Data Protection and Digital Information Bill

“

3A Information relating to an identifiable living individual

(1) For the purposes of this Act, information being processed is information relating to an identifiable living individual only in cases described in subsections (2) and (3).

(2) The first case is where the living individual is identifiable (as described in section 3(3)) by the controller or processor by reasonable means at the time of the processing.

(3) The second case is where the controller or processor knows, or ought reasonably to know, that—

(a) another person will, or is likely to, obtain the information as a result of the processing, and

(b) the living individual will be, or is likely to be, identifiable (as described in section 3(3)) by that person by reasonable means at the time of the processing.

(4) The reference in subsection (3)(a) to obtaining the information as a result of the processing includes obtaining the information as a result of the controller or processor carrying out the processing without implementing appropriate technical and organisational measures to mitigate the risk of the information being obtained by persons with whom the controller or processor does not intend to share the information.

(5) For the purposes of this section, an individual is identifiable by a person “by reasonable means” if the individual is identifiable by the person by any means that the person is reasonably likely to use.

(6) For the purposes of subsection (5), whether a person is reasonably likely to use a means of identifying an individual is to be determined taking into account, among other things—

(a) the time, effort and costs involved in identifying the individual by that means, and

(b) the technology and other resources available to the person.

”

“

7. A data subject’s consent is to be treated as falling within the definition of “consent” in point (11) of paragraph 1 if—

(a) it does not fall within that definition because (and only because) the consent is given to the processing of personal data for the purposes of an area of scientific research,

(b) at the time the consent is sought, it is not possible to identify fully the purposes for which personal data is to be processed,

(c) seeking consent in relation to the area of scientific research is consistent with generally recognised ethical standards relevant to the area of research, and

(d) so far as the intended purposes of the processing allow, the data subject is given the opportunity to consent only to processing for part of the research.

8. References in this Regulation to consent given for a specific purpose (however expressed) include consent described in paragraph 7.

”

“

(1A) “Consent” of the data subject to the processing of personal data means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data (and see section 40A).

”

“

(aa) section 40A makes provision about processing carried out in reliance on the consent of the data subject,

”

“

40A Conditions for consent

(1) This section is about processing of personal data that is carried out in reliance on the consent of the data subject.

(2) The controller must be able to demonstrate that the data subject consented to the processing.

(3) If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made—

(a) in a manner which clearly distinguishes the request from the other matters,

(b) in an intelligible and easily accessible form, and

(c) in clear and plain language.

(4) Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding.

(5) The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal).

(6) Processing may only be carried out in reliance on consent if—

(a) before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and

(b) it is as easy for the data subject to withdraw the consent as to give it.

(7) When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service.

”

“

5. For the purposes of paragraph 1(ea), processing is necessary for the purposes of a recognised legitimate interest only if it meets a condition in Annex 1.

6. The Secretary of State may by regulations amend Annex 1 by—

(a) adding or varying provisions, or

(b) omitting provisions added by regulations made under this paragraph.

7. The Secretary of State may only make regulations under paragraph 6 where the Secretary of State considers it appropriate to do so having regard to, among other things—

(a) the interests and fundamental rights and freedoms of data subjects which require protection of personal data, and

(b) where relevant, the need to provide children with special protection with regard to their personal data.

8. Regulations under paragraph 6 are subject to the affirmative resolution procedure.

9. For the purposes of paragraph 1(f), examples of types of processing that may be processing that is necessary for the purposes of a legitimate interest include—

(a) processing that is necessary for the purposes of direct marketing,

(b) intra-group transmission of personal data (whether relating to clients, employees or other individuals) where that is necessary for internal administrative purposes, and

(c) processing that is necessary for the purposes of ensuring the security of network and information systems.

10. In paragraph 9—

intra-group transmission means transmission between members of a group of undertakings or between members of a group of institutions affiliated to a central body;

security of network and information systems has the same meaning as in the Network and Information Systems Regulations 2018 (S.I. 2018/506) (see regulation 1(3)(g)).

”

“

3. For the avoidance of doubt, processing is not lawful by virtue only of being processing in a manner that is compatible with the purposes for which the personal data was collected.

”

“

Article 8A

Purpose limitation: further processing

1. This Article is about the determination, for the purposes of Article 5(1)(b) (purpose limitation), of whether processing of personal data by or on behalf of a controller for a purpose (a “new purpose”) other than the purpose for which the controller collected the data (“the original purpose”) is processing in a manner compatible with the original purpose.

2. In making the determination, a person must take into account, among other things—

(a) any link between the original purpose and the new purpose;

(b) the context in which the personal data was collected, including the relationship between the data subject and the controller;

(c) the nature of the personal data, including whether it is a special category of personal data (see Article 9) or personal data related to criminal convictions and offences (see Article 10);

(d) the possible consequences of the intended processing for data subjects;

(e) the existence of appropriate safeguards (for example, encryption or pseudonymisation).

3. Processing of personal data for a new purpose is to be treated as processing in a manner compatible with the original purpose where—

(a) the data subject consents to the processing of personal data for the new purpose and the new purpose is specified, explicit and legitimate,

(b) the processing is carried out in accordance with Article 84B—

(i) for the purposes of scientific research or historical research,

(ii) for the purposes of archiving in the public interest, or

(iii) for statistical purposes,

(c) the processing is carried out for the purposes of ensuring that processing of personal data complies with Article 5(1) or demonstrating that it does so,

(d) the processing meets a condition in Annex 2, or

(e) the processing is necessary to safeguard an objective listed in Article 23(1)(c) to (j) and is authorised by an enactment or rule of law.

4. Where the controller collected the personal data based on Article 6(1)(a) (data subject’s consent), processing for a new purpose is only processing in a manner compatible with the original purpose if—

(a) it falls within paragraph 3(a) or (c), or

(b) it falls within paragraph 3(d) or (e) and the controller cannot reasonably be expected to obtain the data subject’s consent.

5. The Secretary of State may by regulations amend Annex 2 by—

(a) adding or varying provisions, or

(b) omitting provisions added by regulations made under this paragraph.

6. The Secretary of State may only make regulations under paragraph 5 adding a case to Annex 2 where the Secretary of State considers that processing in that case is necessary to safeguard an objective listed in Article 23(1)(c) to (j).

7. Regulations under paragraph 5 may make provision identifying processing by any means, including by reference to the controller, the data subject, the personal data or the provision of Article 6(1) relied on for the purposes of the processing.

8. Regulations under paragraph 5 are subject to the affirmative resolution procedure.

”

“

Article 12A

Vexatious or excessive requests

1. Paragraph 2 applies where a request from a data subject under any of Articles 15 to 22 or 34 is vexatious or excessive.

2. The controller may—

(a) charge a reasonable fee for dealing with the request (see section 12 of the 2018 Act), or

(b) refuse to act on the request.

3. In any proceedings where there is an issue as to whether a request is vexatious or excessive, it is for the controller to show that it is.

4. Whether a request is vexatious or excessive must be determined having regard to the circumstances of the request, including (so far as relevant)—

(a) the nature of the request,

(b) the relationship between the data subject and the controller,

(c) the resources available to the controller,

(d) the extent to which the request repeats a previous request made by the data subject to the controller,

(e) how long ago any previous request was made, and

(f) whether the request overlaps with other requests made by the data subject to the controller.

5. Examples of requests that may be vexatious include requests that—

(a) are intended to cause distress,

(b) are not made in good faith, or

(c) are an abuse of process.

”

“

204A Vexatious or excessive

(1) For the purposes of this Act, whether a request is vexatious or excessive must be determined having regard to the circumstances of the request, including (so far as relevant)—

(a) the nature of the request,

(b) the relationship between the person making the request (the “sender”) and the person receiving it (the “recipient”),

(c) the resources available to the recipient,

(d) the extent to which the request repeats a previous request made by the sender to the recipient,

(e) how long ago any previous request was made, and

(f) whether the request overlaps with other requests made by the sender to the recipient.

