Cap. 584 Art. 14Protection of personal data.

(1) In respect of all processing of personal data pursuant to this Act, every passenger shall have the same right to protection of his personal data, rights of access, rectification, erasure and restriction and rights to compensation and judicial redress as laid down in the Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations.

(2) The NPIU and national competent authorities shall ensure confidentiality of processing and data security in accordance with the Data Protection (Processing of Personal Data by Competent

Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations, which shall apply to all processing of personal data pursuant to this Act.

(3) This Act is without prejudice to the applicability of the

Data Protection Act and the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 regarding the protection of natural persons with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC, to the processing of personal data by air carriers (hereinafter referred to as the "General Data Protection Regulation").

(4) The NPIU and the national competent authorities shall not process PNR data which reveals a person's race or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, health, sexual life or sexual orientation. In the event that PNR data revealing such information is received by the NPIU and the national competent authorities, it shall be deleted immediately.

(5) The NPIU shall maintain documentation relating to all processing systems and procedures under their responsibility. This documentation shall contain at least:

(a) the name and contact details of the organisation and personnel in the NPIU entrusted with the processing of the PNR data and the different levels of access authorisation;

(b) the requests made by competent authorities and PIUs of other EU Member States;

(c) all requests for and transfers of PNR data to a third country.

The NPIU shall make all documentation available, upon request, to the national supervisory authority.

(6) The NPIU shall keep records of the processing operations, which shall consist of, at least, the collection, consultation, disclosure and erasure:

Provided that the records of consultation and disclosure shall show, in particular, the purpose, date and time of such operations and, as far as possible, the identity of the person who consulted or disclosed the PNR data and the identity of recipients of that data. The records shall be used solely for the purposes of verification, of self-monitoring, of ensuring data integrity and data security or of auditing. The NPIU shall make the records available, upon request, to the national supervisory authority.

(7) The records referred to in sub-article (6) shall be kept for a period of five years.

(8) The NPIU shall implement appropriate technical and organisational measures and procedures to ensure a high level of security appropriate to the risks represented by the processing and the nature of the PNR data.

(9) The Commissioner of Police shall ensure that where a personal data breach is likely to result in a high risk for the protection of the personal data or affect the privacy of the data subject adversely, the NPIU shall communicate that breach to the data subject and to the national supervisory authority without undue delay.