(1) The Secretary of State must remove a person from the DVS register if the person—
(a) asks to be removed from the register,
(b) ceases to provide all of the digital verification services in respect of which the person is registered in the register, or
(c) no longer holds a certificate from an accredited conformity assessment body certifying that at least one of those digital verification services is provided in accordance with the DVS trust framework.
(2) For the purposes of subsection (1)(c), a certificate is to be ignored if—
(a) it has expired in accordance with its terms,
(b) it has been withdrawn by the body that issued it, or
(c) it is required to be ignored by reason of provision included in the DVS trust framework under section 28(8).
(1) The Secretary of State may remove a person from the DVS register if—
(a) the Secretary of State is satisfied that the person is failing to comply with the DVS trust framework when providing one or more of the digital verification services in respect of which the person is registered,
(b) the person has a supplementary note included in the DVS register and the Secretary of State is satisfied that the person is failing to comply with the supplementary code to which the note relates when providing one or more of the digital verification services recorded in the note,
(c) the Secretary of State is satisfied that the person has failed to provide the Secretary of State with information in accordance with a notice under section 51, or
(d) the Secretary of State considers that it is necessary to do so in the interests of national security.
(2) Before removing a person from the DVS register under this section the Secretary of State must, by written notice, inform the person that the Secretary of State intends to do so.
(3) The notice must—
(a) state the name and address of the person,
(b) state the reason why the Secretary of State—
(i) is satisfied that the person is failing or has failed as mentioned in subsection (1)(a) to (c), or
(ii) considers that it is necessary to remove the person from the DVS register in the interests of national security,
(c) state whether the Secretary of State intends to specify a period in the notice under subsection (8) and, if so, what period is intended to be specified,
(d) state that the person may make written representations to the Secretary of State about—
(i) the Secretary of State’s intention to remove the person from the DVS register, and
(ii) where relevant, the period the Secretary of State intends to specify in the notice under subsection (8), and
(e) specify the period within which such representations may be made.
(4) The requirement in subsection (3)(b) does not apply if, or to the extent that, the Secretary of State considers that stating the reason described in subsection (3)(b)(ii) would be contrary to the interests of national security.
(5) The period specified for making written representations must be a period of not less than 21 days beginning with the day on which the notice is given.
(6) If the Secretary of State considers that it is appropriate for the person to have an opportunity to make oral representations about the matters mentioned in subsection (3)(d), the notice must also—
(a) state that the person may make such representations, and
(b) specify the arrangements for making such representations and the time at which, or the period within which, they may be made.
(7) When deciding whether to remove the person from the DVS register under this section, the Secretary of State must consider any oral or written representations made by the person in accordance with the notice.
(8) Where the Secretary of State removes the person from the DVS register under this section, the Secretary of State must by written notice inform the person of that.
(9) The Secretary of State may, in the notice given under subsection (8), state that any application for re-registration made by the person during a period specified in the notice will be refused.
(10) If the person applies to be re-registered during the period specified in the notice in reliance on subsection (9), the Secretary of State must refuse the application.
(11) The period specified in the notice in reliance on subsection (9) must begin with the day on which the notice is given and must not exceed two years.
(1) Where a person is registered in the DVS register in respect of digital verification services, subsection (2) applies if the person—
(a) asks for the register to be amended so that the person is no longer registered in respect of one or more of those services,
(b) ceases to provide one or more of those services (but not all of them), or
(c) no longer holds a certificate from an accredited conformity assessment body certifying that all of those services are provided in accordance with the DVS trust framework.
(2) The Secretary of State must amend the register to record that the person is no longer registered in respect of (as the case may be)—
(a) the service or services mentioned in a request described in subsection (1)(a),
(b) the service or services which the person has ceased to provide, or
(c) the service or services for which there is no longer a certificate as described in subsection (1)(c).
(3) For the purposes of subsection (1)(c), a certificate is to be ignored if—
(a) it has expired in accordance with its terms,
(b) it has been withdrawn by the body that issued it, or
(c) it is required to be ignored by reason of provision included in the DVS trust framework under section 28(8).
43 Duty to remove supplementary notes from the DVS register
(1) The Secretary of State must remove a supplementary note included in the entry in the DVS register relating to a person if—
(a) the person asks for the note to be removed,
(b) the person ceases to provide all of the digital verification services to which the note relates,
(c) the person no longer holds a certificate from an accredited conformity assessment body certifying that at least one of those digital verification services is provided in accordance with the supplementary code to which the note relates, or
(d) the supplementary code to which the note relates has been withdrawn.
(2) For the purposes of subsection (1)(c), a certificate is to be ignored if—
(a) it has expired in accordance with its terms,
(b) it has been withdrawn by the body that issued it, or
(c) it is required to be ignored by reason of provision included in the supplementary code as a result of section 29(9).
44 Duty to remove services from supplementary notes
(1) Where a person has a supplementary note included in their entry in the DVS register in respect of digital verification services, subsection (2) applies if the person—
(a) asks for the note to be amended so that it no longer records one or more of those services,
(b) ceases to provide one or more of the services recorded in the note (but not all of them), or
(c) no longer holds a certificate from an accredited conformity assessment body certifying that all of the services included in the note are provided in accordance with a supplementary code.
(2) The Secretary of State must amend the supplementary note so it no longer records (as the case may be)—
(a) the service or services mentioned in a request described in subsection (1)(a),
(b) the service or services which the person has ceased to provide, or
(c) the service or services for which there is no longer a certificate as described in subsection (1)(c).
(3) For the purposes of subsection (1)(c), a certificate is to be ignored if—
(a) it has expired in accordance with its terms,
(b) it has been withdrawn by the body that issued it, or
(c) it is required to be ignored by reason of provision included in the supplementary code as a result of section 29(9).
49 Code of practice about the disclosure of information
(1) The Secretary of State must prepare and publish a code of practice about the disclosure of information under section 45.
(2) The code of practice must be consistent with the code of practice prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act (as altered or replaced from time to time).
(3) A public authority must have regard to the code of practice in disclosing information under section 45.
(4) The Secretary of State may from time to time revise and republish the code of practice.
(5) In preparing or revising the code of practice, the Secretary of State must consult—
(a) the Information Commission,
(b) the Welsh Ministers,
(c) the Scottish Ministers,
(d) the Department of Finance in Northern Ireland, and
(e) such other persons as the Secretary of State considers appropriate.
(6) The requirement in subsection (5) may be satisfied by consultation undertaken before the coming into force of this section.
(7) The Secretary of State may not publish the first version of the code of practice unless a draft of the code has been laid before, and approved by a resolution of, each House of Parliament.
(8) The Secretary of State may not republish the code of practice following its revision unless—
(a) a draft of the code as revised has been laid before each House of Parliament, and
(b) the 40-day period has expired without either House of Parliament resolving not to approve the draft.
(9) “The 40-day period” means—
(a) the period of 40 days beginning with the day on which the draft is laid before Parliament, or
(b) if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.
(10) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.
(11) In this section, “public authority” means a person whose functions—
(a) are of a public nature, or
(b) include functions of that nature.
(1) The Secretary of State may designate a mark for use in the course of providing, or offering to provide, digital verification services.
(2) A mark designated under this section must be published by the Secretary of State.
(3) A mark designated under this section may not be used by a person in the course of providing, or offering to provide, digital verification services unless the person is registered in the DVS register in respect of those digital verification services.
(4) The Secretary of State may enforce subsection (3) in civil proceedings for an injunction or, in Scotland, an interdict.
51 Power of Secretary of State to require information
(1) The Secretary of State may by written notice require—
(a) an accredited conformity assessment body, or
(b) a person registered in the DVS register,
to provide the Secretary of State with information that the Secretary of State reasonably requires for the purposes of the exercise of the Secretary of State’s functions under this Part.
(2) A notice under this section must state why the information is required for the purposes of the exercise of those functions.
(3) A notice under this section—
(a) may specify or describe particular information or a category of information;
(b) may specify the form in which the information must be provided;
(c) may specify the time at which, or the period within which, the information must be provided;
(d) may specify the place where the information must be provided.
(4) A notice under this section that is given to a person registered in the DVS register must provide information about the consequences under section 41 of failure to comply with the notice.
(5) The Secretary of State may cancel a notice under this section by notice to the person to whom it was given.
(6) A disclosure of information required by a notice under this section does not breach—
(a) any obligation of confidence owed by the person making the disclosure, or
(b) any other restriction on the disclosure of information (however imposed).
(7) But a notice under this section does not require a disclosure of information if the disclosure—
(a) would contravene section 46, 47 or 48,
(b) would contravene the data protection legislation (but in determining whether a disclosure would do so, the duty imposed by the notice is to be taken into account), or
(c) is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
(8) A notice under this section does not require a person to provide the Secretary of State with information in respect of a communication which is made—
(a) between a professional legal adviser and the adviser’s client, and
(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under this Part.
(9) In subsection (8), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
(10) A notice under this section does not require a person to provide the Secretary of State with information if doing so would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.
(11) The reference to an offence in subsection (10) does not include an offence under—
(a) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
(b) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);
(c) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).
(12) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act).
52 Arrangements for third party to exercise functions
(1) The Secretary of State may make arrangements for a person prescribed by regulations under this section to exercise a relevant function of the Secretary of State (and, where arrangements are made, references in this Part, or in regulations made under this Part, to the Secretary of State are to be read accordingly).
(2) Arrangements under this section may—
(a) provide for the Secretary of State to make payments to the person, and
(b) make provision as to the circumstances in which any such payments are to be repaid to the Secretary of State.
(3) Regulations under this section are subject to the affirmative resolution procedure.
(4) In this section, “relevant function” means a function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under regulations under section 39) other than a power to make regulations.
(5) If a person exercises the function of charging or recovering fees by virtue of arrangements under this section, the person must pay the fees to the Secretary of State, except to the extent that the Secretary of State directs otherwise.
(1) The Secretary of State must prepare and publish reports on the operation of this Part.
(2) The first report must be published within the period of 12 months beginning with the day on which section 28 comes into force.
(3) The reports must be published not more than 12 months apart.
The Table below lists provisions that define or otherwise explain terms defined for the purposes of this Part.
Term | Provision
accredited conformity assessment body | section 33 (6)
digital verification services | section 27 (2)
the DVS register | section 32 (2)
the DVS trust framework | section 28 (1)
supplementary code | section 29 (2)
supplementary note | section 36 (6)
55 Powers relating to verification of identity or status
(1) In section 15 of the Immigration, Asylum and Nationality Act 2006 (penalty for employing a person subject to immigration control), after subsection (7) insert—
(8) An order under subsection (3) containing provision described in subsection (7)(a), (b) or (c) may, in particular—
(a) specify a document generated by a DVS-registered person or a DVS-registered person of a specified description;
(b) specify a document which was provided to such a person in order to generate such a document;
(c) specify steps involving the use of services provided by such a person.
(9) In subsection (8), “DVS-registered person” means a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“the DVS register”).
(10) An order under subsection (3) which specifies a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to specified services (see section 36 of the Data (Use and Access) Act 2025).