(2) For the purposes of this Act, examples of requests that may be vexatious include requests that—

(a) are intended to cause distress,

(b) are not made in good faith, or

(c) are an abuse of process.

”

“

excessive

section 204A”;

“vexatious

section 204A

”

“

Article 12B

Meaning of “applicable time period”

1. In Article 12, “the applicable time period” means the period of one month beginning with the relevant time, subject to paragraph 3.

2. “The relevant time” means the latest of the following—

(a) when the controller receives the request in question;

(b) when the controller receives the information (if any) requested in connection with a request under Article 12(6);

(c) when the fee (if any) charged in connection with the request under Article 12A is paid.

3. The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—

(a) the complexity of requests made by the data subject, or

(b) the number of such requests.

4. A notice under paragraph 3 must—

(a) be given before the end of the period of one month beginning with the relevant time, and

(b) state the reasons for the delay.

5. Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under Article 15 relates—

(a) the controller may ask the data subject to provide the further information, and

(b) the period beginning with the day on which the controller makes the request and ending with the day on which the controller receives the information does not count towards—

(i) the applicable time period, or

(ii) the period described in paragraph 4(a).

6. An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.

”

“

Data subject’s rights to information

”

“

45A Exemption from sections 44 and 45: legal professional privilege

(1) Sections 44(2) and 45(1) do not require the controller to give the data subject—

(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or

(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

(2) A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—

(a) the decision to rely on the exemption,

(b) the reason for the decision,

(c) the data subject’s right to make a request to the Commissioner under section 51,

(d) the data subject’s right to lodge a complaint with the Commissioner under section 165, and

(e) the data subject’s right to apply to a court under section 167.

(3) Subsection (2)(a) and (b) do not apply to the extent that complying with them would—

(a) undermine a claim described in subsection (1)(a), or

(b) conflict with a duty described in subsection (1)(b).

(4) The controller must—

(a) record the reason for a decision to rely on the exemption in subsection (1), and

(b) if requested to do so by the Commissioner, make the record available to the Commissioner.

(5) The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).

”

“

Section 4A Automated individual decision-making

Article 22A

Automated processing and significant decisions

1. For the purposes of Articles 22B and 22C—

(a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and

(b) a decision is a significant decision, in relation to a data subject, if—

(i) it produces a legal effect for the data subject, or

(ii) it has a similarly significant effect for the data subject.

2. When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.

Article 22B

Restrictions on automated decision-making

1. A significant decision based entirely or partly on special categories of personal data referred to in Article 9(1) may not be taken based solely on automated processing, unless one of the following conditions is met.

2. The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.

3. The second condition is that—

(a) the decision is—

(i) necessary for entering into, or performing, a contract between the data subject and a controller, or

(ii) required or authorised by law, and

(b) point (g) of Article 9(2) applies.

4. A significant decision may not be taken based solely on automated processing if the processing of personal data carried out by, or on behalf of, the decision-maker for the purposes of the decision is carried out entirely or partly in reliance on Article 6(1)(ea).

Article 22C

Safeguards for automated decision-making

1. Where a significant decision taken by or on behalf of a controller in relation to a data subject is—

(a) based entirely or partly on personal data, and

(b) based solely on automated processing,

the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with paragraph 2 and any regulations under Article 22D(4).

2. The safeguards must consist of or include measures which—

(a) provide the data subject with information about decisions described in paragraph 1 taken in relation to the data subject;

(b) enable the data subject to make representations about such decisions;

(c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;

(d) enable the data subject to contest such decisions.

Article 22D

Further provision about automated decision-making

1. The Secretary of State may by regulations provide that, for the purposes of Article 22A(1)(a), there is, or is not, to be taken to be meaningful human involvement in the taking of a decision in cases described in the regulations.

2. The Secretary of State may by regulations provide that, for the purposes of Article 22A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant effect for the data subject.

3. Regulations under paragraph 1 or 2 may amend Article 22A.

4. The Secretary of State may by regulations make further provision about the safeguards required under Article 22C(1), including provision about what is, or is not, to be taken to satisfy a requirement under Article 22C(1) or (2).

5. Regulations under paragraph 4 may amend Article 22C—

(a) by adding or varying safeguards, and

(b) by omitting provision added by regulations under that paragraph.

6. Regulations under this Article are subject to the affirmative resolution procedure.

”

“

50A Automated processing and significant decisions

(1) For the purposes of sections 50B and 50C—

(a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and

(b) a decision is a significant decision, in relation to a data subject, if—

(i) it produces an adverse legal effect for the data subject, or

(ii) it has a similarly significant adverse effect for the data subject.

(2) When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.

50B Restrictions on automated decision-making using sensitive personal data

(1) A significant decision based entirely or partly on sensitive personal data may not be taken based solely on automated processing, unless one of the following conditions is met.

(2) The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.

(3) The second condition is that the decision is required or authorised by law.

50C Safeguards for automated decision-making

(1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—

(a) based entirely or partly on personal data, and

(b) based solely on automated processing,

the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).

(2) The safeguards must consist of or include measures which—

(a) provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;

(b) enable the data subject to make representations about such decisions;

(c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;

(d) enable the data subject to contest such decisions.

(3) Subsections (1) and (2) do not apply in relation to a significant decision if—

(a) exemption from those provisions is required for a reason listed in subsection (4),

(b) the controller reconsiders the decision as soon as reasonably practicable, and

(c) there is meaningful human involvement in the reconsideration of the decision.

(4) Those reasons are—

(a) to avoid obstructing an official or legal inquiry, investigation or procedure;

(b) to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c) to protect public security;

(d) to safeguard national security;

(e) to protect the rights and freedoms of others.

(5) When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.

50D Further provision about automated decision-making

(1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations.

(2) The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject.

(3) Regulations under subsection (1) or (2) may amend section 50A.

(4) The Secretary of State may by regulations make further provision about the safeguards required under section 50C(1), including provision about what is, or is not, to be taken to satisfy a requirement under section 50C(1) or (2).

(5) Regulations under subsection (4) may amend section 50C—

(a) by adding or varying safeguards, and

(b) by omitting provision added by regulations under that subsection.

(6) Regulations under this section are subject to the affirmative resolution procedure.

”

“

Section 1A Senior responsible individual

Article 27A

Designation of senior responsible individual

1. This Article and Articles 27B and 27C apply to a controller or processor that—

(a) is a public body, or

(b) carries out processing of personal data which, taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of individuals,

other than a court or tribunal acting in its judicial capacity.

2. The controller or processor must designate one individual to be its senior responsible individual, subject to paragraph 3(b).

3. Where the controller or processor is an organisation—

(a) a designated individual must be part of the organisation’s senior management, and

(b) the controller or processor may designate two or more individuals to act jointly as its senior responsible individual where the individuals are employed part-time and share a single role within the organisation’s senior management.

4. The controller or processor must—

(a) ensure that the current contact details of the senior responsible individual are publicly available, and

(b) send those details to the Commissioner.

5. In this Article, “senior management”, in relation to an organisation, means the individuals who play significant roles in the making of decisions about how the whole or a substantial part of its activities are to be managed or organised.

Article 27B

Senior responsible individual’s tasks

1. The senior responsible individual designated by a controller must be responsible at least for performing the tasks listed in paragraph 2 or securing that they are performed by another person.

