Legislation – Data Protection Act 2018

section 35(1) sets out the first data protection principle (requirement that processing be lawful and fair);

section 36(1) sets out the second data protection principle (requirement that purposes of processing be specified, explicit and legitimate);

section 37 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive);

section 38(1) sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date);

section 39(1) sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary);

section 40 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner).

each of sections 35, 36, 38 and 39 makes provision to supplement the principle to which it relates, and

sections 41 and 42 make provision about the safeguards that apply in relation to certain types of processing.

the data subject has given consent to the processing for that purpose, or

the processing is necessary for the performance of a task carried out for that purpose by a competent authority.

the data subject has given consent to the processing for the law enforcement purpose as mentioned in subsection (2)(a), and

at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

the processing is strictly necessary for the law enforcement purpose,

the processing meets at least one of the conditions in Schedule 8, and

at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).

by adding conditions;

by F1varying or omitting conditions added by regulations under paragraph (a).

the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;

the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual;

the processing of data concerning health;

the processing of data concerning an individual’s sex life or sexual orientation.

the law enforcement purpose for which personal data is collected F3(whether from the data subject or otherwise) must be specified, explicit and legitimate, and

personal data so collected must not be processed F4by or on behalf of a controller in a manner that is incompatible with the purpose for which F5the controller collected it.

the controller is authorised by law to process the data for the other purpose, and

the processing is necessary and proportionate to that other purpose.

personal data processed for any of the law enforcement purposes must be accurate and, where necessary, kept up to date, and

every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the law enforcement purpose for which it is processed, is erased or rectified without delay.

persons suspected of having committed or being about to commit a criminal offence;

persons convicted of a criminal offence;

persons who are or may be victims of a criminal offence;

witnesses or other persons with information about offences.

the quality of personal data must be verified before it is transmitted or made available,

in all transmissions of personal data, the necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of the data and the extent to which it is up to date must be included, and

if, after personal data has been transmitted, it emerges that the data was incorrect or that the transmission was unlawful, the recipient must be notified without delay.

for archiving purposes in the public interest,

for scientific or historical research purposes, or

for statistical purposes.

it is carried out for the purposes of, or in connection with, measures or decisions with respect to a particular data subject, or

it is likely to cause substantial damage or substantial distress to a data subject.

explains the controller’s procedures for securing compliance with the data protection principles (see section 34(1)) in connection with sensitive processing in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, and

explains the controller’s policies as regards the retention and erasure of personal data processed in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, giving an indication of how long such personal data is likely to be retained.

retain the appropriate policy document,

review and (if appropriate) update it from time to time, and

make it available to the Commissioner, on request, without charge.

whether the sensitive processing is carried out in reliance on the consent of the data subject or, if not, which condition in Schedule 8 is relied on,

how the processing satisfies section 35 (lawfulness of processing), and

whether the personal data is retained and erased in accordance with the policies described in subsection (2)(b) and, if it is not, the reasons for not following those policies.

begins when the controller starts to carry out the sensitive processing in reliance on the data subject’s consent or (as the case may be) in reliance on that condition, and

ends at the end of the period of 6 months beginning when the controller ceases to carry out the processing.

make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,

make provision so that added processing is not sensitive processing for the purposes of this Part,

make provision so that a protected condition in Schedule 8 may or may not be relied on in connection with added processing, and

make provision varying such a condition as it relates to added processing.