Cap. 584 Art. 13Period of data retention and depersonalisation.

(1) The NPIU shall ensure that the PNR data provided by the air carriers is retained in a database at the NPIU for a period of five years from the date of its transfer to the PIU of the EU Member State on whose territory the flight is landing or departing.

(2) Upon expiry of a period of six months from the date of the transfer of the PNR data referred to in sub-article (1), all PNR data shall be depersonalised through masking out the following data elements which could serve to identify directly the passenger to whom the PNR data relates:

(a) name(s), including the names of other passengers on the PNR and number of travellers on the PNR travelling together;

(b) address and contact information;

(c) all forms of payment information, including billing address, to the extent that it contains any information which could serve to identify directly the passenger to whom the PNR relate or any other persons;

(d) frequent flyer information;

(e) general remarks to the extent that they contain any information which could serve to identify directly the passenger to whom the PNR relate; and

(f) any API data that has been collected.

(3) Upon expiry of the period of six months referred to in sub-article (2), disclosure of the full PNR data shall be permitted only where it is:

(a) reasonably believed that it is necessary for the purposes referred to in article 7(2)(b); and

(b) approved by:

(i) a judicial authority; or

(ii) the national supervisory authority to verify whether the conditions for disclosure are met, following a request made by the Data Protection Officer of the NPIU who carries out an expost review of such disclosure.

(4) The NPIU shall ensure that the PNR data is deleted permanently upon expiry of the period referred to in sub-article (1):

Provided that this obligation shall be without prejudice to cases where specific PNR data has been transferred to a national competent authority or competent authority of other EU Member States and used in the context of specific cases for the purposes of preventing, detecting, investigating or prosecuting terrorist offences or serious crime, in which case data retention shall be regulated by the national law relevant to such competent authorities.

(5) The result of the processing referred to in article 7(2)(a) shall be kept by the NPIU only as long as necessary to inform the national competent authorities and, in accordance with article 10(1), to inform the corresponding NPIUs of other EU Member States of a positive match. Where the result of automated processing has, further to individual review by non-automated means as referred to in article 7(5), proven to be negative, it may be stored so as to avoid future "false" positive matches for as long as the underlying data is not deleted under sub-article (4).