2. Those tasks are—

(a) monitoring compliance by the controller with the data protection legislation;

(b) ensuring that the controller develops, implements, reviews and updates measures to ensure its compliance with the data protection legislation;

(c) informing and advising the controller, any processor engaged by the controller and employees of the controller who carry out processing of personal data of their obligations under the data protection legislation;

(d) organising training for employees of the controller who carry out processing of personal data;

(e) dealing with complaints made to the controller in connection with the processing of personal data;

(f) dealing with personal data breaches;

(g) co-operating with the Commissioner on behalf of the controller;

(h) acting as the contact point for the Commissioner on issues relating to processing of personal data.

3. The senior responsible individual designated by a processor must be responsible at least for performing the tasks listed in paragraph 4 or securing that they are performed by another person.

4. Those tasks are—

(a) monitoring compliance by the processor with Articles 28, 30A and 32;

(b) co-operating with the Commissioner on behalf of the processor;

(c) acting as the contact point for the Commissioner on issues relating to processing of personal data.

5. Where the performance of one of its tasks would result in a conflict of interests, the senior responsible individual must secure that the task is performed by another person.

6. In deciding whether one or more of their tasks should be performed by another person (whether alone or jointly with others) and, if so, by whom, the senior responsible individual must consider, among other things—

(a) the other person’s professional qualifications and knowledge of the data protection legislation,

(b) the resources likely to be available to the other person to carry out the task, and

(c) whether the other person is involved in day-to-day processing of personal data for the controller or processor and, if so, whether that affects the person’s ability to perform the task.

Article 27C

Senior responsible individual’s position

1. A controller or processor must support its senior responsible individual in the performance of the individual’s tasks, including by providing the individual with appropriate resources.

2. A controller or processor must not dismiss or penalise its senior responsible individual for performing the individual’s tasks.

3. Where the senior responsible individual decides that one or more of its tasks should be performed by another person, the controller or processor must ensure that the person—

(a) has appropriate resources to perform the task,

(b) is not dismissed or penalised by the controller or processor for performing the task, and

(c) does not receive instructions about the performance of the task.

4. Paragraph 3(c) does not require the controller or processor to prevent instructions being given by the senior responsible individual or another person performing a task for the senior responsible individual, except where such instructions would involve a conflict of interests.

Section 1B Processor etc

”

“

Senior responsible individual

58A Designation of senior responsible individual

(1) This section and sections 58B and 58C apply to all controllers and processors other than a court, or other judicial authority, acting in its judicial capacity.

(2) The controller or processor must designate one individual to be its senior responsible individual.

(3) Where the controller or processor is an organisation—

(a) a designated individual must be part of the organisation’s senior management, and

(b) the controller or processor may designate two or more individuals to act jointly as its senior responsible individual where the individuals are employed part-time and share a single role within the organisation’s senior management.

(4) The controller or processor must—

(a) ensure that the current contact details of the senior responsible individual are publicly available, and

(b) send those details to the Commissioner.

(5) In this section, “senior management”, in relation to an organisation, means the individuals who play significant roles in the making of decisions about how the whole or a substantial part of its activities are to be managed or organised.

58B Tasks of the senior responsible individual

(1) The senior responsible individual designated by a controller must be responsible at least for performing the tasks listed in subsection (2) or securing that they are performed by another person.

(2) Those tasks are—

(a) monitoring compliance by the controller with the data protection legislation;

(b) ensuring that the controller develops, implements, reviews and updates measures to ensure its compliance with the data protection legislation;

(c) informing and advising the controller, any processor engaged by the controller and employees of the controller who carry out processing of personal data of their obligations under the data protection legislation;

(d) organising training for employees of the controller who carry out processing of personal data;

(e) dealing with complaints made to the controller in connection with the processing of personal data;

(f) dealing with personal data breaches;

(g) co-operating with the Commissioner on behalf of the controller;

(h) acting as the contact point for the Commissioner on issues relating to processing of personal data.

(3) The senior responsible individual designated by a processor must be responsible at least for performing the tasks listed in subsection (4) or securing that they are performed by another person.

(4) Those tasks are—

(a) monitoring compliance by the processor with sections 59, 61A and 66;

(b) co-operating with the Commissioner on behalf of the processor;

(c) acting as the contact point for the Commissioner on issues relating to processing of personal data.

(5) Where the performance of one of its tasks would result in a conflict of interests, the senior responsible individual must secure that the task is performed by another person.

(6) In deciding whether one or more of their tasks should be performed by another person (whether alone or jointly with others), and, if so, by whom, the senior responsible individual must consider, among other things—

(a) the other person’s professional qualifications and knowledge of the data protection legislation,

(b) the resources likely to be available to the other person to carry out the task, and

(c) whether the other person is involved in day-to-day processing of personal data for the controller or processor and, if so, whether that affects the person’s ability to perform the task.

58C Senior responsible individual’s position

(1) A controller or processor must support its senior responsible individual in the performance of the individual’s tasks, including by providing the individual with appropriate resources.

(2) A controller or processor must not dismiss or penalise its senior responsible individual for performing the individual’s tasks.

(3) Where its senior responsible individual decides that one or more of its tasks should be performed by another person, the controller or processor must ensure that the person—

(a) has appropriate resources to perform the task,

(b) is not dismissed or penalised by the controller or processor for performing the task, and

(c) does not receive instructions about the performance of the task.

(4) Subsection (3)(c) does not require the controller or processor to prevent instructions being given by the senior responsible individual or another person performing a task for the senior responsible individual, except where such instructions would involve a conflict of interests.

Processor etc

”

“

Section 1C Records and co-operation with the Commissioner

”

“

Article 30A

Records of processing of personal data

1. In this Article—

(a) paragraphs 2 to 4, 8 and 9 apply to a controller that carries out processing of personal data which, taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of individuals, and

(b) paragraphs 5 to 9 apply to a processor that carries out such processing.

2. The controller must maintain appropriate records of processing of personal data carried out by or on behalf of the controller.

3. The controller’s records must include at least the following information about the personal data in respect of which the controller is for the time being a controller—

(a) where the personal data is (including information about any personal data that is outside the United Kingdom),

(b) the purposes for which the controller is processing the personal data,

(c) the categories of person with whom the controller has shared, or intends to share, the personal data (including persons who are in third countries or international organisations),

(d) how long the controller intends to retain the personal data,

(e) whether the personal data includes special categories of personal data referred to in Article 9(1) and, if so, which categories, and

(f) whether the personal data includes personal data relating to criminal convictions and offences or related security measures referred to in Article 10(1) and, if so, which types of such data.

4. Where possible, the controller’s records must include information about how it ensures that personal data is secure.

5. The processor must maintain appropriate records of its processing of personal data.

6. The processor’s records must include at least the following information about the personal data in respect of which it is for the time being a processor—

(a) the name and contact details of each controller on behalf of which the processor is acting, and

(b) where the personal data is (including information about any personal data that is outside the United Kingdom).

7. Where possible, the processor’s records must include information about how it ensures that personal data is secure.

8. A controller or processor must make the records maintained under this Article available to the Commissioner on request.

9. In deciding what is appropriate for the purposes of this Article, a controller or processor must take into account, among other things—

(a) the nature, scope, context and purposes of processing carried out by or on behalf of the controller or by the processor,

(b) the risks for the rights and freedoms of individuals arising from that processing, including the likelihood of risks arising and their severity, and

(c) the resources available to the controller or processor.

”

“

Records and co-operation with the Commissioner

”

“

61A Records of processing of personal data

(1) Each controller must maintain appropriate records of processing of personal data carried out by or on behalf of the controller.

(2) The controller’s records must include at least the following information about the personal data in respect of which the controller is for the time being a controller—

(a) where the personal data is (including information about any personal data that is outside the United Kingdom),

(b) the purposes for which the controller is processing the personal data,

(c) the categories of person with whom the controller has shared, or intends to share, the personal data (including persons who are in third countries or international organisations),

(d) how long the controller intends to retain the personal data, and

(e) whether the personal data includes personal data described in section 35(8) and, if so, which types of such data.

