Protection of Passenger Information Regulations

8 (1) Subject to subsection (2), where PNR information is copied from the PAXIS system and the copy retained in an enforcement database in the circumstances described in subsection 7(3) or (5), as applicable,

• (a) the information may be retained in the enforcement database for not longer than the time that it continues to be required for the purpose for which it was copied, up to a maximum period of six years after the time it was first received; and

• (b) during that period, access to the information may be provided only to intelligence officials whose duties require such access for the purpose referred to in section 3.

(2) Where API information or PNR information is required, by the Access to Information Act or the Privacy Act, to be retained in an enforcement database for a period longer than the six-year period referred to in paragraph (1)(a), access to that information may be provided during that longer period only for the purpose for which it is retained under the Access to Information Act or the Privacy Act, as applicable.