Data Protection Act 2018, section 80

Special processing restrictions

PART 3 Law enforcement processing

(1)Subsections (3) and (4) apply where, for a law enforcement purpose, a controller transmits or otherwise makes available personal data to [F367a non-UK recipientF367] .

(2)In this section—

(3)The controller must consider whether, if the personal data had instead been transmitted or otherwise made available within the United Kingdom to another competent authority, processing of the data by the other competent authority would have been subject to any restrictions by virtue of any enactment or rule of law.

(4)Where that would be the case, the controller must inform [F370the non-UK recipientF370] that the data is transmitted or otherwise made available subject to compliance by that person with the same restrictions (which must be set out in the information given to that person).

F371(5). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F371(6). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F371(7). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Definitions used in section 80 7

the law enforcement purposes

For the purposes of this Part, “the law enforcement purposes” are the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Defined in s.31 · see it in the full Act
controller

(1) In this Part, “controller” means the competent authority which, alone or jointly with others—

(a)determines the purposes and means of the processing of personal data, or

(b)is the controller by virtue of subsection (2).

Defined in s.32(1) · see it in the full Act
Recipient

(5) “Recipient”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a public authority to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.

Defined in s.33(5) · see it in the full Act
Third country

(7) “Third country” means a country or territory outside the United Kingdom .

Defined in s.33(7) · see it in the full Act
international organisation

“international organisation” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;

Defined in s.205(1) · see it in the full Act
competent authority

(1) In this Part, “competent authority” means—

(a)a person specified or described in Schedule 7, and

(b)any other person if and to the extent that the person has statutory functions for any of the law enforcement purposes.

Defined in s.30(1) · see it in the full Act
enactment

“enactment” includes—

(a)

an enactment passed or made after this Act,

(b)

an enactment comprised in subordinate legislation,

(c)

an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,

(d)

an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ...

(e)

an enactment comprised in, or in an instrument made under, Northern Ireland legislation; and

(f)

any assimilated direct legislation;

Defined in s.205(1) · see it in the full Act

Cases considering section 80 3

Boris Karpichkov v The National Crime Agency

[2023] EWHC 2653 (KB) · 27 October 2023Limits

Requires a controller to consider whether equivalent domestic transmission would have been subject to restrictions. It forms part of the statutory framework governing transfers to EU recipients. (see paras [149]-[150]) Permits relevant restrictions to be communicated to an EU recipient where equivalent domestic processing would have been restricted. The provision was treated as the principal statutory form of restriction available for an otherwise required transfer. (see paras [149]-[150]) Generally bars additional restrictions on data transmitted to an EU recipient, except for restrictions communicated under subsection (4). The bar applies only where the transfer is required by law; whether that condition was met remained arguable where fundamental rights were engaged. (see paras [150]-[152])

El Gizouli, R (On the Application Of) v The Secretary of State for the Home Department

[2019] EWHC 60 (Admin) · 18 January 2019Limits

Section 80 did not convert the United Kingdom’s domestic restriction on punishments into a restriction on foreign data processing. It could not be used to require a foreign state to adopt particular sentences (see paras [212]-[216]).

Elgizouli v Secretary of State for the Home Department

[2020] UKSC 10 · 25 March 2020Limits

Lord Kerr was inclined to accept that the special-processing restriction did not apply to the data subject, but the court reached no final conclusion because the transfer was unlawful on other grounds. (see para [159])

What each judgment says about section 80 is in the case-law panel in the full Act.

Amendments and notes

6 notes from legislation.gov.uk

Amendments

  1. F367Words in s. 80(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F368Words in s. 80(2) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F369Words in s. 80(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F370Words in s. 80(4) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F371S. 80(5)(6)(7) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 46(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

  1. I79S. 80 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(c)