(3) Where possible, the controller’s records must include information about how it ensures that personal data is secure.

(4) Each processor must maintain appropriate records of its processing of personal data.

(5) The processor’s records must include at least the following information about the personal data in respect of which it is for the time being a processor—

(a) the name and contact details of each controller on behalf of which the processor is acting, and

(b) where the personal data is (including information about any personal data that is outside the United Kingdom).

(6) Where possible, the processor’s records must include information about how it ensures that personal data is secure.

(7) A controller or processor must make the records maintained under this section available to the Commissioner on request.

(8) In deciding what is appropriate for the purposes of this section, a controller or processor must take into account, among other things—

(a) the nature, scope, context and purposes of processing carried out by or on behalf of the controller or by the processor,

(b) the risks for the rights and freedoms of individuals arising from that processing, including the likelihood of risks arising and their severity, and

(c) the resources available to the controller or processor.

”

“

(k) produce and publish a document containing examples of types of processing which the Commissioner considers are likely to result in a high risk to the rights and freedoms of individuals (for the purposes of Articles 27A, 30A and 35);

”

“

Risk assessment and prior consultation

”

“

4A. If the action taken by a body under paragraph 4 consists of suspending or excluding a controller or processor from the code, the body must inform the Commissioner, giving reasons for taking that action.

”

“

(e) makes provision about codes of conduct (see section 68A).

”

“

(4) Adherence to a code of conduct approved under section 68A may be used by a controller as a means of demonstrating compliance with the requirements of this Part.

”

“

(7A) Adherence to a code of conduct approved under section 68A may be used by a processor as a means of demonstrating sufficient guarantees as described in subsection (2).

”

“

(3) Adherence to a code of conduct approved under section 68A may be used by a controller or processor as a means of demonstrating compliance with subsection (1).

”

“

Codes of conduct

68A Codes of conduct

(1) The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.

(2) Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.

(3) For the purposes of this section—

(a) “public body” means a body or other person whose functions are, or include, functions of a public nature, and

(b) a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).

(4) A code of conduct described in subsection (1) may, for example, make provision with regard to—

(a) lawful and fair processing;

(b) the collection of personal data;

(c) the information provided to the public and to data subjects;

(d) the exercise of the rights of data subjects;

(e) the measures and procedures referred to in sections 56, 57 and 62;

(f) the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;

(g) the transfer of personal data to third countries or international organisations;

(h) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.

(5) The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.

(6) Where an expert public body does so, the Commissioner must—

(a) provide the body with an opinion on whether the code correctly reflects the requirements of this Part,

(b) decide whether to approve the code, and

(c) if the code is approved, register and publish the code.

(7) Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.

”

“

CHAPTER 8A — Safeguards for processing for research, archiving or statistical purposes

Article 84A

Research, archives and statistics

1. This Chapter makes provision about the processing of personal data—

(a) for the purposes of scientific research or historical research,

(b) for the purposes of archiving in the public interest, or

(c) for statistical purposes.

2. Those purposes are referred to in this Chapter as “RAS purposes”.

Article 84B

Additional requirements when processing for RAS purposes

1. Personal data may only be processed for RAS purposes if—

(a) the processing consists of the collection of the personal data (whether from the data subject or otherwise),

(b) the processing is carried out in order to convert the personal data into information which can be processed in a manner which does not permit the identification of a living individual, or

(c) without the processing, the RAS purposes cannot be fulfilled.

2. For the purposes of paragraph 1, processing permits the identification of a living individual only in cases described in section 3A(2) and (3) of the 2018 Act (information relating to an identifiable living individual).

3. Processing of personal data for RAS purposes must be carried out subject to appropriate safeguards for the rights and freedoms of the data subject.

Article 84C

Appropriate safeguards

1. This Article makes provision about when the requirement under Article 84B(3) for processing of personal data to be carried out subject to appropriate safeguards is satisfied.

2. The requirement is not satisfied if the processing is likely to cause substantial damage or substantial distress to a data subject to whom the personal data relates.

3. The requirement is not satisfied if the processing is carried out for the purposes of measures or decisions with respect to a particular data subject to whom the personal data relates, except where the purposes for which the processing is carried out include the purposes of approved medical research.

4. The requirement is only satisfied if the safeguards include technical and organisational measures for the purpose of ensuring respect for the principle of data minimisation (see Article 5(1)(c)), such as, for example, pseudonymisation.

5. In this Article—

approved medical research means medical research carried out by a person who has approval to carry out that research from—

(a) a research ethics committee recognised or established by the Health Research Authority under Chapter 2 of Part 3 of the Care Act 2014, or

(b) a body appointed by any of the following for the purpose of assessing the ethics of research involving individuals—

(i) the Secretary of State, the Scottish Ministers, the Welsh Ministers or a Northern Ireland department;

(ii) a relevant NHS body;

(iii) United Kingdom Research and Innovation or a body that is a Research Council for the purposes of the Science and Technology Act 1965;

(iv) an institution that is a research institution for the purposes of Chapter 4A of Part 7 of the Income Tax (Earnings and Pensions) Act 2003 (see section 457 of that Act);

relevant NHS body means—

(a) an NHS trust or NHS foundation trust in England,

(b) an NHS trust or Local Health Board in Wales,

(c) a Health Board or Special Health Board constituted under section 2 of the National Health Service (Scotland) Act 1978,

(d) the Common Services Agency for the Scottish Health Service, or

(e) any of the health and social care bodies in Northern Ireland falling within paragraphs (b) to (e) of section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)).

Article 84D

Appropriate safeguards: further provision

1. The Secretary of State may by regulations make further provision about when the requirement for appropriate safeguards under Article 84B(3) is satisfied.

2. The power under this Article includes power to amend Article 84C by adding, varying or omitting provision, except that it does not include power—

(a) to vary or omit paragraph 1 of that Article, or

(b) to omit any of paragraphs 2 to 4 of that Article.

3. Regulations under this Article are subject to the affirmative resolution procedure.

”

“

(zi) Article 77 (right to lodge a complaint with the Commissioner);

”

“

78A National security exemption

(1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.

(2) The provisions are—

(a) Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);

(b) Chapter 3 of this Part (rights of the data subject);

(c) in Chapter 4 of this Part—

(i) section 67 (notification of personal data breach to the Commissioner);

(ii) section 68 (communication of personal data breach to the data subject);

(d) Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);

(e) in Part 5—

(i) section 119 (inspection in accordance with international obligations);

(ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;

(f) in Part 6—

(i) sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);

(ii) sections 170 to 173 (offences relating to personal data);

(g) in Part 7, section 187 (representation of data subjects).

(3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—

(a) section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;

(b) section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);

(c) section 42 (safeguards: sensitive processing);

(d) Schedule 8 (conditions for sensitive processing).

(4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—

(a) the following provisions of section 73—

(i) subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);

(ii) subsections (1)(d), (5) and (6) (conditions for transfer of personal data originally made available by a member State);

(b) section 78 (subsequent transfers).

”

“

(ca) in Part 3 of this Act, section 78A, and

”

“

82A Designation of processing by a qualifying competent authority

(1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—

(a) an application for designation of the processing is made in accordance with this section, and

(b) the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.

(2) The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.

(3) The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—

(a) a country or territory outside the United Kingdom, or

(b) an international organisation.

(4) A designation notice must—

(a) specify or describe the processing and qualifying competent authority that are designated, and

(b) be given to the applicants for the designation (and see also section 82D).