(2) In section 34 of the Immigration Act 2014 (requirements which may be prescribed for the purposes of provisions about occupying premises under a residential tenancy agreement)—
(a) in subsection (1)—
(i) in paragraph (a), after “occupiers” insert “, a DVS-registered person or a DVS-registered person of a prescribed description”,
(ii) in paragraph (b), after “occupiers” insert “, a DVS-registered person or a DVS-registered person of a prescribed description”, and
(iii) in paragraph (c), at the end insert “, including steps involving the use of services provided by a DVS-registered person or a DVS-registered person of a prescribed description”, and
(b) after that subsection insert—
(1A) An order prescribing requirements for the purposes of this Chapter which contains provision described in subsection (1)(a) or (b) may, in particular—
(a) prescribe a document generated by a DVS-registered person or a DVS-registered person of a prescribed description;
(b) prescribe a document which was provided to such a person in order to generate such a document.
(1B) In subsections (1) and (1A), “DVS-registered person” means a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“the DVS register”).
(1C) An order prescribing requirements for the purposes of this Chapter which prescribes a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section 36 of the Data (Use and Access) Act 2025).
(3) In Schedule 6 to the Immigration Act 2016 (illegal working compliance orders etc), after paragraph 5 insert—
Prescribed checks and documents
5A (1) Regulations under paragraph 5(6)(b) or (c) may, in particular—
(a) prescribe checks carried out using services provided by a DVS-registered person or a DVS-registered person of a prescribed description;
(b) prescribe documents generated by such a person;
(c) prescribe documents which were provided to such a person in order to generate such documents.
(2) In sub-paragraph (1), “DVS-registered person” means a person who is registered in the DVS register maintained under Part 2 of the Data (Use and Access) Act 2025 (“the DVS register”).
(3) Regulations under paragraph 5(6)(b) or (c) which prescribe a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section 36 of the Data (Use and Access) Act 2025).
56 National Underground Asset Register: England and Wales
(1) After section 106 of the New Roads and Street Works Act 1991 insert—
Part 3A National Underground Asset Register: England and Wales
The register
National Underground Asset Register
106A (1) The Secretary of State must keep a register of information relating to apparatus in streets in England and Wales.
(2) The register is to be known as the National Underground Asset Register (and is referred to in this Act as “NUAR”).
(3) NUAR must be kept in such form and manner as may be prescribed.
(4) The Secretary of State must make arrangements so as to enable any person who is required, by a provision of this Act, to enter information into NUAR to have access to NUAR for that purpose.
(5) Regulations under subsection (3) are subject to the negative procedure.
(6) The obligations of the Secretary of State under subsection (1) and under Article 45A(1) of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (keeping of register of information relating to apparatus in streets in Northern Ireland) may be discharged by the keeping of a single register in relation to England, Wales and Northern Ireland.
Initial upload of information into NUAR
106B (1) Before the end of the initial upload period an undertaker having apparatus in a street must enter into NUAR—
(a) all information that is included in the undertaker’s records under section 79(1) on the archive upload date, and
(b) any other information of a prescribed description that is held by the undertaker on that date.
(2) The duty under subsection (1) does not apply in such cases as may be prescribed.
(3) Information must be entered into NUAR under subsection (1) in such form and manner as may be prescribed.
(4) An undertaker who fails to comply with a duty placed on the undertaker under this section—
(a) commits an offence, and
(b) is liable to compensate any person in respect of damage or loss incurred by the person in consequence of the failure.
(5) A person who commits an offence under subsection (4)(a) is liable on summary conviction to a fine.
(6) In criminal or civil proceedings against an undertaker arising out of a failure to comply with a duty under this section, it is a defence for the undertaker to show that all reasonable care was taken to secure that no such failure occurred by—
(a) the undertaker and the undertaker’s employees, and
(b) any contractor of the undertaker and the contractor’s employees.
(7) Section 95 applies in relation to an offence under this section as it applies in relation to an offence under Part 3.
(8) For the purposes of subsection (1) the Secretary of State must by regulations—
(a) specify a date as “the archive upload date”, and
(b) specify a period beginning with that date as the “initial upload period”.
(9) Regulations under this section are subject to the negative procedure.
Access to information kept in NUAR
106C (1) The Secretary of State may by regulations make provision for or in connection with making information kept in NUAR available.
(2) The regulations may (among other things)—
(a) make provision about which information, or descriptions of information, may be made available;
(b) make provision about the descriptions of person to whom information may be made available;
(c) make provision for information to be made available subject to exceptions;
(d) make provision requiring or authorising the Secretary of State to adapt, modify or obscure information before making it available;
(e) make provision authorising all information kept in NUAR to be made available to prescribed descriptions of person under prescribed conditions;
(f) make provision about the purposes for which information may be made available;
(g) make provision about the form and manner in which information may be made available;
(h) make provision for or in connection with the granting of licences by the Secretary of State in relation to any non-Crown IP rights that may exist in relation to information made available (including provision about the form of a licence and the terms and conditions of a licence);
(i) make provision for information to be made available for free or for a fee;
(j) make provision about the amounts of the fees, including provision for the amount of a fee to be an amount which is intended to exceed the cost of the things in respect of which the fee is charged;
(k) make provision about how funds raised by means of fees must or may be used, including provision for funds to be paid to persons who are required, by a provision of this Act, to enter information into NUAR.
(3) Except as otherwise prescribed and subject to section 106I, processing of information by the Secretary of State in exercise of functions conferred by or under section 106A or this section does not breach—
(a) an obligation of confidence owed by the Secretary of State, or
(b) any other restriction on the processing of information (however imposed).
(4) Regulations under this section are subject to the affirmative procedure.
(5) In this section—
“database right” has the same meaning as in Part 3 of the Copyright and Rights in Databases Regulations 1997 (S.I. 1997/3032);
“non-Crown IP right” means any copyright, database right or other intellectual property right which is not owned by the Crown.
Guidance
106D (1) The Secretary of State must produce guidance for persons described in subsection (2) about how to protect information kept in, or obtained from, NUAR.
(2) The persons are persons who, pursuant to regulations made under section 106C, are able to access information kept in NUAR.
(3) The Secretary of State may revise or replace the guidance.
(4) The Secretary of State must publish the guidance (and any revised or replacement guidance) in such manner as the Secretary of State considers appropriate for bringing it to the attention of persons described in subsection (2).
(5) The same guidance may discharge the obligations of the Secretary of State under this section and under Article 45D of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)).
Requirements for undertakers to pay fees and provide information
Fees payable by undertakers in relation to NUAR
106E (1) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to pay fees to the Secretary of State for or in connection with the exercise by the Secretary of State of any function conferred by or under this Part.
(2) The regulations may—
(a) specify the amounts of the fees, or the maximum amounts of the fees, or
(b) provide for the amounts of the fees, or the maximum amounts of the fees, to be determined in accordance with the regulations.
(3) In making the regulations the Secretary of State must seek to secure that, so far as possible and taking one year with another, combined NUAR income matches combined NUAR expenses.
(4) Except where the regulations specify the amounts of the fees—
(a) the amounts of the fees must be specified by the Secretary of State in a statement, and
(b) the Secretary of State must—
(i) publish the statement, and
(ii) lay it before Parliament.
(5) Regulations under subsection (1) may make provision about—
(a) when a fee is to be paid;
(b) the manner in which a fee is to be paid;
(c) the payment of discounted fees;
(d) exceptions to requirements to pay fees;
(e) the refund of all or part of a fee which has been paid.
(6) Before making regulations under subsection (1), the Secretary of State must consult—
(a) such representatives of persons likely to be affected by the regulations as the Secretary of State considers appropriate, and
(b) such other persons as the Secretary of State considers appropriate.
(7) Subject to the following provisions of this section regulations under subsection (1) are subject to the affirmative procedure.
(8) Regulations under subsection (1) that only make provision of a kind mentioned in subsection (2) are subject to the negative procedure.
(9) But the first regulations under subsection (1) that make provision of a kind mentioned in subsection (2) are subject to the affirmative procedure.
(10) In this section—
“combined NUAR expenses” means the sum of—
expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under this Part (including expenses not directly connected with the keeping of NUAR), and
expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under Articles 45A to 45I of, and Schedule 2ZA to, the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (including expenses not directly connected with the keeping of the register kept under Article 45A(1) of that Order);
“combined NUAR income” means the sum of—
income received by the Secretary of State from fees payable under regulations under subsection (1), and
income received by the Secretary of State from fees payable under regulations under Article 45E(1) of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)).
Providing information for purposes of regulations under section 106E
106F (1) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes—
(a) assisting the Secretary of State in determining the provision that it is appropriate for regulations under section 106E(1) or a statement under section 106E(4) to make;
(b) assisting the Secretary of State in determining whether it is appropriate to make changes to such provision.
(2) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes—
(a) ascertaining whether a fee is payable by a person under regulations under section 106E(1);
(b) working out the amount of a fee payable by a person.
(3) Regulations under subsection (1) or (2) may require an undertaker to notify the Secretary of State of any changes to information previously provided under the regulations.
(4) Regulations under subsection (1) or (2) may make provision about—
(a) when information is to be provided (which may be at prescribed intervals);
(b) the form and manner in which information is to be provided;
(c) exceptions to requirements to provide information.
(5) Regulations under subsection (1) or (2) are subject to the negative procedure.
Monetary penalties
Monetary penalties
106G Schedule 5A makes provision about the imposition of penalties in connection with requirements imposed by regulations under sections 106E(1) and 106F(1) and (2).
Exercise of functions by third party
Arrangements for third party to exercise functions
106H (1) The Secretary of State may make arrangements for a prescribed person to exercise a relevant function of the Secretary of State.
(2) More than one person may be prescribed.
(3) Arrangements under this section may—
(a) provide for the Secretary of State to make payments to the person, and
(b) make provision as to the circumstances in which such payments are to be repaid to the Secretary of State.
(4) In the case of the exercise of a function by a person authorised by arrangements under this section to exercise that function, a reference in this Part or in regulations under this Part to the Secretary of State in connection with that function is to be read as a reference to that person.
(5) Arrangements under this section do not prevent the Secretary of State from exercising a function to which the arrangements relate.
(6) Except as otherwise prescribed and subject to section 106I, the disclosure of information between the Secretary of State and a person in connection with the person’s entering into arrangements under this section or exercise of functions to which such arrangements relate does not breach—
(a) an obligation of confidence owed by the person making the disclosure, or
(b) any other restriction on the disclosure of information (however imposed).
(7) Regulations under this section are subject to the affirmative procedure.
(8) In this section “relevant function” means a function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under regulations under section 106E) other than—
(a) a power to make regulations, or
(b) a function under section 106E(4) (specifying of fees etc).
(9) If a person exercises the function of charging or recovering fees by virtue of arrangements under this section, the person must pay the fees to the Secretary of State, except to the extent that the Secretary of State directs otherwise.
Data protection
Data protection
106I (1) A duty or power to process information that is imposed or conferred by or under this Part does not operate to require or authorise the processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, that duty or power is to be taken into account).
(2) In this section—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);
“personal data” has the same meaning as in that Act (see section 3(2) of that Act).
Supplementary provisions
Regulations under this Part
106J (1) In this Part “prescribed” means prescribed by regulations made by the Secretary of State.
(2) Regulations under this Part may make—
(a) different provision for different purposes;
(b) supplementary and incidental provision.
(3) Regulations under this Part are to be made by statutory instrument.
