89 Joint processing by intelligence services and competent authorities
(1) Part 4 of the 2018 Act (intelligence services processing) is amended as follows.
(2) In section 82 (processing to which Part 4 applies)—
(a) before subsection (1) insert—
(A1) This Part—
(a) applies to processing of personal data by an intelligence service, and
(b) applies to processing of personal data by a qualifying competent authority where the processing is the subject of a designation notice that is for the time being in force (see sections 82A to 82E).
,
(b) in subsection (1)—
(i) after “applies” insert “only”,
(ii) in paragraph (a), for “the processing by an intelligence service” substitute “processing”, and
(iii) in paragraph (b), for “the processing by an intelligence service” substitute “processing”,
(c) after subsection (2) insert—
(2A) In this Part—
“competent authority” has the same meaning as in Part 3;
“qualifying competent authority” means a competent authority specified or described in regulations made by the Secretary of State.
, and
(d) after subsection (3) insert—
(4) Regulations under this section are subject to the affirmative resolution procedure.
(3) After section 82 insert—
Designation of processing by a qualifying competent authority
82A (1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—
(a) an application for designation of the processing is made in accordance with this section, and
(b) the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.
(2) The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.
(3) The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—
(a) a country or territory outside the United Kingdom, or
(b) an international organisation.
(4) A designation notice must—
(a) specify or describe the processing and qualifying competent authority that are designated, and
(b) be given to the applicants for the designation (and see also section 82D).
(5) An application for designation of processing of personal data by a qualifying competent authority must be made jointly by—
(a) the qualifying competent authority, and
(b) the intelligence service with which the processing is to be carried out.
(6) An application may be made in respect of more than one qualifying competent authority and in respect of processing with more than one intelligence service.
(7) The application must—
(a) describe the processing, including the intended purposes and means of processing, and
(b) explain why the applicants consider that designation is required for the purposes of safeguarding national security.
(8) Before giving a designation notice, the Secretary of State must consult the Commissioner.
(9) In this section, “joint controller”, in relation to processing of personal data, means a controller whose responsibilities for compliance with this Part in relation to the processing are determined in an arrangement under section 104.
Duration of designation notice
82B (1) A designation notice must state when it comes into force.
(2) A designation notice ceases to be in force at the earliest of the following times—
(a) at the end of the period of 5 years beginning when the notice comes into force;
(b) (if relevant) at the end of a shorter period specified in the notice;
(c) when the notice is withdrawn under section 82C.
(3) The Secretary of State may give a further designation notice in respect of processing that is, or has been, the subject of a previous designation notice.
Review and withdrawal of designation notice
82C (1) Subsections (2) to (4) apply where processing is the subject of a designation notice for the time being in force.
(2) A person who applied for the designation of the processing must notify the Secretary of State without undue delay if the person considers that the designation is no longer required for the purposes of safeguarding national security.
(3) A person who applied for the designation of the processing must, on a request from the Secretary of State, provide—
(a) a description of the processing that is being, or is intended to be, carried out in reliance on the notice, and
(b) an explanation of why the person considers that designation of the processing continues to be required for the purposes of safeguarding national security.
(4) The Secretary of State must at least annually—
(a) review each designation notice that is for the time being in force, and
(b) consider whether designation of the processing which is the subject of the notice continues to be required for the purposes of safeguarding national security.
(5) The Secretary of State—
(a) may withdraw a designation notice by giving a further notice (a “withdrawal notice”) to the persons who applied for the designation, and
(b) must give a withdrawal notice if the Secretary of State considers that designation of some or all of the processing to which the notice applies is no longer required for the purposes of safeguarding national security (whether as a result of a review required under subsection (4) or otherwise).
(6) A withdrawal notice must—
(a) withdraw the designation notice completely, and
(b) state when it comes into force.
(7) In determining when a withdrawal notice required under subsection (5)(b) comes into force, the Secretary of State must consider—
(a) the desirability of the processing ceasing to be designated as soon as possible, and
(b) where relevant, the time needed to effect an orderly transition to new arrangements for the processing of personal data.
Records of designation notices
82D (1) Where the Secretary of State gives a designation notice—
(a) the Secretary of State must send a copy of the notice to the Commissioner, and
(b) the Commissioner must publish a record of the notice.
(2) The record must contain—
(a) the Secretary of State’s name,
(b) the date on which the notice was given,
(c) the date on which the notice ceases to have effect (if not previously withdrawn), and
(d) subject to subsection (3), the rest of the text of the notice.
(3) The Commissioner must not publish the text, or a part of the text, of the notice if—
(a) the Secretary of State has determined that publishing the text or that part of the text—
(i) would be against the interests of national security,
(ii) would be contrary to the public interest, or
(iii) might jeopardise the safety of any person, and
(b) the Secretary of State has notified the Commissioner of that determination.
