On September 17, Organic Law 1/2020, of September 16, was published in the BOE on the use of data from the Passenger Name Record for the prevention, detection, investigation and prosecution of terrorist offences and serious crimes.
This regulation is transposed from Directive (EU) 2016/681 of the European Parliament and of the Council and was promulgated with the aim of raising the security levels of Union citizens. Accordingly, it incorporates new tools to combat the threat of terrorism and organized crime. This regulation also creates its own legal framework for personal data protection.
In this sense, this regulation creates the PNR (Passenger Name Record). PNR data is the set of data related to a passenger's trip, such as the date of booking and ticket issuance, the planned dates of the trip, name and surname, address and contact information, payment information, seat information, etc.
Organic Law 1/2020 expressly provides that personal data that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union or political party, health, life or sexual orientation may not be processed.
The airlines must collect and transfer the PNR data corresponding to people traveling on international flights, both inside and outside the European Union, on their departure from or arrival to Spanish territory, or who make a stopover there. This regulation extends to commercial flights and private flights, although with some exceptions for the latter.
The transmission of PNR data must take place at two different times: The first, between the forty-eight and twenty-four hours prior to the scheduled departure of the flight. And the second, once the flight is closed, that is, at the moment from which no one can enter or leave the plane.
The agency receiving the PNR data will be the Spanish Passenger Information Unit (UIP), which will be in charge of processing. PNR data must be transferred by one of the valid methods established by Commission Implementation Decision (EU) 2017/759, of April 28, 2017, regarding common protocols and data formats that airline companies must use for the transmission of PNR data to the Passenger Information Units.
The Organic Law 1/2020 will enter into force two months after its publication in the BOE, that is, on November 17 of the current year. However, as established in the First Additional Provision of the aforementioned regulation, the airlines will inform the UIP of the data format and the transmission protocol that they will use, within a period of forty days from the date of publication of the regulation, that is, next October 27, 2020.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