(4) Before making regulations under this Part the Secretary of State must obtain the consent of the Welsh Ministers in relation to any provision which would be within the legislative competence of Senedd Cymru if contained in an Act of the Senedd (ignoring any requirement for the consent of a Minister of the Crown imposed under Schedule 7B to the Government of Wales Act 2006).
(5) Where regulations under this Part are subject to “the affirmative procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before and approved by a resolution of each House of Parliament.
(6) Where regulations under this Part are subject to “the negative procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
(7) Any provision that may be made in regulations under this Part subject to the negative procedure may be made in regulations subject to the affirmative procedure.
Interpretation
106K (1) In this Part the following terms have the same meaning as in Part 3—
“apparatus” (see sections 89(3) and 105(1));
“in” (in a context referring to apparatus in a street) (see section 105(1));
“street” (see section 48(1) and (2));
“undertaker” (in relation to apparatus or in a context referring to having apparatus in a street) (see sections 48(5) and 89(4)).
(2) In this Part “processing” has the same meaning as in the Data Protection Act 2018 (see section 3(4) of that Act) and “process” is to be read accordingly.
(2) Section 166 of the New Roads and Street Works Act 1991, so far as relating to Part 3A of that Act (inserted by subsection (1)), extends to England and Wales.
(3) In section 167 of that Act (Crown application), after subsection (5) insert—
(5A) The provisions of Part 3A of this Act (National Underground Asset Register: England and Wales) bind the Crown.
(5B) Nothing in subsection (5A) is to be construed as authorising the bringing of proceedings for a criminal offence against a person acting on behalf of the Crown.
(4) Schedule 1 to this Act inserts Schedule 5A into the New Roads and Street Works Act 1991 (monetary penalties).
57 Information in relation to apparatus: England and Wales
(1) The New Roads and Street Works Act 1991 is amended in accordance with subsections (2) to (6).
(2) For the italic heading before section 79 (records of location of apparatus) substitute “Duties in relation to recording and sharing of information about apparatus”.
(3) In section 79—
(a) for the heading substitute “Information in relation to apparatus”;
(b) in subsection (1), for paragraph (c) substitute—
(c) being informed of its location under section 80(2)(a),
;
(c) after subsection (1A) (as inserted by section 46(2) of the Traffic Management Act 2004) insert—
(1B) An undertaker must, except in such cases as may be prescribed, record in relation to every item of apparatus belonging to the undertaker such other information as may be prescribed as soon as reasonably practicable after—
(a) placing the item in the street or altering its position,
(b) inspecting, maintaining, adjusting, repairing, altering or renewing the item,
(c) locating the item in the street in the course of executing any other works, or
(d) receiving any such information in relation to the item under section 80(2)(a).
;
(d) omit subsection (3);
(e) in subsection (3A) (as inserted by section 46(4) of the Traffic Management Act 2004)—
(i) for “to (3)” substitute “and (2A)”;
(ii) for “subsection (1)” substitute “this section”;
(f) after subsection (3A) insert—
(3B) Except in such cases as may be prescribed, where an undertaker records information as required by subsection (1) or (1B), or updates such information, the undertaker must, within a prescribed period, enter the recorded or updated information into NUAR.
(3C) Information must be entered into NUAR under subsection (3B) in such form and manner as may be prescribed.
;
(g) in subsection (4)(a), omit “not exceeding level 5 on the standard scale”;
(h) after subsection (6) insert—
(7) In this section “prescribed” means—
(a) in subsections (1) to (2)—
(i) in relation to apparatus in streets in England, prescribed by regulations made by the Secretary of State;
(ii) in relation to apparatus in streets in Wales, prescribed by regulations made by the Secretary of State or the Welsh Ministers;
(b) otherwise, prescribed by regulations made by the Secretary of State.
(8) Before making regulations under this section the Secretary of State must obtain the consent of the Welsh Ministers in relation to any provision that relates to apparatus in streets in Wales.
(9) For the meaning of “NUAR”, see section 106A.
(4) For section 80 (duty to inform undertakers of location of apparatus) substitute—
Duties to report missing or incorrect information in relation to apparatus
80 (1) Subsection (2) applies where a relevant person executing works of any description in a street finds an item of apparatus which does not belong to the person in relation to which prescribed information—
(a) is not entered in NUAR, or
(b) is entered in NUAR but is incorrect.
(2) Except in such cases as may be prescribed, the person must—
(a) take such steps as are reasonably practicable to inform the undertaker to whom the item belongs of the missing or incorrect information, and
(b) if (having taken such steps) the person is unable to inform the undertaker to whom the item belongs of the missing or incorrect information, enter into NUAR, in such form and manner as may be prescribed, prescribed information in relation to the item.
(3) A person who fails to comply with subsection (2) commits an offence.
(4) A person who commits an offence under subsection (3) is liable on summary conviction to a fine not exceeding level 4 on the standard scale.
(5) Before making regulations under this section the Secretary of State must obtain the consent of the Welsh Ministers in relation to any provision that relates to apparatus in streets in Wales.
(6) Before making regulations under this section the Secretary of State must consult—
(a) such representatives of persons likely to be affected by the regulations as the Secretary of State considers appropriate, and
(b) such other persons as the Secretary of State considers appropriate.
(7) For the purposes of this section a person executing works in a street is a “relevant person” if the person has, pursuant to regulations under section 106C(1), access to NUAR in relation to the street in question.
(8) For the meaning of “NUAR”, see section 106A.
(5) Before section 81 (duty to maintain apparatus) insert—
Other duties and liabilities of undertakers in relation to apparatus
.
(6) In section 104 (regulations)—
(a) in subsection (1)—
(i) after “Part” insert “, except in section 79,”;
(ii) omit from “, which” to the end;
(b) after subsection (1) insert—
(1A) Regulations under this Part may make—
(a) different provision for different cases;
(b) supplementary or incidental provision.
;
(c) in subsection (2), after “Regulations” insert “made by the Secretary of State”;
(d) after subsection (2) insert—
(2A) Regulations made by the Welsh Ministers under section 79 are to be made by statutory instrument and a statutory instrument containing such regulations is subject to annulment in pursuance of a resolution of Senedd Cymru.
(7) In consequence of the provision made by subsection (4), omit section 47 of the Traffic Management Act 2004.
(8) In Schedule 7B to the Government of Wales Act 2006 (general restriction on competence of Senedd Cymru), in paragraph 11(6)(b) (exceptions to restrictions relating to Ministers of the Crown), before sub-paragraph (i) insert—
(ai) section 79 of the New Roads and Street Works Act 1991;
.
58 National Underground Asset Register: Northern Ireland
(1) The Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) is amended in accordance with subsections (2) to (4).
(2) In Article 2 (interpretation), in paragraph (2)—
(a) after the definition of “in” insert—
“NUAR provision” means any of Articles 45A to 45I and Schedule 2ZA;
;
(b) in the definition of “prescribed”—
(i) for “means” substitute “means—”;
(ii) the words from “prescribed by” to the end become paragraph (a);
(iii) at the beginning of that paragraph insert “except in Articles 39 and 40 and a NUAR provision,”;
(iv) after that paragraph insert—
in Article 40 and a NUAR provision, prescribed by regulations made by the Secretary of State;
.
(3) After Article 45
insert—
National Underground Asset Register
National Underground Asset Register
45A (1) The Secretary of State must keep a register of information relating to apparatus in streets in Northern Ireland.
(2) The register is to be known as the National Underground Asset Register (and is referred to in this Order as “NUAR”).
(3) NUAR must be kept in such form and manner as may be prescribed.
(4) The Secretary of State must make arrangements so as to enable any person who is required, by a provision of this Order, to enter information into NUAR to have access to NUAR for that purpose.
(5) The obligations of the Secretary of State under paragraph (1) and under section 106A(1) of the New Roads and Street Works Act 1991 (keeping of register of information relating to apparatus in streets in England and Wales) may be discharged by the keeping of a single register in relation to England, Wales and Northern Ireland.
Initial upload of information into NUAR
45B (1) Before the end of the initial upload period an undertaker having apparatus in a street must enter into NUAR—
(a) all information that is included in the undertaker’s records under Article 39(1) on the archive upload date, and
(b) any other information of a prescribed description that is held by the undertaker on that date.
(2) The duty under paragraph (1) does not apply in such cases as may be prescribed.
(3) Information must be entered into NUAR under paragraph (1) in such form and manner as may be prescribed.
(4) An undertaker who fails to comply with a duty placed on the undertaker under this Article—
(a) commits an offence, and
(b) is liable to compensate any person in respect of damage or loss incurred by the person in consequence of the failure.
(5) A person who commits an offence under paragraph (4)(a) is liable on summary conviction to a fine not exceeding level 5 on the standard scale.
(6) In criminal or civil proceedings against an undertaker arising out of a failure to comply with a duty under this Article, it is a defence for the undertaker to show that all reasonable care was taken to secure that no such failure occurred by—
(a) the undertaker and the undertaker’s employees, and
(b) any contractor of the undertaker and the contractor’s employees.
(7) For the purposes of paragraph (1) the Secretary of State must by regulations—
(a) specify a date as “the archive upload date”, and
(b) specify a period beginning with that date as the “initial upload period”.
Access to information kept in NUAR
45C (1) The Secretary of State may by regulations make provision for or in connection with making information kept in NUAR available.
(2) The regulations may (among other things)—
(a) make provision about which information, or descriptions of information, may be made available;
(b) make provision about the descriptions of person to whom information may be made available;
(c) make provision for information to be made available subject to exceptions;
(d) make provision requiring or authorising the Secretary of State to adapt, modify or obscure information before making it available;
(e) make provision authorising all information kept in NUAR to be made available to prescribed descriptions of person under prescribed conditions;
(f) make provision about the purposes for which information may be made available;
(g) make provision about the form and manner in which information may be made available;
(h) make provision for or in connection with the granting of licences by the Secretary of State in relation to any non-Crown IP rights that may exist in relation to information made available (including provision about the form of a licence and the terms and conditions of a licence);
(i) make provision for information to be made available for free or for a fee;
(j) make provision about the amounts of the fees, including provision for the amount of a fee to be an amount which is intended to exceed the cost of the things in respect of which the fee is charged;
(k) make provision about how funds raised by means of fees must or may be used, including provision for funds to be paid to persons who are required, by a provision of this Order, to enter information into NUAR.
(3) Except as otherwise prescribed and subject to Article 45I, processing of information by the Secretary of State in exercise of functions conferred by or under Article 45A or this Article does not breach—
(a) an obligation of confidence owed by the Secretary of State, or
(b) any other restriction on the processing of information (however imposed).
(4) In this Article—
“database right” has the same meaning as in Part 3 of the Copyright and Rights in Databases Regulations 1997 (S.I. 1997/3032);
“non-Crown IP right” means any copyright, database right or other intellectual property right which is not owned by the Crown;
“processing” has the same meaning as in the Data Protection Act 2018 (see section 3(4) of that Act).
Guidance
45D (1) The Secretary of State must produce guidance for persons described in paragraph (2) about how to protect information kept in, or obtained from, NUAR.
(2) The persons are persons who, pursuant to regulations made under Article 45C, are able to access information kept in NUAR.
(3) The Secretary of State may revise or replace the guidance.
(4) The Secretary of State must publish the guidance (and any revised or replacement guidance) in such manner as the Secretary of State considers appropriate for bringing it to the attention of persons described in paragraph (2).
