier shall, in accordance with this section, transfer by the push method to the PNR database all PNR data which it has collected in the normal course of business in respect of passengers to be carried by the air carrier on an extra-EU flight or on a designated intra-EU flight.

• (2) Where a flight referred to in subsection (1) is code-shared between one or more air carriers, the air carrier which operates the flight shall transfer the PNR data of all passengers on the flight to the PIU in accordance with that subsection.

• (3) An air carrier shall, where an extra-EU flight has one or more stop-overs at airports of Member States, transfer the PNR data of all passengers, including those who disembark at the time of a stop-over, to the PIU.

• (4) An air carrier shall, where a designated intra-EU flight has one or more stop-overs at airports of Member States, transfer the PNR data of all passengers, including those who disembark at the time of a stop-over, to the PIU.

• (5) Where an air carrier collects API data in respect of passengers on an extra-EU flight or a designated intra-EU flight, the air carrier shall, whether or not it retains those data by the same technical means as for other PNR data, transfer that API data to the PIU by the push method and such data shall be considered as PNR data for the purposes of this Part.

• (6) Subject to subsections (7) and (8), an air carrier shall transfer the PNR data referred to in subsection (1) to the PNR database—

• (a) 24 to 48 hours before a scheduled flight departure time, and

• (b) immediately after flight closure, that is once the passengers have boarded the aircraft in preparation for departure and it is no longer possible for passengers to board or leave the flight.

• (7) An air carrier shall transfer the PNR data referred to in subsection (1) to the PNR database—

• (a) by electronic means using the common protocols and supported data formats adopted in accordance with Article 16(2), or

• (b) in the event of technical failure or difficulty, by any other appropriate means ensuring the same level of technical and organisational security.

• (8) An air carrier may limit PNR data transferred under paragraph (b) of subsection (6) to an update of the PNR data already transferred under paragraph (a) of that subsection.

• (9) An air carrier shall, on a case-by-case basis, where requested by the PIU under section 99(11)(a), transfer PNR data to the PIU at times other than those provided for in subsection (6)—

• (a) where access to that data is necessary in order to respond to a specific and actual threat related to a terrorist offence or serious crime, and

• (b) the PIU has determined, in accordance with section 99(8), there is an objective link, whether of a direct or an indirect nature, between the offence or crime referred to in paragraph (a) and the carriage of passengers by air.

• (10) An air carrier shall use its best endeavours to ensure that any data collected by it that is not PNR data is not transferred to the PIU.

• (11) An air carrier that fails to comply with a requirement under this section, other than the requirement under subsection (10), shall be guilty of an offence and shall be liable—

• (a) on summary conviction, to a class A fine, or

• (b) on conviction on indictment, to a fine not exceeding €250,000.

• (12) It shall be a defence for an air carrier charged with an offence under subsection (11) to show that it took all reasonable steps to ensure compliance with this section.

• (13) Proceedings for an offence under this section may be brought and prosecuted summarily by the Director.

• (14) Where an offence under subsection (11) is committed by a body corporate and is proved to have been so committed with the consent or connivance of any person, being a director, manager, secretary or other officer of the body corporate, or a person who was purporting to act in any such capacity, that person shall, as well as the body corporate, be guilty of an offence and shall be liable to be proceeded against and punished as if he or she were guilty of the first-mentioned offence.

• (15) Where the affairs of a body corporate are managed by its members, subsection (14) applies in relation to the acts and defaults of a member in connection with his or her functions of management as if he or she were a director or manager of the body corporate.

96. Assessment of passengers by PIU

96. (1) The PIU shall carry out an assessment of PNR data in respect of passengers on—

• (a) an extra-EU flight, or

• (b) a designated intra-EU flight,

prior to their scheduled arrival in, or departure from, the State for the purpose of identifying persons who require further examination by a competent authority or a competent authority in another Member State and, where relevant, by Europol, to determine whether such persons may be, or may have been, involved in a terrorist offence or serious crime, in respect of which there is an objective link, whether of a direct or an indirect nature, with the carriage of passengers by air.

• (2) Subject to subsection (3), the PIU may determine criteria (in this section referred to as “pre-determined criteria”) to be used in processing PNR data for the purpose of conducting an assessment under subsection (1) and, where such criteria are determined, they shall—

• (a) be targeted, proportionate and specific in nature,

• (b) be regularly reviewed in consultation with the competent authorities, and

• (c) not, in any circumstance, be based on the race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sexual life or sexual orientation of a person.

