Legislation – Data (Use and Access) Act 2025
Changes to legislation:
There are currently no known outstanding effects for the Data (Use and Access) Act 2025, Section 90.
Changes to Legislation
Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.
Part 5Data protection and privacy
Chapter 1Data protection
Intelligence services
90Joint processing: consequential amendments
(1)
The 2018 Act is amended in accordance with subsections (2) to (9).
(2)
In section 1(5) (overview: Part 4), at the end insert “(and certain processing carried out by competent authorities jointly with the intelligence services)”
.
(3)
“(1A)
This Part does not apply to processing to which Part 4 applies by virtue of a designation notice (see section 82A).”
(4)
In section 83 (meaning of “controller” and “processor” in Part 4)—
(a)
“A1
For the purposes of this Part—
(a)
an intelligence service is the “controller” in relation to the processing of personal data if it satisfies subsection (1) alone or jointly with others, and
(b)
a qualifying competent authority is the “controller” in relation to the processing of personal data that is the subject of a designation notice that is for the time being in force if the authority satisfies subsection (1) jointly with others.”,
(b)
in subsection (1), for the words before paragraph (a) substitute “This subsection is satisfied by a person who—”
, and
(c)
in subsection (2), for “intelligence service on which” substitute “person on whom”
.
(5)
In section 84 (other definitions)—
(a)
“(2A)
“Designation notice” has the meaning given in section 82A.”, and
(b)
“(6B)
“Withdrawal notice” has the meaning given in section 82C.”
(6)
In section 104(1) (joint controllers), for “intelligence services” substitute “controllers”
.
(7)
In section 202(1)(a)(i) (proceedings in the First-tier Tribunal: contempt) after “79,” insert “82E,”
.
(8)
In section 203(1) (Tribunal Procedure Rules), after “79,” insert “82E,”
.
(9)
In section 206 (index of defined expressions), in the Table—
(a)
in the entry for “competent authority”—
(i)
for “Part 3” substitute “Parts 3 and 4”
, and
(ii)
for “section 30” substitute “sections 30 and 82”
, and
(b)
“designation notice (in Part 4)
section 84”;
“qualifying competent authority (in Part 4)
section 82”;
“withdrawal notice (in Part 4)
section 84”.
(10)
In section 199(2)(a) of the Investigatory Powers Act 2016 (bulk personal datasets: meaning of “personal data”), after “section 82(1) of that Act” insert “by an intelligence service”
.