PART 1 Preliminary

1 Overview _I1

(1)This Act makes provision about the processing of personal data.

(2)Most processing of personal data is subject to the [^F1UK GDPR^F1] .

(3)Part 2 supplements the [^F2UK GDPR^F2] .

(4)^F3Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes ....

(5)Part 4 makes provision about the processing of personal data by the intelligence services.

(6)Part 5 makes provision about the Information Commissioner.

(7)Part 6 makes provision about the enforcement of the data protection legislation.

(8)Part 7 makes supplementary provision, including provision about the application of this Act to the Crown and to Parliament.

2 Protection of personal data _I2

(1)The [^F4UK GDPR^F4] and this Act protect individuals with regard to the processing of personal data, in particular by—

(a)requiring personal data to be processed lawfully and fairly, on the basis of the data subject's consent or another specified basis,

(b)conferring rights on the data subject to obtain information about the processing of personal data and to require inaccurate personal data to be rectified, and

(c)conferring functions on the Commissioner, giving the holder of that office responsibility for monitoring and enforcing their provisions.

^F5(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3 Terms relating to the processing of personal data _I3

(1)This section defines some terms used in this Act.

(2) “ Personal data ” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) “ Identifiable living individual ” means a living individual who can be identified, directly or indirectly, in particular by reference to—

(a)an identifier such as a name, an identification number, location data or an online identifier, or

(b)one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

(4) “ Processing ”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as—

(a)collection, recording, organisation, structuring or storage,

(b)adaptation or alteration,

(c)retrieval, consultation or use,

(d)disclosure by transmission, dissemination or otherwise making available,

(e)alignment or combination, or

(f)restriction, erasure or destruction,

(subject to subsection (14)(c) and sections 5(7), 29(2) and 82(3), which make provision about references to processing in the different Parts of this Act).

(5) “ Data subject ” means the identified or identifiable living individual to whom personal data relates.

(6) ^F6,F6 “Controller” and “ processor ”, in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies, have the same meaning as in that ... Part (see sections 5, 6, 32 and 83 and see also subsection (14)(d)).

(7) “ Filing system ” means any structured set of personal data which is accessible according to specific criteria, whether held by automated means or manually and whether centralised, decentralised or dispersed on a functional or geographical basis.

(8) “ The Commissioner ” means the Information Commissioner (see section 114).

[^F7 (8A) “ The Commission ” means the Information Commission (see section 114A). ^F7]

(9) “ The data protection legislation ” means—

[^F8 (a)the UK GDPR,^F8]

^F9(b). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c)this Act, [^F10and^F10]

(d)^F12regulations made under this Act [^F11or the UK GDPR^F11] , ...

^F12(e). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(10) “ [^F13 The UK GDPR ^F13] ” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data [^F14 (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)) ^F14] .

[^F15 (10A) “ The EU GDPR ” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law. ^F15]

^F16(11). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(12) “ The Law Enforcement Directive ” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

(13) “ The Data Protection Convention ” means the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data which was opened for signature on 28 January 1981, as amended up to the day on which this Act is passed.

(14)In Parts 5 to 7, except where otherwise provided—

[^F17 (a)references to the UK GDPR are to the UK GDPR read with Part 2;^F17]

^F18(b). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c)^F19references to personal data, and the processing of personal data, are to personal data and processing to which ... Part 2, Part 3 or Part 4 applies;

(d)^F20references to a controller or processor are to a controller or processor in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies.

(15)There is an index of defined expressions in section 206.

PART 2 General processing

CHAPTER 1 Scope and definitions

4 Processing to which this Part applies _I4

(1)This Part is relevant to most processing of personal data.

(2)[^F21 This Part^F21] —

(a)applies to the types of processing of personal data to which the [^F22UK GDPR^F22] applies by virtue of Article 2 of the [^F22UK GDPR^F22] , and

(b)supplements, and must be read with, the [^F22UK GDPR^F22] .

^F23(3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5 Definitions _{cross-notes I5}

(1)^F24Terms used in ... this Part and in the [^F25UK GDPR^F25] have the same meaning in [^F26this Part as^F26] they have in the [^F25UK GDPR^F25] .

(2)In subsection (1), the reference to a term's meaning in the [^F27UK GDPR^F27] is to its meaning in the [^F27UK GDPR^F27] read with any provision of [^F28this Part^F28] which modifies the term's meaning for the purposes of the [^F27UK GDPR^F27] .

(3)Subsection (1) is subject to any provision in [^F29this Part^F29] which provides expressly for the term to have a different meaning and to section 204.

^F30(4). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

^F30(5). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

^F30(6). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7)^F31A reference in ... this Part to the processing of personal data is to processing to which [^F32this Part^F32] applies.

(8)Sections 3 and 205 include definitions of other expressions used in this Part.

CHAPTER 2 [^F33 The UK GDPR^F33]

Meaning of certain terms used in the [^F34UK GDPR^F34]

6 Meaning of “controller” _I6

(1) The definition of “controller” in Article 4(7) of the [^F35 UK GDPR ^F35] has effect subject to—

(a)subsection (2),

(b)section 209, and

(c)section 210.

(2)For the purposes of the [^F36UK GDPR^F36] , where personal data is processed only—

(a)for purposes for which it is required by an enactment to be processed, and

(b)by means by which it is required by an enactment to be processed,

the person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

7 Meaning of “public authority” and “public body” _I7,I8

(1) ^F38 For the purposes of the [^F37 UK GDPR ^F37] , the following (and only the following) are “public authorities” and “public bodies” ...—

(a)a public authority as defined by the Freedom of Information Act 2000,

(b)a Scottish public authority as defined by the Freedom of Information (Scotland) Act 2002 (asp 13),

[^F39 (ba)the Advanced Research and Invention Agency,^F39] and

(c)an authority or body specified or described by the Secretary of State in regulations,

subject to subsections (2), (3) and (4).

(2) An authority or body that falls within subsection (1) is only a “public authority” or “ public body ” for the purposes of the [^F40 UK GDPR ^F40] when performing a task carried out in the public interest or in the exercise of official authority vested in it.

(3)The references in subsection (1)(a) and (b) to public authorities and Scottish public authorities as defined by the Freedom of Information Act 2000 and the Freedom of Information (Scotland) Act 2002 (asp 13) do not include any of the following that fall within those definitions—

(a)a parish council in England;

(b)a community council in Wales;

(c)a community council in Scotland;

(d)a parish meeting constituted under section 13 of the Local Government Act 1972;

(e)a community meeting constituted under section 27 of that Act;

(f)charter trustees constituted—

(i)under section 246 of that Act,

(ii)under Part 1 of the Local Government and Public Involvement in Health Act 2007, or

(iii)by the Charter Trustees Regulations 1996 (S.I. 1996/263).

(4) The Secretary of State may by regulations provide that a person specified or described in the regulations that is a public authority[^F41 described or mentioned in subsection (1)(a), (b) or (ba) ^F41] is not a “public authority” or “ public body ” for the purposes of the [^F42 UK GDPR ^F42] .

(5)Regulations under this section are subject to the affirmative resolution procedure.

Lawfulness of processing

8 Lawfulness of processing: public interest etc _I9

In Article 6(1) of the [^F43UK GDPR^F43] (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller's official authority includes processing of personal data that is necessary for—

(a)the administration of justice,

(b)the exercise of a function of either House of Parliament,

(c)the exercise of a function conferred on a person by an enactment or rule of law,

(d)the exercise of a function of the Crown, a Minister of the Crown or a government department, or

(e)an activity that supports or promotes democratic engagement.

^F449 Child's consent in relation to information society services

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[^F45Relevant international law

9A Processing in reliance on relevant international law

(1)Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant international law only if it meets a condition in Schedule A1.

(2)A condition in Schedule A1 may be relied on for the purposes of any of those provisions, unless that Schedule provides otherwise.

(3)The Secretary of State may by regulations amend Schedule A1 by adding, varying or omitting—

(a)conditions,

(b)provision about the purposes for which a condition may be relied on, and

(c)safeguards in connection with processing carried out in reliance on a condition in the Schedule.

(4)Regulations under this section may only add a condition relating entirely or partly to a treaty ratified by the United Kingdom.

(5)Regulations under this section are subject to the affirmative resolution procedure.

(6) In this section, “ treaty ” and “ ratified ” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act ). ^F45]

Special categories of personal data

10 Special categories of personal data and criminal convictions etc data _I10,I11

(1)Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the [^F46UK GDPR^F46] (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—

(a)point (b) (employment, social security and social protection);

(b)point (g) (substantial public interest);

(c)point (h) (health and social care);

(d)point (i) (public health);

(e)point (j) (archiving, research and statistics).

(2)The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the [^F47UK GDPR^F47] for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.

(3)The processing meets the requirement in point (g) of Article 9(2) of the [^F48UK GDPR^F48] for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.

(4)Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.

(5)The processing meets the requirement in Article [^F4910(1) of the UK GDPR^F49] for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.

(6)The Secretary of State may by regulations—

(a)amend Schedule 1—

(i)by adding or varying conditions or safeguards, and

(ii)by omitting conditions or safeguards added by regulations under this section, and

(b)consequentially amend this section.

(7)Regulations under this section are subject to the affirmative resolution procedure.

11 Special categories of personal data etc: supplementary _I12

(1)For the purposes of Article 9(2)(h) of the [^F50UK GDPR^F50] (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the [^F50UK GDPR^F50] (obligation of secrecy) include circumstances in which it is carried out—

(a)by or under the responsibility of a health professional or a social work professional, or

(b)by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.

(2)In Article 10 of the [^F51UK GDPR^F51] and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to—

(a)the alleged commission of offences by the data subject, or

(b)proceedings for an offence committed or alleged to have been committed by the data subject or the disposal of such proceedings, including sentencing.

Rights of the data subject

12 Limits on fees that may be charged by controllers _I13,I14

(1)The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on—

(a)Article 12(5) of the [^F52UK GDPR^F52] (reasonable fees when responding to manifestly unfounded or excessive requests), or

(b)Article 15(3) of the [^F53UK GDPR^F53] (reasonable fees for provision of further copies).

(2)The Secretary of State may by regulations—

(a)require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in reliance on those provisions, and

(b)specify what the guidance must include.

(3)Regulations under this section are subject to the negative resolution procedure.

13 Obligations of credit reference agencies _{cross-notes I15}

(1)This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974).

(2)The controller's obligations under Article 15(1) to (3) of the [^F54UK GDPR^F54] (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject's financial standing, unless the data subject has indicated a contrary intention.

(3)Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the [^F55UK GDPR^F55] , the disclosure must be accompanied by a statement informing the data subject of the data subject's rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information).

14 Automated decision-making authorised by law: safeguards _I16,I17

(1)This section makes provision for the purposes of Article 22(2)(b) of the [^F56UK GDPR^F56] (exception from Article 22(1) of the [^F56UK GDPR^F56] for significant decisions based solely on automated processing that are [^F57required or authorised under the law of the United Kingdom or a part of the United Kingdom^F57] and subject to safeguards for the data subject's rights, freedoms and legitimate interests).

(2) A decision is a “ significant decision ” for the purposes of this section if, in relation to a data subject, it—

(a)produces legal effects concerning the data subject, or

(b)similarly significantly affects the data subject.

(3) A decision is a “ qualifying significant decision ” for the purposes of this section if—

(a)it is a significant decision in relation to a data subject,

(b)it is required or authorised by law, and

(c)it does not fall within Article 22(2)(a) or (c) of the [^F58UK GDPR^F58] (decisions necessary to a contract or made with the data subject's consent).

(4)Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—

(a)the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and

(b)the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to—

(i)reconsider the decision, or

(ii)take a new decision that is not based solely on automated processing.

(5)If a request is made to a controller under subsection (4), the controller must, within the period described in Article 12(3) of the [^F59UK GDPR^F59] —

(a)consider the request, including any information provided by the data subject that is relevant to it,

(b)comply with the request, and

(c)by notice in writing inform the data subject of—

(i)the steps taken to comply with the request, and

(ii)the outcome of complying with the request.

