UKPGA-2018-12 Data Protection Act 2018 UK

This Act makes provision about the processing of personal data.

Most processing of personal data is subject to the UK GDPR.

Part 2 supplements the UK GDPR.

Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes ....

Part 4 makes provision about the processing of personal data by the intelligence services (and certain processing carried out by competent authorities jointly with the intelligence services).

Part 5 makes provision about the Information Commissioner.

Part 6 makes provision about the enforcement of the data protection legislation.

Part 7 makes supplementary provision, including provision about the application of this Act to the Crown and to Parliament.

The UK GDPR and this Act protect individuals with regard to the processing of personal data, in particular by—

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

This section defines some terms used in this Act.

“Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

“Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to—

“Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as—(subject to subsection (14)(c) and sections 5(7), 29(2) and 82(3), which make provision about references to processing in the different Parts of this Act).

“Data subject” means the identified or identifiable living individual to whom personal data relates.

“Controller” and “processor”, in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies, have the same meaning as in that ... Part (see sections 5, 6, 32 and 83 and see also subsection (14)(d)).

“Filing system” means any structured set of personal data which is accessible according to specific criteria, whether held by automated means or manually and whether centralised, decentralised or dispersed on a functional or geographical basis.

“The Commissioner” means the Information Commissioner (see section 114).

“The Commission” means the Information Commission (see section 114A).

“The data protection legislation” means—

“The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)).

“The EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

“The Law Enforcement Directive” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

“The Data Protection Convention” means the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data which was opened for signature on 28 January 1981, as amended up to the day on which this Act is passed.

In Parts 5 to 7, except where otherwise provided—

There is an index of defined expressions in section 206.

This Part is relevant to most processing of personal data.

This Part—

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Terms used in ... this Part and in the UK GDPR have the same meaning in this Part as they have in the UK GDPR.

In subsection (1), the reference to a term's meaning in the UK GDPR is to its meaning in the UK GDPR read with any provision of this Part which modifies the term's meaning for the purposes of the UK GDPR.

Subsection (1) is subject to any provision in this Part which provides expressly for the term to have a different meaning and to section 204.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A reference in ... this Part to the processing of personal data is to processing to which this Part applies.

Sections 3 and 205 include definitions of other expressions used in this Part.

The definition of “controller” in Article 4(1)(7) of the UK GDPR has effect subject to—

For the purposes of the UK GDPR, where personal data is processed only—the person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

For the purposes of the UK GDPR, the following (and only the following) are “public authorities” and “public bodies” ...—subject to subsections (2), (3) and (4).

An authority or body that falls within subsection (1) is only a “public authority” or “public body” for the purposes of the UK GDPR when performing a task carried out in the public interest or in the exercise of official authority vested in it.

The references in subsection (1)(a) and (b) to public authorities and Scottish public authorities as defined by the Freedom of Information Act 2000 and the Freedom of Information (Scotland) Act 2002 (asp 13) do not include any of the following that fall within those definitions—

The Secretary of State may by regulations provide that a person specified or described in the regulations that is a public authority described or mentioned in subsection (1)(a), (b) or (ba) is not a “public authority” or “public body” for the purposes of the UK GDPR.

Regulations under this section are subject to the affirmative resolution procedure.

Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant international law only if it meets a condition in Schedule A1.

A condition in Schedule A1 may be relied on for the purposes of any of those provisions, unless that Schedule provides otherwise.

The Secretary of State may by regulations amend Schedule A1 by adding, varying or omitting—

Regulations under this section may only add a condition relating entirely or partly to a treaty ratified by the United Kingdom.

Regulations under this section are subject to the affirmative resolution procedure.

In this section, “treaty” and “ratified” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act).

Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)—

The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the UK GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1.

The processing meets the requirement in point (g) of Article 9(2) of the UK GDPR for a basis in the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 2 of Schedule 1.

Subsection (5) makes provision about the processing of personal data relating to criminal convictions and offences or related security measures that is not carried out under the control of official authority.

The processing meets the requirement in Article 10(1) of the UK GDPR for authorisation by the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1, 2 or 3 of Schedule 1.

The Secretary of State may by regulations—

Regulations under this section are subject to the affirmative resolution procedure.

For the purposes of Article 9(2)(h) of the UK GDPR (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the UK GDPR (obligation of secrecy) include circumstances in which it is carried out—

In Article 10 of the UK GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to—

The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on—

The Secretary of State may by regulations—

Regulations under this section are subject to the negative resolution procedure.

This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974).

The controller's obligations under Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject's financial standing, unless the data subject has indicated a contrary intention.

Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the UK GDPR, the disclosure must be accompanied by a statement informing the data subject of the data subject's rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information).

The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR.

Regulations under this section are subject to the affirmative resolution procedure.

Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the UK GDPR.

In Schedule 2—

Schedule 3 makes provision restricting the application of rules contained in Articles 13 to 21 of the UK GDPR to health, social work, education and child abuse data (of a kind described in Article 23(1) of the UK GDPR).

Schedule 4 makes provision restricting the application of rules contained in Articles 13 to 21 of the UK GDPR to information the disclosure of which is prohibited or restricted by an enactment (of a kind described in Article 23(1) of the UK GDPR).

In connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25).