• (3) Notwithstanding the coming into operation of section 81, where immediately before the coming into operation of that section, pre-determined criteria referred to in Regulation 5 of the Regulations of 2018 are in use in conducting assessments under that Regulation, those criteria shall be considered to be pre-determined criteria for the purposes of this section until new criteria are established under subsection (5).

• (4) When carrying out an assessment under subsection (1), the PIU may—

• (a) compare PNR data against databases relevant for the purpose referred to in that subsection, only where such databases are databases containing data on persons or objects sought or under alert, in accordance with European Union, international and national law and the laws of the State applicable to such databases, or

• (b) process PNR data against pre-determined criteria.

• (5) The PIU may establish pre-determined criteria and may, from time to time, update those criteria.

97. Transfer of PNR data to another Member State and to competent authority

97. (1) Where the PIU carries out an assessment under section 96(1) and identifies a person who requires further examination by a competent authority in another Member State, the PIU shall, subject to subsection (4), transfer the PNR data relating to that person and, where applicable, the result of the processing of such data by it, to the PIU of the Member State concerned for onward transfer to the competent authority in the Member State concerned.

• (2) Where the PIU carries out an assessment under section 96(1) and identifies a person who requires further examination by a competent authority, the PIU shall, subject to subsection (4), transfer the PNR data relating to that person and, where applicable, the result of the processing of such data by it, to the competent authority concerned.

• (3) Where the PIU of another Member State transfers PNR data, or the result of the processing of such data, or both, to the PIU for onward transfer by the PIU to a competent authority, the PIU shall, subject to subsection (4), transfer the data and, where applicable, the result of the processing of such data, to the competent authority that is to carry out further examination of the data.

• (4) Where a person referred to in subsection (1) or (2) has been identified by the automated processing of PNR data, the PIU shall only transfer the PNR data relating to that person, in accordance with those subsections, where the PIU has carried out a review of the identification by non-automated means and has verified the identification of the person concerned.

98. Request by competent authority for PNR data

98. (1) A competent authority is entitled—

• (a) to request, under subsection (2), and receive, under section 97(2), PNR data, and the result of the processing of such data by the PIU, from the PIU, and

• (b) to request, under section 100(3), PNR data, and the result of the processing of such data by the PIU of another Member State, from that PIU,

in order to examine that data and take appropriate action for the purpose of preventing, detecting, investigating and prosecuting a terrorist offence or serious crime.

• (2) Where a request is received by the PIU from a competent authority for PNR data, or the result of the processing of such data by the PIU, or both, the PIU shall, subject to section 103, make an application to the Independent Authority for approval to transfer the data requested to the competent authority concerned where, on the basis of the request—

• (a) the PIU considers there are reasonable grounds for believing that—

• (i) the transfer of the data requested is necessary for the purpose of preventing, detecting, investigating and prosecuting a terrorist offence or serious crime, and

• (ii) there is an objective link, whether of a direct or an indirect nature, between the offence or crime and the carriage of passengers by air,

and

• (b) the PIU—

• (i) where the request relates to a request for PNR data relating to a serious crime, has a reasonable suspicion that a person, to whom the PNR data, the subject of the request, relates, is involved in any way with the crime, or

• (ii) where the request relates to a request for PNR data relating to a terrorist offence, infers that the PNR data, the subject of the request, could contribute effectively to the combatting of the offence.

• (3) An application under subsection (2) shall be in writing, submitted by electronic means, and shall contain a copy of the request referred to in that subsection.

• (4) Following receipt of an application under subsection (2), the Independent Authority shall review the application and, as soon as practicable and in any event not later than 96 hours after receiving the application, shall—

• (a) decide, on the basis of the application, whether to approve the transfer of the PNR data, and, where applicable, the result of the processing of such data, and

• (b) notify the PIU of the decision of the Independent Authority and the reasons for that decision.

• (5) Where, under subsection (4), the Independent Authority approves the transfer of the data requested, the PIU shall, as soon as practicable after receipt of the notification under paragraph (b) of that subsection, transfer the data to the competent authority concerned.