(6)In connection with this section, a controller has the powers and obligations under Article 12 of the [^F60UK GDPR^F60] (transparency, procedure for extending time for acting on request, fees, manifestly unfounded or excessive requests etc) that apply in connection with Article 22 of the [^F60UK GDPR^F60] .

(7)The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject's rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.

(8)Regulations under subsection (7)—

(a)may amend this section, and

(b)are subject to the affirmative resolution procedure.

[^F61Exemptions etc^F61]

15 Exemptions etc _I18

(1)Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the [^F62UK GDPR^F62] .

(2)In Schedule 2—

(a)Part 1 makes provision adapting or restricting the application of rules contained in Articles 13 to 21 and 34 of the [^F63UK GDPR^F63] in specified circumstances [^F64(of a kind described in^F64] Article 6(3) and Article 23(1) of the [^F65UK GDPR)^F65] ;

(b)Part 2 makes provision restricting the application of rules contained in Articles 13 to 21 and 34 of the [^F66UK GDPR^F66] in specified circumstances [^F67(of a kind described in^F67] Article 23(1) of the [^F68UK GDPR)^F68] ;

(c)Part 3 makes provision restricting the application of Article 15 of the [^F69UK GDPR^F69] where this is necessary to protect the rights of others [^F70(of a kind described in^F70] Article 23(1) of the [^F71UK GDPR)^F71] ;

(d)Part 4 makes provision restricting the application of rules contained in Articles 13 to 15 of the [^F72UK GDPR^F72] in specified circumstances [^F73(of a kind described in^F73] Article 23(1) of the [^F74UK GDPR)^F74] ;

(e)Part 5 makes provision containing exemptions or derogations from Chapters II, III, IV [^F75and V of the UK GDPR^F75] for reasons relating to freedom of expression [^F76(of a kind described in Article 85(2) of the UK GDPR)^F76] ;

(f)^F78Part 6 makes provision containing derogations from rights contained in Articles 15, 16, 18, 19, 20 and 21 of the [^F77UK GDPR^F77] for scientific or historical research purposes, statistical purposes and archiving purposes ....

(3)Schedule 3 makes provision restricting the application of rules contained in Articles 13 to 21 of the [^F79UK GDPR^F79] to health, social work, education and child abuse data [^F80(of a kind described in^F80] Article 23(1) of the [^F81UK GDPR)^F81] .

(4)Schedule 4 makes provision restricting the application of rules contained in Articles 13 to 21 of the [^F82UK GDPR^F82] to information the disclosure of which is prohibited or restricted by an enactment[^F83 (of a kind described in^F83] Article 23(1) of the [^F84UK GDPR)^F84] .

[^F85 (4A)In connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25).^F85]

(5)In connection with the safeguarding of national security and with defence, see Chapter 3 of this Part [^F86(sections 26 to 28)^F86] .

16 Power to make further exemptions etc by regulations _I19,I20

(1)The following powers to make provision altering the application of the [^F87UK GDPR^F87] may be exercised by way of regulations made by the Secretary of State under this section—

(a)^F88the power in Article 6(3) ... to lay down a legal basis containing specific provisions to adapt the application of rules of the [^F89UK GDPR^F89] where processing is necessary for compliance with a legal obligation, for the performance of a task in the public interest or in the exercise of official authority;

(b)the power in Article 23(1) to make [^F90provision^F90] restricting the scope of the obligations and rights mentioned in that Article where necessary and proportionate to safeguard certain objectives of general public interest;

(c)the power in Article 85(2) to provide for exemptions or derogations from certain Chapters of the [^F91UK GDPR^F91] where necessary to reconcile the protection of personal data with the freedom of expression and information.

(2)Regulations under this section may—

(a)amend Schedules 2 to 4—

(i)by adding or varying provisions, and

(ii)^F92by omitting provisions added by regulations under this section, ...

(b)consequentially amend section 15 [^F93, and

(c)consequentially amend the UK GDPR by adding, varying or omitting a reference to section 15, Schedule 2, 3 or 4, this section or regulations under this section.^F93]

(3)Regulations under this section are subject to the affirmative resolution procedure.

[^F94Certification^F94]

17 Accreditation of certification providers _I21

(1)Accreditation of a person as a certification provider is only valid when carried out by—

(a)the Commissioner, or

(b)the [^F95UK national accreditation body^F95] .

(2)The Commissioner may only accredit a person as a certification provider where the Commissioner—

(a)has published a statement that the Commissioner will carry out such accreditation, and

(b)has not published a notice withdrawing that statement.

(3)The [^F96UK national accreditation body^F96] may only accredit a person as a certification provider where the Commissioner—

(a)has published a statement that the body may carry out such accreditation, and

(b)has not published a notice withdrawing that statement.

(4)The publication of a notice under subsection (2)(b) or (3)(b) does not affect the validity of any accreditation carried out before its publication.

(5)Schedule 5 makes provision about reviews of, and appeals from, a decision relating to accreditation of a person as a certification provider.

(6)The [^F97UK national accreditation body^F97] may charge a reasonable fee in connection with, or incidental to, the carrying out of the body's functions under this section, Schedule 5 and Article 43 of the [^F98UK GDPR^F98] .

(7)The [^F99UK national accreditation body^F99] must provide the Secretary of State with such information relating to its functions under this section, Schedule 5 and Article 43 of the [^F100UK GDPR^F100] as the Secretary of State may reasonably require.

(8)In this section—

• “ certification provider ” means a person who issues certification for the purposes of Article 42 of the [^F101 UK GDPR ^F101] ;

• “ the [^F102 UK national accreditation body ^F102] ” means the [^F102 UK national accreditation body ^F102] for the purposes of Article 4(1) of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 .

Transfers of personal data to third countries etc

[^F10317A Transfers based on adequacy regulations

(1)The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data—

(a)a third country,

(b)a territory or one or more sectors within a third country,

(c)an international organisation, or

(d)a description of such a country, territory, sector or organisation.

(2)For the purposes of the UK GDPR and this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes—

(a)in the case of a third country, the country or a relevant territory or sector within the country, or

(b)in the case of an international organisation, the organisation.

(3)Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2).

(4)Article 45(2) of the UK GDPR makes provision about the assessment of the adequacy of the level of protection for the purposes of this section and section 17B.

(5)Regulations under this section—

(a)where they relate to a third country, must specify their territorial and sectoral application;

(b)where applicable, must specify the independent supervisory authority or authorities referred to in Article 45(2)(b) of the UK GDPR.

(6)Regulations under this section may, among other things—

(a)provide that in relation to a country, territory, sector, organisation or transfer specified, or falling within a description specified, in the regulations, section 17B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations;

(b)identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;

(c)confer a discretion on a person.

(7)Regulations under this section are subject to the negative resolution procedure.^F103]

[^F10317B Transfers based on adequacy regulations: review etc

(1)For so long as regulations under section 17A are in force which specify, or specify a description which includes, a third country, a territory or sector within a third country or an international organisation, the Secretary of State must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years.

(2)Each review under subsection (1) must take into account all relevant developments in the third country or international organisation.

(3)The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under section 17A or to amend or revoke such regulations.

(4)Where the Secretary of State becomes aware that a country, territory, sector or organisation specified, or falling within a description specified, in regulations under section 17A no longer ensures an adequate level of protection of personal data, whether as a result of a review under this section or otherwise, the Secretary of State must, to the extent necessary, amend or revoke the regulations.

(5)Where regulations under section 17A are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to remedying the lack of an adequate level of protection.

(6)The Secretary of State must publish—

(a)a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which are for the time being specified in regulations under section 17A, and

(b)a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which have been but are no longer specified in such regulations.

(7)In the case of regulations under section 17A which specify that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations—

(a)the duty under subsection (1) is only to carry out a review of the level of protection ensured for such a transfer, and

(b)the lists published under subsection (6) must specify or describe the relevant transfers.^F103]

[^F10317C Standard data protection clauses

(1)The Secretary of State may by regulations specify standard data protection clauses which the Secretary of State considers provide appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Article 46 of the UK GDPR (and see also section 119A).

(2)The Secretary of State must keep under review the standard data protection clauses specified in regulations under this section that are for the time being in force.

(3)Regulations under this section are subject to the negative resolution procedure.^F103]

18 Transfers of personal data to third countries etc [^F104: public interest^F104] _I22,I23

(1)The Secretary of State may by regulations specify, for the purposes of Article 49(1)(d) of the [^F105UK GDPR^F105] —

(a)circumstances in which a transfer of personal data to a third country or international organisation is to be taken to be necessary for important reasons of public interest, and

(b)circumstances in which a transfer of personal data to a third country or international organisation which is not required by an enactment is not to be taken to be necessary for important reasons of public interest.

(2)The Secretary of State may by regulations restrict the transfer of a category of personal data to a third country or international organisation where—

[^F106 (a)the transfer cannot take place based on adequacy regulations (see section 17A),^F106] and

(b)the Secretary of State considers the restriction to be necessary for important reasons of public interest.

(3)Regulations under this section—

(a)are subject to the made affirmative resolution procedure where the Secretary of State has made an urgency statement in respect of them;

(b)are otherwise subject to the affirmative resolution procedure.

(4)For the purposes of this section, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.

Specific processing situations

19 Processing for archiving, research and statistical purposes: safeguards _I24,I25

(1)This section makes provision about—

(a)processing of personal data that is necessary for archiving purposes in the public interest,

(b)processing of personal data that is necessary for scientific or historical research purposes, and

(c)processing of personal data that is necessary for statistical purposes.

(2)Such processing does not satisfy the requirement in Article 89(1) of the [^F107UK GDPR^F107] for the processing to be subject to appropriate safeguards for the rights and freedoms of the data subject if it is likely to cause substantial damage or substantial distress to a data subject.

(3)Such processing does not satisfy that requirement if the processing is carried out for the purposes of measures or decisions with respect to a particular data subject, unless the purposes for which the processing is necessary include the purposes of approved medical research.

(4)In this section—

• “ approved medical research ” means medical research carried out by a person who has approval to carry out that research from—

  (a)

  a research ethics committee recognised or established by the Health Research Authority under Chapter 2 of Part 3 of the Care Act 2014, or

  (b)

  a body appointed by any of the following for the purpose of assessing the ethics of research involving individuals—

  (i)

  the Secretary of State, the Scottish Ministers, the Welsh Ministers, or a Northern Ireland department;

  (ii)

  a relevant NHS body;

  (iii)

  United Kingdom Research and Innovation or a body that is a Research Council for the purposes of the Science and Technology Act 1965;

  (iv)

  an institution that is a research institution for the purposes of Chapter 4A of Part 7 of the Income Tax (Earnings and Pensions) Act 2003 (see section 457 of that Act);

• “ relevant NHS body ” means—

  (a)

  an NHS trust or NHS foundation trust in England,

  (b)

  an NHS trust or Local Health Board in Wales,

  (c)

  a Health Board or Special Health Board constituted under section 2 of the National Health Service (Scotland) Act 1978,

  (d)

  the Common Services Agency for the Scottish Health Service, or

  (e)

  any of the health and social care bodies in Northern Ireland falling within paragraphs (a) to (e) of section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)).

(5) The Secretary of State may by regulations change the meaning of “ approved medical research ” for the purposes of this section, including by amending subsection (4).

(6)Regulations under subsection (5) are subject to the affirmative resolution procedure.

Minor definition

^F10820 Meaning of “court”

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

CHAPTER 3 [^F109Exemptions for manual unstructured processing and for national security and defence purposes^F109] _cross-notes

[^F110Definitions^F110]

21 [^F111Definitions^F111] _I26

^F112(1). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

^F112(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

^F112(3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

^F112(4). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) In this Chapter, “ FOI public authority ” means—

(a)^F113a public authority as defined in the Freedom of Information Act 2000, ...