In connection with the safeguarding of national security and with defence, see Chapter 3 of this Part (sections 26 to 28).

The following powers to make provision altering the application of the UK GDPR may be exercised by way of regulations made by the Secretary of State under this section—

Regulations under this section may—

Regulations under this section are subject to the affirmative resolution procedure.

Accreditation of a person as a certification provider is only valid when carried out by—

The Commissioner may only accredit a person as a certification provider where the Commissioner—

The UK national accreditation body may only accredit a person as a certification provider where the Commissioner—

The publication of a notice under subsection (2)(b) or (3)(b) does not affect the validity of any accreditation carried out before its publication.

Schedule 5 makes provision about reviews of, and appeals from, a decision relating to accreditation of a person as a certification provider.

The UK national accreditation body may charge a reasonable fee in connection with, or incidental to, the carrying out of the body's functions under this section, Schedule 5 and Article 43 of the UK GDPR.

The UK national accreditation body must provide the Secretary of State with such information relating to its functions under this section, Schedule 5 and Article 43 of the UK GDPR as the Secretary of State may reasonably require.

In this section—“certification provider” means a person who issues certification for the purposes of Article 42 of the UK GDPR;“the UK national accreditation body” means the UK national accreditation body for the purposes of Article 4(1) of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

In this Chapter, “FOI public authority” means—

References in this Chapter to personal data “held” by an FOI public authority are to be interpreted—but such references do not include information held by an intelligence service (as defined in section 82) on behalf of an FOI public authority.

But personal data is not to be treated as “held” by an FOI public authority for the purposes of this Chapter, where—

In relation to the Advanced Research and Invention Agency—

The provisions of the UK GDPR and this Act listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) (manual unstructured personal data held by FOI public authorities).

Those provisions are—(see also paragraph 1(2) of Schedule 18).

In addition, the provisions of the UK GDPR listed in subsection (4) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) where the personal data relates to appointments, removals, pay, discipline, superannuation or other personnel matters in relation to—

Those provisions are—

A controller is not obliged to comply with Article 15(1) to (3) of the UK GDPR (right of access by the data subject) in relation to personal data to which the UK GDPR applies by virtue of Article 2(1A) if—

Subsection (5)(b) does not remove the controller's obligation to confirm whether or not personal data concerning the data subject is being processed unless the estimated cost of complying with that obligation alone in relation to the personal data would exceed the appropriate maximum.

An estimate for the purposes of this section must be made in accordance with regulations under section 12(5) of the Freedom of Information Act 2000.

In subsections (5) and (6), “the appropriate maximum” means the maximum amount specified by the Secretary of State by regulations.

Regulations under subsection (8) are subject to the negative resolution procedure.

The provisions of the UK GDPR listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) (manual unstructured personal data held by FOI public authorities) at any time when—

Those provisions are—

The exemptions in this section apply in addition to the exemptions in section 24.

A provision of the UK GDPR or this Act mentioned in subsection (2) does not apply to personal data to which the UK GDPR applies if exemption from the provision is required for—

The provisions are—

Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 26(2) is, or at any time was, required in relation to any personal data for the purpose of safeguarding national security is conclusive evidence of that fact.

A certificate under subsection (1)—

Any person directly affected by a certificate under subsection (1) may appeal to the Tribunal against the certificate.

If, on an appeal under subsection (3), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing a certificate, the Tribunal may—

Where, in any proceedings under or by virtue of the UK GDPR or this Act, it is claimed by a controller that a certificate under subsection (1) which identifies the personal data to which it applies by means of a general description applies to any personal data, another party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.

But, subject to any determination under subsection (7), the certificate is to be conclusively presumed so to apply.

On an appeal under subsection (5), the Tribunal may determine that the certificate does not so apply.

A document purporting to be a certificate under subsection (1) is to be—

A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—

The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—

Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) does not prohibit the processing of personal data to which the UK GDPR applies to the extent that the processing is carried out—

Article 32 of the UK GDPR (security of processing) does not apply to a controller or processor to the extent that the controller or the processor (as the case may be) is processing personal data to which the UK GDPR applies for—

Where Article 32 of the UK GDPR does not apply, the controller or the processor must implement security measures appropriate to the risks arising from the processing of the personal data.

For the purposes of subsection (3), where the processing of personal data is carried out wholly or partly by automated means, the controller or the processor must, following an evaluation of the risks, implement measures designed to—

The functions conferred on the Commissioner in relation to the UK GDPR by Articles 57(1)(a), (d), (e), (h) and (u) and 58(1)(d) and (2)(a) to (d) of the UK GDPR (which are subject to safeguards set out in section 115) include functions in relation to subsection (3).

This Part applies to—

This Part does not apply to processing to which Part 4 applies by virtue of a designation notice (see section 82A).

Any reference in this Part to the processing of personal data is to processing to which this Part applies.

For the meaning of “competent authority”, see section 30.

In this Part, “competent authority” means—

But an intelligence service is not a competent authority within the meaning of this Part.

The Secretary of State may by regulations amend Schedule 7—

Regulations under subsection (3) which make provision of the kind described in subsection (3)(a) may also make consequential amendments of section 73(4)(b).

