Citation and commencement

1. This Order may be cited as the Data Protection (Functions of Designated Authority) Order 2000 and shall come into force on 1st March 2000.

Interpretation

2. —(1) In this Order:

“the Act” means the Data Protection Act 1998;

“foreign designated authority” means an authority designated for the purposes of Article 13 of the Convention by a party (other than the United Kingdom) which is bound by that Convention;

“register” means the register maintained under section 19(1) of the Act;

“request”, except in article 3, means a request for assistance under Article 14 of the Convention which states—

and “requesting person” means a person making such a request.

(2) In this Order, references to the Commissioner are to the Commissioner as the designated authority in the United Kingdom for the purposes of Article 13 of the Convention.

Co-operation between the Commissioner and foreign designated authorities

3. —(1) The Commissioner shall, at the request of a foreign designated authority, furnish to that foreign designated authority such information referred to in Article 13(3)(a) of the Convention, and in particular the data protection legislation in force in the United Kingdom at the time the request is made, as is the subject of the request.

(2) The Commissioner shall, at the request of a foreign designated authority, take appropriate measures in accordance with Article 13(3)(b) of the Convention, for furnishing to that foreign designated authority information relating to the processing of personal data in the United Kingdom.

(3) The Commissioner may request a foreign designated authority to furnish to him or, as the case may be, to take appropriate measures for furnishing to him, the information referred to in Article 13(3) of the Convention.

Persons resident outside the United Kingdom

4. —(1) This article applies where a person resident outside the United Kingdom makes a request to the Commissioner under Article 14 of the Convention, including a request forwarded to the Commissioner through the Secretary of State or a foreign designated authority, seeking assistance in exercising any of the rights under Article 8 of the Convention.

(2) If the request—

(a) seeks assistance in exercising the rights under section 7 of the Act; and

(b) does not indicate that the data controller has failed, contrary to section 7 of the Act, to comply with the same request on a previous occasion,

the Commissioner shall notify the requesting person of the data controller’s address for the receipt of notices from data subjects exercising their rights under that section and of such other information as the Commissioner considers necessary to enable that person to exercise his rights under that section.

(3) If the request indicates that a data protection principle has been contravened by a data controller the Commissioner shall either—

(a) notify the requesting person of the rights of data subjects and the remedies available to them under Part II of the Act together with such particulars as are contained in the data controller’s entry in the register as are necessary to enable the requesting person to avail himself of those remedies; or

(b) if the Commissioner considers that notification in accordance with sub-paragraph (a) would not assist the requesting person or would, for any other reason, be inappropriate, treat the request as if it were a request for an assessment which falls to be dealt with under section 42 of the Act.

(4) The Commissioner shall not be required, in response to any request referred to in paragraphs (2) and (3) above, to supply to the requesting person a duly certified copy in writing of the particulars contained in any entry made in the register other than on payment of such fee as is prescribed for the purposes of section 19(7) of the Act.

Persons resident in the United Kingdom

5. —(1) Where a request for assistance in exercising any of the rights referred to in Article 8 of the Convention in a country or territory (other than the United Kingdom) specified in the request is made by a person resident in the United Kingdom and submitted through the Commissioner under Article 14(2) of the Convention, the Commissioner shall, if he is satisfied that the request contains all necessary particulars referred to in Article 14(3) of the Convention, send it to the foreign designated authority in the specified country or territory.

(2) If the Commissioner decides that he is not required by paragraph (1) above to render assistance to the requesting person he shall, where practicable, notify that person of the reasons for his decision.

Restrictions on use of information

6. Where the Commissioner receives information from a foreign designated authority as a result of either—

(a) a request made by him under article 3(3) above; or

(b) a request received by him under articles 3(2) or 4 above,

the Commissioner shall use that information only for the purposes specified in the request.