• (6) Subject to subsection (7), PNR data, and the result of the processing of such data by the PIU, transferred to a competent authority under subsection (5), may be processed by the competent authority only for the purpose of preventing, detecting, investigating and prosecuting a terrorist offence or serious crime.

• (7) Where evidence of an offence, other than the one referred to in subsection (6), is detected during the processing of data referred to in that subsection, that subsection shall not affect law enforcement or judicial powers to process that data for purposes relating to that other offence.

• (8) A competent authority shall not take any decision that produces an adverse legal effect on a person or significantly affects the person—

• (a) only by reason of the automated processing of PNR data, or

• (b) on the basis of the race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation of the person.

99. Request from other Member State for PNR data

99. (1) Where a request is received by the PIU from the PIU of another Member State for PNR data, or the result of the processing of such data by the PIU, or both, the PIU shall, subject to section 103, make an application to the Independent Authority for approval to transfer the data requested to the PIU of the other Member State where, on the basis of the request—

• (a) the PIU considers there are reasonable grounds for believing that—

• (i) the transfer of the data requested is necessary for the purpose of preventing, detecting, investigating and prosecuting a terrorist offence or serious crime, and

• (ii) there is an objective link, whether of a direct or an indirect nature, between the offence or crime and the carriage of passengers by air,

and

• (b) the PIU—

• (i) where the request relates to a request for PNR data relating to a serious crime, has a reasonable suspicion that a person, to whom the PNR data, the subject of the request, relates, is involved in any way with the crime, or

• (ii) where the request relates to a request for PNR data relating to a terrorist offence, infers that the PNR data, the subject of the request, could contribute effectively to the combatting of the offence.

• (2) An application under subsection (1) shall be in writing, submitted by electronic means, and shall contain a copy of the request referred to in that subsection.

• (3) Following receipt of an application under subsection (1), the Independent Authority shall review the application and, as soon as practicable and in any event not later than 96 hours after receiving the application, shall—

• (a) decide, on the basis of the application, whether to approve the transfer of the PNR data and, where applicable, the result of the processing of such data, and

• (b) notify the PIU of the decision of the Independent Authority and the reasons for that decision.

• (4) Where, under subsection (3), the Independent Authority approves the transfer of the data requested, the PIU shall, as soon as practicable after receipt of the notification under paragraph (b) of that subsection, transfer the data to the PIU of the other Member State.

• (5) Where, in the case of an emergency, a competent authority of another Member State submits to the PIU a direct request for PNR data, or the result of the processing of such data by the PIU, or both, the PIU shall, subject to section 103, make an application to the Independent Authority for approval to transfer the data requested to the competent authority of the other Member State where, on the basis of the request—

• (a) the PIU considers there are reasonable grounds for believing that—

• (i) the circumstances set out in the request constitute an emergency and the transfer of the data requested is necessary for the purpose of preventing, detecting, investigating and prosecuting a terrorist offence or serious crime, and

• (ii) there is an objective link, whether of a direct or an indirect nature, between the offence or crime and the carriage of passengers by air,

and

• (b) the PIU—

• (i) where the request relates to a request for PNR data relating to a serious crime, has a reasonable suspicion that a person, to whom the PNR data, the subject of the request, relates, is involved in any way with the crime, or

• (ii) where the request relates to a request for PNR data relating to a terrorist offence, infers that the PNR data, the subject of the request, could contribute effectively to the combatting of the offence.

• (6) An application under subsection (5) shall be in writing, submitted by electronic means, and shall contain a copy of the request referred to in that subsection.

• (7) Subsections (3) and (4) shall apply to an application under subsection (5) as they apply to an application under subsection (1), subject to the modification that a reference in subsections (3) and (4) to subsection (1) shall be construed as a reference to subsection (5).

• (8) Where, in exceptional circumstances, a request is received by the PIU from the PIU of another Member State to obtain PNR data from an air carrier at a time other than that provided for in section 95(6), the PIU shall, subject to section 103, make an application to the Independent Authority for approval to transfer the PNR data to the PIU of the Member State concerned where, on the basis of the request—

• (a) the PIU considers there are reasonable grounds for believing that—

• (i) the transfer of the PNR data requested is necessary for the purpose of responding to a specific and actual threat related to a terrorist offence or serious crime, and

• (ii) there is an objective link, whether of a direct or an indirect nature, between the offence or crime and the carriage of passengers by air,

and

• (b) the PIU—

• (i) where the request relates to a request for PNR data relating to a serious crime, has a reasonable suspicion that a person to whom the PNR data, the subject of the request, relates, is involved in any way with the crime, or

• (ii) where the request relates to a request for PNR data relating to a terrorist offence, infers that the PNR data, the subject of the request, could contribute effectively to the combatting of the offence.

