Legislation – Data (Use and Access) Act 2025

“(8A)

The power to give a notice conferred by subsection (1) does not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).”

“A1

Subsection (C1) applies if a senior coroner (in England and Wales), a procurator fiscal (in Scotland) or a coroner (in Northern Ireland) (“the investigating authority”)—

(a)

notifies OFCOM that they are conducting an investigation in connection with the death of a child, and

(b)

provides OFCOM with the details in subsection (B1).

B1

The details are—

(a)

the name of the child who has died,

(b)

the child’s date of birth,

(c)

any email addresses used by the child (so far as the investigating authority knows), and

(d)

if any regulated service has been brought to the attention of the investigating authority as being of interest in connection with the child’s death, the name of the service.

C1

Where this subsection applies, OFCOM—

(a)

must give a notice to the provider of a service within subsection (E1) requiring the provider to ensure the retention of information relating to the use of the service by the child who has died, and

(b)

may give a notice to any other relevant person requiring the person to ensure the retention of information relating to the use of a service within subsection (E1) by that child.

D1

The references in subsection (C1) to ensuring the retention of information relating to the child’s use of a service include taking all reasonable steps, without delay, to prevent the deletion of such information by the routine operation of systems or processes.

E1

A service is within this subsection if it is—

(a)

a regulated service of a kind described in regulations made by the Secretary of State, or

(b)

a regulated service notified to OFCOM by the investigating authority as described in subsection (B1)(d).

F1

A notice under subsection (C1) may require information described in that subsection to be retained only if it is information—

(a)

of a kind which OFCOM have power to require under a notice under subsection (1) (see, in particular, subsection (2)(a) to (d)), or

(b)

which a person might need to retain to enable the person to provide information in response to a notice under subsection (1) (if such a notice were given).

G1

OFCOM must share with the investigating authority any information they receive in response to requirements mentioned in section 102(5A)(d) that are included in a notice under subsection (C1).”;

“(5A)

The powers to give a notice conferred by this section do not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).”

“(5A)

An information notice under section 101(C1) must—

(a)

specify or describe the information to be retained,

(b)

specify why OFCOM require the information to be retained,

(c)

require the information to be retained for the period of one year beginning with the date of the notice,

(d)

require the person to whom the notice is given—

(i)

if the child to whom the notice relates used the service in question, to notify OFCOM by a specified date of steps taken to ensure the retention of information;

(ii)

if the child did not use the service, or the person does not hold any information of the kind required, to notify OFCOM of that fact by a specified date, and

(e)

contain information about the consequences of not complying with the notice.

(5B)

If OFCOM give an information notice to a person under section 101(C1), they may, in response to information received from the investigating authority, extend the period for which the person is required to retain information by a maximum period of six months.

(5C)

The power conferred by subsection (5B) is exercisable—

(a)

by giving the person a notice varying the notice under section 101(C1) and stating the further period for which information must be retained and the reason for the extension;

(b)

any number of times.”;

“(9A)

OFCOM must cancel an information notice under section 101(C1) by notice to the person to whom it was given if advised by the investigating authority that the information in question no longer needs to be retained.”;

““the investigating authority” has the same meaning as in section 101;”.

“(6A)

A person who is given an information notice under section 101(C1) commits an offence if—

(a)

the person deletes or alters, or causes or permits the deletion or alteration of, any information required by the notice to be retained, and

(b)

the person’s intention was to prevent the information being available, or (as the case may be) to prevent it being available in unaltered form, for the purposes of any official investigation into the death of the child to whom the notice relates.

(6B)

For the purposes of subsection (6A) information has been deleted if it is irrecoverable (however that occurred).”

“(6A)

An individual named as a senior manager of an entity commits an offence if—

(a)

the entity commits an offence under section 109(6A) (deletion etc of information), and

(b)

the individual has failed to take all reasonable steps to prevent that offence being committed.”;

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);”;