(5) The same guidance may discharge the obligations of the Secretary of State under this Article and under section 106D of the New Roads and Street Works Act 1991.
Fees payable by undertakers in relation to NUAR
45E (1) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to pay fees to the Secretary of State for or in connection with the exercise by the Secretary of State of any function conferred by or under a NUAR provision.
(2) The regulations may—
(a) specify the amounts of the fees, or the maximum amounts of the fees, or
(b) provide for the amounts of the fees, or the maximum amounts of the fees, to be determined in accordance with the regulations.
(3) In making the regulations the Secretary of State must seek to secure that, so far as possible and taking one year with another, combined NUAR income matches combined NUAR expenses.
(4) Except where the regulations specify the amounts of the fees—
(a) the amounts of the fees must be specified by the Secretary of State in a statement, and
(b) the Secretary of State must—
(i) publish the statement, and
(ii) lay it before Parliament.
(5) Regulations under paragraph (1) may make provision about—
(a) when a fee is to be paid;
(b) the manner in which a fee is to be paid;
(c) the payment of discounted fees;
(d) exceptions to requirements to pay fees;
(e) the refund of all or part of a fee which has been paid.
(6) Before making regulations under paragraph (1), the Secretary of State must consult—
(a) such representatives of persons likely to be affected by the regulations as the Secretary of State considers appropriate, and
(b) such other persons as the Secretary of State considers appropriate.
(7) In this Article—
“combined NUAR expenses” means the sum of—
expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under a NUAR provision (including expenses not directly connected with the keeping of NUAR), and
expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under Part 3A of the New Roads and Street Works Act 1991 (including expenses not directly connected with the keeping of the register kept under section 106A(1) of that Act);
“combined NUAR income” means the sum of—
income received by the Secretary of State from fees payable under regulations under paragraph (1), and
income received by the Secretary of State from fees payable under regulations under section 106E(1) of the New Roads and Street Works Act 1991.
Providing information for purposes of regulations under Article 45E
45F (1) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes—
(a) assisting the Secretary of State in determining the provision that it is appropriate for regulations under Article 45E(1) or a statement under Article 45E(4) to make;
(b) assisting the Secretary of State in determining whether it is appropriate to make changes to such provision.
(2) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes—
(a) ascertaining whether a fee is payable by a person under regulations under Article 45E(1);
(b) working out the amount of a fee payable by a person.
(3) Regulations under paragraph (1) or (2) may require an undertaker to notify the Secretary of State of any changes to information previously provided under the regulations.
(4) Regulations under paragraph (1) or (2) may make provision about—
(a) when information is to be provided (which may be at prescribed intervals);
(b) the form and manner in which information is to be provided;
(c) exceptions to requirements to provide information.
Monetary penalties
45G Schedule 2ZA makes provision about the imposition of penalties in connection with requirements imposed by regulations under Articles 45E(1) and 45F(1) and (2).
Arrangements for third party to exercise functions
45H (1) The Secretary of State may make arrangements for a prescribed person to exercise a relevant function of the Secretary of State.
(2) More than one person may be prescribed.
(3) Arrangements under this Article may—
(a) provide for the Secretary of State to make payments to the person, and
(b) make provision as to the circumstances in which such payments are to be repaid to the Secretary of State.
(4) In the case of the exercise of a function by a person authorised by arrangements under this Article to exercise that function, a reference in a NUAR provision or in regulations under a NUAR provision to the Secretary of State in connection with that function is to be read as a reference to that person.
(5) Arrangements under this Article do not prevent the Secretary of State from exercising a function to which the arrangements relate.
(6) Except as otherwise prescribed and subject to Article 45I, the disclosure of information between the Secretary of State and a person in connection with the person’s entering into arrangements under this Article or exercise of functions to which such arrangements relate does not breach—
(a) an obligation of confidence owed by the person making the disclosure, or
(b) any other restriction on the disclosure of information (however imposed).
(7) In this Article “relevant function” means a function of the Secretary of State conferred by or under a NUAR provision (including the function of charging or recovering fees under regulations under Article 45E) other than—
(a) a power to make regulations, or
(b) a function under Article 45E(4) (specifying of fees etc).
(8) If a person exercises the function of charging or recovering fees by virtue of arrangements under this Article, the person must pay the fees to the Secretary of State, except to the extent that the Secretary of State directs otherwise.
Data protection
45I (1) A duty or power to process information that is imposed or conferred by or under a NUAR provision does not operate to require or authorise the processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, that duty or power is to be taken into account).
(2) In this Article—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);
“personal data” has the same meaning as in that Act (see section 3(2) of that Act);
“processing” has the same meaning as in that Act (see section 3(4) of that Act).
(4) In Article 59 (regulations)—
(a) before paragraph (1) insert—
(A1) Before making regulations under this Order the Secretary of State must obtain the consent of the Department for Infrastructure.
(A2) Regulations under Article 39 or 40 or under a NUAR provision may make supplementary or incidental provision.
;
(b) in paragraph (1), after “Order” insert “, other than regulations made by the Secretary of State,”;
(c) before paragraph (2) insert—
(1B) For the purposes of the Statutory Instruments Act 1946 a power of the Secretary of State to make regulations under this Order is exercisable by statutory instrument, and that Act applies in relation to a document by which such a power is exercised as if this Order were an Act of Parliament passed after the commencement of that Act.
(1C) Regulations made by the Secretary of State under Articles 39, 40, 45A, 45B and 45F are subject to the negative Westminster procedure.
(1D) Subject to paragraphs (1E) and (1F), regulations made by the Secretary of State under Articles 45C, 45E and 45H and paragraph 1 of Schedule 2ZA are subject to the affirmative Westminster procedure.
(1E) Regulations under Article 45E(1) that only make provision of a kind mentioned in Article 45E(2) are subject to the negative Westminster procedure.
(1F) But the first regulations under Article 45E(1) that make provision of a kind mentioned in Article 45E(2) are subject to the affirmative Westminster procedure.
(1G) Where regulations under this Order are subject to “the affirmative Westminster procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before and approved by a resolution of each House of Parliament.
(1H) Where regulations under this Order are subject to “the negative Westminster procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
(1I) Any provision that may be made in regulations under this Order subject to the negative Westminster procedure may be made in regulations subject to the affirmative Westminster procedure.
(5) Article 59(A2) of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (inserted by subsection (4)(a)) is revoked on the coming into operation of Article 59(1A) of that Order (as inserted by Article 28(3) of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1))).
(6) Schedule 2 to this Act inserts Schedule 2ZA into the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (monetary penalties).
59 Information in relation to apparatus: Northern Ireland
(1) The Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) is amended in accordance with subsections (2) to (5).
(2) For the italic heading before Article 39 (records of location of apparatus) substitute “Duties in relation to recording and sharing of information about apparatus”.
(3) In Article 39—
(a) for the heading substitute “Information in relation to apparatus”;
(b) in paragraph (1), for sub-paragraph (c) substitute—
(c) being informed of its location under Article 40(2)(a),
;
(c) after paragraph (1A) (as inserted by Article 22(2) of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1))) insert—
(1B) An undertaker must, except in such cases as may be prescribed, record in relation to every item of apparatus belonging to the undertaker such other information as may be prescribed as soon as reasonably practicable after—
(a) placing the item in the street or altering its position,
(b) inspecting, maintaining, adjusting, repairing, altering or renewing the item,
(c) locating the item in the street in the course of executing any other works, or
(d) receiving any such information in relation to the item under Article 40(2)(a).
;
(d) omit paragraph (3);
(e) in paragraph (3A) (as inserted by Article 22(4) of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1)))—
(i) for “to (3)” substitute “and (2A)”;
(ii) for “paragraph (1)” substitute “this Article”;
(f) after paragraph (3A) insert—
(3B) Except in such cases as may be prescribed, where an undertaker records information as required by paragraph (1) or (1B), or updates such information, the undertaker must, within a prescribed period, enter the recorded or updated information into NUAR.
(3C) Information must be entered into NUAR under paragraph (3B) in such form and manner as may be prescribed.
;
(g) after paragraph (5) insert—
(6) In this Article “prescribed” means—
(a) in paragraphs (1) to (2), prescribed by regulations made by the Secretary of State or the Department for Infrastructure;
(b) otherwise, prescribed by regulations made by the Secretary of State.
(7) For the meaning of “NUAR”, see Article 45A.
(4) For Article 40 (duty to inform undertakers of location of apparatus) substitute—
Duties to report missing or incorrect information in relation to apparatus
40 (1) Paragraph (2) applies where a relevant person executing works of any description in a street finds an item of apparatus which does not belong to the person in relation to which prescribed information—
(a) is not entered in NUAR, or
(b) is entered in NUAR but is incorrect.
(2) Except in such cases as may be prescribed, the person must—
(a) take such steps as are reasonably practicable to inform the undertaker to whom the item belongs of the missing or incorrect information, and
(b) if (having taken such steps) the person is unable to inform the undertaker to whom the item belongs of the missing or incorrect information, enter into NUAR, in such form and manner as may be prescribed, prescribed information in relation to the item.
(3) A person who fails to comply with paragraph (2) commits an offence.
(4) A person who commits an offence under paragraph (3) is liable on summary conviction to a fine not exceeding level 4 on the standard scale.
(5) Before making regulations under this Article the Secretary of State must consult—
(a) such representatives of persons likely to be affected by the regulations as the Secretary of State considers appropriate, and
(b) such other persons as the Secretary of State considers appropriate.
(6) For the purposes of this Article a person executing works in a street is a “relevant person” if the person has, pursuant to regulations under Article 45C, access to NUAR in relation to the street in question.
(7) For the meaning of “NUAR”, see Article 45A.
(5) Before Article 41 (duty to maintain apparatus) insert—
Other duties and liabilities of undertakers in relation to apparatus
.
(6) As a consequence of the provision made by subsection (4), omit Article 23 of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1)).
(7) A power of the Secretary of State to make regulations under paragraph (1) or (2) of Article 39 of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (by virtue of subsection (3)(g)) includes power to amend or revoke any provision of the Street Works (Records) Regulations (Northern Ireland) 2004 (S.R. (N.I.) 2004 No. 276) made under the paragraph concerned.
(1) The Births and Deaths Registration Act 1953 is amended as follows.
(2) After section 38A insert—
Requirements to sign register
38B (1) Where any register of births or register of deaths is required to be kept under this Act otherwise than in hard copy form, the Minister may by regulations provide that—
(a) a person’s duty under this Act to sign the register at any time is to have effect as a duty to comply with specified requirements at that time, and
(b) a person who complies with those requirements is to be treated for the purposes of this Act as having signed the register at that time and, in the case of a duty to sign the register in the presence of the registrar, to have done so in the presence of the registrar,
and accordingly, in such a case, the entry in the register is to be taken for the purposes of this Act to have been signed by the person.
(2) The provision that may be made by regulations under this section includes, among other things—
(a) provision requiring a person to sign something other than the register;
(b) provision requiring a person to provide specified evidence of identity in such form and manner as may be specified.
(3) In this section “specified” means specified in regulations under this section.
(3) In section 39A (regulations made by the Minister: further provisions), after subsection (5) insert—
(6) A statutory instrument that contains (whether alone or with other provision) regulations made by the Minister under section 38B may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.