• (9) An application under subsection (8) shall be in writing, submitted by electronic means, and shall contain a copy of the request referred to in that subsection.

• (10) Following receipt of an application under subsection (8), the Independent Authority shall review the application and, as soon as practicable and in any event not later than 96 hours after receiving the application, shall—

• (a) decide, on the basis of the application, whether to approve the transfer of the PNR data, and

• (b) notify the PIU of the decision of the Independent Authority and the reasons for that decision.

• (11) Where, under subsection (10), the Independent Authority approves the transfer of the PNR data requested, the PIU shall as soon as practicable after receipt of the notification under paragraph (b) of that subsection—

• (a) request the air carrier to transfer the PNR data to the PIU in accordance with section 95(7), and

• (b) provide the PNR data to the PIU of the Member State concerned.

100. Requests by PIU or competent authority to PIU of another Member State for PNR data

100. (1) Subject to subsection (5), the PIU may make a request for PNR data, or the result of the processing of such data by the PIU of another Member State, or both, to that PIU where the PIU considers—

• (a) there are reasonable grounds for believing that—

• (i) the transfer of the data to the PIU is necessary for the purpose of preventing, detecting, investigating and prosecuting a terrorist offence or serious crime, and

• (ii) there is an objective link, whether of a direct or an indirect nature between the offence or crime and the carriage of passengers by air,

and

• (b) the PIU—

• (i) where the request relates to a request for PNR data relating to a serious crime, has a reasonable suspicion that a person, to whom the PNR data, the subject of the request, relates, is involved in any way with the crime, or

• (ii) where the request relates to a request for PNR data relating to a terrorist offence, infers that the PNR data, the subject of the request, could contribute effectively to the combatting of the offence.

• (2) A request under subsection (1) may be for one or more of the PNR data elements specified in Schedule 2, as are considered necessary by the PIU for the purpose referred to in that subsection, and shall include the reasons for the request.

• (3) In cases of emergency, a competent authority may make a request for PNR data, or the result of the processing of such data by the PIU of another Member State, or both, directly to that PIU, where the competent authority considers—

• (a) there are reasonable grounds for believing that—

• (i) the circumstances set out in the request constitute an emergency and the transfer of the data to the competent authority is necessary for the purpose of preventing, detecting, investigating and prosecuting a terrorist offence or serious crime, and

• (ii) there is an objective link, whether of a direct or an indirect nature, between the offence or crime and the carriage of passengers by air,

and

• (b) the competent authority—

• (i) where the request relates to a request for PNR data relating to a serious crime, has a reasonable suspicion that a person, to whom the PNR data, the subject of the request, relates, is involved in any way with the crime, or

• (ii) where the request relates to a request for PNR data relating to a terrorist offence, infers that the PNR data, the subject of the request, could contribute effectively to the combatting of the offence.

• (4) In exceptional circumstances, the PIU may request the PIU of another Member State to request an air carrier to transfer PNR data to the PIU of that Member State at a time other than the time the air carrier normally transfers PNR data to the PIU of the other Member State concerned, and transmit the data to the PIU, where the PIU considers—

• (a) there are reasonable grounds for believing that—

• (i) the transfer of the data to the PIU is necessary for the purpose of responding to a specific and actual threat related to a terrorist offence or serious crime, and

• (ii) there is an objective link, whether of a direct or an indirect nature, between the offence or crime and the carriage of passengers by air,

and

• (b) the PIU—

• (i) where the request relates to a request for PNR data relating to a serious crime, has a reasonable suspicion that a person, to whom the PNR data, the subject of the request, relates, is involved in any way with the crime, or

• (ii) where the request relates to a request for PNR data relating to a terrorist offence, infers that the PNR data, the subject of the request, could contribute effectively to the combatting of the offence.

