"PNR data can only be kept for a period of 5 years, and must be depersonalised after a period of 6 months so the data subject is no longer immediately identifiable"Yes, that's always recommended.
Still not 100% sure what type of passenger name record (PNR) data the tax agencies have access to though, and for how long the data is stored due to GDPR.
EU directive on passenger name record (PNR) data
On 21 April 2016 the Council adopted a directive to harmonise the use of passenger name record (PNR) data in the EU. The directive establishes that PNR data can only be used for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.www.consilium.europa.eu