In this Chapter—
“the 2018 Act” means the Data Protection Act 2018;
“the UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
(1) In Article 4 of the UK GDPR (definitions)—
(a) the existing text becomes paragraph 1, and
(b) after that paragraph insert—
2. References in this Regulation to the processing of personal data for the purposes of scientific research (including references to processing for “scientific research purposes”) are references to processing for the purposes of any research that can reasonably be described as scientific, whether publicly or privately funded and whether carried out as a commercial or non-commercial activity.
3. Such references—
(a) include processing for the purposes of technological development or demonstration, fundamental research or applied research, so far as those activities can reasonably be described as scientific, but
(b) only include processing for the purposes of a study in the area of public health that can reasonably be described as scientific where the study is conducted in the public interest.
4. References in this Regulation to the processing of personal data for the purposes of historical research (including references to processing for “historical research purposes”) include processing for the purposes of genealogical research.
5. References in this Regulation to the processing of personal data for statistical purposes are references to processing for statistical surveys or for the production of statistical results where—
(a) the information that results from the processing is aggregate data that is not personal data, and
(b) the controller does not use the personal data processed, or the information that results from the processing, in support of measures or decisions with respect to a particular data subject to whom the personal data relates.
(2) In consequence of the amendment made by subsection (1)(a), in section 6 of the 2018 Act (meaning of “controller”), for “4(7)” substitute “4(1)(7)”.
68 Consent to processing for the purposes of scientific research
(1) Article 4 of the UK GDPR (definitions) is amended as follows.
(2) In point (11) of paragraph 1 (definition of “consent”), at the end insert “(and see paragraphs 6 and 7 of this Article)”.
(3) After paragraph 5 (inserted by section 67 of this Act) insert—
6. A data subject’s consent is to be treated as falling within the definition of “consent” in point (11) of paragraph 1 if—
(a) it does not fall within that definition because (and only because) the consent is given to the processing of personal data for the purposes of an area of scientific research,
(b) at the time the consent is sought, it is not possible to identify fully the purposes for which personal data is to be processed,
(c) seeking consent in relation to the area of scientific research is consistent with generally recognised ethical standards relevant to the area of research, and
(d) so far as the intended purposes of the processing allow, the data subject is given the opportunity to consent only to processing for part of the research.
7. References in this Regulation to consent given for a specific purpose (however expressed) include consent described in paragraph 6.
(1) The 2018 Act is amended as follows.
(2) In section 33 (definitions), after subsection (1) insert—
(1A) “Consent” of the data subject to the processing of personal data means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data (and see section 40A).
(3) In section 34(2) (overview of Chapter 2 of Part 3), after paragraph (a) (but before the “and” at the end of that paragraph) insert—
(aa) section 40A makes provision about processing carried out in reliance on the consent of the data subject,
.
(4) After section 40 insert—
Conditions for consent
40A (1) This section is about processing of personal data that is carried out in reliance on the consent of the data subject.
(2) The controller must be able to demonstrate that the data subject consented to the processing.
(3) If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made—
(a) in a manner which clearly distinguishes the request from the other matters,
(b) in an intelligible and easily accessible form, and
(c) in clear and plain language.
(4) Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding.
(5) The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal).
(6) Processing may only be carried out in reliance on consent if—
(a) before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and
(b) it is as easy for the data subject to withdraw the consent as to give it.
(7) When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service.
(5) In section 206 (index of defined expressions), in the Table, in the entry for “consent”—
(a) after “consent” insert “(to processing of personal data)”,
(b) for “Part” substitute “Parts 3 and”, and
(c) for “section” substitute “sections 33, 40A and”.
(1) The UK GDPR is amended in accordance with subsections (2) to (5).
(2) In Article 6(1) (lawful processing)—
(a) in point (e)—
(i) after “task” insert “of the controller”, and
(ii) after “or” insert “a task carried out”,
(b) after that point insert—
(ea) processing is necessary for the purposes of a recognised legitimate interest;
, and
(c) in the words after point (f), for “Point (f)” substitute “Points (ea) and (f)”.
(3) In Article 6(3) (basis for processing etc), in the last subparagraph, in the first sentence—
(a) after “task” insert “of the controller”, and
(b) after “interest or” insert “a task carried out”.
(4) In Article 6, at the end insert—
5. For the purposes of paragraph 1(ea), processing is necessary for the purposes of a recognised legitimate interest only if it meets a condition in Annex 1.
6. The Secretary of State may by regulations amend Annex 1 by—
(a) adding or varying provisions, or
(b) omitting provisions added by regulations made under this paragraph.
7. The Secretary of State may only make regulations under paragraph 6 where—
(a) the requirement in paragraph 8 is satisfied, and
(b) if the regulations add a case to Annex 1, the requirement in paragraph 9 is also satisfied.
8. The requirement in this paragraph is that the Secretary of State considers it appropriate to make the regulations having regard to, among other things—
(a) the interests and fundamental rights and freedoms of data subjects which require protection of personal data, and
(b) where relevant, the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing.
9. The requirement in this paragraph is that the Secretary of State considers that processing in the case to be added to Annex 1 is necessary to safeguard an objective listed in Article 23(1)(c) to (j).
10. Regulations under paragraph 6 are subject to the affirmative resolution procedure.
11. For the purposes of paragraph 1(f), examples of types of processing that may be processing that is necessary for the purposes of a legitimate interest include—
(a) processing that is necessary for the purposes of direct marketing,
(b) intra-group transmission of personal data (whether relating to clients, employees or other individuals) where that is necessary for internal administrative purposes, and
(c) processing that is necessary for the purposes of ensuring the security of network and information systems.
12. In paragraph 11—
“intra-group transmission” means transmission between members of a group of undertakings or between members of a group of institutions affiliated to a central body;
“security of network and information systems” has the same meaning as in the Network and Information Systems Regulations 2018 (S.I. 2018/506) (see regulation 1(3)(g)).
(5) In Article 21(1) (right to object), after “point (e)” insert “, (ea)”.
(6) Schedule 4 to this Act inserts Annex 1 to the UK GDPR.
(7) In section 8 of the 2018 Act (lawfulness of processing: public interest etc), omit “the controller’s”.
(8) In the provisions listed in subsection (9)—
(a) for “gateway” substitute “gateways”, and
(b) for “were omitted” substitute “disapplied only the gateway in point (ea) (recognised legitimate interests)”.
(9) The provisions are—
(a) section 40(8) of the Freedom of Information Act 2000 (personal data which is exempt information);
(b) section 38(5A) of the Freedom of Information (Scotland) Act 2002 (asp 13) (personal data which is exempt information);
(c) regulation 13(6) of the Environmental Information Regulations 2004 (S.I. 2004/3391) (restriction on disclosure of personal data);
(d) regulation 11(7) of the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520) (restriction on disclosure of personal data);
(e) regulation 45(1E) of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042) (personal data which is sensitive information);
(f) regulation 39(1E) of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494) (personal data which is sensitive information);
(g) regulation 9(9) of the INSPIRE Regulations 2009 (S.I. 2009/3157) (limitation of public access to personal data included in a spatial data set);
(h) regulation 10(8) of the INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440) (limitation of public access to personal data included in a spatial data set).
(1) The UK GDPR is amended in accordance with subsections (2) to (5).
(2) In Article 5(1)(b) (purpose limitation)—
(a) after “collected” insert “(whether from the data subject or otherwise)”,
(b) after “further processed” insert “by or on behalf of a controller”, and
(c) for the words from “those purposes;” to “initial purposes” substitute “the purposes for which the controller collected the data”.
(3) In Article 5, at the end insert—
3. For the avoidance of doubt, processing is not lawful by virtue only of being processing in a manner that is compatible with the purposes for which the personal data was collected.
(4) In Article 6 (lawfulness of processing), omit paragraph 4.
(5) After Article 8 insert—
Purpose limitation: further processing
Article 8A 1. This Article is about the determination, for the purposes of Article 5(1)(b) (purpose limitation), of whether processing of personal data by or on behalf of a controller for a purpose (a “new purpose”) other than the purpose for which the controller collected the data (“the original purpose”) is processing in a manner compatible with the original purpose.
2. In making the determination, a person must take into account, among other things—
(a) any link between the original purpose and the new purpose;
(b) the context in which the personal data was collected, including the relationship between the data subject and the controller;
(c) the nature of the processing, including whether it is processing described in Article 9(1) (processing of special categories of personal data) or Article 10(1) (processing of personal data relating to criminal convictions etc);
(d) the possible consequences of the intended processing for data subjects;
(e) the existence of appropriate safeguards (for example, encryption or pseudonymisation).
3. Processing of personal data for a new purpose is to be treated as processing in a manner compatible with the original purpose where—
(a) the data subject consents to the processing of personal data for the new purpose and the new purpose is specified, explicit and legitimate,
(b) the processing is carried out in accordance with Article 84B—
(i) for the purposes of scientific research or historical research,
(ii) for the purposes of archiving in the public interest, or
(iii) for statistical purposes,
(c) the processing is carried out for the purposes of ensuring that processing of personal data complies with Article 5(1) or demonstrating that it does so,
(d) the processing meets a condition in Annex 2, or
(e) the processing is necessary to safeguard an objective listed in Article 23(1)(c) to (j) and is authorised by an enactment or rule of law.
4. Where the controller collected the personal data based on Article 6(1)(a) (data subject’s consent), processing for a new purpose is only processing in a manner compatible with the original purpose if—
(a) it falls within paragraph 3(a) or (c), or
(b) it falls within paragraph 3(d) or (e) and the controller cannot reasonably be expected to obtain the data subject’s consent.
5. The Secretary of State may by regulations amend Annex 2 by—
(a) adding or varying provisions, or
(b) omitting provisions added by regulations made under this paragraph.
6. The Secretary of State may only make regulations under paragraph 5 adding a case to Annex 2 where the Secretary of State considers that processing in that case is necessary to safeguard an objective listed in Article 23(1)(c) to (j).
7. Regulations under paragraph 5 may make provision identifying processing by any means, including by reference to the controller, the data subject, the personal data or the provision of Article 6(1) relied on for the purposes of the processing.
8. Regulations under paragraph 5 are subject to the affirmative resolution procedure.
(6) Schedule 5 to this Act inserts Annex 2 to the UK GDPR.
(7) The 2018 Act is amended in accordance with subsections (8) to (10).
(8) In section 36(1) (the second data protection principle)—
(a) in paragraph (a), for “on any occasion” substitute “(whether from the data subject or otherwise)”, and
(b) in paragraph (b)—
(i) after “processed” insert “by or on behalf of a controller”, and
(ii) for “it was collected” substitute “the controller collected it”.
(9) In section 87(1) (the second data protection principle)—
(a) in paragraph (a), for “on any occasion” substitute “(whether from the data subject or otherwise)”, and
(b) in paragraph (b)—
(i) after “processed” insert “by or on behalf of a controller”, and
(ii) for “it was collected” substitute “the controller collected it”.
(10) In paragraph 1 of Schedule 2 (exemptions etc from the UK GDPR: provisions to be adapted or restricted), omit sub-paragraph (b)(ii).
72 Processing in reliance on relevant international law
(1) The UK GDPR is amended in accordance with subsections (2) to (5).