(b)a Scottish public authority as defined in the Freedom of Information (Scotland) Act 2002 (asp 13) [^F114, or

(c)the Advanced Research and Invention Agency^F114] .

(6) References in this Chapter to personal data “held” by an FOI public authority are to be interpreted—

(a)in relation to England and Wales and Northern Ireland, in accordance with section 3(2) of the Freedom of Information Act 2000, and

(b)in relation to Scotland, in accordance with section 3(2), (4) and (5) of the Freedom of Information (Scotland) Act 2002 (asp 13),

but such references do not include information held by an intelligence service (as defined in section 82) on behalf of an FOI public authority.

(7) But personal data is not to be treated as “held” by an FOI public authority for the purposes of this Chapter, where—

(a)section 7 of the Freedom of Information Act 2000 prevents Parts 1 to 5 of that Act from applying to the personal data, or

(b)section 7(1) of the Freedom of Information (Scotland) Act 2002 (asp 13) prevents that Act from applying to the personal data.

[^F115 (8)In relation to the Advanced Research and Invention Agency—

(a)for the purposes of subsection (6)(a)—

(i) section 3(2) of the Freedom of Information Act 2000 is to be read as if “public authority” included that Agency, and

(ii) section 3(2) of the Freedom of Information (Scotland) Act 2002 (asp 13) is to be read as if “authority” included that Agency, and

(b)subsection (7) does not apply.^F115]

^F116...

^F11622 Application of the GDPR to processing to which this Chapter applies

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

^F11723 Power to make provision in consequence of regulations related to the GDPR

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Exemptions etc

24 Manual unstructured data held by FOI public authorities _I27,I28

(1)The provisions of [^F118the UK GDPR^F118] and this Act listed in subsection (2) do not apply to personal data to which [^F119the UK GDPR^F119] applies by virtue of [^F120Article 2(1A)^F120] (manual unstructured personal data held by FOI public authorities).

(2)Those provisions are—

(a)in Chapter II of [^F121the UK GDPR^F121] (principles)—

(i)Article 5(1)(a) to (c), (e) and (f) (principles relating to processing, other than the accuracy principle),

(ii)Article 6 (lawfulness),

(iii)Article 7 (conditions for consent),

(iv)Article 8(1) and (2) (child's consent),

(v)Article 9 (processing of special categories of personal data),

(vi)Article 10 (data relating to criminal convictions etc), and

(vii)Article 11(2) (processing not requiring identification);

(b)in Chapter III of [^F122the UK GDPR^F122] (rights of the data subject)—

(i)Article 13(1) to (3) (personal data collected from data subject: information to be provided),

(ii)Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),

(iii)Article 20 (right to data portability), and

(iv)Article 21(1) (objections to processing);

(c)in Chapter V of [^F123the UK GDPR^F123] , Articles 44 to 49 (transfers of personal data to third countries or international organisations);

[^F124 (ca)in Part 2 of this Act, sections 17A, 17B and 17C (transfers to third countries);

(cb)in Part 5 of this Act, section 119A (standard clauses for transfers to third countries);^F124]

[^F125 (d)in Part 7 of this Act, sections 170 and 171 (offences relating to personal data).^F125]

(see also paragraph 1(2) of Schedule 18).

(3)In addition, the provisions of [^F126the UK GDPR^F126] listed in subsection (4) do not apply to personal data to which [^F127the UK GDPR^F127] applies by virtue of [^F128Article 2(1A)^F128] where the personal data relates to appointments, removals, pay, discipline, superannuation or other personnel matters in relation to—

(a)service in any of the armed forces of the Crown;

(b)service in any office or employment under the Crown or under any public authority;

(c)service in any office or employment, or under any contract for services, in respect of which power to take action, or to determine or approve the action taken, in such matters is vested in—

(i)Her Majesty,

(ii)a Minister of the Crown,

(iii)the National Assembly for Wales,

(iv)the Welsh Ministers,

(v)a Northern Ireland Minister (within the meaning of the Freedom of Information Act 2000), or

(vi)an FOI public authority.

(4)Those provisions are—

(a)the remaining provisions of Chapters II and III (principles and rights of the data subject);

(b)Chapter IV (controller and processor);

(c)Chapter IX (specific processing situations).

(5)A controller is not obliged to comply with Article 15(1) to (3) of [^F129the UK GDPR^F129] (right of access by the data subject) in relation to personal data to which [^F130the UK GDPR^F130] applies by virtue of [^F131Article 2(1A)^F131] if—

(a)the request under [^F132Article 15^F132] does not contain a description of the personal data, or

(b)the controller estimates that the cost of complying with the request so far as relating to the personal data would exceed the appropriate maximum.

(6)Subsection (5)(b) does not remove the controller's obligation to confirm whether or not personal data concerning the data subject is being processed unless the estimated cost of complying with that obligation alone in relation to the personal data would exceed the appropriate maximum.

(7)An estimate for the purposes of this section must be made in accordance with regulations under section 12(5) of the Freedom of Information Act 2000.

(8) In subsections (5) and (6), “ the appropriate maximum ” means the maximum amount specified by the Secretary of State by regulations.

(9)Regulations under subsection (8) are subject to the negative resolution procedure.

25 Manual unstructured data used in longstanding historical research _I29

(1)The provisions of [^F133the UK GDPR^F133] listed in subsection (2) do not apply to personal data to which [^F134the UK GDPR^F134] applies by virtue of [^F135Article 2(1A)^F135] (manual unstructured personal data held by FOI public authorities) at any time when—

(a)the personal data—

(i)is subject to processing which was already underway immediately before 24 October 1998, and

(ii)is processed only for the purposes of historical research, and

(b)the processing is not carried out—

(i)for the purposes of measures or decisions with respect to a particular data subject, or

(ii)in a way that causes, or is likely to cause, substantial damage or substantial distress to a data subject.

(2)Those provisions are—

(a)^F136in Chapter II ...(principles), Article 5(1)(d) (the accuracy principle), and

(b)^F137in Chapter III ... (rights of the data subject)—

(i)Article 16 (right to rectification), and

(ii)Article 17(1) and (2) (right to erasure).

(3)The exemptions in this section apply in addition to the exemptions in section 24.

26 National security and defence exemption _I30

(1)A provision of [^F138the UK GDPR^F138] or this Act mentioned in subsection (2) does not apply to personal data to which [^F139the UK GDPR^F139] applies if exemption from the provision is required for—

(a)the purpose of safeguarding national security, or

(b)defence purposes.

(2)The provisions are—

(a)Chapter II of [^F140the UK GDPR^F140] (principles) except for—

(i)Article 5(1)(a) (lawful, fair and transparent processing), so far as it requires processing of personal data to be lawful;

(ii)Article 6 (lawfulness of processing);

(iii)Article 9 (processing of special categories of personal data);

(b)Chapter III of [^F141the UK GDPR^F141] (rights of data subjects);

(c)in Chapter IV of [^F142the UK GDPR^F142] —

(i)Article 33 (notification of personal data breach to the Commissioner);

(ii)Article 34 (communication of personal data breach to the data subject);

(d)Chapter V of [^F143the UK GDPR^F143] (transfers of personal data to third countries or international organisations);

(e)in Chapter VI of [^F144the UK GDPR^F144] —

(i)Article 57(1)(a) and (h) (Commissioner's duties to monitor and enforce [^F144the UK GDPR^F144] and to conduct investigations);

(ii)Article 58 (investigative, corrective, authorisation and advisory powers of Commissioner);

(f)Chapter VIII of [^F145the UK GDPR^F145] (remedies, liabilities and penalties) except for—

[^F146 (ai)Article 77 (right to lodge a complaint with the Commissioner);^F146]

(i)Article 83 (general conditions for imposing administrative fines);

(ii)Article 84 (penalties);

[^F147 (fa)in Part 2 of this Act, sections 17A, 17B and 17C (transfers to third countries);^F147]

(g)in Part 5 of this Act—

(i)in section 115 (general functions of the Commissioner), subsections (3) and (8);

(ii)in section 115, subsection (9), so far as it relates to Article 58(2)(i) of [^F148the UK GDPR^F148] ;

(iii)section 119 (inspection in accordance with international obligations);

[^F149 (iv)section 119A (standard clauses for transfers to third countries);^F149]

(h)in Part 6 of this Act—

(i)sections 142 to 154 and Schedule 15 (Commissioner's notices and powers of entry and inspection);

(ii)sections 170 to 173 (offences relating to personal data);

(i)in Part 7 of this Act, section 187 (representation of data subjects).

27 National security: certificate _I31

(1)Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 26(2) is, or at any time was, required in relation to any personal data for the purpose of safeguarding national security is conclusive evidence of that fact.

(2)A certificate under subsection (1)—

(a)may identify the personal data to which it applies by means of a general description, and

(b)may be expressed to have prospective effect.

(3)Any person directly affected by a certificate under subsection (1) may appeal to the Tribunal against the certificate.

(4)If, on an appeal under subsection (3), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing a certificate, the Tribunal may—

(a)allow the appeal, and

(b)quash the certificate.

(5)Where, in any proceedings under or by virtue of [^F150the UK GDPR^F150] or this Act, it is claimed by a controller that a certificate under subsection (1) which identifies the personal data to which it applies by means of a general description applies to any personal data, another party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.

(6)But, subject to any determination under subsection (7), the certificate is to be conclusively presumed so to apply.

(7)On an appeal under subsection (5), the Tribunal may determine that the certificate does not so apply.

(8)A document purporting to be a certificate under subsection (1) is to be—

(a)received in evidence, and

(b)deemed to be such a certificate unless the contrary is proved.

(9)A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—

(a)in any legal proceedings, evidence of that certificate;

(b)in any legal proceedings in Scotland, sufficient evidence of that certificate.

(10)The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—

(a)a Minister who is a member of the Cabinet, or

(b)the Attorney General or the Advocate General for Scotland.

28 National security and defence: modifications to Articles 9 and 32 of the [^F151UK GDPR^F151] _I32

(1)Article 9(1) of [^F152the UK GDPR^F152] (prohibition on processing of special categories of personal data) does not prohibit the processing of personal data to which [^F153the UK GDPR^F153] applies to the extent that the processing is carried out—

(a)for the purpose of safeguarding national security or for defence purposes, and

(b)with appropriate safeguards for the rights and freedoms of data subjects.

(2)Article 32 of [^F154the UK GDPR^F154] (security of processing) does not apply to a controller or processor to the extent that the controller or the processor (as the case may be) is processing personal data to which [^F155the UK GDPR^F155] applies for—

(a)the purpose of safeguarding national security, or

(b)defence purposes.

(3)Where Article 32 of [^F156the UK GDPR^F156] does not apply, the controller or the processor must implement security measures appropriate to the risks arising from the processing of the personal data.

(4)For the purposes of subsection (3), where the processing of personal data is carried out wholly or partly by automated means, the controller or the processor must, following an evaluation of the risks, implement measures designed to—

(a)prevent unauthorised processing or unauthorised interference with the systems used in connection with the processing,

(b)ensure that it is possible to establish the precise details of any processing that takes place,

(c)ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and

(d)ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.

[^F157 (5)The functions conferred on the Commissioner in relation to the UK GDPR by Articles 57(1)(a), (d), (e), (h) and (u) and 58(1)(d) and (2)(a) to (d) of the UK GDPR (which are subject to safeguards set out in section 115) include functions in relation to subsection (3).^F157]

PART 3 Law enforcement processing

CHAPTER 1 Scope and definitions

Scope

29 Processing to which this Part applies _I33

(1)This Part applies to—

(a)the processing by a competent authority of personal data wholly or partly by automated means, and

(b)the processing by a competent authority otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.

(2)Any reference in this Part to the processing of personal data is to processing to which this Part applies.

(3) For the meaning of “competent authority”, see section 30.

Definitions

30 Meaning of “competent authority” _I34,I35

(1) In this Part, “ competent authority ” means—

(a)a person specified or described in Schedule 7, and

(b)any other person if and to the extent that the person has statutory functions for any of the law enforcement purposes.

