Legislation – Data (Use and Access) Act 2025

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Part 5Data protection and privacy

Chapter 1Data protection

Data subject’s rights

79Data subjects’ rights to information: legal professional privilege exemption

(1)

The 2018 Act is amended as follows.

(2)

In section 43 (overview and scope of Chapter 3 of Part 3: rights of the data subject in connection with law enforcement processing)—

(a)

in subsection (1)(a), for “section 44” substitute “sections 44 and 45A”, and

(b)

in subsection (1)(b), for “section 45” substitute “sections 45 and 45A”.

(3)

For the italic heading before section 44 substitute—

“Data subject’s rights to information”.

(4)

In the heading of section 44, omit “Information:”.

(5)

Omit the italic heading before section 45.

(6)

After that section insert—

“45AExemption from sections 44 and 45: legal professional privilege

(1)

Sections 44(2) and 45(1) do not require the controller to give the data subject—

(a)

information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or

(b)

information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

(2)

A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—

(a)

the decision to rely on the exemption,

(b)

the reason for the decision,

(c)

the data subject’s right to make a request to the Commissioner under section 51,

(d)

the data subject’s right to lodge a complaint with the Commissioner under section 165, and

(e)

the data subject’s right to apply to a court under section 167.

(3)

Subsection (2)(a) and (b) do not apply to the extent that complying with them would—

(a)

undermine a claim described in subsection (1)(a), or

(b)

conflict with a duty described in subsection (1)(b).

(4)

The controller must—

(a)

record the reason for a decision to rely on the exemption in subsection (1), and

(b)

if requested to do so by the Commissioner, make the record available to the Commissioner.

(5)

The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).”

(7)

In section 51 (exercise of rights through the Commissioner)—

(a)

in subsection (1), after paragraph (b) (but before the “or” at the end of that paragraph) insert—

“(ba)

relies on the exemption from sections 44(2) and 45(1) in section 45A (legal professional privilege),”,

(b)

in subsection (2), after paragraph (a) insert—

“(aa)

where subsection (1)(ba) applies, request the Commissioner to check that the controller was entitled to rely on the exemption;”,

(c)

in subsection (4), after paragraph (a) insert—

“(aa)

where subsection (1)(ba) applies, whether the Commissioner is satisfied that the controller was entitled to rely on the exemption;”, and

(d)

in subsection (6), after “(a)” insert “, (aa)”.