Data Protection Act 2018, section 34

Overview and general duty of controller

PART 3 Law enforcement processing

(1)This Chapter sets out the six data protection principles as follows—

(a)section 35(1) sets out the first data protection principle (requirement that processing be lawful and fair);

(b)section 36(1) sets out the second data protection principle (requirement that purposes of processing be specified, explicit and legitimate);

(c)section 37 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive);

(d)section 38(1) sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date);

(e)section 39(1) sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary);

(f)section 40 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner).

(2)In addition—

(a)each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates, and

(b)sections 41 and 42 make provision about the safeguards that apply in relation to certain types of processing.

(3)The controller in relation to personal data is responsible for, and must be able to demonstrate, compliance with this Chapter.

Definitions used in section 34 1

controller

(1) In this Part, “controller” means the competent authority which, alone or jointly with others—

(a)determines the purposes and means of the processing of personal data, or

(b)is the controller by virtue of subsection (2).

Defined in s.32(1) · see it in the full Act

Cases considering section 34 10

YZ v The Chief Constable of South Wales Police

[2022] EWCA Civ 683 · 19 May 2022Interprets

Section 34 requires law-enforcement processing to comply with the data-protection principles and places responsibility on the data controller to ensure compliance. The applicant’s provision of supporting material does not transfer that responsibility. (see paras [26], [65]–[67]) The appeal relied on section 34(3) in arguing that the controller had to demonstrate compliance. The court rejected any reading that required the applicant to prove that retention was unlawful or unnecessary; responsibility remained with the controller. (see paras [56], [65]–[69])

Geoffrey Driver v Crown Prosecution Service

[2022] EWHC 2500 (KB) · 10 October 2022

Section 34 was applied to identify the six data-protection principles and the controller’s responsibility to demonstrate compliance. The claimant relied on the first, second and sixth principles. (see paras [105]-[106]) Section 34(1)(a) was used to identify the first data-protection principle, requiring lawful and fair processing. The court found that principle breached. (see paras [105]-[108]; [120]) Section 34(1)(b) was used to identify the second data-protection principle concerning specified, explicit and legitimate purposes and compatible processing. The disclosure breached that principle. (see paras [105]-[106]; [121]) Section 34(1)(f) was used to identify the sixth data-protection principle requiring appropriate security. The CPS failed to establish appropriate organisational measures. (see paras [105]-[106]; [122]-[125])

YZ, R (on the application of) v Chief Constable of South Wales Police (Rev 1)

[2021] EWHC 1060 (Admin) · 30 April 2021

Applies the controller’s responsibility to demonstrate compliance with the law-enforcement processing requirements. The court treated this responsibility as remaining with the controller despite the deletion guidance encouraging applicants to give reasons for deletion (see paras [37]; [43]-[44]).

What each judgment says about section 34 is in the case-law panel in the full Act.

Amendments and notes

1 notes from legislation.gov.uk

Commencement

  1. I33S. 34 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)