(2)But an intelligence service is not a competent authority within the meaning of this Part.

(3)The Secretary of State may by regulations amend Schedule 7—

(a)so as to add or remove a person or description of person;

(b)so as to reflect any change in the name of a person specified in the Schedule.

(4)Regulations under subsection (3) which make provision of the kind described in subsection (3)(a) may also make consequential amendments of section 73(4)(b).

(5)Regulations under subsection (3) which make provision of the kind described in subsection (3)(a), or which make provision of that kind and of the kind described in subsection (3)(b), are subject to the affirmative resolution procedure.

(6)Regulations under subsection (3) which make provision only of the kind described in subsection (3)(b) are subject to the negative resolution procedure.

(7)In this section—

• “ intelligence service ” means—

  (a)

  the Security Service;

  (b)

  the Secret Intelligence Service;

  (c)

  the Government Communications Headquarters;

• “ statutory function ” means a function under or by virtue of an enactment.

31 “The law enforcement purposes” _I36

For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

32 Meaning of “controller” and “processor” _I37

(1) In this Part, “ controller ” means the competent authority which, alone or jointly with others—

(a)determines the purposes and means of the processing of personal data, or

(b)is the controller by virtue of subsection (2).

(2)Where personal data is processed only—

(a)for purposes for which it is required by an enactment to be processed, and

(b)by means by which it is required by an enactment to be processed,

the competent authority on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

(3) In this Part, “ processor ” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).

33 Other definitions _I38

(1)This section defines certain other expressions used in this Part.

(2) “ Employee ”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.

(3) “ Personal data breach ” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

(4) “ Profiling ” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

(5) “ Recipient ”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a public authority to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.

(6) “ Restriction of processing ” means the marking of stored personal data with the aim of limiting its processing for the future.

[^F158 (6A) “ Sensitive processing ” has the meaning given in section 35(8). ^F158]

(7) “ Third country ” means a country or territory [^F159 outside the United Kingdom ^F159] .

(8)Sections 3 and 205 include definitions of other expressions used in this Part.

CHAPTER 2 Principles

34 Overview and general duty of controller _I39

(1)This Chapter sets out the six data protection principles as follows—

(a)section 35(1) sets out the first data protection principle (requirement that processing be lawful and fair);

(b)section 36(1) sets out the second data protection principle (requirement that purposes of processing be specified, explicit and legitimate);

(c)section 37 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive);

(d)section 38(1) sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date);

(e)section 39(1) sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary);

(f)section 40 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner).

(2)In addition—

(a)each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates, and

(b)sections 41 and 42 make provision about the safeguards that apply in relation to certain types of processing.

(3)The controller in relation to personal data is responsible for, and must be able to demonstrate, compliance with this Chapter.

35 The first data protection principle _I40,I41

(1)The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.

(2)The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—

(a)the data subject has given consent to the processing for that purpose, or

(b)the processing is necessary for the performance of a task carried out for that purpose by a competent authority.

(3)In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in subsections (4) and (5).

(4)The first case is where—

(a)the data subject has given consent to the processing for the law enforcement purpose as mentioned in subsection (2)(a), and

(b)at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

(5)The second case is where—

(a)the processing is strictly necessary for the law enforcement purpose,

(b)the processing meets at least one of the conditions in Schedule 8, and

(c)at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

(6)The Secretary of State may by regulations amend Schedule 8—

(a)by adding conditions;

(b)by [^F160varying or^F160] omitting conditions added by regulations under paragraph (a).

(7)Regulations under subsection (6) are subject to the affirmative resolution procedure.

(8) In this [^F161 Part ^F161] , “ sensitive processing ” means—

(a)the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;

(b)the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual;

(c)the processing of data concerning health;

(d)the processing of data concerning an individual's sex life or sexual orientation.

36 The second data protection principle _I42

(1)The second data protection principle is that—

(a)the law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and

(b)personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected.

(2)Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

(3)Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that—

(a)the controller is authorised by law to process the data for the other purpose, and

(b)the processing is necessary and proportionate to that other purpose.

(4)Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.

37 The third data protection principle _I43

The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in relation to the purpose for which it is processed.

38 The fourth data protection principle _I44

(1)The fourth data protection principle is that—

(a)personal data processed for any of the law enforcement purposes must be accurate and, where necessary, kept up to date, and

(b)every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the law enforcement purpose for which it is processed, is erased or rectified without delay.

(2)In processing personal data for any of the law enforcement purposes, personal data based on facts must, so far as possible, be distinguished from personal data based on personal assessments.

(3)In processing personal data for any of the law enforcement purposes, a clear distinction must, where relevant and as far as possible, be made between personal data relating to different categories of data subject, such as—

(a)persons suspected of having committed or being about to commit a criminal offence;

(b)persons convicted of a criminal offence;

(c)persons who are or may be victims of a criminal offence;

(d)witnesses or other persons with information about offences.

(4)All reasonable steps must be taken to ensure that personal data which is inaccurate, incomplete or no longer up to date is not transmitted or made available for any of the law enforcement purposes.

(5)For that purpose—

(a)the quality of personal data must be verified before it is transmitted or made available,

(b)in all transmissions of personal data, the necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of the data and the extent to which it is up to date must be included, and

(c)if, after personal data has been transmitted, it emerges that the data was incorrect or that the transmission was unlawful, the recipient must be notified without delay.

39 The fifth data protection principle _I45

(1)The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for the purpose for which it is processed.

(2)Appropriate time limits must be established for the periodic review of the need for the continued storage of personal data for any of the law enforcement purposes.

40 The sixth data protection principle _I46

The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, “ appropriate security ” includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).

41 Safeguards: archiving _I47

(1)This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is necessary—

(a)for archiving purposes in the public interest,

(b)for scientific or historical research purposes, or

(c)for statistical purposes.

(2)The processing is not permitted if—

(a)it is carried out for the purposes of, or in connection with, measures or decisions with respect to a particular data subject, or

(b)it is likely to cause substantial damage or substantial distress to a data subject.

42 Safeguards: sensitive processing _I48

(1)This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying out sensitive processing in reliance on the consent of the data subject or, as the case may be, in reliance on a condition specified in Schedule 8).

(2)The controller has an appropriate policy document in place in relation to the sensitive processing if the controller has produced a document which—

(a)explains the controller's procedures for securing compliance with the data protection principles (see section 34(1)) in connection with sensitive processing in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, and

(b)explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, giving an indication of how long such personal data is likely to be retained.

(3)Where personal data is processed on the basis that an appropriate policy document is in place, the controller must during the relevant period—

(a)retain the appropriate policy document,

(b)review and (if appropriate) update it from time to time, and

(c)make it available to the Commissioner, on request, without charge.

(4)The record maintained by the controller under section 61(1) and, where the sensitive processing is carried out by a processor on behalf of the controller, the record maintained by the processor under section 61(3) must include the following information—

(a)whether the sensitive processing is carried out in reliance on the consent of the data subject or, if not, which condition in Schedule 8 is relied on,

(b)how the processing satisfies section 35 (lawfulness of processing), and

(c)whether the personal data is retained and erased in accordance with the policies described in subsection (2)(b) and, if it is not, the reasons for not following those policies.

(5) In this section, “ relevant period ”, in relation to sensitive processing in reliance on the consent of the data subject or in reliance on a condition specified in Schedule 8, means a period which—

(a)begins when the controller starts to carry out the sensitive processing in reliance on the data subject's consent or (as the case may be) in reliance on that condition, and

(b)ends at the end of the period of 6 months beginning when the controller ceases to carry out the processing.

[^F16242A Further provision about sensitive processing

(1)The Secretary of State may by regulations—

(a)make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,

(b)make provision so that added processing is not sensitive processing for the purposes of this Part,

(c)make provision so that a protected condition in Schedule 8 may or may not be relied on in connection with added processing, and

(d)make provision varying such a condition as it relates to added processing.

(2)In subsection (1)—

• “ added processing ” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);

• “ protected condition in Schedule 8 ” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).

(3)Regulations under this section may amend this Part and sections 205 and 206.

(4)Regulations under this section are subject to the affirmative resolution procedure.^F162]

CHAPTER 3 Rights of the data subject

Overview and scope

43 Overview and scope _I49

(1)This Chapter—

(a)imposes general duties on the controller to make information available (see [^F163sections 44 and 45A^F163] );

(b)confers a right of access by the data subject (see [^F164sections 45 and 45A^F164] );

(c)confers rights on the data subject with respect to the rectification of personal data and the erasure of personal data or the restriction of its processing (see sections 46 to 48);

(d)regulates automated decision-making (see sections 49 and 50);

(e)makes supplementary provision (see sections 51 to 54).

(2)This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.

(3)But sections 44 to 48 do not apply in relation to the processing of relevant personal data in the course of a criminal investigation or criminal proceedings, including proceedings for the purpose of executing a criminal penalty.

(4) In subsection (3), “ relevant personal data ” means personal data contained in a judicial decision or in other documents relating to the investigation or proceedings which are created by or on behalf of a court or other judicial authority.

(5) In this Chapter, “ the controller ”, in relation to a data subject, means the controller in relation to personal data relating to the data subject.

[^F165Data subject’s rights to information^F165]

44 ^F166... Controller's general duties _I50

(1)The controller must make available to data subjects the following information (whether by making the information generally available to the public or in any other way)—

(a)the identity and the contact details of the controller;

(b)where applicable, the contact details of the data protection officer (see sections 69 to 71);

(c)the purposes for which the controller processes personal data;

(d)the existence of the rights of data subjects to request from the controller—

(i)access to personal data (see section 45),

(ii)rectification of personal data (see section 46), and

(iii)erasure of personal data or the restriction of its processing (see section 47);

(e)the existence of the right to lodge a complaint with the Commissioner and the contact details of the Commissioner.

(2)The controller must also, in specific cases for the purpose of enabling the exercise of a data subject's rights under this Part, give the data subject the following—

(a)information about the legal basis for the processing;

(b)information about the period for which the personal data will be stored or, where that is not possible, about the criteria used to determine that period;

(c)where applicable, information about the categories of recipients of the personal data (including recipients in third countries or international organisations);

(d)such further information as is necessary to enable the exercise of the data subject's rights under this Part.

(3)An example of where further information may be necessary as mentioned in subsection (2)(d) is where the personal data being processed was collected without the knowledge of the data subject.

(4)The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (2) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

(a)avoid obstructing an official or legal inquiry, investigation or procedure;

(b)avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c)protect public security;

^F167(d). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(e)protect the rights and freedoms of others.

(5)Where the provision of information to a data subject under subsection (2) is restricted [^F168under subsection (4)^F168] , wholly or partly, the controller must inform the data subject in writing without undue delay—

(a)that the provision of information has been restricted,

(b)of the reasons for the restriction,

(c)of the data subject's right to make a request to the Commissioner under section 51,

(d)of the data subject's right to lodge a complaint with the Commissioner, and

(e)of the data subject's right to apply to a court under section 167.

(6)Subsection (5)(a) and (b) do not apply to the extent that complying with them would undermine the purpose of the restriction.

(7)The controller must—

(a)record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (2) [^F169in reliance on subsection (4)^F169] , and

(b)if requested to do so by the Commissioner, make the record available to the Commissioner.

^F170...

45 Right of access by the data subject _I51

(1)A data subject is entitled to obtain from the controller—

(a)confirmation as to whether or not personal data concerning him or her is being processed, and

(b)where that is the case, access to the personal data and the information set out in subsection (2).

(2)That information is—

(a)the purposes of and legal basis for the processing;

(b)the categories of personal data concerned;

(c)the recipients or categories of recipients to whom the personal data has been disclosed (including recipients or categories of recipients in third countries or international organisations);

(d)the period for which it is envisaged that the personal data will be stored or, where that is not possible, the criteria used to determine that period;

(e)the existence of the data subject's rights to request from the controller—

(i)rectification of personal data (see section 46), and

(ii)erasure of personal data or the restriction of its processing (see section 47);

(f)the existence of the data subject's right to lodge a complaint with the Commissioner and the contact details of the Commissioner;

(g)communication of the personal data undergoing processing and of any available information as to its origin.