Regulations under subsection (3) which make provision of the kind described in subsection (3)(a), or which make provision of that kind and of the kind described in subsection (3)(b), are subject to the affirmative resolution procedure.

Regulations under subsection (3) which make provision only of the kind described in subsection (3)(b) are subject to the negative resolution procedure.

In this section—“intelligence service” means—the Security Service; the Secret Intelligence Service; the Government Communications Headquarters;“statutory function” means a function under or by virtue of an enactment.

In this Part, “controller” means the competent authority which, alone or jointly with others—

Where personal data is processed only—the competent authority on which the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

In this Part, “processor” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).

This section defines certain other expressions used in this Part.

“Employee”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.

“Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

“Recipient”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a public authority to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.

“Restriction of processing” means the marking of stored personal data with the aim of limiting its processing for the future.

“Sensitive processing” has the meaning given in section 35(8).

“Third country” means a country or territory outside the United Kingdom.

Sections 3 and 205 include definitions of other expressions used in this Part.

This Chapter sets out the six data protection principles as follows—

In addition—

The controller in relation to personal data is responsible for, and must be able to demonstrate, compliance with this Chapter.

The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.

The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—

In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in subsections (4) and (5).

The first case is where—

The second case is where—

The Secretary of State may by regulations amend Schedule 8—

Regulations under subsection (6) are subject to the affirmative resolution procedure.

In this Part, “sensitive processing” means—

The second data protection principle is that—

Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that—

Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.

The fourth data protection principle is that—

In processing personal data for any of the law enforcement purposes, personal data based on facts must, so far as possible, be distinguished from personal data based on personal assessments.

In processing personal data for any of the law enforcement purposes, a clear distinction must, where relevant and as far as possible, be made between personal data relating to different categories of data subject, such as—

All reasonable steps must be taken to ensure that personal data which is inaccurate, incomplete or no longer up to date is not transmitted or made available for any of the law enforcement purposes.

For that purpose—

The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for the purpose for which it is processed.

Appropriate time limits must be established for the periodic review of the need for the continued storage of personal data for any of the law enforcement purposes.

This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is carried out—

The processing is not permitted if—

This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying out sensitive processing in reliance on the consent of the data subject or, as the case may be, in reliance on a condition specified in Schedule 8).

The controller has an appropriate policy document in place in relation to the sensitive processing if the controller has produced a document which—

Where personal data is processed on the basis that an appropriate policy document is in place, the controller must during the relevant period—

The record maintained by the controller under section 61(1) and, where the sensitive processing is carried out by a processor on behalf of the controller, the record maintained by the processor under section 61(3) must include the following information—

In this section, “relevant period”, in relation to sensitive processing in reliance on the consent of the data subject or in reliance on a condition specified in Schedule 8, means a period which—

The Secretary of State may by regulations—

In subsection (1)—“added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);“protected condition in Schedule 8” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).

Regulations under this section may amend this Part and sections 205 and 206.

Regulations under this section are subject to the affirmative resolution procedure.

This Chapter—

This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.

But sections 44 to 48 do not apply in relation to the processing of relevant personal data in the course of a criminal investigation or criminal proceedings, including proceedings for the purpose of executing a criminal penalty.

In subsection (3), “relevant personal data” means personal data contained in a judicial decision or in other documents relating to the investigation or proceedings which are created by or on behalf of a court or other judicial authority.

In this Chapter, “the controller”, in relation to a data subject, means the controller in relation to personal data relating to the data subject.

The controller must make available to data subjects the following information (whether by making the information generally available to the public or in any other way)—

The controller must also, in specific cases for the purpose of enabling the exercise of a data subject's rights under this Part, give the data subject the following—

An example of where further information may be necessary as mentioned in subsection (2)(d) is where the personal data being processed was collected without the knowledge of the data subject.

The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (2) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

Where the provision of information to a data subject under subsection (2) is restricted under subsection (4), wholly or partly, the controller must inform the data subject in writing without undue delay—

Subsection (5)(a) and (b) do not apply to the extent that complying with them would undermine the purpose of the restriction.

The controller must—

A data subject is entitled to obtain from the controller—

That information is—

Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.

Where a data subject makes a request under subsection (1), the information to which the data subject is entitled must be provided in writing —

The controller may restrict, wholly or partly, the rights conferred by subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

Where the rights of a data subject under subsection (1) are restricted under subsection (4), wholly or partly, the controller must inform the data subject in writing without undue delay and in any event before the end of the applicable time period (as to which see section 54)—

Subsection (5)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.

The controller must—

Sections 44(2) and 45(1) do not require the controller to give the data subject—

A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—

Subsection (2)(a) and (b) do not apply to the extent that complying with them would—

The controller must—

The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).

The controller must, if so requested by a data subject, rectify without undue delay inaccurate personal data relating to the data subject.

Where personal data is inaccurate because it is incomplete, the controller must, if so requested by a data subject, complete it.

The duty under subsection (2) may, in appropriate cases, be fulfilled by the provision of a supplementary statement.

Where the controller would be required to rectify personal data under this section but the personal data must be maintained for the purposes of evidence, the controller must (instead of rectifying the personal data) restrict its processing.

The controller must erase personal data without undue delay where—

Where the controller would be required to erase personal data under subsection (1) but the personal data must be maintained for the purposes of evidence, the controller must (instead of erasing the personal data) restrict its processing.

