The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, “appropriate security” includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).
Definitions used in section 40 1
- the law enforcement purposes
For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
Defined in s.31 · see it in the full Act
Cases considering section 40 6
M, R (On the Application Of) v The Chief Constable of Sussex Police
Applied the sixth data protection principle requiring appropriate security through technical and organisational measures. (see paras [53]-[55], [89])
Boris Karpichkov v The National Crime Agency
Applies the sixth data-protection principle requiring appropriate security of law-enforcement data. The safety of transmitting sensitive identity and address information was an arguable issue rather than one conclusively resolved by the SIRENE regime. (see paras [68]; [137]; [154]-[159])
Geoffrey Driver v Crown Prosecution Service
Section 40 was applied to require appropriate technical or organisational measures against unauthorised or unlawful processing. The CPS failed to prove that adequate procedures existed for random public enquiries about live investigations. (see paras [107]; [122]-[125])
- M, R (on the application of) v The Chief Constable of Sussex Police & Anor
- XGY v The Chief Constable of Sussex Police & Anor
- Bridges, R (On Application of) v The Chief Constable of South Wales Police
What each judgment says about section 40 is in the case-law panel in the full Act.
Amendments and notes
1 notes from legislation.gov.uk
Commencement
- I40S. 40 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)