Data (Use and Access) Act 2025

91 Duties of the Commission in carrying out functions

(1) The 2018 Act is amended in accordance with subsections (2) to (4). (2) Omit section 2(2) (duty of Commissioner when carrying out functions). (3) After section 120 insert— Duties in carrying out functions Principal objective 120A It is the principal objective of the Commissioner, in carrying out functions under the data protection legislation— (a) to secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and (b) to promote public trust and confidence in the processing of personal data. Duties in relation to functions under the data protection legislation 120B In carrying out functions under the data protection legislation, the Commissioner must have regard to such of the following as appear to the Commissioner to be relevant in the circumstances— (a) the desirability of promoting innovation; (b) the desirability of promoting competition; (c) the importance of the prevention, investigation, detection and prosecution of criminal offences; (d) the need to safeguard public security and national security; (e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing. Strategy 120C (1) The Commissioner must prepare a strategy for carrying out the Commissioner’s functions under the data protection legislation in accordance with the Commissioner’s duties under— (a) sections 120A and 120B, (b) section 108 of the Deregulation Act 2015 (exercise of regulatory functions: economic growth), and (c) section 21 of the Legislative and Regulatory Reform Act 2006 (exercise of regulatory functions: principles). (2) The Commissioner must— (a) review the strategy from time to time, and (b) revise the strategy as appropriate. (3) The Commissioner must publish the strategy and any revised strategy. Duty to consult other regulators 120D (1) The Commissioner must, at such times as the Commissioner considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which the Commissioner exercises functions under the data protection legislation may affect economic growth, innovation and competition. (2) The persons are— (a) such persons exercising regulatory functions as the Commissioner considers appropriate; (b) such other persons as the Commissioner considers appropriate. (3) In this section, “regulatory function” has the meaning given by section 111 of the Deregulation Act 2015. (4) In section 139 (reporting to Parliament), after subsection (1) insert— (1A) In connection with the Commissioner’s functions under the data protection legislation, the report must contain (among other things)— (a) a review of what the Commissioner has done during the reporting period to comply with the duties under— (i) sections 120A and 120B, (ii) section 108 of the Deregulation Act 2015, and (iii) section 21 of the Legislative and Regulatory Reform Act 2006, including a review of the operation of the strategy prepared and published under section 120C; (b) a review of what the Commissioner has done during the reporting period to comply with the duty under section 120D. (1B) In subsection (1A), “the reporting period” means the period to which the report relates. (5) The Information Commission must prepare and publish a strategy in accordance with section 120C of the 2018 Act before the end of the period of 18 months beginning with the day on which this section comes into force.