How long is any information supplied through the UK Public Health Passenger Locator Form kept for, when some EU citizen travels from the EU to England by plane, as of now (or 12 July 2020: it doesn't matter because the information supplied through the form may vary, but the retention policy will probably stay)? The form says that

the information you provide will be used by the Home Office and Public Health England, as described in the privacy policy.

Now such privacy policy, under section "How long we keep your personal information for", is rather vague. I will analyze some relevant portions here below:

We will keep your personal information for as long as it is necessary for permitted purposes.

This doesn't convey anything.

In the borders, immigration and citizenship system, we maintain a long-term record of immigration history and immigration offending to support future decision-making and enforce penalties.

This suggests they can keep this data forever.

Personal data will be typically retained for 25 years after a decision to grant settlement or naturalisation and for 15 years after the last action in other cases.

This suggests they might keep this data for 15 years.

At the border, passenger name records data is retained for up to 10 years. Advance passenger information may be retained for 10 years.

This is unclear, because "advance passenger information" is generally used as a technical term, often abbreviated by API, which until the start of this year essentially meant "Passport No / ID No".

However, it should be noted that the Jay Inquiry, which commenced in February 2015, has placed a moratorium on the disposal of all records throughout the Home Office, including all operational records and case files. This is currently in force and will remain so until further notice. It does not apply where there is a statutory requirement to delete data.

This again implies they can keep the data forever.

I haven't tried calling the "Form and self-isolation helpline" yet, but I doubt they'll provide any further information. Furthermore, I'd prefer reading some published governmental policy paper rather than hearing by phone from some unknown employee.

Incidentally, the Republic of Ireland is extremely clear instead:

This form and any copies of it, and any updates that you send using the [email] email address, will be destroyed 28 days after your arrival, unless the form is required for law enforcement purposes.

  • PNR is a technical term too. – Michael Hampton Jul 5 '20 at 15:20
  • 1
    You're right to criticize the form's "explanations" as inconsistent and vague. The Republic of Ireland's statement, however, is likewise vague to the point of uselessness. "Law enforcement purposes" might be anything at all related to criminal law, travel, immigration and so on...all of which are regulated by laws. And the statement allows information which might support "law enforcement purposes" to be disclosed to other countries which which the Republic shares information. All in all, the Republic's statement sounds good, but means nothing. – DavidSupportsMonica Jul 5 '20 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.