(4) The Commissioner must keep the record of the notice available to the public while the notice is in force.
(5) Where the Secretary of State gives a withdrawal notice, the Secretary of State must send a copy of the notice to the Commissioner.
Appeal against designation notice
82E (1) A person directly affected by a designation notice may appeal to the Tribunal against the notice.
(2) If, on an appeal under this section, the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Secretary of State did not have reasonable grounds for giving the notice, the Tribunal may—
(a) allow the appeal, and
(b) quash the notice.
(1) The 2018 Act is amended in accordance with subsections (2) to (9).
(2) In section 1(5) (overview: Part 4), at the end insert “(and certain processing carried out by competent authorities jointly with the intelligence services)”.
(3) In section 29 (processing to which Part 3 applies), after subsection (1) insert—
(1A) This Part does not apply to processing to which Part 4 applies by virtue of a designation notice (see section 82A).
(4) In section 83 (meaning of “controller” and “processor” in Part 4)—
(a) before subsection (1) insert—
(A1) For the purposes of this Part—
(a) an intelligence service is the “controller” in relation to the processing of personal data if it satisfies subsection (1) alone or jointly with others, and
(b) a qualifying competent authority is the “controller” in relation to the processing of personal data that is the subject of a designation notice that is for the time being in force if the authority satisfies subsection (1) jointly with others.
,
(b) in subsection (1), for the words before paragraph (a) substitute “This subsection is satisfied by a person who—”, and
(c) in subsection (2), for “intelligence service on which” substitute “person on whom”.
(5) In section 84 (other definitions)—
(a) after subsection (2) insert—
(2A) “Designation notice” has the meaning given in section 82A.
, and
(b) before subsection (7) insert—
(6B) “Withdrawal notice” has the meaning given in section 82C.
(6) In section 104(1) (joint controllers), for “intelligence services” substitute “controllers”.
(7) In section 202(1)(a)(i) (proceedings in the First-tier Tribunal: contempt) after “79,” insert “82E,”.
(8) In section 203(1) (Tribunal Procedure Rules), after “79,” insert “82E,”.
(9) In section 206 (index of defined expressions), in the Table—
(a) in the entry for “competent authority”—
(i) for “Part 3” substitute “Parts 3 and 4”, and
(ii) for “section 30” substitute “sections 30 and 82”, and
(b) at the appropriate places insert—
designation notice (in Part 4) | section 84
;
qualifying competent authority (in Part 4) | section 82
;
withdrawal notice (in Part 4) | section 84
.
(10) In section 199(2)(a) of the Investigatory Powers Act 2016 (bulk personal datasets: meaning of “personal data”), after “section 82(1) of that Act” insert “by an intelligence service”.
91 Duties of the Commission in carrying out functions
(1) The 2018 Act is amended in accordance with subsections (2) to (4).
(2) Omit section 2(2) (duty of Commissioner when carrying out functions).
(3) After section 120 insert—
Duties in carrying out functions
Principal objective
120A It is the principal objective of the Commissioner, in carrying out functions under the data protection legislation—
(a) to secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and
(b) to promote public trust and confidence in the processing of personal data.
Duties in relation to functions under the data protection legislation
120B In carrying out functions under the data protection legislation, the Commissioner must have regard to such of the following as appear to the Commissioner to be relevant in the circumstances—
(a) the desirability of promoting innovation;
(b) the desirability of promoting competition;
(c) the importance of the prevention, investigation, detection and prosecution of criminal offences;
(d) the need to safeguard public security and national security;
(e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing.
Strategy
120C (1) The Commissioner must prepare a strategy for carrying out the Commissioner’s functions under the data protection legislation in accordance with the Commissioner’s duties under—
(a) sections 120A and 120B,
(b) section 108 of the Deregulation Act 2015 (exercise of regulatory functions: economic growth), and
(c) section 21 of the Legislative and Regulatory Reform Act 2006 (exercise of regulatory functions: principles).
(2) The Commissioner must—
(a) review the strategy from time to time, and
(b) revise the strategy as appropriate.
(3) The Commissioner must publish the strategy and any revised strategy.
Duty to consult other regulators
120D (1) The Commissioner must, at such times as the Commissioner considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which the Commissioner exercises functions under the data protection legislation may affect economic growth, innovation and competition.
(2) The persons are—
(a) such persons exercising regulatory functions as the Commissioner considers appropriate;
(b) such other persons as the Commissioner considers appropriate.
(3) In this section, “regulatory function” has the meaning given by section 111 of the Deregulation Act 2015.
