S.L. 365.13 Art. 4CData filing system in relation to brokering activities.

(1) In relation to brokering activities, the Director shall keep a data filing system which shall record all information relating to firearms which is needed in order to trace and identify those firearms, including:

(a) the type, make, model, calibre and serial number of each firearm and the mark applied to its frame or receiver as a unique marking in accordance with sub-regulation (1), which shall serve as the unique identifier of each firearm;

(b) the serial number or unique marker applied to the essential components, where that differs from the marking on the frame or receiver of each firearm;

(c) the names and addresses of the suppliers and of the persons acquiring or possessing the firearm, together with the relevant date or dates; and

(d) any conversions or modifications to a firearm leading to a change in its category or subcategory, including its certified deactivation or destruction and the relevant date or dates.

(2) The Director shall ensure that the record of firearms and the essential components, including the related personal data, is retained in the data filing systems for a period of thirty (30) years after the destruction of the firearms or essential components in question.

The records of firearms and essential components referred to in sub-regulation (1) and the related personal data shall be made available and be capable of being accessed:

(a) by the Director or by the national authorities competent for customs proceedings for a period of ten (10) years after the destruction of the firearm or the essential components in question; and

(b) by the national authorities competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, for a period of thirty (30) years after the destruction of the firearm or the essential components in question.

(3) The Director shall ensure that the personal data is deleted from the data-filing systems upon expiry of the periods specified in sub-regulation (2). This is without prejudice to cases in which specific personal data have been transferred to a national authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties and are used in that specific context, or to other national authorities competent for a compatible purpose. In those cases, the processing of such data shall be regulated by the Data Protection Act.