(2) In Article 6(3) (lawfulness of processing: basis in domestic law)—
(a) in the first subparagraph, omit “and (e)”,
(b) after that subparagraph insert—
The basis for the processing referred to in point (e) of paragraph 1 must be laid down by domestic law or relevant international law (see section 9A of the 2018 Act).
, and
(c) in the last subparagraph, in the last sentence, after “domestic law” insert “or relevant international law”.
(3) In Article 8A(3)(e) (purpose limitation: further processing necessary to safeguard an objective listed in Article 23(1)) (inserted by section 71 of this Act), at the end insert “or by relevant international law (see section 9A of the 2018 Act)”.
(4) In Article 9 (processing of special categories of personal data)—
(a) in paragraph 2(g) (substantial public interest), after “domestic law” insert “, or relevant international law,”, and
(b) in paragraph 5, before point (a) insert—
(za) section 9A makes provision about when the requirement in paragraph 2(g) of this Article for a basis in relevant international law is met;
.
(5) In Article 10 (processing of personal data relating to criminal convictions and offences)—
(a) in paragraph 1, after “domestic law” insert “, or relevant international law,”, and
(b) in paragraph 2, before point (a) insert—
(za) section 9A makes provision about when the requirement in paragraph 1 of this Article for authorisation by relevant international law is met;
.
(6) The 2018 Act is amended in accordance with subsections (7) and (8).
(7) Before section 10 (and the italic heading before that section) insert—
Relevant international law
Processing in reliance on relevant international law
9A (1) Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant international law only if it meets a condition in Schedule A1.
(2) A condition in Schedule A1 may be relied on for the purposes of any of those provisions, unless that Schedule provides otherwise.
(3) The Secretary of State may by regulations amend Schedule A1 by adding, varying or omitting—
(a) conditions,
(b) provision about the purposes for which a condition may be relied on, and
(c) safeguards in connection with processing carried out in reliance on a condition in the Schedule.
(4) Regulations under this section may only add a condition relating entirely or partly to a treaty ratified by the United Kingdom.
(5) Regulations under this section are subject to the affirmative resolution procedure.
(6) In this section, “treaty” and “ratified” have the same meaning as in Part 2 of the Constitutional Reform and Governance Act 2010 (see section 25 of that Act).
(8) Before Schedule 1 insert—
Schedule A1
Processing in reliance on relevant international law
Section 9A
This condition is met where the processing is necessary for the purposes of responding to a request made in accordance with the Agreement between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the United States of America on Access to Electronic Data for the Purpose of Countering Serious Crime, signed on 3 October 2019.
In paragraph 23 of Schedule 1 to the 2018 Act (processing of special categories of personal data: elected representatives responding to requests), in sub-paragraph (4), for “fourth day after” substitute “period of 30 days beginning with the day after”.
74 Processing of special categories of personal data
(1) In Chapter 2 of the UK GDPR, after Article 11 insert—
Further provision about processing of special categories of personal data
Article 11A 1. The Secretary of State may by regulations—
(a) make provision so that an additional description of processing of personal data is subject to the prohibition in Article 9(1),
(b) make provision so that added processing is not subject to that prohibition,
(c) make provision so that an exception in Article 9(2) may or may not be relied on in connection with added processing, and
(d) make provision varying such an exception as it applies in connection with added processing.
2. In paragraph 1, “added processing” means a description of processing which is subject to the prohibition in Article 9(1) by virtue of provision made under paragraph 1(a).
3. Regulations made under this Article (in reliance on Article 91A(4)(b)) may amend section 5, 205 or 206 of the 2018 Act (interpretation).
4. Regulations under this Article are subject to the affirmative resolution procedure.
(2) The 2018 Act is amended in accordance with subsections (3) to (9).
(3) In section 33 (definitions of expressions used in Part 3), after subsection (6) insert—
(6A) “Sensitive processing” has the meaning given in section 35(8).
(4) In section 35 (the first data protection principle)—
(a) in subsection (6)(b) (power to omit conditions added to Schedule 8 by regulations), after “by”, in the first place it occurs, insert “varying or”, and
(b) in subsection (8) (definition of “sensitive processing”), for “section” substitute “Part”.
(5) After section 42 insert—
Further provision about sensitive processing
42A (1) The Secretary of State may by regulations—
(a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,
(b) make provision so that added processing is not sensitive processing for the purposes of this Part,
(c) make provision so that a protected condition in Schedule 8 may or may not be relied on in connection with added processing, and
(d) make provision varying such a condition as it relates to added processing.
(2) In subsection (1)—
“added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);
“protected condition in Schedule 8” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).
(3) Regulations under this section may amend this Part and sections 205 and 206.
(4) Regulations under this section are subject to the affirmative resolution procedure.
(6) In section 84 (definitions of expressions used in Part 4), after subsection (6) insert—
(6A) “Sensitive processing” has the meaning given in section 86(7).
(7) In section 86 (the first data protection principle)—
(a) in subsection (3)(b) (power to omit conditions added to Schedule 10 by regulations), after “by”, in the first place it occurs, insert “varying or”, and
(b) in subsection (7) (definition of “sensitive processing”), for “section” substitute “Part”.
(8) After section 91 insert—
Further provision about sensitive processing
91A (1) The Secretary of State may by regulations—
(a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,
(b) make provision so that added processing is not sensitive processing for the purposes of this Part,
(c) make provision so that a protected condition in Schedule 10 may or may not be relied on in connection with added processing, and
(d) make provision varying such a condition as it relates to added processing.
(2) In subsection (1)—
“added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);
“protected condition in Schedule 10” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3).
(3) Regulations under this section may amend this Part and sections 205 and 206.
(4) Regulations under this section are subject to the affirmative resolution procedure.
(9) In section 206 (index of defined expressions), in the Table, at the appropriate place insert—
“sensitive processing (in Parts 3 and 4) | sections 35 and 86”.
(10) The Investigatory Powers Act 2016 is amended in accordance with subsections (11) to (13).
(11) In section 202(4) (restrictions on use of class BPD warrants: definitions), omit the definition of “sensitive personal data” and insert—
“sensitive personal data” means personal data whose retention, or (as appropriate) retention and examination, would be sensitive processing;
“sensitive processing” means—
processing of personal data relating to a living individual that is processing of a kind described in section 86(7)(a) to (e) of the Data Protection Act 2018, or
processing of personal data relating to a deceased individual that would be that kind of processing if the personal data related to a living individual.
(12) After that section insert—
Further provision about sensitive processing
202A (1) The Secretary of State may by regulations—
(a) make provision so that a description of Part 4 sensitive processing, or of processing that would be such processing if the information processed related to a living individual, is sensitive processing for the purposes of section 202, and
(b) make provision so that added processing is not sensitive processing for the purposes of that section.
(2) In this section—
“added processing” means a description of processing that is sensitive processing for the purposes of section 202 by virtue of provision made under subsection (1)(a);
“Part 4 sensitive processing” means processing of personal data that, at the time the regulations are made, is sensitive processing for the purposes of Part 4 of the Data Protection Act 2018 by virtue of regulations made under section 91A of that Act.
(3) Regulations under this section may amend section 202.
(13) In section 267(3) (regulations subject to the affirmative procedure), after paragraph (e) insert—
(ea) section 202A,
.
75 Fees and reasons for responses to data subjects’ requests about law enforcement processing
(1) The 2018 Act is amended as follows.
(2) In section 53 (manifestly unfounded or excessive requests by the data subject under Part 3)—
(a) after subsection (4) insert—
(4A) The Secretary of State may by regulations—
(a) require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in accordance with subsection (1)(a), and
(b) specify what the guidance must include.
,
(b) in subsection (5), for “subsection (4)” substitute “this section”, and
(c) after subsection (5) insert—
(6) If, in reliance on subsection (1)(b), the controller does not take action on the request, the controller must inform the data subject of—
(a) the reasons for not doing so, and
(b) the data subject’s right to lodge a complaint with the Commissioner.
(7) The controller must comply with subsection (6)—
(a) without undue delay, and
(b) in any event, before the end of the applicable time period (as to which see section 54).
(3) In section 54(1) (meaning of “applicable time period”), for “and 48(2)(b)” substitute “, 48(2)(b) and 53(7)”.
76 Time limits for responding to data subjects’ requests
(1) The UK GDPR is amended in accordance with subsections (2) and (3).
(2) In Article 12 (transparent information, communication and modalities for the exercise of rights of the data subject)—
(a) in paragraph 3—
(i) for “within one month of receipt of the request” substitute “before the end of the applicable time period (see Article 12A)”, and
(ii) omit the second and third sentences,
(b) in paragraph 4, for “without delay and at the latest within one month of receipt of the request” substitute “without undue delay, and in any event before the end of the applicable time period (see Article 12A),”, and
(c) in paragraph 6—
(i) after “may” insert
—
(a)
, and
(ii) at the end insert
, and
(b) delay dealing with the request until the identity is confirmed.
(3) After Article 12 insert—
Meaning of “applicable time period”
Article 12A 1. In Article 12, “the applicable time period” means the period of one month beginning with the relevant time, subject to paragraph 3.
2. “The relevant time” means the latest of the following—
(a) when the controller receives the request in question;
(b) when the controller receives the information (if any) requested in connection with a request under Article 12(6);
(c) when the fee (if any) charged in connection with the request under Article 12(5) is paid.
3. The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—
(a) the complexity of requests made by the data subject, or
(b) the number of such requests.
4. A notice under paragraph 3 must—
(a) be given before the end of the period of one month beginning with the relevant time, and
(b) state the reasons for the delay.
5. Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under Article 15 relates—
(a) the controller may ask the data subject to provide the further information, and
(b) the period beginning with the day on which the controller makes the request and ending with the day on which the controller receives the information does not count towards—
(i) the applicable time period, or
(ii) the period described in paragraph 4(a).
6. An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.
(4) The 2018 Act is amended in accordance with subsections (5) to (7).
(5) In section 45(5) (right of access by the data subject), after “delay” insert “and in any event before the end of the applicable time period (as to which see section 54)”.
(6) In section 54 (meaning of “applicable time period” for responding to data subjects’ requests)—
(a) in subsection (1), after “45(3)(b)” insert “and (5)”,
(b) in subsection (2)—
(i) for “1 month, or such longer period as may be specified in regulations,” substitute “one month”, and
(ii) at the end insert “, subject to subsection (3A)”,
(c) after subsection (3) insert—
(3A) The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—
(a) the complexity of requests made by the data subject, or
(b) the number of such requests.
(3B) A notice under subsection (3A) must—
(a) be given before the end of the period of one month beginning with the relevant time, and
(b) state the reasons for the delay.
(3C) Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under section 45(1) relates—
(a) the controller may ask the data subject to provide the further information, and
(b) the period beginning with the day on which the controller makes the request and ending with the day on which the controller receives the information does not count towards—
(i) the applicable time period, or
(ii) the period described in subsection (3B)(a).
(3D) An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.
, and
(d) omit subsections (4) to (6).
(7) In section 94 (right of access under Part 4)—
(a) in subsection (14), for the definition of “the applicable time period” substitute—
“the applicable time period” means the period of one month beginning with the relevant time, subject to subsection (14A);
, and
(b) after subsection (14) insert—
(14A) The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—
(a) the complexity of requests made by the data subject, or
(b) the number of such requests.
