Legislation – Data Protection Act 2018

the processing by a competent authority of personal data wholly or partly by automated means, and

the processing by a competent authority otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.

a person specified or described in Schedule 7, and

any other person if and to the extent that the person has statutory functions for any of the law enforcement purposes.

so as to add or remove a person or description of person;

so as to reflect any change in the name of a person specified in the Schedule.

determines the purposes and means of the processing of personal data, or

is the controller by virtue of subsection (2).

for purposes for which it is required by an enactment to be processed, and

by means by which it is required by an enactment to be processed,

imposes general duties on the controller to make information available (see F11sections 44 and 45A);

confers a right of access by the data subject (see F12sections 45 and 45A);

confers rights on the data subject with respect to the rectification of personal data and the erasure of personal data or the restriction of its processing (see sections 46 to 48);

regulates automated decision-making (see F13sections 50A to 50D);

makes supplementary provision (see sections 51 to 54).

the identity and the contact details of the controller;

where applicable, the contact details of the data protection officer (see sections 69 to 71);

the purposes for which the controller processes personal data;

the existence of the right to lodge a complaint with the Commissioner and the contact details of the Commissioner.

information about the legal basis for the processing;

information about the period for which the personal data will be stored or, where that is not possible, about the criteria used to determine that period;

where applicable, information about the categories of recipients of the personal data (including recipients in third countries or international organisations);

such further information as is necessary to enable the exercise of the data subject’s rights under this Part.

avoid obstructing an official or legal inquiry, investigation or procedure;

avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

protect public security;

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

protect the rights and freedoms of others.

that the provision of information has been restricted,

of the reasons for the restriction,

of the data subject’s right to make a request to the Commissioner under section 51,

of the data subject’s right to lodge a complaint with the Commissioner, and

of the data subject’s right to apply to a court under section 167.

record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (2) F18in reliance on subsection (4), and

if requested to do so by the Commissioner, make the record available to the Commissioner.

confirmation as to whether or not personal data concerning him or her is being processed, and

where that is the case, access to the personal data and the information set out in subsection (2).

the purposes of and legal basis for the processing;

the categories of personal data concerned;

the recipients or categories of recipients to whom the personal data has been disclosed (including recipients or categories of recipients in third countries or international organisations);

the period for which it is envisaged that the personal data will be stored or, where that is not possible, the criteria used to determine that period;

the existence of the data subject’s right to lodge a complaint with the Commissioner and the contact details of the Commissioner;

communication of the personal data undergoing processing and of any available information as to its origin.

without undue delay, and

in any event, before the end of the applicable time period (as to which see section 54).

avoid obstructing an official or legal inquiry, investigation or procedure;

avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

protect public security;

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

protect the rights and freedoms of others.

that the rights of the data subject have been restricted,

of the reasons for the restriction,

of the data subject’s right to make a request to the Commissioner under section 51,

of the data subject’s right to lodge a complaint with the Commissioner, and

of the data subject’s right to apply to a court under section 167.

record the reasons for a decision to restrict (whether wholly or partly) the rights of a data subject under subsection (1) F24in reliance on subsection (4), and

if requested to do so by the Commissioner, make the record available to the Commissioner.

information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or

information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

the decision to rely on the exemption,

the reason for the decision,

the data subject’s right to make a request to the Commissioner under section 51,

the data subject’s right to lodge a complaint with the Commissioner under section 165, and

the data subject’s right to apply to a court under section 167.

undermine a claim described in subsection (1)(a), or

conflict with a duty described in subsection (1)(b).

record the reason for a decision to rely on the exemption in subsection (1), and

if requested to do so by the Commissioner, make the record available to the Commissioner.

the processing of the personal data would infringe section 35, 36(1) to (3), 37, 38(1), 39(1), 40, 41 or 42, or

the controller has a legal obligation to erase the data.

whether the request has been granted, and

without undue delay, and

in any event, before the end of the applicable time period (see section 54).

avoid obstructing an official or legal inquiry, investigation or procedure;

avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

protect public security;

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

protect the rights and freedoms of others.