• (5) Where, in the case of a request referred to in subsection (1), it is a requirement in the Member State to which the request referred to in that subsection is made that, before such a request is made to the PIU in that Member State, a court or other independent authority in the requesting Member State provide approval for the transfer of the PNR data, and, where applicable, the result of the processing of such data, the PIU shall make an application to the Independent Authority for approval to have the data transferred to it by the PIU of the other Member State.

• (6) An application under subsection (5) shall be in writing, submitted by electronic means, and shall contain a copy of the request which the PIU proposes to make to the PIU of the other Member State.

• (7) Following receipt of an application under subsection (5), the Independent Authority shall review the application and, as soon as practicable and in any event not later than 96 hours after receiving the application, shall—

• (a) decide, on the basis of the application, whether to approve the transfer of the PNR data and, where applicable, the result of the processing of such data, to the PIU, and

• (b) notify the PIU of the decision of the Independent Authority and the reasons for that decision.

• (8) Where, under subsection (7), the Independent Authority approves the transfer of data by the PIU of the other Member State, the PIU shall, when making a request under subsection (1) to which subsection (5) applies, notify the PIU of that other Member State of the decision of the Independent Authority.

101. Request by Europol to PIU for PNR data

101. (1) Where a request for PNR data, or the result of the processing of such data by the PIU, or both, is received by the PIU from Europol, having been submitted by Europol to the PIU in accordance with Article 10, the PIU shall, subject to section 103, make an application to the Independent Authority for approval to transfer the data to Europol where, on the basis of the request—

• (a) the PIU considers there are reasonable grounds for believing that—

• (i) the transfer of the data requested will substantially contribute to the prevention, detection or investigation of a terrorist offence or serious crime, and

• (ii) there is an objective link, whether of a direct or an indirect nature, between the offence or crime and the carriage of passengers by air,

and

• (b) the PIU—

• (i) where the request relates to a request for PNR data relating to a serious crime, has a reasonable suspicion that a person, to whom the PNR data, the subject of the request, relates, is involved in any way with the crime, or

• (ii) where the request relates to a request for PNR data relating to a terrorist offence, infers that the PNR data, the subject of the request, could contribute effectively to the combatting of the offence.

• (2) An application under subsection (1) shall be in writing, submitted by electronic means, and shall contain a copy of the request referred to in that subsection.

• (3) Following receipt of an application under subsection (1), the Independent Authority shall review the application and, as soon as practicable and in any event not later than 96 hours after receiving the application, shall—

• (a) decide, on the basis of the application, whether to approve the transfer of the PNR data and, where applicable, the result of the processing of such data, to Europol, and

• (b) notify the PIU of the decision of the Independent Authority and the reasons for that decision.

• (4) Where, under subsection (3), the Independent Authority approves the transfer of the data requested, the PIU shall, as soon as practicable after receipt of the notification under paragraph (b) of that subsection, transfer the data to Europol in accordance with Article 10(4).

102. Transfer of data to competent authority of third country

102. (1) Where a request is received by the PIU from a competent authority of a third country for PNR data, or the result of the processing of such data by the PIU, or both, the PIU may, subject to section 103, make an application to the Independent Authority for approval to transfer the data to the competent authority of the third country concerned, where, on the basis of the request—

• (a) the PIU considers there are reasonable grounds for believing that—

• (i) the transfer of the data requested is necessary for the purpose of preventing, detecting, investigating and prosecuting a terrorist offence or serious crime in a Member State or the third country making the request, and

• (ii) there is an objective link, whether of a direct or an indirect nature, between the offence or crime and the carriage of passengers by air,

• (b) the PIU is satisfied that the circumstances referred to in subsection (2) apply, and

• (c) the PIU—

• (i) where the request relates to a request for PNR data relating to a serious crime, has a reasonable suspicion that a person, to whom the PNR data, the subject of the request, relates, is involved in any way with the crime, or

• (ii) where the request relates to a request for PNR data relating to a terrorist offence, infers that the PNR data, the subject of the request, could contribute effectively to the combatting of the offence.

• (2) The circumstances referred to in subsection (1) are that—

• (a) the transfer is consistent with the law of the State in relation to data protection,

• (b) subject to subsection (6), where the data that are sought in the request under subsection (1) were obtained by the PIU from the PIU of another Member State, the other Member State has given its prior consent to the transfer, and

• (c) the third country concerned agrees that it will only transfer the PNR data that is the subject of the request to another third country where—

• (i) such transfer is strictly necessary for the purpose of the prevention, detection, investigation and prosecution of a terrorist offence or serious crime in a Member State or the third country making the request, in respect of which offence or crime there is an objective link, whether of a direct or an indirect nature, with the carriage of passengers by air, and

• (ii) having received the express written authorisation of the Director.