(14B) A notice under subsection (14A) must—
(a) be given before the end of the period of one month beginning with the relevant time, and
(b) state the reasons for the delay.
(1) In Article 13 of the UK GDPR (information to be provided where personal data is collected from the data subject)—
(a) in paragraph 4, for “shall not apply where and insofar as” substitute “do not apply to the extent that”, and
(b) at the end insert—
5. Paragraph 3 does not apply to the extent that—
(a) the controller intends to further process the personal data—
(i) for (and only for) the purposes of scientific or historical research, the purposes of archiving in the public interest or statistical purposes, and
(ii) in accordance with Article 84B, and
(b) providing the information is impossible or would involve a disproportionate effort.
6. For the purposes of paragraph 5(b), whether providing the information would involve a disproportionate effort depends on, among other things, the number of data subjects, the age of the personal data and any appropriate safeguards applied to the processing.
7. A controller relying on paragraph 5 must take appropriate measures to protect the data subject’s rights, freedoms and legitimate interests, including by making the information available publicly.
(2) In Article 14 of the UK GDPR (information to be provided where personal data is not obtained from the data subject)—
(a) in paragraph 5—
(i) for “shall not apply where and insofar as” substitute “do not apply to the extent that”,
(ii) omit point (b),
(iii) omit the “or” at the end of point (c),
(iv) in point (d), omit “where”, and
(v) after that point insert—
(e) providing the information is impossible or would involve a disproportionate effort, or
(f) the obligation referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of the processing for which the personal data are intended.
, and
(b) at the end insert—
6. For the purposes of paragraph 5(e), whether providing the information would involve a disproportionate effort depends on, among other things, the number of data subjects, the age of the personal data and any appropriate safeguards applied to the processing.
7. A controller relying on paragraph 5(e) or (f) must take appropriate measures to protect the data subject’s rights, freedoms and legitimate interests, including by making the information available publicly.
78 Searches in response to data subjects’ requests
(1) In Article 15 of the UK GDPR (right of access by the data subject)—
(a) after paragraph 1 insert—
1A. Under paragraph 1, the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that paragraph.
, and
(b) in paragraph 3, after “processing” insert “to which the data subject is entitled under paragraph 1”.
(2) The 2018 Act is amended in accordance with subsections (3) and (4).
(3) In section 45 (law enforcement processing: right of access by the data subject), after subsection (2) insert—
(2A) Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.
(4) In section 94 (intelligence services processing: right of access by the data subject), after subsection (2) insert—
(2A) Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.
(5) The amendments made by this section are to be treated as having come into force on 1 January 2024.
79 Data subjects’ rights to information: legal professional privilege exemption
(1) The 2018 Act is amended as follows.
(2) In section 43 (overview and scope of Chapter 3 of Part 3: rights of the data subject in connection with law enforcement processing)—
(a) in subsection (1)(a), for “section 44” substitute “sections 44 and 45A”, and
(b) in subsection (1)(b), for “section 45” substitute “sections 45 and 45A”.
(3) For the italic heading before section 44 substitute—
Data subject’s rights to information
.
(4) In the heading of section 44, omit “Information:”.
(5) Omit the italic heading before section 45.
(6) After that section insert—
Exemption from sections 44 and 45: legal professional privilege
45A (1) Sections 44(2) and 45(1) do not require the controller to give the data subject—
(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or
(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.
(2) A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—
(a) the decision to rely on the exemption,
(b) the reason for the decision,
(c) the data subject’s right to make a request to the Commissioner under section 51,
(d) the data subject’s right to lodge a complaint with the Commissioner under section 165, and
(e) the data subject’s right to apply to a court under section 167.
(3) Subsection (2)(a) and (b) do not apply to the extent that complying with them would—
(a) undermine a claim described in subsection (1)(a), or
(b) conflict with a duty described in subsection (1)(b).
(4) The controller must—
(a) record the reason for a decision to rely on the exemption in subsection (1), and
(b) if requested to do so by the Commissioner, make the record available to the Commissioner.
(5) The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).
(7) In section 51 (exercise of rights through the Commissioner)—
(a) in subsection (1), after paragraph (b) (but before the “or” at the end of that paragraph) insert—
(ba) relies on the exemption from sections 44(2) and 45(1) in section 45A (legal professional privilege),
,
(b) in subsection (2), after paragraph (a) insert—
(aa) where subsection (1)(ba) applies, request the Commissioner to check that the controller was entitled to rely on the exemption;
,
(c) in subsection (4), after paragraph (a) insert—
(aa) where subsection (1)(ba) applies, whether the Commissioner is satisfied that the controller was entitled to rely on the exemption;
, and
(d) in subsection (6), after “(a)” insert “, (aa)”.
(1) For Article 22 of the UK GDPR (automated individual decision-making, including profiling) substitute—
Section 4A Automated individual decision-making
Automated processing and significant decisions
Article 22A 1. For the purposes of Articles 22B and 22C—
(a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and
(b) a decision is a significant decision, in relation to a data subject, if—
(i) it produces a legal effect for the data subject, or
(ii) it has a similarly significant effect for the data subject.
2. When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.
Restrictions on automated decision-making
Article 22B 1. A significant decision based entirely or partly on processing described in Article 9(1) (processing of special categories of personal data) may not be taken based solely on automated processing, unless one of the following conditions is met.
2. The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.
3. The second condition is that—
(a) the decision is—
(i) necessary for entering into, or performing, a contract between the data subject and a controller, or
(ii) required or authorised by law, and
(b) point (g) of Article 9(2) applies.
4. A significant decision may not be taken based solely on automated processing if the processing of personal data carried out by, or on behalf of, the decision-maker for the purposes of the decision is carried out entirely or partly in reliance on Article 6(1)(ea).
Safeguards for automated decision-making
Article 22C 1. Where a significant decision taken by or on behalf of a controller in relation to a data subject is—
(a) based entirely or partly on personal data, and
(b) based solely on automated processing,
the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with paragraph 2 and any regulations under Article 22D(3).
2. The safeguards must consist of or include measures which—
(a) provide the data subject with information about decisions described in paragraph 1 taken in relation to the data subject;
(b) enable the data subject to make representations about such decisions;
(c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;
(d) enable the data subject to contest such decisions.
Further provision about automated decision-making
Article 22D 1. The Secretary of State may by regulations provide that, for the purposes of Article 22A(1)(a), there is, or is not, to be taken to be meaningful human involvement in the taking of a decision in cases described in the regulations.
2. The Secretary of State may by regulations provide that, for the purposes of Article 22A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant effect for the data subject.
3. The Secretary of State may by regulations make the following types of provision about the safeguards required under Article 22C(1)—
(a) provision requiring the safeguards to include measures in addition to those described in Article 22C(2),
(b) provision imposing requirements which supplement what Article 22C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in Article 22C(2) must be done or be capable of being done), and
(c) provision about measures which are not to be taken to satisfy one or more of points (a) to (d) of Article 22C(2).
4. Regulations under paragraph 3 may not amend Article 22C.
5. Regulations under this Article are subject to the affirmative resolution procedure.
(2) The 2018 Act is amended in accordance with subsections (3) to (5).
(3) For sections 49 and 50 (law enforcement processing: automated individual decision-making) substitute—
Automated processing and significant decisions
50A (1) For the purposes of sections 50B and 50C—
(a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and
(b) a decision is a significant decision, in relation to a data subject, if—
(i) it produces an adverse legal effect for the data subject, or
(ii) it has a similarly significant adverse effect for the data subject.
(2) When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.
Restrictions on automated decision-making based on sensitive processing
50B (1) A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met.
(2) The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.
(3) The second condition is that the decision is required or authorised by law.
Safeguards for automated decision-making
50C (1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—
(a) based entirely or partly on personal data, and
(b) based solely on automated processing,
the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).
(2) The safeguards must consist of or include measures which—
(a) provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;
(b) enable the data subject to make representations about such decisions;
(c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;
(d) enable the data subject to contest such decisions.
(3) Subsections (1) and (2) do not apply in relation to a significant decision if—
(a) exemption from those provisions is required for a reason listed in subsection (4),
(b) the controller reconsiders the decision as soon as reasonably practicable, and
(c) there is meaningful human involvement in the reconsideration of the decision.
(4) Those reasons are—
(a) to avoid obstructing an official or legal inquiry, investigation or procedure;
(b) to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
(c) to protect public security;
(d) to safeguard national security;
(e) to protect the rights and freedoms of others.
(5) When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.
Further provision about automated decision-making
50D (1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations.
(2) The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject.
(3) Regulations under subsection (1) or (2) may amend section 50A.
(4) The Secretary of State may by regulations make the following types of provision about the safeguards required under section 50C(1)—
(a) provision requiring the safeguards to include measures in addition to those described in section 50C(2),
(b) provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and
(c) provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2).
(5) Regulations under this section are subject to the affirmative resolution procedure.
(4) In section 96 (intelligence services processing: right not to be subject to automated decision-making)—
(a) in subsection (1), for “solely on” substitute “on entirely”,
(b) in subsection (3), after “section” insert “and section 97”, and
(c) at the end insert—
(4) For the purposes of this section and section 97, a decision is based on entirely automated processing if the decision-making process does not include an opportunity for a human being to accept, reject or influence the decision.
(5) In section 97 (intelligence services processing: right to intervene in automated decision-making)—
(a) in subsection (1)(a), for “solely on” substitute “on entirely”,
(b) in subsection (4)(b), for “solely on” substitute “on entirely”, and
(c) omit subsection (6).
(6) Schedule 6 to this Act contains minor and consequential amendments.
81 Data protection by design: children’s higher protection matters
(1) Article 25 of the UK GDPR (data protection by design and by default) is amended as follows.
(2) After paragraph 1 insert—
1A. In the case of processing carried out in the course of providing information society services which are likely to be accessed by children, when assessing what are appropriate technical and organisational measures in accordance with paragraph 1, the controller must take into account the children’s higher protection matters.
1B. The children’s higher protection matters are—
(a) how children can best be protected and supported when using the services, and
(b) the fact that children—
(i) merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing, and
(ii) have different needs at different ages and at different stages of development.
(3) In paragraph 3, for “1 and 2” substitute “1 to 2”.
(4) At the end insert—
4. Paragraphs 1A and 1B are not to be read as implying anything about the matters that may be relevant to the assessment of what are appropriate technical and organisational measures for the purposes of paragraph 1 in cases other than those described in paragraph 1A.
5. In this Article, “information society services” does not include preventive or counselling services.
In section 62 of the 2018 Act (logging of law enforcement processing)—
(a) in subsection (2)(a), omit “justification for, and”, and
(b) in subsection (3)(a), omit “justification for, and”.
In Article 41 of the UK GDPR (monitoring of approved codes of conduct)—
(a) in paragraph 4, omit the words from “, including suspension” to the end, and
(b) after that paragraph insert—
4A. If the action taken by a body under paragraph 4 consists of suspending or excluding a controller or processor from the code, the body must inform the Commissioner, giving reasons for taking that action.
84 Law enforcement processing and codes of conduct
(1) The 2018 Act is amended as follows.
(2) In section 55(1) (overview and scope of provisions about controllers and processors), at the end insert—
(e) makes provision about codes of conduct (see section 71A).
(3) In section 56 (general obligations of the controller), at the end insert—
(4) Adherence to a code of conduct approved under section 71A may be used by a controller as a means of demonstrating compliance with the requirements of this Part.