(5) An application for designation of processing of personal data by a qualifying competent authority must be made jointly by—

(a) the qualifying competent authority, and

(b) the intelligence service with which the processing is to be carried out.

(6) An application may be made in respect of more than one qualifying competent authority and in respect of processing with more than one intelligence service.

(7) The application must—

(a) describe the processing, including the intended purposes and means of processing, and

(b) explain why the applicants consider that designation is required for the purposes of safeguarding national security.

(8) Before giving a designation notice, the Secretary of State must consult the Commissioner.

(9) In this section, “joint controller”, in relation to processing of personal data, means a controller whose responsibilities for compliance with this Part in relation to the processing are determined in an arrangement under section 104.

82B Duration of designation notice

(1) A designation notice must state when it comes into force.

(2) A designation notice ceases to be in force at the earliest of the following times—

(a) at the end of the period of 5 years beginning with the day on which it comes into force;

(b) (if relevant) at the end of a shorter period specified in the notice;

(c) when the notice is withdrawn under section 82C.

(3) The Secretary of State may give a further designation notice in respect of processing that is, or has been, the subject of a previous designation notice.

82C Review and withdrawal of designation notice

(1) Subsections (2) to (4) apply where processing is the subject of a designation notice for the time being in force.

(2) A person who applied for the designation of the processing must notify the Secretary of State without undue delay if the person considers that the designation is no longer required for the purposes of safeguarding national security.

(3) A person who applied for the designation of the processing must, on a request from the Secretary of State, provide—

(a) a description of the processing that is being, or is intended to be, carried out in reliance on the notice, and

(b) an explanation of why the person considers that designation of the processing continues to be required for the purposes of safeguarding national security.

(4) The Secretary of State must at least annually—

(a) review each designation notice that is for the time being in force, and

(b) consider whether designation of the processing which is the subject of the notice continues to be required for the purposes of safeguarding national security.

(5) The Secretary of State—

(a) may withdraw a designation notice by giving a further notice (a “withdrawal notice”) to the persons who applied for the designation, and

(b) must give a withdrawal notice if the Secretary of State considers that designation of some or all of the processing to which the notice applies is no longer required for the purposes of safeguarding national security (whether as a result of a review required under subsection (4) or otherwise).

(6) A withdrawal notice must—

(a) withdraw the designation notice completely, and

(b) state when it comes into force.

(7) In determining when a withdrawal notice required under subsection (5)(b) comes into force, the Secretary of State must consider—

(a) the desirability of the processing ceasing to be designated as soon as possible, and

(b) where relevant, the time needed to effect an orderly transition to new arrangements for the processing of personal data.

82D Records of designation notices

(1) Where the Secretary of State gives a designation notice—

(a) the Secretary of State must send a copy of the notice to the Commissioner, and

(b) the Commissioner must publish a record of the notice.

(2) The record must contain—

(a) the Secretary of State’s name,

(b) the date on which the notice was given,

(c) the date on which the notice ceases to have effect (if not previously withdrawn), and

(d) subject to subsection (3), the rest of the text of the notice.

(3) The Commissioner must not publish the text, or a part of the text, of the notice if—

(a) the Secretary of State has determined that publishing the text or that part of the text—

(i) would be against the interests of national security,

(ii) would be contrary to the public interest, or

(iii) might jeopardise the safety of any person, and

(b) the Secretary of State has notified the Commissioner of that determination.

(4) The Commissioner must keep the record of the notice available to the public while the notice is in force.

(5) Where the Secretary of State gives a withdrawal notice, the Secretary of State must send a copy of the notice to the Commissioner.

82E Appeal against designation notice

(1) A person directly affected by a designation notice may appeal to the Tribunal against the notice.

(2) If, on an appeal under this section, the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Secretary of State did not have reasonable grounds for giving the notice, the Tribunal may—

(a) allow the appeal, and

(b) quash the notice.

”

“

(1A) This Part does not apply to processing to which Part 4 applies by virtue of a designation notice (see section 82A).

”

“

Duties in carrying out functions

120A Principal objective

It is the principal objective of the Commissioner, in carrying out functions under the data protection legislation—

(a) to secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and

(b) to promote public trust and confidence in the processing of personal data.

120B Duties in relation to functions under the data protection legislation

In carrying out functions under the data protection legislation, the Commissioner must have regard to such of the following as appear to the Commissioner to be relevant in the circumstances—

(a) the desirability of promoting innovation;

(b) the desirability of promoting competition;

(c) the importance of the prevention, investigation, detection and prosecution of criminal offences;

(d) the need to safeguard public security and national security.

120C Strategy

(1) The Commissioner must prepare a strategy for carrying out the Commissioner’s functions under the data protection legislation in accordance with the Commissioner’s duties under—

(a) sections 120A and 120B,

(b) section 108 of the Deregulation Act 2015 (exercise of regulatory functions: economic growth), and

(c) section 21 of the Legislative and Regulatory Reform Act 2006 (exercise of regulatory functions: principles).

(2) The Commissioner must—

(a) review the strategy from time to time, and

(b) revise the strategy as appropriate.

(3) The Commissioner must publish the strategy and any revised strategy.

120D Duty to consult other regulators

(1) The Commissioner must, at such times as the Commissioner considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which the Commissioner exercises functions under the data protection legislation may affect economic growth, innovation and competition.

(2) The persons are—

(a) such persons exercising regulatory functions as the Commissioner considers appropriate;

(b) such other persons as the Commissioner considers appropriate.

(3) In this section, “regulatory function” has the meaning given by section 111 of the Deregulation Act 2015.

”

“

(1A) In connection with the Commissioner’s functions under the data protection legislation, the report must contain (among other things)—

(a) a review of what the Commissioner has done during the reporting period to comply with the duties under—

(i) sections 120A and 120B,

(ii) section 108 of the Deregulation Act 2015, and

(iii) section 21 of the Legislative and Regulatory Reform Act 2006,

including a review of the operation of the strategy prepared and published under section 120C;

(b) a review of what the Commissioner has done during the reporting period to comply with the duty under section 120D.

(1B) In subsection (1A), “the reporting period” means the period to which the report relates.

”

“

Strategic priorities

120E Designation of statement of strategic priorities

(1) The Secretary of State may designate a statement as the statement of strategic priorities for the purposes of this Part if the requirements set out in section 120H are satisfied.

(2) The statement of strategic priorities is a statement prepared by the Secretary of State that sets out the strategic priorities of His Majesty’s government relating to data protection.

(3) The Secretary of State must publish the statement of strategic priorities (including any amended statement following a review under section 120G) in whatever manner the Secretary of State considers appropriate.

(4) In this Part, “the statement of strategic priorities” means the statement for the time being designated under subsection (1).

120F Duties of the Commissioner in relation to strategic priorities

(1) The Commissioner must have regard to the statement of strategic priorities when carrying out functions under the data protection legislation.

(2) But the duty in subsection (1) does not apply when the Commissioner is carrying out functions in relation to a particular person, case or investigation.

(3) Where the Secretary of State designates a statement as the statement of strategic priorities (including any amended statement following a review under section 120G), the Commissioner must—

(a) explain in writing how the Commissioner will have regard to the statement when carrying out functions under the data protection legislation, and

(b) publish a copy of that explanation.

(4) The duty in subsection (3) must be complied with—

(a) within the period of 40 days beginning with the day of the designation, or

(b) within whatever longer period the Secretary of State may allow.

(5) In calculating the period of 40 days mentioned in subsection (4)(a), no account is to be taken of—

(a) Saturdays or Sundays,

(b) Christmas Day or Good Friday, or

(c) a day which is a bank holiday under the Banking and Financial Dealings Act 1971 in any part of the United Kingdom.

(6) For a further duty of the Commissioner in relation to the statement of strategic priorities, see section 139(1A)(c).