• (3) An application under subsection (1) shall be in writing, submitted by electronic means, and shall contain a copy of the request referred to in that subsection.

• (4) Following receipt of an application under subsection (1), the Independent Authority shall review the application and, as soon as practicable and in any event not later than 96 hours after receiving the application, shall—

• (a) decide, on the basis of the application, whether to approve the transfer of the PNR data and, where applicable the result of the processing of such data, and

• (b) notify the PIU of the decision of the Independent Authority and the reasons for that decision.

• (5) Where, under subsection (4), the Independent Authority approves the transfer of the data requested, the PIU shall, as soon as practicable after receipt of the notification under paragraph (b) of that subsection, transfer the data to the competent authority of the third country.

• (6) For the purposes of subsection (2)(b), in exceptional circumstances, the PIU may, where PNR data is obtained by it from another Member State, permit the transfer of that data to a competent authority of a third country without the prior consent of the other Member State from which the PNR data were obtained, only if—

• (a) the transfer is essential in order to respond to a specific and actual threat related to a terrorist offence or serious crime in a Member State or third country, and

• (b) the prior consent of the Member State concerned cannot be obtained in good time.

• (7) Where subsection (6) applies in respect of a transfer of data under subsection (5), the PIU shall, without delay, notify the PIU of the Member State from which the PNR data were originally obtained and make a record of the notification.

• (8) Where the PIU is notified by a PIU of another Member State that there has been a transfer, by that PIU, to a third country of PNR data—

• (a) that was originally obtained from the PIU, and

• (b) without the prior consent of the PIU,

the PIU shall make a record of the notification and shall notify the data protection officer for the purposes of section 86(5).

• (9) PNR data shall be transferred under this section by the PIU to the competent authority of a third country only in accordance with the provisions of this Part and upon ascertaining that the use the recipients intend to make of the PNR data is consistent with the conditions and safeguards contained in this Part.

• (10) In this section—

“serious crime” means—

• (a) where it relates to an offence in a Member State, an offence referred to in paragraph (b) of the definition of “serious crime”, and

• (b) where it relates to an offence in a third country, an offence in the third country equivalent to that referred to in paragraph (a);

“terrorist offence” means—

• (a) where it relates to an offence in a Member State, an offence referred to in paragraph (b) of the definition of “terrorist offence”, and

• (b) where it relates to an offence in a third country, an offence in the third country equivalent to that referred to in paragraph (a).

103. Disclosure of PNR data in case of duly justified urgency

103. (1) Where—

• (a) but for this section, the PIU would, in respect of a request under section 98(2), 99(1), 99(5), 99(8), 101(1) or 102(1), otherwise be satisfied to bring an application to the Independent Authority under the subsection concerned for approval to transfer data, and

• (b) where the circumstances specified in subsection (2) apply in respect of the request,

the Director shall authorise the transfer of the data, or the result of the processing of such data, or both, which is the subject of that request, in accordance with this section.

• (2) The circumstances referred to in subsection (1) are that the Director is satisfied, on the basis of the request, that it is likely that, before approval for the transfer of the data concerned could be obtained from the Independent Authority under the subsection concerned, the prevention, detection, investigation and prosecution of a terrorist offence or serious crime, to which the request relates, would be impeded.

• (3) Where the Director authorises the transfer of PNR data under subsection (1), he or she shall, as soon as practicable, and in any event not later than 24 hours after he or she issues the authorisation, apply to the Independent Authority for review of the authorisation.

• (4) An application under subsection (3) shall—

• (a) be made in writing, and

• (b) specify the grounds on which the authorisation under subsection (1) was issued.

• (5) Following receipt of an application under subsection (3), the Independent Authority, as soon as practicable, and in any event not later than 72 hours after receiving the application shall—

• (a) review the grounds for the authorisation issued under subsection (1) for the purpose of determining whether it was necessary for, and proportionate to, the purposes for which it was issued,

• (b) determine, on the basis of the review carried out under paragraph (a), whether to affirm or revoke the authorisation, and

• (c) notify the PIU of its decision and the reasons for that decision.