(4) In section 59 (processors), after subsection (7) insert—
(7A) Adherence to a code of conduct approved under section 71A may be used by a processor as a means of demonstrating sufficient guarantees as described in subsection (2).
(5) In section 66 (security of processing), at the end insert—
(3) Adherence to a code of conduct approved under section 71A may be used by a controller or processor as a means of demonstrating compliance with subsection (1).
(6) After section 71 insert—
Codes of conduct
Codes of conduct
71A (1) The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.
(2) Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.
(3) For the purposes of this section—
(a) “public body” means a body or other person whose functions are, or include, functions of a public nature, and
(b) a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).
(4) A code of conduct described in subsection (1) may, for example, make provision with regard to—
(a) lawful and fair processing;
(b) the collection of personal data;
(c) the information provided to the public and to data subjects;
(d) the exercise of the rights of data subjects;
(e) the measures and procedures referred to in sections 56, 57 and 62;
(f) the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;
(g) the transfer of personal data to third countries or international organisations;
(h) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.
(5) The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.
(6) Where an expert public body does so, the Commissioner must—
(a) provide the body with an opinion on whether the code correctly reflects the requirements of this Part,
(b) decide whether to approve the code, and
(c) if the code is approved, register and publish the code.
(7) Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.
85 Transfers of personal data to third countries and international organisations
(1) Schedule 7 amends Chapter 5 of the UK GDPR (general processing and transfers of personal data to third countries and international organisations).
(2) Schedule 8 amends Chapter 5 of Part 3 of the 2018 Act (law enforcement processing and transfers of personal data to third countries and international organisations).
(3) In Schedule 9—
(a) Part 1 contains minor and consequential amendments, and
(b) Part 2 contains transitional provision.
86 Safeguards for processing for research etc purposes
(1) The UK GDPR is amended in accordance with subsections (2) to (4).
(2) After Chapter 8 insert—
CHAPTER 8A Safeguards for processing for research, archiving or statistical purposes
Research, archives and statistics
Article 84A 1. This Chapter makes provision about the processing of personal data—
(a) for the purposes of scientific research or historical research,
(b) for the purposes of archiving in the public interest, or
(c) for statistical purposes.
2. Those purposes are referred to in this Chapter as “RAS purposes”.
Additional requirements when processing for RAS purposes
Article 84B 1. Personal data may only be processed for RAS purposes if—
(a) the processing consists of the collection of the personal data (whether from the data subject or otherwise),
(b) the processing is carried out in order to convert the personal data into information which can be processed in a manner which does not permit the identification of a data subject, or
(c) without the processing, the RAS purposes cannot be fulfilled.
2. Processing of personal data for RAS purposes must be carried out subject to appropriate safeguards for the rights and freedoms of the data subject.
Appropriate safeguards
Article 84C 1. This Article makes provision about when the requirement under Article 84B(2) for processing of personal data to be carried out subject to appropriate safeguards is satisfied.
2. The requirement is not satisfied if the processing is likely to cause substantial damage or substantial distress to a data subject to whom the personal data relates.
3. The requirement is not satisfied if the processing is carried out for the purposes of measures or decisions with respect to a particular data subject to whom the personal data relates, except where the purposes for which the processing is carried out include the purposes of approved medical research.
4. The requirement is only satisfied if the safeguards include technical and organisational measures for the purpose of ensuring respect for the principle of data minimisation (see Article 5(1)(c)), such as, for example, pseudonymisation.
5. In this Article—
“approved medical research” means medical research carried out by a person who has approval to carry out that research from—
a research ethics committee recognised or established by the Health Research Authority under Chapter 2 of Part 3 of the Care Act 2014, or
a body appointed by any of the following for the purpose of assessing the ethics of research involving individuals—
the Secretary of State, the Scottish Ministers, the Welsh Ministers or a Northern Ireland department;
a relevant NHS body;
United Kingdom Research and Innovation or a body that is a Research Council for the purposes of the Science and Technology Act 1965;
an institution that is a research institution for the purposes of Chapter 4A of Part 7 of the Income Tax (Earnings and Pensions) Act 2003 (see section 457 of that Act);
“relevant NHS body” means—
an NHS trust or NHS foundation trust in England,
an NHS trust or Local Health Board in Wales,
a Health Board or Special Health Board constituted under section 2 of the National Health Service (Scotland) Act 1978,
the Common Services Agency for the Scottish Health Service, or
any of the health and social care bodies in Northern Ireland falling within paragraphs (b) to (e) of section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)).
Appropriate safeguards: further provision
Article 84D 1. The Secretary of State may by regulations make further provision about when the requirement for appropriate safeguards under Article 84B(2) is, or is not, satisfied.
2. Regulations under this Article may not amend or revoke Article 84C(2), (3) or (4) (but may change the meaning of “approved medical research” for the purposes of Article 84C).
3. Regulations under this Article are subject to the affirmative resolution procedure.
(3) In the heading of Chapter 9, after “relating to” insert “other”.
(4) Omit Article 89 (safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes).
(5) The 2018 Act is amended in accordance with subsections (6) and (7).
(6) Omit section 19 (processing for archiving, research and statistical purposes: safeguards) and the italic heading before it.
(7) In section 41(1) (safeguards: archiving), for “necessary” substitute “carried out”.
(1) In the UK GDPR—
(a) in Article 5(1)(e) (storage limitation), for “Article 89(1)” to “data subject” substitute “Article 84B”,
(b) in Article 9(2)(j) (processing of special categories of personal data), for “in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act)” substitute “, is carried out in accordance with Article 84B and is”,
(c) in Article 17(3)(d) (right to erasure), for “Article 89(1)” substitute “Article 84B”, and
(d) in Article 21(6) (right to object), omit “pursuant to Article 89(1)”.
(2) In the 2018 Act—
(a) in section 24(4) (manual unstructured data held by FOI public authorities), after paragraph (b) insert—
(ba) Chapter 8A (safeguards for processing for research, archiving or statistical purposes);
,
(b) in paragraph 4(b) of Schedule 1 (special categories of personal data and criminal convictions etc data: research etc), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”, and
(c) in Schedule 2 (exemptions etc from the UK GDPR)—
(i) in paragraph 27(3)(a) (research and statistics), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”, and
(ii) in paragraph 28(3) (archiving), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”.
(3) In section 279(2) of the Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13) (information for research), for “Article 89(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics)” substitute “Article 84A of the UK GDPR (research, archives and statistics)”.
(1) The 2018 Act is amended in accordance with subsections (2) to (10).
(2) In section 26(2)(f) (national security and defence exemption), before sub-paragraph (i) insert—
(ai) Article 77 (right to lodge a complaint with the Commissioner);
.
(3) In section 44 (controller’s general duties to provide information to data subject)—
(a) in subsection (4), omit paragraph (d) (grounds for restricting information provided: national security),
(b) in subsection (5), after “restricted” insert “under subsection (4)”, and
(c) in subsection (7)(a), after “subsection (2)” insert “in reliance on subsection (4)”.
(4) In section 45 (right of access by the data subject)—
(a) in subsection (4), omit paragraph (d) (grounds for restricting information provided: national security),
(b) in subsection (5), after “restricted” insert “under subsection (4)”, and
(c) in subsection (7)(a), after “subsection (1)” insert “in reliance on subsection (4)”.
(5) In section 48 (requests by data subject for rectification or erasure of personal data)—
(a) in subsection (3), omit paragraph (d) (grounds for restricting information provided: national security),
(b) in subsection (4)—
(i) for “(1)” substitute “(1)(b)(i)”, and
(ii) after “restricted” insert “under subsection (3)”, and
(c) in subsection (6)(a), after “subsection (1)(b)(i)” insert “in reliance on subsection (3)”.
(6) In section 68(7) (communication of a personal data breach to the data subject: grounds for restricting information provided), omit paragraph (d) (national security).
(7) In Chapter 6 of Part 3 (law enforcement processing: supplementary), before section 79 insert—
National security exemption
78A (1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.
(2) The provisions are—
(a) Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);
(b) Chapter 3 of this Part (rights of the data subject);
(c) in Chapter 4 of this Part—
(i) section 67 (notification of personal data breach to the Commissioner);
(ii) section 68 (communication of personal data breach to the data subject);
(d) Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);
(e) in Part 5—
(i) section 119 (inspection in accordance with international obligations);
(ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;
(f) in Part 6—
(i) sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);
(ii) sections 170 to 173 (offences relating to personal data);
(g) in Part 7, section 187 (representation of data subjects).
(3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—
(a) section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;
(b) section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);
(c) section 42 (safeguards: sensitive processing);
(d) Schedule 8 (conditions for sensitive processing).
(4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—
(a) the following provisions of section 73—
(i) subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);
(ii) subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);
(b) section 78 (subsequent transfers).
(8) In section 79 (national security: certificate)—
(a) omit subsections (1) to (3),
(b) after subsection (3) insert—
(3A) Subject to subsection (5), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 78A(2) is, or at any time was, required in relation to any personal data for the purposes of safeguarding national security is conclusive evidence of that fact.
,
(c) in subsection (4), for “subsection (1)” substitute “subsection (3A)—
(a) may identify the personal data to which it applies by means of a general description, and
(b)
,
(d) in subsection (5), for “subsection (1)” substitute “subsection (3A)”,
(e) in subsection (7)—
(i) for “a restriction falls within a general description in a certificate issued under subsection (1)” substitute “a certificate under subsection (3A) which identifies the personal data to which it applies by means of a general description applies to any personal data”, and
(ii) for “the restriction does not fall within that description” substitute “the certificate does not apply to the personal data in question”,
(f) in subsection (8)—
(i) for “the restriction” substitute “the certificate”, and
(ii) for “to fall within the general description” substitute “so to apply”,
(g) in subsection (10), for “subsection (1)” substitute “subsection (3A)”,
(h) in subsection (11), for “subsection (1)” substitute “subsection (3A)”,
(i) in subsection (12), for “subsection (1)” substitute “subsection (3A)”, and
(j) omit subsection (13).
(9) In section 110(2) (intelligence services processing: national security)—
(a) in paragraph (a), after “Chapter 2” insert “of this Part”,
(b) in paragraph (b), after “Chapter 3” insert “of this Part”, and
(c) in paragraph (c), after “Chapter 4” insert “of this Part”.
(10) In section 186(3) (data subject’s rights etc: exceptions), after paragraph (c) insert—
(ca) in Part 3 of this Act, section 78A, and
.
(11) In the provisions listed in subsection (12), for “subsection (4) of that section” substitute “section 45(4) or 78A of that Act”.
(12) The provisions are—
(a) section 40(4A)(b) and (5B)(d) of the Freedom of Information Act 2000 (personal data which is exempt information);
(b) section 38(3A)(b) of the Freedom of Information (Scotland) Act 2002 (asp 13) (personal data which is exempt information);
(c) regulation 13(3A)(b) and (5B)(d) of the Environmental Information Regulations 2004 (S.I. 2004/3391) (restriction on disclosure of personal data);
(d) regulation 11(4A)(b) of the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520) (restriction on disclosure of personal data);
(e) regulation 45(1C)(b) of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042) (personal data which is sensitive information);
(f) regulation 39(1C)(b) of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494) (personal data which is sensitive information).