[^F171 (2A)Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.^F171]

(3)Where a data subject makes a request under subsection (1), the information to which the data subject is entitled must be provided in writing —

(a)without undue delay, and

(b)in any event, before the end of the applicable time period (as to which see section 54).

(4)The controller may restrict, wholly or partly, the rights conferred by subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

(a)avoid obstructing an official or legal inquiry, investigation or procedure;

(b)avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c)protect public security;

^F172(d). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(e)protect the rights and freedoms of others.

(5)Where the rights of a data subject under subsection (1) are restricted [^F173under subsection (4)^F173] , wholly or partly, the controller must inform the data subject in writing without undue delay—

(a)that the rights of the data subject have been restricted,

(b)of the reasons for the restriction,

(c)of the data subject's right to make a request to the Commissioner under section 51,

(d)of the data subject's right to lodge a complaint with the Commissioner, and

(e)of the data subject's right to apply to a court under section 167.

(6)Subsection (5)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.

(7)The controller must—

(a)record the reasons for a decision to restrict (whether wholly or partly) the rights of a data subject under subsection (1) [^F174in reliance on subsection (4)^F174] , and

(b)if requested to do so by the Commissioner, make the record available to the Commissioner.

[^F17545A Exemption from sections 44 and 45: legal professional privilege

(1)Sections 44(2) and 45(1) do not require the controller to give the data subject—

(a)information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or

(b)information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

(2)A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—

(a)the decision to rely on the exemption,

(b)the reason for the decision,

(c)the data subject’s right to make a request to the Commissioner under section 51,

(d)the data subject’s right to lodge a complaint with the Commissioner under section 165, and

(e)the data subject’s right to apply to a court under section 167.

(3)Subsection (2)(a) and (b) do not apply to the extent that complying with them would—

(a)undermine a claim described in subsection (1)(a), or

(b)conflict with a duty described in subsection (1)(b).

(4)The controller must—

(a)record the reason for a decision to rely on the exemption in subsection (1), and

(b)if requested to do so by the Commissioner, make the record available to the Commissioner.

(5)The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).^F175]

Data subject's rights to rectification or erasure etc

46 Right to rectification _I52

(1)The controller must, if so requested by a data subject, rectify without undue delay inaccurate personal data relating to the data subject.

(2)Where personal data is inaccurate because it is incomplete, the controller must, if so requested by a data subject, complete it.

(3)The duty under subsection (2) may, in appropriate cases, be fulfilled by the provision of a supplementary statement.

(4)Where the controller would be required to rectify personal data under this section but the personal data must be maintained for the purposes of evidence, the controller must (instead of rectifying the personal data) restrict its processing.

47 Right to erasure or restriction of processing _I53

(1)The controller must erase personal data without undue delay where—

(a)the processing of the personal data would infringe section 35, 36(1) to (3), 37, 38(1), 39(1), 40, 41 or 42, or

(b)the controller has a legal obligation to erase the data.

(2)Where the controller would be required to erase personal data under subsection (1) but the personal data must be maintained for the purposes of evidence, the controller must (instead of erasing the personal data) restrict its processing.

(3)Where a data subject contests the accuracy of personal data (whether in making a request under this section or section 46 or in any other way), but it is not possible to ascertain whether it is accurate or not, the controller must restrict its processing.

(4)A data subject may request the controller to erase personal data or to restrict its processing (but the duties of the controller under this section apply whether or not such a request is made).

48 Rights under section 46 or 47: supplementary _I54

(1)Where a data subject requests the rectification or erasure of personal data or the restriction of its processing, the controller must inform the data subject in writing—

(a)whether the request has been granted, and

(b)if it has been refused—

(i)of the reasons for the refusal,

(ii)of the data subject's right to make a request to the Commissioner under section 51,

(iii)of the data subject's right to lodge a complaint with the Commissioner, and

(iv)of the data subject's right to apply to a court under section 167.

(2)The controller must comply with the duty under subsection (1)—

(a)without undue delay, and

(b)in any event, before the end of the applicable time period (see section 54).

(3)The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1)(b)(i) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

(a)avoid obstructing an official or legal inquiry, investigation or procedure;

(b)avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c)protect public security;

^F176(d). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(e)protect the rights and freedoms of others.

(4)Where the rights of a data subject under subsection [^F177(1)(b)(i)^F177] are restricted [^F178under subsection (3)^F178] , wholly or partly, the controller must inform the data subject in writing without undue delay—

(a)that the rights of the data subject have been restricted,

(b)of the reasons for the restriction,

(c)of the data subject's right to lodge a complaint with the Commissioner, and

(d)of the data subject's right to apply to a court under section 167.

(5)Subsection (4)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.

(6)The controller must—

(a)record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (1)(b)(i) [^F179in reliance on subsection (3)^F179] , and

(b)if requested to do so by the Commissioner, make the record available to the Commissioner.

(7)Where the controller rectifies personal data, it must notify the competent authority (if any) from which the inaccurate personal data originated.

^F180(8). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(9)Where the controller rectifies, erases or restricts the processing of personal data which has been disclosed by the controller—

(a)the controller must notify the recipients, and

(b)the recipients must similarly rectify, erase or restrict the processing of the personal data (so far as they retain responsibility for it).

(10)Where processing is restricted in accordance with section 47(3), the controller must inform the data subject before lifting the restriction.

Automated individual decision-making

[^F18149 Right not to be subject to automated decision-making _I55

(1)A controller may not take a significant decision based solely on automated processing unless that decision is required or authorised by law.

(2) A decision is a “significant decision” for the purpose of this section if, in relation to a data subject, it—

(a)produces an adverse legal effect concerning the data subject, or

(b)significantly affects the data subject.^F181]

[^F18150 Automated decision-making authorised by law: safeguards _I56,I57

(1) A decision is a “ qualifying significant decision ” for the purposes of this section if—

(a)it is a significant decision in relation to a data subject, and

(b)it is required or authorised by law.

(2)Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—

(a)the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and

(b)the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to—

(i)reconsider the decision, or

(ii)take a new decision that is not based solely on automated processing.

(3)If a request is made to a controller under subsection (2), the controller must, before the end of the period of 1 month beginning with receipt of the request—

(a)consider the request, including any information provided by the data subject that is relevant to it,

(b)comply with the request, and

(c)by notice in writing inform the data subject of—

(i)the steps taken to comply with the request, and

(ii)the outcome of complying with the request.

(4)The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject's rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.

(5)Regulations under subsection (4)—

(a)may amend this section, and

(b)are subject to the affirmative resolution procedure.

(6) In this section “ significant decision ” has the meaning given by section 49(2). ^F181]

[^F18150A Automated processing and significant decisions

(1)For the purposes of sections 50B and 50C—

(a)a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and

(b)a decision is a significant decision, in relation to a data subject, if—

(i)it produces an adverse legal effect for the data subject, or

(ii)it has a similarly significant adverse effect for the data subject.

(2)When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.

50B Restrictions on automated decision-making based on sensitive processing

(1)A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met.

(2)The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.

(3)The second condition is that the decision is required or authorised by law.

50C Safeguards for automated decision-making

(1)Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—

(a)based entirely or partly on personal data, and

(b)based solely on automated processing,

the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).

(2)The safeguards must consist of or include measures which—

(a)provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;

(b)enable the data subject to make representations about such decisions;

(c)enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;

(d)enable the data subject to contest such decisions.

(3)Subsections (1) and (2) do not apply in relation to a significant decision if—

(a)exemption from those provisions is required for a reason listed in subsection (4),

(b)the controller reconsiders the decision as soon as reasonably practicable, and

(c)there is meaningful human involvement in the reconsideration of the decision.

(4)Those reasons are—

(a)to avoid obstructing an official or legal inquiry, investigation or procedure;

(b)to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c)to protect public security;

(d)to safeguard national security;

(e)to protect the rights and freedoms of others.

(5)When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.

50D Further provision about automated decision-making

(1)The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations.

(2)The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject.

(3)Regulations under subsection (1) or (2) may amend section 50A.

(4)The Secretary of State may by regulations make the following types of provision about the safeguards required under section 50C(1)—

(a)provision requiring the safeguards to include measures in addition to those described in section 50C(2),

(b)provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and

(c)provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2).

(5)Regulations under this section are subject to the affirmative resolution procedure.^F181]

Supplementary

51 Exercise of rights through the Commissioner _I58

(1)This section applies where a controller—

(a)restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the controller to give the data subject additional information),

(b)restricts under section 45(4) the data subject's rights under section 45(1) (right of access),

[^F182 (ba)relies on the exemption from sections 44(2) and 45(1) in section 45A (legal professional privilege),^F182] or

(c)refuses a request by the data subject for rectification under section 46 or for erasure or restriction of processing under section 47.

(2)The data subject may—

(a)where subsection (1)(a) or (b) applies, request the Commissioner to check that the restriction imposed by the controller was lawful;

[^F183 (aa)where subsection (1)(ba) applies, request the Commissioner to check that the controller was entitled to rely on the exemption;^F183]

(b)where subsection (1)(c) applies, request the Commissioner to check that the refusal of the data subject's request was lawful.

(3)The Commissioner must take such steps as appear to the Commissioner to be appropriate to respond to a request under subsection (2) (which may include the exercise of any of the powers conferred by sections 142 and 146).

(4)After taking those steps, the Commissioner must inform the data subject—

(a)where subsection (1)(a) or (b) applies, whether the Commissioner is satisfied that the restriction imposed by the controller was lawful;

[^F184 (aa)where subsection (1)(ba) applies, whether the Commissioner is satisfied that the controller was entitled to rely on the exemption;^F184]

(b)where subsection (1)(c) applies, whether the Commissioner is satisfied that the controller's refusal of the data subject's request was lawful.

(5)The Commissioner must also inform the data subject of the data subject's right to apply to a court under section 167.

(6)Where the Commissioner is not satisfied as mentioned in subsection (4)(a) [^F185, (aa)^F185] or (b), the Commissioner may also inform the data subject of any further steps that the Commissioner is considering taking under Part 6 .

52 Form of provision of information etc _I59

(1)The controller must take reasonable steps to ensure that any information that is required by this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language.

(2)Subject to subsection (3), the information may be provided in any form, including electronic form.

(3)Where information is provided in response to a request by the data subject under section 45, 46, 47 or 50, the controller must provide the information in the same form as the request where it is practicable to do so.

(4)Where the controller has reasonable doubts about the identity of an individual making a request under section 45, 46 or 47, the controller may—

(a)request the provision of additional information to enable the controller to confirm the identity, and

(b)delay dealing with the request until the identity is confirmed.

(5)Subject to section 53, any information that is required by this Chapter to be provided to the data subject must be provided free of charge.

(6)The controller must facilitate the exercise of the rights of the data subject under sections 45 to 50.

53 Manifestly unfounded or excessive requests by the data subject _I60,I61

(1)Where a request from a data subject under section 45, 46, 47 or 50 is manifestly unfounded or excessive, the controller may—

(a)charge a reasonable fee for dealing with the request, or

(b)refuse to act on the request.

(2)An example of a request that may be excessive is one that merely repeats the substance of previous requests.

(3)In any proceedings where there is an issue as to whether a request under section 45, 46, 47 or 50 is manifestly unfounded or excessive, it is for the controller to show that it is.

(4)The Secretary of State may by regulations specify limits on the fees that a controller may charge in accordance with subsection (1)(a).

[^F186 (4A)The Secretary of State may by regulations—

(a)require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in accordance with subsection (1)(a), and

(b)specify what the guidance must include.^F186]

(5)Regulations under subsection (4) are subject to the negative resolution procedure.