120G Review of designated statement

(1) The Secretary of State must review the statement of strategic priorities if a period of 3 years has elapsed since the relevant time.

(2) The “relevant time”, in relation to the statement of strategic priorities, means—

(a) the time when the statement was first designated under section 120E, or

(b) if later, the time when a review of the statement under this section last took place.

(3) A review under subsection (1) must take place as soon as reasonably practicable after the end of the 3 year period.

(4) The Secretary of State may review the statement of strategic priorities at any other time if—

(a) a Parliamentary general election has taken place since the relevant time,

(b) a significant change in the policy of His Majesty’s government relating to data protection has occurred since the relevant time, or

(c) the Parliamentary requirement in relation to an amended statement was not met on the last review (see subsection (12)).

(5) For the purposes of subsection (4)(b), a significant change in the policy of the government relating to data protection has occurred only if—

(a) the change was not anticipated by the Secretary of State at the relevant time, and

(b) if the change had been so anticipated, it appears to the Secretary of State likely that the statement would have been different in a material way.

(6) On a review under this section, the Secretary of State may—

(a) amend the statement (including by replacing the whole or part of the statement with new content),

(b) leave the statement as it is, or

(c) withdraw the statement’s designation as the statement of strategic priorities.

(7) A statement amended under subsection (6)(a) has effect only if the Secretary of State designates the amended statement as the statement of strategic priorities under section 120E (and the requirements set out in section 120H apply in relation to any such designation).

(8) Where the designation of a statement is withdrawn under subsection (6)(c), the Secretary of State must publish notice of the withdrawal in whatever manner the Secretary of State considers appropriate.

(9) For the purposes of this section, corrections of clerical or typographical errors are not to be treated as amendments of the statement.

(10) The designation of a statement as the statement of strategic priorities ceases to have effect upon a subsequent designation of an amended statement as the statement of strategic priorities in accordance with subsection (7).

(11) For the purposes of subsection (2)(b), a review of a statement takes place—

(a) in the case of a decision on the review to amend the statement under subsection (6)(a)—

(i) at the time when the amended statement is designated as the statement of strategic priorities under section 120E, or

(ii) if the amended statement is not so designated, at the time when the amended statement was laid before Parliament under section 120H(1);

(b) in the case of a decision on the review to leave the statement as it is under subsection (6)(b), at the time when that decision is taken.

(12) For the purposes of subsection (4)(c), the Parliamentary requirement in relation to an amended statement was not met on the last review if—

(a) on the last review of the statement of strategic priorities to be held under this section, an amended statement was laid before Parliament under section 120H(1), but

(b) the amended statement was not designated because within the period mentioned in section 120H(2) either House of Parliament resolved not to approve it.

120H Parliamentary procedure

(1) Before the Secretary of State designates a statement as the statement of strategic priorities, the Secretary of State must lay the statement before Parliament.

(2) The Secretary of State must then wait until the end of the 40-day period and may not designate the statement if, within that period, either House of Parliament resolves not to approve it.

(3) “The 40-day period” means—

(a) if the statement is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or

(b) if the statement is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.

(4) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.

”

“

(c) a review of how the Commissioner has had regard to the statement of strategic priorities during the reporting period.

”

“

124A Other codes of practice

(1) The Commissioner must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by regulations made by the Secretary of State.

(2) Regulations under this section—

(a) must describe the personal data or processing to which the code of practice is to relate, and

(b) may describe the persons or classes of person to whom it is to relate.

(3) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.

(4) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—

(a) trade associations;

(b) data subjects;

(c) persons who appear to the Commissioner to represent the interests of data subjects.

(5) A code under this section may include transitional provision or savings.

(6) Regulations under this section are subject to the negative resolution procedure.

(7) In this section—

good practice in the processing of personal data means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;

trade association includes a body representing controllers or processors.

”

“

124D Approval by Secretary of State of codes of practice

(1) Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commissioner must submit the final version to the Secretary of State.

(2) Within the period of 40 days beginning with the day on which the code is submitted to the Secretary of State, the Secretary of State must decide whether to approve the code.

(3) If the Secretary of State approves the code, the Secretary of State must lay the code before Parliament.

(4) If the Secretary of State does not approve the code, the Secretary of State must—

(a) give a statement to the Commissioner that—

(i) states that the Secretary of State does not approve the code, and

(ii) explains the reasons why the Secretary of State does not approve the code, and

(b) publish the statement.

(5) If the Secretary of State does not approve the code, the Commissioner must—

(a) revise the code in the light of the statement given by the Secretary of State, and

(b) submit the revised code to the Secretary of State.

(6) If the Commissioner submits a revised code to the Secretary of State, subsections (2) to (5) and this subsection apply again.

(7) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections.

(8) In calculating the period of 40 days mentioned in subsection (2), no account is to be taken of—

(a) Saturdays or Sundays,

(b) Christmas Day or Good Friday, or

(c) a day which is a bank holiday under the Banking and Financial Dealings Act 1971 in any part of the United Kingdom.

”

“

146A Assessment notices: approval of person to prepare report etc

(1) This section applies where an assessment notice requires a controller or processor to make arrangements for an approved person to prepare a report.

(2) The controller or processor must, within such period as is specified in the assessment notice, nominate to the Commissioner a person to prepare the report.

(3) If the Commissioner is satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor approve the nominated person to prepare the report.

(4) If the Commissioner is not satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor—

(a) inform the controller or processor that the Commissioner has decided not to approve the nominated person to prepare the report,

(b) inform the controller or processor of the reasons for that decision, and

(c) approve a person who the Commissioner is satisfied is a suitable person to prepare the report to do so.

(5) If the controller or processor does not nominate a person within the period specified in the assessment notice, the Commissioner must by written notice to the controller or processor approve a person who the Commissioner is satisfied is a suitable person to prepare the report to do so.

(6) It is the duty of the controller or processor to give the person approved to prepare the report all such assistance as the person may reasonably require to prepare the report.

”

“

(aa) provision specifying factors to be considered in determining whether to give an assessment notice to a person that imposes a requirement of a sort mentioned in section 146(2)(j);

(ab) provision about the factors the Commissioner may take into account when determining the suitability of a person to prepare a report of a sort mentioned in section 146(2)(j);

”

“

Interview notices

148A Interview notices

(1) This section applies where the Commissioner suspects that a controller or processor—

(a) has failed or is failing as described in section 149(2), or

(b) has committed or is committing an offence under this Act.

(2) For the purpose of investigating the suspected failure or offence, the Commissioner may, by written notice (an “interview notice”), require an individual within subsection (3) to—

(a) attend at a place specified in the notice, and

(b) answer questions with respect to any matter relevant to the investigation.

(3) An individual is within this subsection if the individual—

(a) is the controller or processor,

(b) is or was at any time employed by, or otherwise working for, the controller or processor, or

(c) is or was at any time concerned in the management or control of the controller or processor.

(4) An interview notice must specify the time at which the individual must attend at the specified place and answer questions (but see the restrictions in subsections (6) and (7)).

(5) An interview notice must—

(a) indicate the nature of the suspected failure or offence that is the subject of the investigation,

(b) provide information about the consequences of failure to comply with the notice, and

(c) provide information about the rights under sections 162 and 164 (appeals etc).

(6) An interview notice may not require an individual to attend at the specified place and answer questions before the end of the period within which an appeal can be brought against the notice.

(7) If an appeal is brought against an interview notice, the individual to whom the notice is given need not attend at the specified place and answer questions pending the determination or withdrawal of the appeal.

(8) If an interview notice—

(a) states that, in the Commissioner’s opinion, it is necessary for the individual to attend at the specified place and answer questions urgently, and

(b) gives the Commissioner’s reasons for reaching that opinion,

subsections (6) and (7) do not apply but the notice must not require the individual to attend at the specified place and answer questions before the end of the period of 24 hours beginning when the notice is given.