that the rights of the data subject have been restricted,

of the reasons for the restriction,

of the data subject’s right to lodge a complaint with the Commissioner, and

of the data subject’s right to apply to a court under section 167.

record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (1)(b)(i) F29in reliance on subsection (3), and

if requested to do so by the Commissioner, make the record available to the Commissioner.

the controller must notify the recipients, and

the recipients must similarly rectify, erase or restrict the processing of the personal data (so far as they retain responsibility for it).

a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and

based entirely or partly on personal data, and

based solely on automated processing,

provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;

enable the data subject to make representations about such decisions;

enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;

enable the data subject to contest such decisions.

exemption from those provisions is required for a reason listed in subsection (4),

the controller reconsiders the decision as soon as reasonably practicable, and

there is meaningful human involvement in the reconsideration of the decision.

to avoid obstructing an official or legal inquiry, investigation or procedure;

to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

to protect public security;

to safeguard national security;

to protect the rights and freedoms of others.

provision requiring the safeguards to include measures in addition to those described in section 50C(2),

provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and

provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2).

restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the controller to give the data subject additional information),

restricts under section 45(4) the data subject’s rights under section 45(1) (right of access),

relies on the exemption from sections 44(2) and 45(1) in section 45A (legal professional privilege), or

refuses a request by the data subject for rectification under section 46 or for erasure or restriction of processing under section 47.

where subsection (1)(a) or (b) applies, request the Commissioner to check that the restriction imposed by the controller was lawful;

where subsection (1)(ba) applies, request the Commissioner to check that the controller was entitled to rely on the exemption;

where subsection (1)(c) applies, request the Commissioner to check that the refusal of the data subject’s request was lawful.

where subsection (1)(a) or (b) applies, whether the Commissioner is satisfied that the restriction imposed by the controller was lawful;

where subsection (1)(ba) applies, whether the Commissioner is satisfied that the controller was entitled to rely on the exemption;

where subsection (1)(c) applies, whether the Commissioner is satisfied that the controller’s refusal of the data subject’s request was lawful.

request the provision of additional information to enable the controller to confirm the identity, and

delay dealing with the request until the identity is confirmed.

charge a reasonable fee for dealing with the request, or

refuse to act on the request.

require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in accordance with subsection (1)(a), and

specify what the guidance must include.

the reasons for not doing so, and

the data subject’s right to lodge a complaint with the Commissioner.

without undue delay, and

in any event, before the end of the applicable time period (as to which see section 54).

when the controller receives the request in question;

when the controller receives the information (if any) requested in connection with a request under section 52(4);

when the fee (if any) charged in connection with the request under section 53 is paid.

the complexity of requests made by the data subject, or

the number of such requests.

be given before the end of the period of one month beginning with the relevant time, and

state the reasons for the delay.

the controller may ask the data subject to provide the further information, and

sets out the general obligations of controllers and processors (see sections 56 to 65);

sets out specific obligations of controllers and processors with respect to security (see section 66);

sets out specific obligations of controllers and processors with respect to personal data breaches (see sections 67 and 68);

makes provision for the designation, position and tasks of data protection officers (see sections 69 to 71);

makes provision about codes of conduct (see section 71A).

the latest developments in technology,

the cost of implementation,

the nature, scope, context and purposes of processing, and

the risks for the rights and freedoms of individuals arising from the processing.

to implement the data protection principles in an effective manner, and

to integrate into the processing itself the safeguards necessary for that purpose.

the amount of personal data collected,

the extent of its processing,

the period of its storage, and

its accessibility.

meet the requirements of this Part, and

ensure the protection of the rights of the data subject.

the subject-matter and duration of the processing;

the nature and purpose of the processing;

the type of personal data and categories of data subjects involved;

the obligations and rights of the controller and processor.

act only on instructions from the controller,

ensure that the persons authorised to process personal data are subject to an appropriate duty of confidentiality,

assist the controller by any appropriate means to ensure compliance with the rights of the data subject under this Part,

make available to the controller all information necessary to demonstrate compliance with this section, and

comply with the requirements of this section for engaging sub-processors.