54 Meaning of “applicable time period” _I62,I63

(1) This section defines “ the applicable time period ” for the purposes of sections 45(3)(b) and 48(2)(b).

(2) “ The applicable time period ” means the period of 1 month, or such longer period as may be specified in regulations, beginning with the relevant time.

(3) “ The relevant time ” means the latest of the following—

(a)when the controller receives the request in question;

(b)when the controller receives the information (if any) requested in connection with a request under section 52(4);

(c)when the fee (if any) charged in connection with the request under section 53 is paid.

(4)The power to make regulations under subsection (2) is exercisable by the Secretary of State.

(5)Regulations under subsection (2) may not specify a period which is longer than 3 months.

(6)Regulations under subsection (2) are subject to the negative resolution procedure.

CHAPTER 4 Controller and processor

Overview and scope

55 Overview and scope _I64

(1)This Chapter—

(a)sets out the general obligations of controllers and processors (see sections 56 to 65);

(b)sets out specific obligations of controllers and processors with respect to security (see section 66);

(c)sets out specific obligations of controllers and processors with respect to personal data breaches (see sections 67 and 68);

(d)makes provision for the designation, position and tasks of data protection officers (see sections 69 to 71);

[^F187 (e)makes provision about codes of conduct (see section 71A).^F187]

(2)This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.

(3)Where a controller is required by any provision of this Chapter to implement appropriate technical and organisational measures, the controller must (in deciding what measures are appropriate) take into account—

(a)the latest developments in technology,

(b)the cost of implementation,

(c)the nature, scope, context and purposes of processing, and

(d)the risks for the rights and freedoms of individuals arising from the processing.

General obligations

56 General obligations of the controller _I65

(1)Each controller must implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that the processing of personal data complies with the requirements of this Part.

(2)Where proportionate in relation to the processing, the measures implemented to comply with the duty under subsection (1) must include appropriate data protection policies.

(3)The technical and organisational measures implemented under subsection (1) must be reviewed and updated where necessary.

[^F188 (4)Adherence to a code of conduct approved under section 71A may be used by a controller as a means of demonstrating compliance with the requirements of this Part.^F188]

57 Data protection by design and default _I66

(1)Each controller must implement appropriate technical and organisational measures which are designed—

(a)to implement the data protection principles in an effective manner, and

(b)to integrate into the processing itself the safeguards necessary for that purpose.

(2)The duty under subsection (1) applies both at the time of the determination of the means of processing the data and at the time of the processing itself.

(3)Each controller must implement appropriate technical and organisational measures for ensuring that, by default, only personal data which is necessary for each specific purpose of the processing is processed.

(4)The duty under subsection (3) applies to—

(a)the amount of personal data collected,

(b)the extent of its processing,

(c)the period of its storage, and

(d)its accessibility.

(5)In particular, the measures implemented to comply with the duty under subsection (3) must ensure that, by default, personal data is not made accessible to an indefinite number of people without an individual's intervention.

58 Joint controllers _I67

(1)Where two or more competent authorities jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.

(2)Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.

(3)The arrangement must designate the controller which is to be the contact point for data subjects.

59 Processors _I68

(1)This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.

(2)The controller may use only a processor who provides guarantees to implement appropriate technical and organisational measures that are sufficient to secure that the processing will—

(a)meet the requirements of this Part, and

(b)ensure the protection of the rights of the data subject.

(3) The processor used by the controller may not engage another processor (“a sub-processor”) without the prior written authorisation of the controller, which may be specific or general.

(4)Where the controller gives a general written authorisation to a processor, the processor must inform the controller if the processor proposes to add to the number of sub-processors engaged by it or to replace any of them (so that the controller has the opportunity to object to the proposal).

(5)The processing by the processor must be governed by a contract in writing between the controller and the processor setting out the following—

(a)the subject-matter and duration of the processing;

(b)the nature and purpose of the processing;

(c)the type of personal data and categories of data subjects involved;

(d)the obligations and rights of the controller and processor.

(6)The contract must, in particular, provide that the processor must—

(a)act only on instructions from the controller,

(b)ensure that the persons authorised to process personal data are subject to an appropriate duty of confidentiality,

(c)assist the controller by any appropriate means to ensure compliance with the rights of the data subject under this Part,

(d)at the end of the provision of services by the processor to the controller—

(i)either delete or return to the controller (at the choice of the controller) the personal data to which the services relate, and

(ii)delete copies of the personal data unless subject to a legal obligation to store the copies,

(e)make available to the controller all information necessary to demonstrate compliance with this section, and

(f)comply with the requirements of this section for engaging sub-processors.

(7)The terms included in the contract in accordance with subsection (6)(a) must provide that the processor may transfer personal data to a third country or international organisation only if instructed by the controller to make the particular transfer.

[^F189 (7A)Adherence to a code of conduct approved under section 71A may be used by a processor as a means of demonstrating sufficient guarantees as described in subsection (2).^F189]

(8)If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.

60 Processing under the authority of the controller or processor _I69

A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—

(a)on instructions from the controller, or

(b)to comply with a legal obligation.

61 Records of processing activities _I70

(1)Each controller must maintain a record of all categories of processing activities for which the controller is responsible.

(2)The controller's record must contain the following information—

(a)the name and contact details of the controller;

(b)where applicable, the name and contact details of the joint controller;

(c)where applicable, the name and contact details of the data protection officer;

(d)the purposes of the processing;

(e)the categories of recipients to whom personal data has been or will be disclosed (including recipients in third countries or international organisations);

(f)a description of the categories of—

(i)data subject, and

(ii)personal data;

(g)where applicable, details of the use of profiling;

(h)where applicable, the categories of transfers of personal data to a third country or an international organisation;

(i)an indication of the legal basis for the processing operations, including transfers, for which the personal data is intended;

(j)where possible, the envisaged time limits for erasure of the different categories of personal data;

(k)where possible, a general description of the technical and organisational security measures referred to in section 66.

(3)Each processor must maintain a record of all categories of processing activities carried out on behalf of a controller.

(4)The processor's record must contain the following information—

(a)the name and contact details of the processor and of any other processors engaged by the processor in accordance with section 59(3);

(b)the name and contact details of the controller on behalf of which the processor is acting;

(c)where applicable, the name and contact details of the data protection officer;

(d)the categories of processing carried out on behalf of the controller;

(e)where applicable, details of transfers of personal data to a third country or an international organisation where explicitly instructed to do so by the controller, including the identification of that third country or international organisation;

(f)where possible, a general description of the technical and organisational security measures referred to in section 66.

(5)The controller and the processor must make the records kept under this section available to the Commissioner on request.

62 Logging _I71

(1)A controller (or, where personal data is processed on behalf of the controller by a processor, the processor) must keep logs for at least the following processing operations in automated processing systems—

(a)collection;

(b)alteration;

(c)consultation;

(d)disclosure (including transfers);

(e)combination;

(f)erasure.

(2)The logs of consultation must make it possible to establish—

(a)the justification for, and date and time of, the consultation, and

(b)so far as possible, the identity of the person who consulted the data.

(3)The logs of disclosure must make it possible to establish—

(a)the justification for, and date and time of, the disclosure, and

(b)so far as possible—

(i)the identity of the person who disclosed the data, and

(ii)the identity of the recipients of the data.

(4)The logs kept under subsection (1) may be used only for one or more of the following purposes—

(a)to verify the lawfulness of processing;

(b)to assist with self-monitoring by the controller or (as the case may be) the processor, including the conduct of internal disciplinary proceedings;

(c)to ensure the integrity and security of personal data;

(d)the purposes of criminal proceedings.

(5)The controller or (as the case may be) the processor must make the logs available to the Commissioner on request.

63 Co-operation with the Commissioner _I72

Each controller and each processor must co-operate, on request, with the Commissioner in the performance of the Commissioner's tasks.

64 Data protection impact assessment _I73

(1)Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing, carry out a data protection impact assessment.

(2)A data protection impact assessment is an assessment of the impact of the envisaged processing operations on the protection of personal data.

(3)A data protection impact assessment must include the following—

(a)a general description of the envisaged processing operations;

(b)an assessment of the risks to the rights and freedoms of data subjects;

(c)the measures envisaged to address those risks;

(d)safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Part, taking into account the rights and legitimate interests of the data subjects and other persons concerned.

(4)In deciding whether a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must take into account the nature, scope, context and purposes of the processing.

65 Prior consultation with the Commissioner _I74

(1)This section applies where a controller intends to create a filing system and process personal data forming part of it.

(2)The controller must consult the Commissioner prior to the processing if a data protection impact assessment prepared under section 64 indicates that the processing of the data would result in a high risk to the rights and freedoms of individuals (in the absence of measures to mitigate the risk).

(3)Where the controller is required to consult the Commissioner under subsection (2), the controller must give the Commissioner—

(a)the data protection impact assessment prepared under section 64, and

(b)any other information requested by the Commissioner to enable the Commissioner to make an assessment of the compliance of the processing with the requirements of this Part.

(4)Where the Commissioner is of the opinion that the intended processing referred to in subsection (1) would infringe any provision of this Part, the Commissioner must provide written advice to the controller and, where the controller is using a processor, to the processor.

(5)The written advice must be provided before the end of the period of 6 weeks beginning with receipt of the request for consultation by the controller or the processor.

(6)The Commissioner may extend the period of 6 weeks by a further period of 1 month, taking into account the complexity of the intended processing.

(7)If the Commissioner extends the period of 6 weeks, the Commissioner must—

(a)inform the controller and, where applicable, the processor of any such extension before the end of the period of 1 month beginning with receipt of the request for consultation, and

(b)provide reasons for the delay.

Obligations relating to security

66 Security of processing _I75

(1)Each controller and each processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks arising from the processing of personal data.

(2)In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—

(a)prevent unauthorised processing or unauthorised interference with the systems used in connection with it,

(b)ensure that it is possible to establish the precise details of any processing that takes place,

(c)ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and

(d)ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.

[^F190 (3)Adherence to a code of conduct approved under section 71A may be used by a controller or processor as a means of demonstrating compliance with subsection (1).^F190]

Obligations relating to personal data breaches

67 Notification of a personal data breach to the Commissioner _I76

(1)If a controller becomes aware of a personal data breach in relation to personal data for which the controller is responsible, the controller must notify the breach to the Commissioner—

(a)without undue delay, and

(b)where feasible, not later than 72 hours after becoming aware of it.

(2)Subsection (1) does not apply if the personal data breach is unlikely to result in a risk to the rights and freedoms of individuals.

(3)Where the notification to the Commissioner is not made within 72 hours, the notification must be accompanied by reasons for the delay.

(4)Subject to subsection (5), the notification must include—

(a)a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(b)the name and contact details of the data protection officer or other contact point from whom more information can be obtained;

(c)a description of the likely consequences of the personal data breach;

(d)a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

(5)Where and to the extent that it is not possible to provide all the information mentioned in subsection (4) at the same time, the information may be provided in phases without undue further delay.

(6)The controller must record the following information in relation to a personal data breach—

(a)the facts relating to the breach,

(b)its effects, and

(c)the remedial action taken.

(7)The information mentioned in subsection (6) must be recorded in such a way as to enable the Commissioner to verify compliance with this section.

^F191(8). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(9)If a processor becomes aware of a personal data breach (in relation to personal data processed by the processor), the processor must notify the controller without undue delay.

68 Communication of a personal data breach to the data subject _I77

(1)Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the controller must inform the data subject of the breach without undue delay.

(2)The information given to the data subject must include the following—

(a)a description of the nature of the breach;

(b)the name and contact details of the data protection officer or other contact point from whom more information can be obtained;

(c)a description of the likely consequences of the personal data breach;

(d)a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

(3)The duty under subsection (1) does not apply where—

(a)the controller has implemented appropriate technological and organisational protection measures which were applied to the personal data affected by the breach,

(b)the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in subsection (1) is no longer likely to materialise, or

(c)it would involve a disproportionate effort.