(9) The Commissioner may cancel or vary an interview notice by written notice to the individual to whom it was given.

148B Interview notices: restrictions

(1) An interview notice does not require an individual to answer questions to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.

(2) An interview notice does not require an individual to answer questions in respect of a communication which is made—

(a) between a professional legal adviser and the adviser’s client, and

(b) in connection with the giving of legal advice to the client with respect of obligations, liabilities or rights under the data protection legislation.

(3) An interview notice does not require an individual to answer questions in respect of a communication which is made—

(a) between a professional legal adviser and the adviser’s client or between such an adviser or client and another person,

(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and

(c) for the purposes of such proceedings.

(4) In subsections (2) and (3), references to the client of a professional legal adviser include references to a person acting on behalf of the client.

(5) An interview notice does not require an individual to answer questions if doing so would, by revealing evidence of the commission of an offence, expose the individual to proceedings for that offence.

(6) The reference to an offence in subsection (5) does not include an offence under—

(a) this Act;

(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);

(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);

(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

(7) A statement made by an individual in response to an interview notice may not be used in evidence against that individual on a prosecution for an offence under this Act (other than an offence under section 148C) unless in the proceedings—

(a) in giving evidence the individual provides information inconsistent with the statement, and

(b) evidence relating to the statement is adduced, or a question relating to it is asked, by that individual or on that individual’s behalf.

(8) The Commissioner may not give an interview notice with respect to the processing of personal data for the special purposes.

(9) The Commissioner may not give an interview notice to an individual for the purpose of investigating a suspected failure or offence if the controller or processor suspected of the failure or offence is—

(a) a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters), or

(b) the Office for Standards in Education, Children’s Services and Skills in so far as it is a controller or processor in respect of information processed for the purposes of functions exercisable by His Majesty’s Chief Inspector of Education, Children’s Services and Skills by virtue of section 5(1)(a) of the Care Standards Act 2000.

148C False statements made in response to interview notices

It is an offence for an individual, in response to an interview notice—

(a) to make a statement which the individual knows to be false in a material respect, or

(b) recklessly to make a statement which is false in a material respect.

”

“

(ba) an interview notice;

”

“

(e) provision about the circumstances in which the Commissioner would consider it necessary to comply with the duty in paragraph 4(A2) of Schedule 16 after the period of 6 months mentioned in that paragraph.

”

“

(2A) The report under this section may include the annual report under section 161A.

”

“

161A Annual report on regulatory action

(1) The Commissioner must produce and publish an annual report containing the information described in subsections (2) to (5).

(2) The report must include the following information about UK GDPR investigations—

(a) the number of investigations begun, continued or completed by the Commissioner during the reporting period,

(b) the different types of act and omission that were the subject matter of the investigations,

(c) the enforcement powers exercised by the Commissioner in the reporting period in connection with the investigations,

(d) the duration of investigations that ended in the reporting period, and

(e) the different types of outcome in investigations that ended in that period.

(3) The report must include information about the enforcement powers exercised by the Commissioner in the reporting period in connection with—

(a) processing of personal data by a competent authority for any of the law enforcement purposes, and

(b) processing of personal data to which Part 4 applies.

(4) The information included in the report in accordance with subsections (2) and (3) must include information about—

(a) the number of penalty notices given in the reporting period that were given more than 6 months after the notice of intent was given under paragraph 2 of Schedule 16, and

(b) the reasons why that happened.

(5) The report must include a review of how the Commissioner had regard to the guidance published under section 160 when exercising the Commissioner’s enforcement powers as described in subsections (2)(c) and (3).

(6) In this section—

enforcement powers means the powers under—

(a) Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR,

(b) sections 142 to 159 of this Act,

(c) paragraph 2(a), (b) and (c) of Schedule 13 to this Act,

(d) Schedules 15 and 16 to this Act;

the law enforcement purposes has the meaning given in section 31 of this Act;

the reporting period means the period to which the report relates;

UK GDPR investigation means an investigation required under Article 57(1)(h) of the UK GDPR (investigations on the application of the UK GDPR).

”

“

164A Complaints by data subjects to controllers

(1) A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act.

(2) A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.

(3) If a controller receives a complaint under this section, the controller must acknowledge receipt of the complaint within the period of 30 days beginning with the day on which it is received.

(4) If a controller receives a complaint under this section, the controller must without undue delay—

(a) take appropriate steps to respond to the complaint, and

(b) inform the complainant of the outcome of the complaint.

(5) The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes—

(a) making enquiries into the subject matter of the complaint, to the extent appropriate, and

(b) informing the complainant about progress on the complaint.

164B Controllers to notify the Commissioner of the number of complaints

(1) The Secretary of State may by regulations require a controller to notify the Commissioner of the number of complaints made to the controller under section 164A in periods specified or described in the regulations.

(2) Regulations under this section may provide that a controller is required to make a notification to the Commissioner in respect of a period only in circumstances specified in the regulations.

(3) Regulations under this section may include—

(a) provision about a matter listed in subsection (4), or

(b) provision conferring power on the Commissioner to determine those matters.

(4) The matters are—

(a) the form and manner in which a notification must be made,

(b) the time at which, or period within which, a notification must be made, and

(c) how the number of complaints made to a controller during a period is to be calculated.

(5) Regulations under this section are subject to the negative resolution procedure.

”

“

165A Power of Commissioner to refuse to act on certain complaints

(1) The Commissioner may refuse to act on a complaint under section 165 if condition A, B or C is met.

(2) Condition A is that—

(a) the complaint concerns an infringement of the UK GDPR or Part 3 of this Act, and

(b) the complaint has not been made to the controller under section 164A.

(3) Condition B is that—

(a) the complaint has been made to the controller under section 164A,

(b) the controller has not finished handling the complaint in accordance with subsection (4) of that section, and

(c) the period of 45 days beginning with the day the complaint was made to the controller under that section has not expired.

(4) Condition C is that the complaint is vexatious or excessive (see section 204A).

(5) In any proceedings where there is an issue as to whether a complaint is vexatious or excessive, it is for the Commissioner to show that it is.

(6) If the Commissioner refuses to act on a complaint under section 165, the Commissioner must inform the complainant of—

(a) the refusal and the reasons for it, and

(b) the right under section 166A.

(7) If the Commissioner refuses to act on a complaint under section 165 that does not prevent the complainant making the complaint again.

165B Guidance about responding to complaints and refusing to act

(1) The Commissioner must produce and publish guidance about—

(a) how the Commissioner proposes to respond to complaints made under section 165, and

(b) how the Commissioner proposes to exercise the discretion conferred by section 165A to refuse to act on a complaint.

(2) The Commissioner—

(a) may alter or replace guidance produced under this section, and

(b) must publish any altered or replacement guidance.

(3) Before producing guidance under this section (including any altered or replacement guidance), the Commissioner must consult—

(a) the Secretary of State, and

(b) such other persons as the Commissioner considers appropriate.

(4) The Commissioner must arrange for any guidance under this section (including any altered or replacement guidance) to be laid before Parliament.

”

“

(1A) But this section does not apply if the Commissioner refuses to act on the complaint in reliance on section 165A.

”

“

166A Appeals against refusal of Commissioner to act on complaint

(1) Where the Commissioner refuses to act on a complaint in reliance on section 165A, the person who made the complaint may appeal to the Tribunal.

(2) The Tribunal may review any determination of fact on which the refusal to act was based.

(3) If the Tribunal considers—

(a) that the refusal to act is not in accordance with the law, or

(b) that the Commissioner ought not to have exercised the discretion to refuse to act,

the Tribunal must allow the appeal.