the name and contact details of the controller;

where applicable, the name and contact details of the joint controller;

where applicable, the name and contact details of the data protection officer;

the purposes of the processing;

the categories of recipients to whom personal data has been or will be disclosed (including recipients in third countries or international organisations);

where applicable, details of the use of profiling;

where applicable, the categories of transfers of personal data to a third country or an international organisation;

an indication of the legal basis for the processing operations, including transfers, for which the personal data is intended;

where possible, the envisaged time limits for erasure of the different categories of personal data;

where possible, a general description of the technical and organisational security measures referred to in section 66.

the name and contact details of the processor and of any other processors engaged by the processor in accordance with section 59(3);

the name and contact details of the controller on behalf of which the processor is acting;

where applicable, the name and contact details of the data protection officer;

the categories of processing carried out on behalf of the controller;

where applicable, details of transfers of personal data to a third country or an international organisation where explicitly instructed to do so by the controller, including the identification of that third country or international organisation;

where possible, a general description of the technical and organisational security measures referred to in section 66.

collection;

alteration;

consultation;

disclosure (including transfers);

combination;

erasure.

the justification for, and date and time of, the consultation, and

so far as possible, the identity of the person who consulted the data.

the justification for, and date and time of, the disclosure, and

to verify the lawfulness of processing;

to assist with self-monitoring by the controller or (as the case may be) the processor, including the conduct of internal disciplinary proceedings;

to ensure the integrity and security of personal data;

the purposes of criminal proceedings.

a general description of the envisaged processing operations;

an assessment of the risks to the rights and freedoms of data subjects;

the measures envisaged to address those risks;

safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Part, taking into account the rights and legitimate interests of the data subjects and other persons concerned.

the data protection impact assessment prepared under section 64, and

any other information requested by the Commissioner to enable the Commissioner to make an assessment of the compliance of the processing with the requirements of this Part.

inform the controller and, where applicable, the processor of any such extension before the end of the period of 1 month beginning with receipt of the request for consultation, and

provide reasons for the delay.

prevent unauthorised processing or unauthorised interference with the systems used in connection with it,

ensure that it is possible to establish the precise details of any processing that takes place,

ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and

ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.

without undue delay, and

where feasible, not later than 72 hours after becoming aware of it.

a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

the name and contact details of the data protection officer or other contact point from whom more information can be obtained;

a description of the likely consequences of the personal data breach;

a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

the facts relating to the breach,

its effects, and

the remedial action taken.

a description of the nature of the breach;

the name and contact details of the data protection officer or other contact point from whom more information can be obtained;

a description of the likely consequences of the personal data breach;

a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

the controller has implemented appropriate technological and organisational protection measures which were applied to the personal data affected by the breach,

the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in subsection (1) is no longer likely to materialise, or

it would involve a disproportionate effort.

require the controller to notify the data subject of the breach, or

decide that the controller is not required to do so because any of paragraphs (a) to (c) of subsection (3) applies.

avoid obstructing an official or legal inquiry, investigation or procedure;

avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

protect public security;

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

protect the rights and freedoms of others.

the proposed officer’s expert knowledge of data protection law and practice, and

the ability of the proposed officer to perform the tasks mentioned in section 71.

must ensure that the data protection officer does not receive any instructions regarding the performance of the tasks mentioned in section 71;

must ensure that the data protection officer does not perform a task or fulfil a duty other than those mentioned in this Part where such task or duty would result in a conflict of interests;

must not dismiss or penalise the data protection officer for performing the tasks mentioned in section 71.

the processing of that data subject’s personal data, or

the exercise of that data subject’s rights under this Part.

informing and advising the controller, any processor engaged by the controller, and any employee of the controller who carries out processing of personal data, of that person’s obligations under this Part,

providing advice on the carrying out of a data protection impact assessment under section 64 and monitoring compliance with that section,

co-operating with the Commissioner,

acting as the contact point for the Commissioner on issues relating to processing, including in relation to the consultation mentioned in section 65, and consulting with the Commissioner, where appropriate, in relation to any other matter,

monitoring compliance with policies of the controller in relation to the protection of personal data, and

monitoring compliance by the controller with this Part.

assigning responsibilities under those policies,

raising awareness of those policies,

training staff involved in processing operations, and

conducting audits required under those policies.