Where a data subject contests the accuracy of personal data (whether in making a request under this section or section 46 or in any other way), but it is not possible to ascertain whether it is accurate or not, the controller must restrict its processing.

A data subject may request the controller to erase personal data or to restrict its processing (but the duties of the controller under this section apply whether or not such a request is made).

Where a data subject requests the rectification or erasure of personal data or the restriction of its processing, the controller must inform the data subject in writing—

The controller must comply with the duty under subsection (1)—

The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1)(b)(i) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

Where the rights of a data subject under subsection (1)(b)(i) are restricted under subsection (3), wholly or partly, the controller must inform the data subject in writing without undue delay—

Subsection (4)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.

The controller must—

Where the controller rectifies personal data, it must notify the competent authority (if any) from which the inaccurate personal data originated.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Where the controller rectifies, erases or restricts the processing of personal data which has been disclosed by the controller—

Where processing is restricted in accordance with section 47(3), the controller must inform the data subject before lifting the restriction.

For the purposes of sections 50B and 50C—

When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.

A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met.

The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.

The second condition is that the decision is required or authorised by law.

Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).

The safeguards must consist of or include measures which—

Subsections (1) and (2) do not apply in relation to a significant decision if—

Those reasons are—

When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.

The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations.

The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject.

Regulations under subsection (1) or (2) may amend section 50A.

The Secretary of State may by regulations make the following types of provision about the safeguards required under section 50C(1)—

Regulations under this section are subject to the affirmative resolution procedure.

This section applies where a controller—

The data subject may—

The Commissioner must take such steps as appear to the Commissioner to be appropriate to respond to a request under subsection (2) (which may include the exercise of any of the powers conferred by sections 142 and 146).

After taking those steps, the Commissioner must inform the data subject—

The Commissioner must also inform the data subject of the data subject's right to apply to a court under section 167.

Where the Commissioner is not satisfied as mentioned in subsection (4)(a) , (aa) or (b), the Commissioner may also inform the data subject of any further steps that the Commissioner is considering taking under Part 6 .

The controller must take reasonable steps to ensure that any information that is required by or under this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language.

Subject to subsection (3), the information may be provided in any form, including electronic form.

Where information is provided in response to a request made by the data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D, the controller must provide the information in the same form as the request where it is practicable to do so.

Where the controller has reasonable doubts about the identity of an individual making a request under or by virtue of any of sections 45, 46, 47, 50C or 50D, the controller may—

Subject to section 53, any information that is required by or under this Chapter to be provided to the data subject must be provided free of charge.

The controller must facilitate the exercise of the rights of the data subject arising under or by virtue of sections 45 to 50D.

Where a request made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D is manifestly unfounded or excessive, the controller may—

An example of a request that may be excessive is one that merely repeats the substance of previous requests.

In any proceedings where there is an issue as to whether a request described in subsection (1) is manifestly unfounded or excessive, it is for the controller to show that it is.

The Secretary of State may by regulations specify limits on the fees that a controller may charge in accordance with subsection (1)(a).

The Secretary of State may by regulations—

Regulations under this section are subject to the negative resolution procedure.

If, in reliance on subsection (1)(b), the controller does not take action on the request, the controller must inform the data subject of—

The controller must comply with subsection (6)—

This section defines “the applicable time period” for the purposes of sections 45(3)(b) and (5) , 48(2)(b) and 53(7).

“The applicable time period” means the period of one month beginning with the relevant time , subject to subsection (3A).

“The relevant time” means the latest of the following—

The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—

A notice under subsection (3A) must—

Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under section 45(1) relates—

An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

This Chapter—

This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.

Where a controller is required by any provision of this Chapter to implement appropriate technical and organisational measures, the controller must (in deciding what measures are appropriate) take into account—

Each controller must implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that the processing of personal data complies with the requirements of this Part.

Where proportionate in relation to the processing, the measures implemented to comply with the duty under subsection (1) must include appropriate data protection policies.

The technical and organisational measures implemented under subsection (1) must be reviewed and updated where necessary.

Adherence to a code of conduct approved under section 71A may be used by a controller as a means of demonstrating compliance with the requirements of this Part.

Each controller must implement appropriate technical and organisational measures which are designed—

The duty under subsection (1) applies both at the time of the determination of the means of processing the data and at the time of the processing itself.

Each controller must implement appropriate technical and organisational measures for ensuring that, by default, only personal data which is necessary for each specific purpose of the processing is processed.

The duty under subsection (3) applies to—

In particular, the measures implemented to comply with the duty under subsection (3) must ensure that, by default, personal data is not made accessible to an indefinite number of people without an individual's intervention.

Where two or more competent authorities jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.

Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.

The arrangement must designate the controller which is to be the contact point for data subjects.

This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.

The controller may use only a processor who provides guarantees to implement appropriate technical and organisational measures that are sufficient to secure that the processing will—

The processor used by the controller may not engage another processor (“a sub-processor”) without the prior written authorisation of the controller, which may be specific or general.

Where the controller gives a general written authorisation to a processor, the processor must inform the controller if the processor proposes to add to the number of sub-processors engaged by it or to replace any of them (so that the controller has the opportunity to object to the proposal).