(4) Otherwise, the Tribunal must dismiss the appeal.

”

“

Modification of section 146A (assessment notices: approval of person to prepare report etc)

6A Section 146A has effect as if for “controller or processor” (in each place) there were substituted “trust service provider”.

”

“

Modification of section 148A (interview notices)

7A Section 148A has effect as if—

(a) in subsection (1)—

(i) for “controller or processor” there were substituted “trust service provider”;

(ii) in paragraph (a), for “as described in section 149(2)” there were substituted “to comply with the eIDAS requirements”;

(iii) in paragraph (b), for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”;

(b) in subsection (3), for “controller or processor” (in each place) there were substituted “trust service provider”.

Modification of section 148B (interview notices: restrictions)

7B

(1) Section 148B has effect as if subsections (8) and (9) were omitted.

(2) In that section—

(a) subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “the eIDAS Regulation or the EITSET Regulations”;

(b) subsection (6)(a) has effect as if for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”;

(c) subsection (7) has effect as if for “this Act (other than an offence under section 148C)” there were substituted “section 144 or 148 or paragraph 15 of Schedule 15”.

”

“

Prohibitions and restrictions etc on processing

183A Protection of prohibitions and restrictions etc on processing

(1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main data protection legislation relating to the processing of personal data.

(2) Subsection (1) does not apply—

(a) to a relevant enactment forming part of the main data protection legislation, or

(b) to the extent that an enactment makes express provision to the contrary referring to this section or to the main data protection legislation (or a provision of that legislation).

(3) Subsection (1) does not prevent a duty or power to process personal data from being taken into account for the purpose of determining whether it is possible to rely on an exception to a requirement under the main data protection legislation that is available where there is such a duty or power.

(4) In this section—

the main data protection legislation means the data protection legislation other than provision of or made under—

(a) Chapter 6 or 8 of the UK GDPR, or

(b) Parts 5 to 7 of this Act;

relevant enactment means an enactment so far as passed or made on or after the day on which section 45 of the Data Protection and Digital Information Act 2024 comes into force;

requirement includes a prohibition or restriction.

(5) The reference in subsection (1) to an enactment or rule of law which imposes a duty, or confers a power, to process personal data is a reference to an enactment or rule of law which, directly or indirectly, requires or authorises the processing of personal data, including (for example)—

(a) by authorising one person to require another person to process personal data, or

(b) by removing restrictions on processing personal data,

and the references in subsection (3) to a duty or power are to be read accordingly.

”

“

CHAPTER 9A — Regulations

Article 91A

Regulations made by Secretary of State

1. This Article makes provision about regulations made by the Secretary of State under this Regulation (“UK GDPR regulations”).

2. Before making UK GDPR regulations, the Secretary of State must consult—

(a) the Commissioner, and

(b) such other persons as the Secretary of State considers appropriate.

3. Paragraph 2 does not apply to regulations made under Article 49 or 49A where the Secretary of State has made an urgency statement in respect of them.

4. UK GDPR regulations may—

(a) make different provision for different purposes;

(b) include consequential, supplementary, incidental, transitional, transitory or saving provision.

5. UK GDPR regulations are to be made by statutory instrument.

6. For the purposes of this Regulation, where regulations are subject to “the negative resolution procedure”, the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.

7. For the purposes of this Regulation, where regulations are subject to “the affirmative resolution procedure”, the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.

8. For the purposes of this Regulation, where regulations are subject to “the made affirmative resolution procedure”—

(a) the statutory instrument containing the regulations must be laid before Parliament after being made, together with the urgency statement in respect of them, and

(b) the regulations cease to have effect at the end of the period of 120 days beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament.

9. In calculating the period of 120 days, no account is to be taken of any whole days that fall within a period during which—

(a) Parliament is dissolved or prorogued, or

(b) both Houses of Parliament are adjourned for more than 4 days.

10. Where regulations cease to have effect as a result of paragraph 8, that does not—

(a) affect anything previously done under the regulations, or

(b) prevent the making of new regulations.

11. Any provision that may be included in UK GDPR regulations subject to the negative resolution procedure may be made by regulations made under this Regulation or another enactment that are subject to the affirmative resolution procedure or the made affirmative resolution procedure.

12. A requirement under this Article to consult may be satisfied by consultation before, as well as by consultation after, the provision conferring the power to make regulations comes into force.

13. In this Article, “urgency statement”, in relation to regulations, means a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.

”

“

6A Power to provide exceptions to regulation 6(1)

(1) The Secretary of State may by regulations made by statutory instrument—

(a) amend these regulations—

(i) by adding an exception to the prohibition in regulation 6(1), or

(ii) by omitting or varying an exception to that prohibition, and

(b) make consequential, supplementary, incidental, transitional, transitory or saving provision, including provision amending these regulations.

(2) Regulations under paragraph (1) may make different provision for different purposes.

(3) Before making regulations under paragraph (1), the Secretary of State must consult—

(a) the Information Commissioner, and

(b) such other persons as the Secretary of State considers appropriate.

(4) A statutory instrument containing regulations under paragraph (1) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

6B Information technology to enable consent to be given, or an objection to be made, automatically

(1) The Secretary of State may by regulations made by statutory instrument provide that a person of a specified description may supply, provide or otherwise make available information technology of a specified description only if the technology meets specified requirements.

(2) The power conferred by paragraph (1) is to be exercised only for the purpose of securing that information technology supplied, provided or otherwise made available enables users of the technology to ensure that any consent they wish to give, or any objection they wish to make, to an operator of a website for the purposes of regulation 6 is given or made automatically upon their visiting the website.

(3) Regulations under paragraph (1) may make provision conferring functions on the Information Commissioner relating to the enforcement of the regulations.

(4) The provision made by reason of paragraph (3) may include provision applying (with or without modification) provisions of the Data Protection Act 2018 relating to enforcement.

(5) Regulations under paragraph (1) may—

(a) make different provision for different purposes, and

(b) make consequential, supplementary, incidental, transitional, transitory or saving provision.

(6) Before making regulations under paragraph (1), the Secretary of State must consult—

(a) the Information Commissioner,

(b) the Competition and Markets Authority, and

(c) such other persons as the Secretary of State considers appropriate.

(7) A statutory instrument containing regulations under paragraph (1) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

(8) In this regulation—

information technology includes—

(a) computers,

(b) other devices whose uses include the processing of information by electronic means (“IT devices”),

(c) parts, accessories and other equipment made or adapted for use in connection with computers or IT devices,

(d) software and code made or adapted for use in connection with computers or IT devices, and

(e) networks and other infrastructure (whether physical or virtual) used in connection with other information technology;

specified means specified in regulations made under paragraph (1);

website includes a mobile application and any other platform by means of which an information society service is provided (and a reference to “an operator” of a website or “visiting” a website is to be read accordingly).

”

“

(1A) In the application of these Regulations in relation to—

(a) information that is sent but not received,

(b) a communication that is transmitted but not received,

(c) an electronic mail that is sent but not received, or

(d) an unsuccessful attempt to make a call,

a reference to the recipient of the information, communication, electronic mail or call is to be read as a reference to the intended recipient.

”

“

(3A) A person may send or instigate the sending of electronic mail for the purposes of direct marketing where—

(a) the direct marketing is solely for the purpose of furthering a charitable, political or other non-commercial objective of that person;

(b) that person obtained the contact details of the recipient of the electronic mail in the course of the recipient expressing an interest in or offering or providing support for the furtherance of that objective or a similar objective; and

(c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of their contact details for the purposes of such direct marketing, at the time that the details were initially collected, and, where the recipient did not initially refuse the use of the details, at the time of each subsequent communication.

”