(4)An example of a case which may fall within subsection (3)(a) is where measures that render personal data unintelligible to any person not authorised to access the data have been applied, such as encryption.

(5)In a case falling within subsection (3)(c) (but not within subsection (3)(a) or (b)), the information mentioned in subsection (2) must be made available to the data subject in another equally effective way, for example, by means of a public communication.

(6)Where the controller has not informed the data subject of the breach the Commissioner, on being notified under section 67 and after considering the likelihood of the breach resulting in a high risk, may—

(a)require the controller to notify the data subject of the breach, or

(b)decide that the controller is not required to do so because any of paragraphs (a) to (c) of subsection (3) applies.

(7)The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

(a)avoid obstructing an official or legal inquiry, investigation or procedure;

(b)avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c)protect public security;

^F192(d). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(e)protect the rights and freedoms of others.

(8)Subsection (6) does not apply where the controller's decision not to inform the data subject of the breach was made in reliance on subsection (7).

(9)The duties in section 52(1) and (2) apply in relation to information that the controller is required to provide to the data subject under this section as they apply in relation to information that the controller is required to provide to the data subject under Chapter 3 .

Data protection officers

69 Designation of a data protection officer _I78

(1)The controller must designate a data protection officer, unless the controller is a court, or other judicial authority, acting in its judicial capacity.

(2)When designating a data protection officer, the controller must have regard to the professional qualities of the proposed officer, in particular—

(a)the proposed officer's expert knowledge of data protection law and practice, and

(b)the ability of the proposed officer to perform the tasks mentioned in section 71.

(3)The same person may be designated as a data protection officer by several controllers, taking account of their organisational structure and size.

(4)The controller must publish the contact details of the data protection officer and communicate these to the Commissioner.

70 Position of data protection officer _I79

(1)The controller must ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.

(2)The controller must provide the data protection officer with the necessary resources and access to personal data and processing operations to enable the data protection officer to—

(a)perform the tasks mentioned in section 71, and

(b)maintain his or her expert knowledge of data protection law and practice.

(3)The controller—

(a)must ensure that the data protection officer does not receive any instructions regarding the performance of the tasks mentioned in section 71;

(b)must ensure that the data protection officer does not perform a task or fulfil a duty other than those mentioned in this Part where such task or duty would result in a conflict of interests;

(c)must not dismiss or penalise the data protection officer for performing the tasks mentioned in section 71.

(4)A data subject may contact the data protection officer with regard to all issues relating to—

(a)the processing of that data subject's personal data, or

(b)the exercise of that data subject's rights under this Part.

(5)The data protection officer, in the performance of this role, must report to the highest management level of the controller.

71 Tasks of data protection officer _I80

(1)The controller must entrust the data protection officer with at least the following tasks—

(a)informing and advising the controller, any processor engaged by the controller, and any employee of the controller who carries out processing of personal data, of that person's obligations under this Part,

(b)providing advice on the carrying out of a data protection impact assessment under section 64 and monitoring compliance with that section,

(c)co-operating with the Commissioner,

(d)acting as the contact point for the Commissioner on issues relating to processing, including in relation to the consultation mentioned in section 65, and consulting with the Commissioner, where appropriate, in relation to any other matter,

(e)monitoring compliance with policies of the controller in relation to the protection of personal data, and

(f)monitoring compliance by the controller with this Part.

(2)In relation to the policies mentioned in subsection (1)(e), the data protection officer's tasks include—

(a)assigning responsibilities under those policies,

(b)raising awareness of those policies,

(c)training staff involved in processing operations, and

(d)conducting audits required under those policies.

(3)In performing the tasks set out in subsections (1) and (2), the data protection officer must have regard to the risks associated with processing operations, taking into account the nature, scope, context and purposes of processing.

[^F193Codes of conduct

71A Codes of conduct

(1)The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.

(2)Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.

(3)For the purposes of this section—

(a) “ public body ” means a body or other person whose functions are, or include, functions of a public nature, and

(b) a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).

(4)A code of conduct described in subsection (1) may, for example, make provision with regard to—

(a)lawful and fair processing;

(b)the collection of personal data;

(c)the information provided to the public and to data subjects;

(d)the exercise of the rights of data subjects;

(e)the measures and procedures referred to in sections 56, 57 and 62;

(f)the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;

(g)the transfer of personal data to third countries or international organisations;

(h)out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.

(5)The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.

(6)Where an expert public body does so, the Commissioner must—

(a)provide the body with an opinion on whether the code correctly reflects the requirements of this Part,

(b)decide whether to approve the code, and

(c)if the code is approved, register and publish the code.

(7)Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.^F193]

CHAPTER 5 Transfers of personal data to third countries etc

Overview and interpretation

72 Overview and interpretation _I81

(1)This Chapter deals with the transfer of personal data to third countries or international organisations, as follows—

(a)sections 73 to 76 set out the general conditions that apply;

(b)section 77 sets out the special conditions that apply where the intended recipient of personal data is not a relevant authority in a third country or an international organisation;

(c)section 78 makes special provision about subsequent transfers of personal data.

(2) In this Chapter, “ relevant authority ”, in relation to a third country, means any person based in a third country that has (in that country) functions comparable to those of a competent authority.

General principles for transfers

73 General principles for transfers of personal data _I82

(1)A controller may not transfer personal data to a third country or to an international organisation unless—

(a)the three conditions set out in subsections (2) to (4) are met, and

(b)^F194in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State ..., that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.

(2)Condition 1 is that the transfer is necessary for any of the law enforcement purposes.

(3)Condition 2 is that the transfer—

(a)is based on [^F195adequacy regulations (see section 74A)^F195] ,

(b)if not based on [^F196adequacy regulations^F196] , is based on there being appropriate safeguards (see section 75), or

(c)if not based on [^F197adequacy regulations^F197] or on there being appropriate safeguards, is based on special circumstances (see section 76).

(4)Condition 3 is that—

(a)the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation, or

(b)in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21, 24 to 28, 34 to 51, 54 and 56 of Schedule 7—

(i)the intended recipient is a person in a third country other than a relevant authority, and

(ii)the additional conditions in section 77 are met.

(5)Authorisation is not required as mentioned in subsection (1)(b) if—

(a)^F198the transfer is necessary for the prevention of an immediate and serious threat either to the public security of ... a third country or to the essential interests of a member State, and

(b)the authorisation cannot be obtained in good time.

(6)Where a transfer is made without the authorisation mentioned in subsection (1)(b), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.

(7) In this section, “ relevant international organisation ” means an international organisation that carries out functions for any of the law enforcement purposes.

^F19974 Transfers on the basis of an adequacy decision

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[^F20074A Transfers based on adequacy regulations

(1)The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data—

(a)a third country,

(b)a territory or one or more sectors within a third country,

(c)an international organisation, or

(d)a description of such a country, territory, sector or organisation.

(2)For the purposes of this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes—

(a)in the case of a third country, the country or a relevant territory or sector within the country, and

(b)in the case of an international organisation, the organisation,

and such a transfer does not require specific authorisation.

(3)Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2).

(4)When assessing the adequacy of the level of protection for the purposes of this section or section 74B, the Secretary of State must, in particular, take account of—

(a)the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation, which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data is transferred,

(b)the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with data protection rules, including adequate enforcement powers, for assisting and advising data subjects in exercising their rights and for cooperation with the Commissioner, and

(c)the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.

(5)Regulations under this section—

(a)where they relate to a third country, must specify their territorial and sectoral application;

(b)where applicable, must specify the independent supervisory authority or authorities referred to in subsection (4)(b).

(6)Regulations under this section may, among other things—

(a)provide that, in relation to a country, territory, sector, organisation or territory specified, or falling within a description specified, in the regulations, section 74B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations;

(b)identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;

(c)confer a discretion on a person.

(7)Regulations under this section are subject to the negative resolution procedure.^F200]

[^F20174AA Transfers approved by regulations

(1)For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to—

(a)a third country, or

(b)an international organisation.

(2)The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).

(3)In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.

(4)Regulations under this section may, among other things—

(a)make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;

(b)approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;

(c)identify a transfer of personal data by any means, including by reference to—

(i)a sector or geographic area within a third country,

(ii)the controller or processor,

(iii)the recipient of the personal data,

(iv)the personal data transferred,

(v)the means by which the transfer is made, or

(vi)relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time;

(d)confer a discretion on a person.

(5)Regulations under this section are subject to the negative resolution procedure.

74AB The data protection test

(1)For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under—

(a)this Part, and

(b)Parts 5 to 7, so far as relevant to law enforcement processing.

(2)In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things—

(a)respect for the rule of law and for human rights in the country or by the organisation,

(b)the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation,

(c)arrangements for judicial or non-judicial redress for data subjects in connection with such processing,

(d)rules about the transfer of personal data from the country or by the organisation to other countries or international organisations,

(e)relevant international obligations of the country or organisation, and

(f)the constitution, traditions and culture of the country or organisation.

(3)In subsections (1) and (2)—

(a)the references to the protection provided for data subjects are to that protection taken as a whole,

(b)the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and

(c)the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2).

(4)When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))—

(a)the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and

(b)the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.^F201]

[^F20074B Transfers based on adequacy regulations: review etc

(1)For so long as regulations under section 74A are in force which specify, or specify a description which includes, a third country, a territory or sector within a third country or an international organisation, the Secretary of State must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years.

(2)Each review under subsection (1) must take into account all relevant developments in the third country or international organisation.

(3)The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under section 74A or to amend or revoke such regulations.

(4)Where the Secretary of State becomes aware that a country, territory, sector or organisation specified, or falling within a description specified, in regulations under section 74A no longer ensures an adequate level of protection of personal data, whether as a result of a review under this section or otherwise, the Secretary of State must, to the extent necessary, amend or revoke the regulations.

(5)Where regulations under section 74A are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to remedying the lack of an adequate level of protection.

(6)The Secretary of State must publish—

(a)a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which are for the time being specified in regulations under section 74A, and

(b)a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which have been but are no longer specified in such regulations.

(7)In the case of regulations under section 74A which specify that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations—

(a)the duty under subsection (1) is only to carry out a review of the level of protection ensured for such a transfer, and

(b)the lists published under subsection (6) must specify or describe the relevant transfers.^F200]

75 Transfers on the basis of appropriate safeguards _I83

(1)A transfer of personal data to a third country or an international organisation is based on there being appropriate safeguards where—

(a)a legal instrument containing appropriate safeguards for the protection of personal data binds the intended recipient of the data, or

(b)the controller, having assessed all the circumstances surrounding transfers of that type of personal data to the third country or international organisation, concludes that appropriate safeguards exist to protect the data.

(2)The controller must inform the Commissioner about the categories of data transfers that take place in reliance on subsection (1)(b).

(3)Where a transfer of data takes place in reliance on subsection (1)—

(a)the transfer must be documented,

(b)the documentation must be provided to the Commissioner on request, and

(c)the documentation must include, in particular—

(i)the date and time of the transfer,

(ii)the name of and any other pertinent information about the recipient,

(iii)the justification for the transfer, and

(iv)a description of the personal data transferred.

76 Transfers on the basis of special circumstances _I84

(1)A transfer of personal data to a third country or international organisation is based on special circumstances where the transfer is necessary—

(a)to protect the vital interests of the data subject or another person,

(b)to safeguard the legitimate interests of the data subject,

(c)^F202for the prevention of an immediate and serious threat to the public security of ... a third country,

(d)in individual cases for any of the law enforcement purposes, or

(e)in individual cases for a legal purpose.

(2)But subsection (1)(d) and (e) do not apply if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer.

(3)Where a transfer of data takes place in reliance on subsection (1)—

(a)the transfer must be documented,

(b)the documentation must be provided to the Commissioner on request, and

(c)the documentation must include, in particular—

(i)the date and time of the transfer,

(ii)the name of and any other pertinent information about the recipient,

(iii)the justification for the transfer, and

(iv)a description of the personal data transferred.

