Cap. 584 чл. 7Processing of PNR data.      S.L. 460.17.

(1) The PNR data transferred by the air carriers shall be collected by the NPIU as provided for in article 9. Where the PNR data transferred by air carriers includes data other than that listed in Schedule B, the NPIU shall delete such data immediately and permanently upon receipt.

(2) The NPIU shall process PNR data only for the following purposes:

(a) carrying out an assessment of passengers prior to their scheduled arrival in or departure from Malta to identify persons who require further examination by national competent authorities or competent authorities of other EU Member States, and where relevant, by Europol in accordance with article 11, in view of the fact that such persons may be involved in a terrorist offence or serious crime;

(b) responding, on a case-by-case basis, to a duly reasoned request based on sufficient grounds from competent authorities to provide and process PNR data in specific cases for the purposes of preventing, detecting, investigating and prosecuting terrorist offences or serious crime, and to provide competent authorities or, where appropriate, Europol with the results of such processing; and

(c) analysing PNR data for the purpose of updating or creating new criteria to be used in the assessments carried out under sub-article (3)(b) in order to identify any person who may be involved in a terrorist offence or serious crime.

(3) When carrying out the assessment referred to in sub-article (2)(a), the NPIU may:

(a) compare PNR data against databases relevant for the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime, including databases on persons or objects sought or under alert, in accordance with Union, international and national rules applicable to such databases; or

(b) process PNR data against pre-determined criteria.

(4) Any assessment of passengers prior to their scheduled arrival or departure in Malta performed under sub-article (3)(b) against pre-determined criteria shall be carried out in a non-discriminatory manner. Those pre-determined criteria must be targeted, proportionate and specific:

Provided that pre-determined criteria shall be set and regularly reviewed by the NPIU in cooperation with the national competent authorities. The criteria shall in no circumstances be based on a person's race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation.

(5) The NPIU shall ensure that any positive match resulting from the automated processing of PNR data conducted under sub-article (2)(a) is individually reviewed by non-automated means to verify whether any of the national competent authorities needs to take action under national law.

(6) The NPIU shall transmit the PNR data of persons identified in accordance with sub-article (2)(a) or the result of processing that data for further examination to the national competent authorities or to the competent authorities of other EU Member States. Such transfers shall only be made on a case-by-case basis and, in the event of automated processing of PNR data, after individual review by non-automated means.

(7) It shall be ensured that the Data Protection Officer has access to all data processed by the NPIU:

Provided that if the Data Protection Officer considers that processing of any data has not been lawful, the Data Protection Officer may refer the matter to the national supervisory authority.

(8) The storage, processing and analysis of PNR data by the NPIU shall be carried out exclusively within a secure location or locations.

(9) The consequences of the assessments of passengers referred to in sub-article (2)(a) shall not jeopardise the right of entry of persons enjoying the Union right of free movement into the territory of the EU Member State concerned as laid down in the Free Movement of

European Union Nationals and their Family Members Order. Where assessments are carried out in relation to intra-EU flights between EU Member States to which Regulation (EU) No. 2016/399 of the European Parliament and of the Council of 9 March 2016 on a Union Code on the rules governing the movement of persons across borders (Schengen Borders Code) applies, the consequences of such assessments shall comply with that Regulation.