Section 38 — Use and retention of information taken under section 37

(1) An authorised person who takes biometric information under section 37 must supply that information to the Secretary of State as soon as reasonably practicable.

(2) Biometric information taken under section 37 may be used by the Secretary of State in connection with—

(a) the exercise of a function relating to immigration or nationality, or

(b) the exercise of a function relating to law enforcement or the protection of national security.

(3) The Secretary of State may retain biometric information taken under section 37 only if the Secretary of State considers that it is necessary to retain the information for any use mentioned in subsection (2).

(4) The Secretary of State must take all reasonable steps to ensure that the information is destroyed on or before the earliest of the following to occur—

(a) the Secretary of State no longer considering that it is necessary to retain the information for any use mentioned in subsection (2), and

(b) the end of the period of 5 years beginning with the day on which the information was taken.

(5) But the requirement to destroy biometric information does not apply if and in so far as the information is retained under a power apart from subsection (3).

(6) Biometric information retained by the Secretary of State by virtue of subsection (3) may also be used by the Secretary of State for the purpose of identifying a person whose departure His Majesty’s Government is considering whether to facilitate, or is facilitating or has facilitated, as mentioned in section 37(2)(b).

(7) Where the Secretary of State’s use of biometric information under subsection (6) involves transferring that information to a third country or to an international organisation, the transfer is to be taken as being necessary for important reasons of public interest for the purposes of Article 49(1)(d) of the UK GDPR.

(8) In subsection (7)— “international organisation” and “third country” have the same meaning as in the UK GDPR (see Article 4 of the Regulation); “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).