The processing by the processor must be governed by a contract in writing between the controller and the processor setting out the following—

The contract must, in particular, provide that the processor must—

The terms included in the contract in accordance with subsection (6)(a) must provide that the processor may transfer personal data to a third country or international organisation only if instructed by the controller to make the particular transfer.

Adherence to a code of conduct approved under section 71A may be used by a processor as a means of demonstrating sufficient guarantees as described in subsection (2).

If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.

Each controller must maintain a record of all categories of processing activities for which the controller is responsible.

The controller's record must contain the following information—

Each processor must maintain a record of all categories of processing activities carried out on behalf of a controller.

The processor's record must contain the following information—

The controller and the processor must make the records kept under this section available to the Commissioner on request.

A controller (or, where personal data is processed on behalf of the controller by a processor, the processor) must keep logs for at least the following processing operations in automated processing systems—

The logs of consultation must make it possible to establish—

The logs of disclosure must make it possible to establish—

The logs kept under subsection (1) may be used only for one or more of the following purposes—

The controller or (as the case may be) the processor must make the logs available to the Commissioner on request.

Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing, carry out a data protection impact assessment.

A data protection impact assessment is an assessment of the impact of the envisaged processing operations on the protection of personal data.

A data protection impact assessment must include the following—

In deciding whether a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must take into account the nature, scope, context and purposes of the processing.

This section applies where a controller intends to create a filing system and process personal data forming part of it.

The controller must consult the Commissioner prior to the processing if a data protection impact assessment prepared under section 64 indicates that the processing of the data would result in a high risk to the rights and freedoms of individuals (in the absence of measures to mitigate the risk).

Where the controller is required to consult the Commissioner under subsection (2), the controller must give the Commissioner—

Where the Commissioner is of the opinion that the intended processing referred to in subsection (1) would infringe any provision of this Part, the Commissioner must provide written advice to the controller and, where the controller is using a processor, to the processor.

The written advice must be provided before the end of the period of 6 weeks beginning with receipt of the request for consultation by the controller or the processor.

The Commissioner may extend the period of 6 weeks by a further period of 1 month, taking into account the complexity of the intended processing.

If the Commissioner extends the period of 6 weeks, the Commissioner must—

Each controller and each processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks arising from the processing of personal data.

In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—

Adherence to a code of conduct approved under section 71A may be used by a controller or processor as a means of demonstrating compliance with subsection (1).

If a controller becomes aware of a personal data breach in relation to personal data for which the controller is responsible, the controller must notify the breach to the Commissioner—

Subsection (1) does not apply if the personal data breach is unlikely to result in a risk to the rights and freedoms of individuals.

Where the notification to the Commissioner is not made within 72 hours, the notification must be accompanied by reasons for the delay.

Subject to subsection (5), the notification must include—

Where and to the extent that it is not possible to provide all the information mentioned in subsection (4) at the same time, the information may be provided in phases without undue further delay.

The controller must record the following information in relation to a personal data breach—

The information mentioned in subsection (6) must be recorded in such a way as to enable the Commissioner to verify compliance with this section.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

If a processor becomes aware of a personal data breach (in relation to personal data processed by the processor), the processor must notify the controller without undue delay.

Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the controller must inform the data subject of the breach without undue delay.

The information given to the data subject must include the following—

The duty under subsection (1) does not apply where—

An example of a case which may fall within subsection (3)(a) is where measures that render personal data unintelligible to any person not authorised to access the data have been applied, such as encryption.

In a case falling within subsection (3)(c) (but not within subsection (3)(a) or (b)), the information mentioned in subsection (2) must be made available to the data subject in another equally effective way, for example, by means of a public communication.

Where the controller has not informed the data subject of the breach the Commissioner, on being notified under section 67 and after considering the likelihood of the breach resulting in a high risk, may—

The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—

Subsection (6) does not apply where the controller's decision not to inform the data subject of the breach was made in reliance on subsection (7).

The duties in section 52(1) and (2) apply in relation to information that the controller is required to provide to the data subject under this section as they apply in relation to information that the controller is required to provide to the data subject under Chapter 3 .

The controller must designate a data protection officer, unless the controller is a court, or other judicial authority, acting in its judicial capacity.

When designating a data protection officer, the controller must have regard to the professional qualities of the proposed officer, in particular—

The same person may be designated as a data protection officer by several controllers, taking account of their organisational structure and size.

The controller must publish the contact details of the data protection officer and communicate these to the Commissioner.

The controller must ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.

The controller must provide the data protection officer with the necessary resources and access to personal data and processing operations to enable the data protection officer to—

The controller—

A data subject may contact the data protection officer with regard to all issues relating to—

The data protection officer, in the performance of this role, must report to the highest management level of the controller.

The controller must entrust the data protection officer with at least the following tasks—

In relation to the policies mentioned in subsection (1)(e), the data protection officer's tasks include—

In performing the tasks set out in subsections (1) and (2), the data protection officer must have regard to the risks associated with processing operations, taking into account the nature, scope, context and purposes of processing.

The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.

Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.

For the purposes of this section—

A code of conduct described in subsection (1) may, for example, make provision with regard to—

The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.

