Our legal powers to collect and manage information on travellers

This page summarises the legislation governing the collection and management of information by our e-Borders programme.

Overview of the legislation

Primary legislation was enacted in 2006 to provide the framework enabling powers for the e-Borders programme.

Paragraphs 27 and 27B of Schedule 2 to the Immigration Act 1971 as amended in 2006 and sections 32 to 38 of the Immigration, Asylum and Nationality Act 2006 create powers for the UK Border Agency and the police to obtain passenger, crew and service data from carriers in advance of all movements into and out of the UK, and a duty for the border agencies to share that data among themselves.

This was followed by five statutory instruments in 2007 and 2008, which:

  • commenced those powers;
  • extended the powers to cover Channel Tunnel trains;
  • specified the data that can be requested by the UK Border Agency and the police;
  • specified the data that must be shared between the border agencies; and
  • brought the code of practice regarding data sharing into force.

The statutory instruments are:

  • the Immigration, Asylum and Nationality Act 2006 (Commencement No 7) Order 2007 (statutory instrument 2007 No 3138 as amended by statutory instrument 2007 No 3580);
  • the Channel Tunnel (International Arrangements and Miscellaneous Provisions) (Amendment) Order 2007 (statutory instrument 2007 No 3579);
  • the Immigration and Police (Passenger, Crew and Service Information) Order 2008 (statutory instrument 2008 No 5);
  • the Immigration, Asylum and Nationality Act 2006 (Duty to Share Information and Disclosure of Information for Security Purposes) Order 2008 (statutory instrument 2008 No 539); and
  • the Immigration, Asylum and Nationality Act 2006 (Data Sharing Code of Practice) Order 2008 (statutory instrument 2008 No 8).

back to top

Powers to acquire data

Statutory instrument 2008 No 5, The Immigration and Police (Passenger, Crew and Service Information) Order 2008 specifies the travel-related data that an immigration officer or a police officer can require from ships, aircraft and trains entering and leaving the UK. It is made under paragraphs 27 and 27B of Schedule 2 to the Immigration Act 1971 and section 32 of the Immigration, Asylum and Nationality Act 2006, as extended by statutory instrument 2007 No 3579 to Channel Tunnel trains.

The data are divided into two groups:

  • mandatory data, which must be collected and supplied when requested at particular times; and
  • additional data, which must be supplied only to the extent which the carrier knows the data.

Data are known to a carrier if they are held by the carrier and either:

  • the carrier routinely holds data of that nature on its carrier reservation system, departure control system or equivalent system; or
  • the carrier requests and obtains the data in the ordinary course of its business even though they are not held, or are not held routinely, on such a system. In other words, if the carrier does not already collect these data, it will not be required to begin collecting them for the purpose of e-Borders. And, if the data are not on the reservation, departure control or equivalent system, they need only be provided if the request expressly states that it is requesting information not held on that system.

The order envisages that mandatory data can be requested on more than one occasion and in particular before and after all passengers are on board in preparation for departure. There is no limit on the number of requests that we can make. Compliance with requests under this order is a legal requirement and there are sanctions for non-compliance contained within section 27 of the Immigration Act 1971 and section 34 of the Immigration, Asylum and Nationality Act 2006.

Mandatory data

The mandatory data requested in the legislation falls into three groups:

  • for passengers, the travel document information (TDI) which are the data held in the machine-readable zone of the passport or identity document. This is known in the airline industry as advance passenger information (API) data;
  • for crew members, their TDI; and
  • service information (for example, number, name of carrier, departure and arrival points).

However, these data are only mandatory when they are requested to be provided at the time when passengers are on board in preparation for departure and it is no longer possible for further passengers or crew to join the service. When they are requested before that time, they need only be provided to the extent to which they are known to the carrier. (See articles 3(4), 5(2) and 6(2) of statutory instrument 2008 No 5.)

Additional data

The additional data are other passenger information (OPI), which airlines call 'passenger name record' (PNR) data. These are details collected for a carrier's own commercial purposes. They include details such as passenger name, address, telephone numbers, ticketing information and travel itinerary. In practice, these will be data generally held on the carrier's reservation, departure control or equivalent system. These data will only be required to the extent to which they are known to the carrier. (See articles 5(4) and 6(4) of statutory instrument 2008 No 5.)

This information need only be provided to the extent to which it is known to the carrier, regardless of when it is requested.

back to top

Duty to share data and our power to do this

Statutory instrument 2008 No 539, The Immigration, Asylum and Nationality Act 2006 (Duty to Share Information and Disclosure of Information for Security Purposes) Order 2008 specifies travel-related information which the border agencies must share with each other where it is likely to be of use for immigration, HM Revenue & Customs, or police purposes.

The order also specifies that the border agencies may also disclose this information to the security and intelligence agencies, if the information is likely to be of use for certain security purposes.

Statutory instrument 2008 No 539 is made under sections 36 and 38 of the Immigration, Asylum and Nationality Act 2006. In this context, the border agencies are:

  • the Secretary of State (the Home Secretary), to the extent that the Home Secretary has functions under the immigration acts;
  • HM Revenue & Customs; and
  • a chief officer of police.

This order underpins the required data sharing by the agencies under e-Borders and other joint working arrangements that pursue their shared aim of securing the border.

back to top

The code of practice

Statutory instrument 2008 No 8, The Immigration, Asylum and Nationality Act 2006 (Data Sharing Code of Practice) Order 2008 brought into force on 1 March 2008 the Code of practice on the management of information shared by the Border and Immigration Agency, HM Revenue & Customs and the police.

This code of practice imposes certain obligations on the border agencies when handling and sharing data under section 36 of the Immigration, Asylum and Nationality Act 2006. It sets out which data may be shared, the ways in which and purposes for which it may be shared, and the safeguards that must be applied.

In particular, it highlights that the data must be handled and shared in compliance with the European Convention on Human Rights and the Data Protection Act 1998. It also sets out the sanctions which may be imposed on staff for the misuse of data. The code of practice will be subject to regular review by the border agencies in conjunction with the Information Commissioner's Office.

back to top

The Channel Tunnel

Statutory instrument 2007 No 3579, the Channel Tunnel (International Arrangements and Miscellaneous Provisions) (Amendment) Order 2007 modifies a number of the provisions of primary legislation referred to above. This enables the secondary legislation made under those provisions to apply to trains entering and leaving the UK through the Channel Tunnel, as well as to ships and aircraft.

back to top