“public body” means a body or other person whose functions are, or include, functions of a public nature, and

a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).

lawful and fair processing;

the collection of personal data;

the information provided to the public and to data subjects;

the exercise of the rights of data subjects;

the measures and procedures referred to in sections 56, 57 and 62;

the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;

the transfer of personal data to third countries or international organisations;

out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.

provide the body with an opinion on whether the code correctly reflects the requirements of this Part,

decide whether to approve the code, and

if the code is approved, register and publish the code.

sections 73 to 76 set out the general conditions that apply;

section 77 sets out F59additional conditions that apply in certain cases where the intended recipient of personal data is not a relevant authority in a third country or an international organisation F60(see section 73(4)(b));

section 78 makes special provision about subsequent transfers of personal data.

the three conditions set out in subsections (2) to (4) are met, F63…

in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State F64…, that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State F65, and—

the transfer is carried out in accordance with the other provisions of this Part.

is approved by regulations under section 74AA that are in force at the time of the transfer,

is made subject to appropriate safeguards (see section 75), or

is based on special circumstances (see section 76).

the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation,

the transfer is necessary for the prevention of an immediate and serious threat F69to the public security, national security or essential interests of a third country or the United Kingdom, and

the authorisation cannot be obtained in good time.

a third country, or

an international organisation.

make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;

approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;

confer a discretion on a person.

this Part, and

Parts 5 to 7, so far as relevant to law enforcement processing.

respect for the rule of law and for human rights in the country or by the organisation,

the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation,

arrangements for judicial or non-judicial redress for data subjects in connection with such processing,

rules about the transfer of personal data from the country or by the organisation to other countries or international organisations,

relevant international obligations of the country or organisation, and

the constitution, traditions and culture of the country or organisation.

the references to the protection provided for data subjects are to that protection taken as a whole,

the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and

the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2).

the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and

the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.

a list of the third countries F80… and international organisations, and the descriptions of such countries F81… and organisations, which are for the time being F82approved by regulations under section 74AA as places or persons to which personal data may be transferred, and

a list of the third countries F83… and international organisations, and the descriptions of such countries F84… and organisations, which have been but are no longer F85approved by such regulations.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

the lists published under subsection (6) must specify or describe the relevant transfers.

an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or

the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).

the transfer must be documented,

the documentation must be provided to the Commissioner on request, and

the instrument is intended to be relied on in connection with the transfer or that type of transfer,

at least one competent authority is a party to the instrument, and

each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).

this Part, and

Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.

it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and

it is necessary for a special purpose.

to protect the vital interests of the data subject or another person,

to safeguard the legitimate interests of the data subject,

for the prevention of an immediate and serious threat to the public security F99or national security of F100… a third country F101or the United Kingdom,

F102in particular circumstances, for any of the law enforcement purposes, or

F103in particular circumstances, for a legal purpose.

the transfer must be documented,

the documentation must be provided to the Commissioner on request, and

it is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) relating to any of the law enforcement purposes,

it is necessary for the purpose of obtaining legal advice in relation to any of the law enforcement purposes, or

it is otherwise necessary for the purposes of establishing, exercising or defending legal rights in relation to any of the law enforcement purposes.

document any transfer to a recipient in a third country F110that takes place in reliance on section 73(4)(b), and

inform the Commissioner about the transfer.

that F115the personal data is not to be further transferred to a third country or international organisation without the authorisation of the transferring controller or another competent authority F116(the “UK authoriser”), or

the transfer is necessary for the prevention of an immediate and serious threat to the public security or national security of a third country or the United Kingdom, and

authorisation from the UK authoriser cannot be obtained in good time.

the seriousness of the circumstances leading to the request for authorisation,

the purpose for which the personal data was originally transferred, and

the standards for the protection of personal data that apply in the third country or international organisation to which the personal data would be transferred.

the transfer is necessary for the prevention of an immediate and serious threat F123to the public security, national security or essential interests of a third country or the United Kingdom, and

the authorisation cannot be obtained in good time.

the terms of any relevant contract entered into, or authorisation given, by the transferring controller in accordance with section 59 are complied with, and

the further transfer satisfies the requirements in section 73(1).