• (6) Where the Independent Authority revokes an authorisation under subsection (5), the notice referred to in paragraph (c) of that subsection shall direct the Director to, without delay, notify the person specified in subsection (7) that—

• (a) the data transferred pursuant to the authorisation should be deleted, and

• (b) that the use or further use of that data by the person is prohibited.

• (7) The person referred to in subsection (6) is—

• (a) in the case of a transfer of data to a competent authority pursuant to a request under section 98(2), the competent authority concerned,

• (b) in the case of a transfer of data to the PIU of another Member State pursuant to a request under section 99(1) or (8), or a competent authority of another Member State pursuant to a request under section 99(5), the PIU of the Member State or competent authority of the Member State concerned,

• (c) in the case of a transfer of data to Europol pursuant to a request under section 101(1), Europol, and

• (d) in the case of a transfer of data to a competent authority of a third country pursuant to a request under section 102, the competent authority of the third country that made the request under that section.

• (8) Where the Independent Authority revokes an authorisation under subsection (5), the Authority may, where it considers it appropriate to do so, refer the matter to the Data Protection Commission.

Chapter 6 Retention of PNR data and documentation

104. Period of data retention and depersonalisation

104. (1) PNR data transferred by an air carrier or by the PIU of another Member State to the PIU may be retained in the PNR database—

• (a) for an initial period of 6 months from the date of the transfer, and

• (b) after the expiration of the period referred to in paragraph (a), for a further period not exceeding 4 years and 6 months, where—

• (i) the PIU has determined, having processed the PNR data in accordance with this Part during that initial period of 6 months—

• (I) that there exists, in respect of the data, objective evidence of a risk related to a terrorist offence or serious crime, and

• (II) there is an objective link, whether of a direct or an indirect nature, between the offence or crime referred to in clause (I) and the carriage of passengers by air,

and

• (ii) the data are depersonalised in accordance with subsection (3).

• (2) Where the PIU does not make a determination referred to in subsection (1)(b)(i) during the period referred to in that provision in respect of PNR data, the PNR data concerned shall be deleted permanently.

• (3) PNR data shall be depersonalised through masking out the following data elements which could serve to identify directly a passenger to whom the PNR data relates:

• (a) passenger name or names, including the—

• (i) names of other passengers on the passenger name record, and

• (ii) number of passengers on the passenger name record travelling together;

• (b) address and contact information;

• (c) all forms of payment information, including billing address, to the extent that it contains any information which could serve to identify directly the passenger to whom the PNR data relate or any other persons;

• (d) frequent flyer information;

• (e) any general remarks relating to the PNR data to the extent that they contain any information which could serve to identify directly the passenger to whom the PNR data relate;

• (f) any API data that have been collected.

• (4) Where an assessment is carried out under section 96(1) and the result of that assessment is the identification of a person who requires further examination by a competent authority or a competent authority in another Member State (in this section referred to as a “positive match”), that result shall only be retained by the PIU for as long as is necessary to—

• (a) transfer the PNR data relating to that person and, where applicable, the result of the processing of such data by the PIU, to the PIU of the Member State concerned under section 97(1), or

• (b) transfer the PNR data relating to that person and, where applicable, the result of the processing of such data by the PIU, to the competent authority concerned under section 97(2).

• (5) Where an assessment is carried out under section 96(1) by automated processing and results in a positive match, which, following an individual review by non-automated means in accordance with section 97(4), is proven not to be a positive match (in this section referred to as a “false positive match”), the result of the automated processing and the result of the review by non-automated means may be retained by the PIU, for the purpose of avoiding future false positive matches in respect of the person, for a period not exceeding 6 months from when the PNR data were received by the PIU.

• (6) PNR data retained in accordance with subsection (1) shall be deleted permanently upon the expiration of the period of 5 years from the date they were transferred to the PIU.

• (7) PNR data, or the result of the processing of such data, or both, that have been transferred to a competent authority by the PIU shall be deleted permanently by the competent authority—

• (a) upon the expiration of a period of 5 years from the date they were transferred to the competent authority, or

• (b) where the data were retained by the competent authority for the purpose of the prevention, detection, investigation and prosecution of a terrorist offence or serious crime and proceedings for such offence are brought against any person, on the day on which final judgment is given in the proceedings,

whichever occurs later.