Where an expert public body does so, the Commissioner must—

Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.

This Chapter deals with the transfer of personal data to third countries or international organisations, as follows—

In this Chapter, “relevant authority”, in relation to a third country, means any person based in a third country that has (in that country) functions comparable to those of a competent authority.

This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose.

The controller in relation to the transfer must secure that the transfer takes place only if—

Condition 1 is that the transfer is necessary for any of the law enforcement purposes.

Condition 2 is that the transfer—

Condition 3 is that—

Authorisation is not required as mentioned in subsection (1)(b) if—

Where a transfer is made without the authorisation mentioned in subsection (1)(b), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.

In this section, “relevant international organisation” means an international organisation that carries out functions for any of the law enforcement purposes.

For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to—

The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB).

In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom.

Regulations under this section may, among other things—

Regulations under this section are subject to the negative resolution procedure.

For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under—

In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things—

In subsections (1) and (2)—

When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))—

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations giving approval under section 74AA or to amend or revoke such regulations.

Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA, the Secretary of State must, to the extent necessary, amend or revoke the regulations.

Where regulations under section 74AA are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation.

The Secretary of State must publish—

In the case of regulations under section 74AA which approve only certain transfers to a third country or international organisation that are specified or described in the regulations(in accordance with section 74AA(4)(b))—

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if—

The controller must inform the Commissioner about the categories of data transfers that take place in reliance on subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor).

Where a transfer of data takes place in reliance on this section but not in reliance on section 73(4)(aa) (transfer to processor)—

For the purposes of this section, a legal instrument is “appropriate”, in relation to a transfer of personal data, if—

For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under—

For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred.

In this section, references to the protection provided for the data subject are to that protection taken as a whole.

For provision about standard data protection clauses which the Commissioner considers are capable of securing that the data protection test in this section is met, see section 119A.

A transfer of personal data to a third country or international organisation is based on special circumstances where—

A transfer of personal data is necessary for a special purpose if it is necessary—

But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e) if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer.

In accordance with the third data protection principle, the amount of personal data transferred in reliance on this section must not be excessive in relation to the special purpose relied on.

Where a transfer of data takes place in reliance on this section—

For the purposes of this section, a transfer is necessary for a legal purpose if—

The additional conditions referred to in section 73(4)(b)(ii) are the following four conditions.

Condition 1 is that the transfer is strictly necessary in a specific case for the performance of a task of the transferring controller as provided by law for any of the law enforcement purposes.

Condition 2 is that the transferring controller has determined that there are no fundamental rights and freedoms of the data subject concerned that override the public interest necessitating the transfer.

Condition 3 is that the transferring controller considers that the transfer of the personal data to a relevant authority in the third country would be ineffective or inappropriate (for example, where the transfer could not be made in sufficient time to enable its purpose to be fulfilled).

Condition 4 is that the transferring controller informs the intended recipient of the specific purpose or purposes for which the personal data may, so far as necessary, be processed.

Where personal data is transferred to a person in a third country in reliance on section 73(4)(b), the transferring controller must inform a relevant authority in that third country without undue delay of the transfer, unless this would be ineffective or inappropriate.

The transferring controller must—

This section does not affect the operation of any international agreement in force between the United Kingdom and third countries in the field of judicial co-operation in criminal matters and police co-operation.

Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section 73(4)(aa) (transfer to processor).

... The transferring controller must make it a condition of the transfer —

This subsection applies if—

The UK authoriser may give an authorisation for the purposes of a condition described in subsection (1) only where the further transfer is necessary for a law enforcement purpose.

In deciding whether to give the authorisation, the UK authoriser must take into account (among any other relevant factors)—

In a case where the personal data was originally transmitted or otherwise made available to the transferring controller or another competent authority by a member State ..., the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1) unless that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.

Authorisation is not required as mentioned in subsection (4) if—

Where a transfer is made in a case described in subsection (4) without the authorisation mentioned in that subsection (whether made with or without authorisation from the UK authoriser), the UK authoriser must, without delay, inform, the authority in the member State which would have been responsible for deciding whether to authorise the transfer ....

Where a transfer takes place in reliance on section 73(4)(aa) (transfer to processor), the transferring controller must make it a condition of the transfer that the data is only to be further transferred to a third country or international organisation where—

A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.

The provisions are—

The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—

The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Subject to subsection (5), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 78A(2) is, or at any time was, required in relation to any personal data for the purposes of safeguarding national security is conclusive evidence of that fact.

A certificate issued under subsection (3A)—

Any person directly affected by the issuing of a certificate under subsection (3A) may appeal to the Tribunal against the certificate.

If, on an appeal under subsection (5), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may —

Where in any proceedings under or by virtue of this Act, it is claimed by a controller that a certificate under subsection (3A) which identifies the personal data to which it applies by means of a general description applies to any personal data, any other party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.

But, subject to any determination under subsection (9), the certificate is to be conclusively presumed so to apply.

On an appeal under subsection (7), the Tribunal may determine that the certificate does not so apply.

A document purporting to be a certificate under subsection (3A) is to be—

A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (3A) is—

The power conferred by subsection (3A) on a Minister of the Crown is exercisable only by—

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Subsections (3) and (4) apply where, for a law enforcement purpose, a controller transmits or otherwise makes available personal data to a non-UK recipient.