(4)For the purposes of this section, a transfer is necessary for a legal purpose if—

(a)it is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) relating to any of the law enforcement purposes,

(b)it is necessary for the purpose of obtaining legal advice in relation to any of the law enforcement purposes, or

(c)it is otherwise necessary for the purposes of establishing, exercising or defending legal rights in relation to any of the law enforcement purposes.

Transfers to particular recipients

77 Transfers of personal data to persons other than relevant authorities _I85

(1)The additional conditions referred to in section 73(4)(b)(ii) are the following four conditions.

(2)Condition 1 is that the transfer is strictly necessary in a specific case for the performance of a task of the transferring controller as provided by law for any of the law enforcement purposes.

(3)Condition 2 is that the transferring controller has determined that there are no fundamental rights and freedoms of the data subject concerned that override the public interest necessitating the transfer.

(4)Condition 3 is that the transferring controller considers that the transfer of the personal data to a relevant authority in the third country would be ineffective or inappropriate (for example, where the transfer could not be made in sufficient time to enable its purpose to be fulfilled).

(5)Condition 4 is that the transferring controller informs the intended recipient of the specific purpose or purposes for which the personal data may, so far as necessary, be processed.

(6)Where personal data is transferred to a person in a third country other than a relevant authority, the transferring controller must inform a relevant authority in that third country without undue delay of the transfer, unless this would be ineffective or inappropriate.

(7)The transferring controller must—

(a)document any transfer to a recipient in a third country other than a relevant authority, and

(b)inform the Commissioner about the transfer.

(8)This section does not affect the operation of any international agreement in force between [^F203the United Kingdom^F203] and third countries in the field of judicial co-operation in criminal matters and police co-operation.

Subsequent transfers

78 Subsequent transfers _I86

(1)Where personal data is transferred in accordance with section 73, the transferring controller must make it a condition of the transfer that the data is not to be further transferred to a third country or international organisation without the authorisation of the transferring controller or another competent authority.

(2)A competent authority may give an authorisation under subsection (1) only where the further transfer is necessary for a law enforcement purpose.

(3)In deciding whether to give the authorisation, the competent authority must take into account (among any other relevant factors)—

(a)the seriousness of the circumstances leading to the request for authorisation,

(b)the purpose for which the personal data was originally transferred, and

(c)the standards for the protection of personal data that apply in the third country or international organisation to which the personal data would be transferred.

(4)^F204In a case where the personal data was originally transmitted or otherwise made available to the transferring controller or another competent authority by a member State ..., an authorisation may not be given under subsection (1) unless that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.

(5)Authorisation is not required as mentioned in subsection (4) if—

(a)^F205the transfer is necessary for the prevention of an immediate and serious threat either to the public security of ... a third country or to the essential interests of a member State, and

(b)the authorisation cannot be obtained in good time.

(6)Where a transfer is made without the authorisation mentioned in subsection (4), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.

CHAPTER 6 Supplementary

[^F20678A National security exemption

(1)A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.

(2)The provisions are—

(a)Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);

(b)Chapter 3 of this Part (rights of the data subject);

(c)in Chapter 4 of this Part—

(i)section 67 (notification of personal data breach to the Commissioner);

(ii)section 68 (communication of personal data breach to the data subject);

(d)Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);

(e)in Part 5—

(i)section 119 (inspection in accordance with international obligations);

(ii)in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;

(f)in Part 6—

(i)sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);

(ii)sections 170 to 173 (offences relating to personal data);

(g)in Part 7, section 187 (representation of data subjects).

(3)The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—

(a)section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;

(b)section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);

(c)section 42 (safeguards: sensitive processing);

(d)Schedule 8 (conditions for sensitive processing).

(4)The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—

(a)the following provisions of section 73—

(i)subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);

(ii)subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);

(b)section 78 (subsequent transfers).^F206]

79 National security: certificate _I87

^F207(1). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

^F207(2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

^F207(3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[^F208 (3A)Subject to subsection (5), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 78A(2) is, or at any time was, required in relation to any personal data for the purposes of safeguarding national security is conclusive evidence of that fact.^F208]

(4)A certificate issued under [^F209subsection (3A)—

(a)may identify the personal data to which it applies by means of a general description, and

(b)^F209] may be expressed to have prospective effect.

(5)Any person directly affected by the issuing of a certificate under [^F210subsection (3A)^F210] may appeal to the Tribunal against the certificate.

(6)If, on an appeal under subsection (5), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may —

(a)allow the appeal, and

(b)quash the certificate.

(7)Where in any proceedings under or by virtue of this Act, it is claimed by a controller that [^F211a certificate under subsection (3A) which identifies the personal data to which it applies by means of a general description applies to any personal data^F211] , any other party to the proceedings may appeal to the Tribunal on the ground that [^F212the certificate does not apply to the personal data in question^F212] .

(8)But, subject to any determination under subsection (9), [^F213the certificate^F213] is to be conclusively presumed [^F214so to apply^F214] .

(9)On an appeal under subsection (7), the Tribunal may determine that the certificate does not so apply.

(10)A document purporting to be a certificate under [^F215subsection (3A)^F215] is to be—

(a)received in evidence, and

(b)deemed to be such a certificate unless the contrary is proved.

(11)A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under [^F216subsection (3A)^F216] is—

(a)in any legal proceedings, evidence of that certificate, and

(b)in any legal proceedings in Scotland, sufficient evidence of that certificate.

(12)The power conferred by [^F217subsection (3A)^F217] on a Minister of the Crown is exercisable only by—

(a)a Minister who is a member of the Cabinet, or

(b)the Attorney General or the Advocate General for Scotland.

^F218(13). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

80 Special processing restrictions _I88

(1)Subsections (3) and (4) apply where, for a law enforcement purpose, a controller transmits or otherwise makes available personal data to [^F219a non-UK recipient^F219] .

(2)In this section—

• ^F220 ...

• “ [^F221 non-UK recipient ^F221] ” means—

  (a)

  a recipient in a third country, or

  (b)

  an international organisation.

(3)The controller must consider whether, if the personal data had instead been transmitted or otherwise made available within the United Kingdom to another competent authority, processing of the data by the other competent authority would have been subject to any restrictions by virtue of any enactment or rule of law.

(4)Where that would be the case, the controller must inform [^F222the non-UK recipient^F222] that the data is transmitted or otherwise made available subject to compliance by that person with the same restrictions (which must be set out in the information given to that person).

^F223(5). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

^F223(6). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

^F223(7). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

81 Reporting of infringements _I89

(1)Each controller must implement effective mechanisms to encourage the reporting of an infringement of this Part.

(2)The mechanisms implemented under subsection (1) must provide that an infringement may be reported to any of the following persons—

(a)the controller;

(b)the Commissioner.

(3)The mechanisms implemented under subsection (1) must include—

(a)raising awareness of the protections provided by Part 4A of the Employment Rights Act 1996 and Part 5A of the Employment Rights (Northern Ireland) Order 1996 (S.I. 1996/1919 (N.I. 16)), and

(b)such other protections for a person who reports an infringement of this Part as the controller considers appropriate.

(4)A person who reports an infringement of this Part does not breach—

(a)an obligation of confidence owed by the person, or

(b)any other restriction on the disclosure of information (however imposed).

(5)Subsection (4) does not apply if or to the extent that the report includes a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(6)Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (5) has effect as if it included a reference to that Part.

PART 4 Intelligence services processing

CHAPTER 1 Scope and definitions

Scope

82 Processing to which this Part applies _I90

(1)This Part applies to—

(a)the processing by an intelligence service of personal data wholly or partly by automated means, and

(b)the processing by an intelligence service otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.

(2) In this Part, “ intelligence service ” means—

(a)the Security Service;

(b)the Secret Intelligence Service;

(c)the Government Communications Headquarters.

[^F224 (2A)In this Part—

• “ competent authority ” has the same meaning as in Part 3;

• “ qualifying competent authority ” means a competent authority specified or described in regulations made by the Secretary of State. ^F224]

(3)A reference in this Part to the processing of personal data is to processing to which this Part applies.

[^F225 (4)Regulations under this section are subject to the affirmative resolution procedure.^F225]

Definitions

83 Meaning of “controller” and “processor” _I91

(1) In this Part, “ controller ” means the intelligence service which, alone or jointly with others—

(a)determines the purposes and means of the processing of personal data, or

(b)is the controller by virtue of subsection (2).

(2)Where personal data is processed only—

(a)for purposes for which it is required by an enactment to be processed, and

(b)by means by which it is required by an enactment to be processed,

the intelligence service on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

(3) In this Part, “ processor ” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).

84 Other definitions _I92

(1)This section defines other expressions used in this Part.

(2) “ Consent ”, in relation to the processing of personal data relating to an individual, means a freely given, specific, informed and unambiguous indication of the individual's wishes by which the individual, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data.

(3) “ Employee ”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.

(4) “ Personal data breach ” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

(5) “ Recipient ”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a person to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.

(6) “ Restriction of processing ” means the marking of stored personal data with the aim of limiting its processing for the future.

[^F226 (6A) “ Sensitive processing ” has the meaning given in section 86(7). ^F226]

(7)Sections 3 and 205 include definitions of other expressions used in this Part.

CHAPTER 2 Principles

Overview

85 Overview _I93

(1)This Chapter sets out the six data protection principles as follows—

(a)section 86 sets out the first data protection principle (requirement that processing be lawful, fair and transparent);

(b)section 87 sets out the second data protection principle (requirement that the purposes of processing be specified, explicit and legitimate);

(c)section 88 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive);

(d)section 89 sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date);

(e)section 90 sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary);

(f)section 91 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner).

(2)Each of sections 86, 87 and 91 makes provision to supplement the principle to which it relates.

The data protection principles

86 The first data protection principle _I94,I95

(1)The first data protection principle is that the processing of personal data must be—

(a)lawful, and

(b)fair and transparent.

(2)The processing of personal data is lawful only if and to the extent that—

(a)at least one of the conditions in Schedule 9 is met, and

(b)in the case of sensitive processing, at least one of the conditions in Schedule 10 is also met.

(3)The Secretary of State may by regulations amend Schedule 10—

(a)by adding conditions;

(b)by [^F227varying or^F227] omitting conditions added by regulations under paragraph (a).

(4)Regulations under subsection (3) are subject to the affirmative resolution procedure.

(5)In determining whether the processing of personal data is fair and transparent, regard is to be had to the method by which it is obtained.

(6)For the purposes of subsection (5), data is to be treated as obtained fairly and transparently if it consists of information obtained from a person who—

(a)is authorised by an enactment to supply it, or

(b)is required to supply it by an enactment or by an international obligation of the United Kingdom.

(7) In this [^F228 Part ^F228] , “ sensitive processing ” means—

(a)the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;

(b)the processing of genetic data for the purpose of uniquely identifying an individual;

(c)the processing of biometric data for the purpose of uniquely identifying an individual;

(d)the processing of data concerning health;

(e)the processing of data concerning an individual's sex life or sexual orientation;

(f)the processing of personal data as to—

(i)the commission or alleged commission of an offence by an individual, or

(ii)proceedings for an offence committed or alleged to have been committed by an individual, the disposal of such proceedings or the sentence of a court in such proceedings.

87 The second data protection principle _I96

(1)The second data protection principle is that—

(a)the purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and

(b)personal data so collected must not be processed in a manner that is incompatible with the purpose for which it is collected.

(2)Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

(3)Personal data collected by a controller for one purpose may be processed for any other purpose of the controller that collected the data or any purpose of another controller provided that—

(a)the controller is authorised by law to process the data for that purpose, and

(b)the processing is necessary and proportionate to that other purpose.

(4)Processing of personal data is to be regarded as compatible with the purpose for which it is collected if the processing—

(a)consists of—

(i)processing for archiving purposes in the public interest,

(ii)processing for the purposes of scientific or historical research, or

(iii)processing for statistical purposes, and

(b)is subject to appropriate safeguards for the rights and freedoms of the data subject.