Data Protection Act 2018 s.32 – Meaning of “controller” and “processor”

(1) In this Part, “controller” means the competent authority which, alone or jointly with others—

(a)determines the purposes and means of the processing of personal data, or

(b)is the controller by virtue of subsection (2).

(2)Where personal data is processed only—

(a)for purposes for which it is required by an enactment to be processed, and

(b)by means by which it is required by an enactment to be processed,

the competent authority on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

(3) In this Part, “processor” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).

Definitions used in section 32 3

competent authority

(1) In this Part, “competent authority” means—

(a)a person specified or described in Schedule 7, and

(b)any other person if and to the extent that the person has statutory functions for any of the law enforcement purposes.

Defined in s.30(1) · see it in the full Act

enactment

“enactment” includes—

(a)

an enactment passed or made after this Act,

(b)

an enactment comprised in subordinate legislation,

(c)

an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,

(d)

an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ...

(e)

an enactment comprised in, or in an instrument made under, Northern Ireland legislation; and

(f)

any assimilated direct legislation;

Defined in s.205(1) · see it in the full Act

Employee

(2) “Employee”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.

Defined in s.33(2) · see it in the full Act

Cases considering section 32 3

M, R (On the Application Of) v The Chief Constable of Sussex Police

[2021] EWCA Civ 42 · 19 January 2021Interprets

Defined a data processor as a person processing data on a controller’s behalf, other than an employee. The court treated onward dissemination as more naturally a controller act. (see paras [36], [43])

Geoffrey Driver v Crown Prosecution Service

[2022] EWHC 2500 (KB) · 10 October 2022Defines

Section 32 was used to identify the controller for Part 3 processing. The relevant competent authority was the CPS through the Director of Public Prosecutions. (see paras [87]-[90]) Section 32(2) was set out as an alternative controller provision where processing is required by enactment. The court did not need to determine that alternative on the facts. (see para [88])

M, R (on the application of) v The Chief Constable of Sussex Police & Anor

[2019] EWHC 975 (Admin) · 15 April 2019Defines

The defendant was a data controller when it passed the claimant’s information to BCRP. The court considered BCRP’s status but held that the controller duties applied at the point of transfer. (see paras [54]; [88]-[89]) The court considered whether BCRP was a processor acting for the defendant, but regarded joint or separate controller status as the more natural analysis. (see paras [54]; [88])

What each judgment says about section 32 is in the case-law panel in the full Act.

Amendments and notes

1 notes from legislation.gov.uk

Commencement

I31S. 32 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)