In this section—...“non-UK recipient” means—a recipient in a third country, or an international organisation.

The controller must consider whether, if the personal data had instead been transmitted or otherwise made available within the United Kingdom to another competent authority, processing of the data by the other competent authority would have been subject to any restrictions by virtue of any enactment or rule of law.

Where that would be the case, the controller must inform the non-UK recipient that the data is transmitted or otherwise made available subject to compliance by that person with the same restrictions (which must be set out in the information given to that person).

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Each controller must implement effective mechanisms to encourage the reporting of an infringement of this Part.

The mechanisms implemented under subsection (1) must provide that an infringement may be reported to any of the following persons—

The mechanisms implemented under subsection (1) must include—

A person who reports an infringement of this Part does not breach—

Subsection (4) does not apply if or to the extent that the report includes a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (5) has effect as if it included a reference to that Part.

This Part—

This Part applies only to—

In this Part, “intelligence service” means—

In this Part—“competent authority” has the same meaning as in Part 3;“qualifying competent authority” means a competent authority specified or described in regulations made by the Secretary of State.

A reference in this Part to the processing of personal data is to processing to which this Part applies.

Regulations under this section are subject to the affirmative resolution procedure.

For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—

The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.

The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—

A designation notice must—

An application for designation of processing of personal data by a qualifying competent authority must be made jointly by—

An application may be made in respect of more than one qualifying competent authority and in respect of processing with more than one intelligence service.

The application must—

Before giving a designation notice, the Secretary of State must consult the Commissioner.

In this section, “joint controller”, in relation to processing of personal data, means a controller whose responsibilities for compliance with this Part in relation to the processing are determined in an arrangement under section 104.

A designation notice must state when it comes into force.

A designation notice ceases to be in force at the earliest of the following times—

The Secretary of State may give a further designation notice in respect of processing that is, or has been, the subject of a previous designation notice.

Subsections (2) to (4) apply where processing is the subject of a designation notice for the time being in force.

A person who applied for the designation of the processing must notify the Secretary of State without undue delay if the person considers that the designation is no longer required for the purposes of safeguarding national security.

A person who applied for the designation of the processing must, on a request from the Secretary of State, provide—

The Secretary of State must at least annually—

The Secretary of State—

A withdrawal notice must—

In determining when a withdrawal notice required under subsection (5)(b) comes into force, the Secretary of State must consider—

Where the Secretary of State gives a designation notice—

The record must contain—

The Commissioner must not publish the text, or a part of the text, of the notice if—

The Commissioner must keep the record of the notice available to the public while the notice is in force.

Where the Secretary of State gives a withdrawal notice, the Secretary of State must send a copy of the notice to the Commissioner.

A person directly affected by a designation notice may appeal to the Tribunal against the notice.

If, on an appeal under this section, the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Secretary of State did not have reasonable grounds for giving the notice, the Tribunal may—

For the purposes of this Part—

This subsection is satisfied by a person who—

Where personal data is processed only—the person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

In this Part, “processor” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).

This section defines other expressions used in this Part.

“Consent”, in relation to the processing of personal data relating to an individual, means a freely given, specific, informed and unambiguous indication of the individual's wishes by which the individual, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data.

“Designation notice” has the meaning given in section 82A.

“Employee”, in relation to any person, includes an individual who holds a position (whether paid or unpaid) under the direction and control of that person.

“Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

“Recipient”, in relation to any personal data, means any person to whom the data is disclosed, whether a third party or not, but it does not include a person to whom disclosure is or may be made in the framework of a particular inquiry in accordance with the law.

“Restriction of processing” means the marking of stored personal data with the aim of limiting its processing for the future.

“Sensitive processing” has the meaning given in section 86(7).

“Withdrawal notice” has the meaning given in section 82C.

Sections 3 and 205 include definitions of other expressions used in this Part.

This Chapter sets out the six data protection principles as follows—

Each of sections 86, 87 and 91 makes provision to supplement the principle to which it relates.

The first data protection principle is that the processing of personal data must be—

The processing of personal data is lawful only if and to the extent that—

The Secretary of State may by regulations amend Schedule 10—

Regulations under subsection (3) are subject to the affirmative resolution procedure.

In determining whether the processing of personal data is fair and transparent, regard is to be had to the method by which it is obtained.

For the purposes of subsection (5), data is to be treated as obtained fairly and transparently if it consists of information obtained from a person who—

In this Part, “sensitive processing” means—

The second data protection principle is that—

Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).

Personal data collected by a controller for one purpose may be processed for any other purpose of the controller that collected the data or any purpose of another controller provided that—

Processing of personal data is to be regarded as compatible with the purpose for which it is collected if the processing—

The sixth data protection principle is that personal data must be processed in a manner that includes taking appropriate security measures as regards risks that arise from processing personal data.

The risks referred to in subsection (1) include (but are not limited to) accidental or unauthorised access to, or destruction, loss, use, modification or disclosure of, personal data.

The Secretary of State may by regulations—

In subsection (1)—“added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);“protected condition in Schedule 10” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3).

Regulations under this section may amend this Part and sections 205 and 206.

Regulations under this section are subject to the affirmative resolution procedure.

This Chapter sets out the rights of the data subject as follows—

In this Chapter, “the controller”, in relation to a data subject, means the controller in relation to personal data relating to the data subject.

The controller must give a data subject the following information—

The controller may comply with subsection (1) by making information generally available, where the controller considers it appropriate to do so.

The controller is not required under subsection (1) to give a data subject information that the data subject already has.

Where personal data relating to a data subject is collected by or on behalf of the controller from a person other than the data subject, the requirement in subsection (1) has effect, in relation to the personal data so collected, with the following exceptions—

An individual is entitled to obtain from a controller—

That information is—

Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.

A controller is not obliged to provide information under this section unless the controller has received such reasonable fee as the controller may require, subject to subsection (4).

The Secretary of State may by regulations—

Where a controller—the controller is not obliged to comply with the request unless the controller is supplied with that further information.

Where a controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, the controller is not obliged to comply with the request unless—

In subsection (6), the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request.

Subsection (6) is not to be construed as excusing a controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.

In determining for the purposes of subsection (6)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard must be had, in particular, to—

Subject to subsections (3), (5) and (6), a controller must comply with a request under subsection (1)—

If a court is satisfied on the application of an individual who has made a request under subsection (1) that the controller in question has failed to comply with the request in contravention of this section, the court may order the controller to comply with the request.

A court may make an order under subsection (11) in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for compliance with the obligation to which the order relates.

The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.

In this section—“the applicable time period” means the period of one month beginning with the relevant time, subject to subsection (14A);“the relevant time”, in relation to a request under subsection (1), means the latest of the following—when the controller receives the request, when the fee (if any) is paid, and when the controller receives the information (if any) required under subsection (5) in connection with the request.

The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—

A notice under subsection (14A) must—

Regulations under this section are subject to the negative resolution procedure.

The controller must comply with the obligation imposed by section 94(1)(b)(i) by supplying the data subject with a copy of the information in writing unless—and where any of the information referred to in section 94(1)(b)(i) is expressed in terms which are not intelligible without explanation the copy must be accompanied by an explanation of those terms.

Where a controller has previously complied with a request made under section 94 by an individual, the controller is not obliged to comply with a subsequent identical or similar request under that section by that individual unless a reasonable interval has elapsed between compliance with the previous request and the making of the current request.

In determining for the purposes of subsection (2) whether requests under section 94 are made at reasonable intervals, regard must be had to—

The information to be supplied pursuant to a request under section 94 must be supplied by reference to the data in question at the time when the request is received, except that it may take account of any amendment or deletion made between that time and the time when the information is supplied, being an amendment or deletion that would have been made regardless of the receipt of the request.

For the purposes of section 94(6) to (8), an individual can be identified from information to be disclosed to a data subject by a controller if the individual can be identified from—

The controller may not take a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to the data subject.

Subsection (1) does not prevent such a decision being made on that basis if—

For the purposes of this section and section 97, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.

For the purposes of this section and section 97, a decision is based on entirely automated processing if the decision-making process does not include an opportunity for a human being to accept, reject or influence the decision.

This section applies where—

This section does not apply to such a decision if—

The controller must as soon as reasonably practicable notify the data subject that such a decision has been made.

The data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller—

If a request is made to the controller under subsection (4), the controller must, before the end of the period of 1 month beginning with receipt of the request—

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Where—the data subject is entitled to obtain from the controller, on request, knowledge of the reasoning underlying the processing.

Where the data subject makes a request under subsection (1), the controller must comply with the request without undue delay.

A data subject is entitled at any time, by notice given to the controller, to require the controller—on the ground that, for specified reasons relating to the situation of the data subject, the processing in question is an unwarranted interference with the interests or rights of the data subject.

Where the controller—the controller is not obliged to comply with the notice unless the controller is supplied with that further information.

The controller must, before the end of 21 days beginning with the relevant time, give a notice to the data subject—

If the controller does not comply with a notice under subsection (1) to any extent, the data subject may apply to a court for an order that the controller take steps for complying with the notice.

If the court is satisfied that the controller should comply with the notice (or should comply to any extent), the court may order the controller to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit.

A court may make an order under subsection (5) in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for compliance with the obligation to which the order relates.

The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.

In this section, “the relevant time”, in relation to a notice under subsection (1), means—

If a court is satisfied on the application of a data subject that personal data relating to the data subject is inaccurate, the court may order the controller to rectify that data without undue delay.

If a court is satisfied on the application of a data subject that the processing of personal data relating to the data subject would infringe any of sections 86 to 91, the court may order the controller to erase that data without undue delay.

If personal data relating to the data subject must be maintained for the purposes of evidence, the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay.

If—the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay.

A court may make an order under this section in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for carrying out the rectification, erasure or restriction of processing that the court proposes to order.

The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.

Where a controller proposes that a particular type of processing of personal data be carried out by or on behalf of the controller, the controller must, prior to the processing, consider the impact of the proposed processing on the rights and freedoms of data subjects.

A controller must implement appropriate technical and organisational measures which are designed to ensure that—

Where two or more controllers jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.

Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.

The arrangement must designate the controller which is to be the contact point for data subjects.

This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.

The controller may use only a processor who undertakes—

If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.