(4) In section 139 (reporting to Parliament), after subsection (1) insert—
(1A) In connection with the Commissioner’s functions under the data protection legislation, the report must contain (among other things)—
(a) a review of what the Commissioner has done during the reporting period to comply with the duties under—
(i) sections 120A and 120B,
(ii) section 108 of the Deregulation Act 2015, and
(iii) section 21 of the Legislative and Regulatory Reform Act 2006,
including a review of the operation of the strategy prepared and published under section 120C;
(b) a review of what the Commissioner has done during the reporting period to comply with the duty under section 120D.
(1B) In subsection (1A), “the reporting period” means the period to which the report relates.
(5) The Information Commission must prepare and publish a strategy in accordance with section 120C of the 2018 Act before the end of the period of 18 months beginning with the day on which this section comes into force.
92 Codes of practice for the processing of personal data
(1) The 2018 Act is amended in accordance with subsections (2) to (6).
(2) After section 124 insert—
Other codes of practice
124A (1) The Commissioner must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by regulations made by the Secretary of State.
(2) Regulations under this section—
(a) must describe the personal data or processing to which the code of practice is to relate, and
(b) may describe the persons or classes of person to whom it is to relate.
(3) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code.
(4) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate—
(a) trade associations;
(b) data subjects;
(c) persons who appear to the Commissioner to represent the interests of data subjects.
(5) A code under this section may include transitional provision or savings.
(6) Regulations under this section are subject to the negative resolution procedure.
(7) In this section—
“good practice in the processing of personal data” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
“trade association” includes a body representing controllers or processors.
(3) In section 125 (approval of codes prepared under sections 121 to 124)—
(a) in the heading, for “124” substitute “124A”,
(b) in subsection (1), for “or 124” substitute “, 124 or 124A”,
(c) in subsection (3), for “or 124” substitute “, 124 or 124A”,
(d) for subsection (5) substitute—
(5) If the Commissioner is prevented by subsection (3) from issuing a code that is not a replacement code, the Commissioner must prepare another version of the code.
, and
(e) in subsection (9), for “or 124” substitute “, 124 or 124A”.
(4) In section 126 (publication and review of codes issued under section 125(4)), in subsection (4), for “or 124(2)” substitute “, 124(2) or 124A(3)”.
(5) Omit section 128 (other codes of practice).
(6) In section 129 (consensual audits), in subsection (3), for “128” substitute “124A”.
(7) In section 19AC of the Registration Service Act 1953 (code of practice), in subsection (11), for “128” substitute “124A”.
(8) In the Statistics and Registration Service Act 2007—
(a) in section 45 (information held by HMRC), in subsection (4A), for “128” substitute “124A”,
(b) in section 45A (information held by other public authorities), in subsection (8), for “128” substitute “124A”,
(c) in section 45E (further provisions about powers in sections 45B, 45C and 45D), in subsection (16), for “128” substitute “124A”, and
(d) in section 53A (disclosure by the Board to devolved administrations), in subsection (9), for “128” substitute “124A”.
(9) In the Digital Economy Act 2017—
(a) in section 43 (code of practice), in subsection (13), for “128” substitute “124A”,
(b) in section 52 (code of practice), in subsection (13), for “128” substitute “124A”,
(c) in section 60 (code of practice), in subsection (13), for “128” substitute “124A”, and
(d) in section 70 (code of practice), in subsection (15), for “128” substitute “124A”.
93 Codes of practice: panels and impact assessments
In the 2018 Act, after section 124A (inserted by section 92 of this Act) insert—
Panels to consider codes of practice
124B (1) This section applies where a code is prepared under section 121, 122, 123, 124 or 124A, subject to subsection (11).
(2) The Commissioner must establish a panel of individuals to consider the code.
(3) The panel must consist of—
(a) individuals the Commissioner considers have expertise in the subject matter of the code, and
(b) individuals the Commissioner considers—
(i) are likely to be affected by the code, or
(ii) represent persons likely to be affected by the code.
(4) Before the panel begins to consider the code, the Commissioner must—
(a) publish the code in draft, and
(b) publish a statement that—
(i) states that a panel has been established to consider the code,
(ii) identifies the members of the panel,
(iii) explains the process by which they were selected, and
(iv) explains the reasons for their selection.
(5) Where at any time it appears to the Commissioner that a member of the panel is not willing or able to serve as a member of the panel, the Commissioner may select another individual to be a member of the panel.
(6) Where the Commissioner selects an individual to be a member of the panel under subsection (5), the Commissioner must publish a statement that—
(a) identifies the member of the panel,
(b) explains the process by which the member was selected, and
(c) explains the reasons for the member’s selection.
(7) The Commissioner must make arrangements—
(a) for the members of the panel to consider the code with one another (whether in person or otherwise), and
(b) for the panel to prepare and submit to the Commissioner a report on the code within such reasonable period as is determined by the Commissioner.
(8) If the panel submits to the Commissioner a report on the code within the period determined by the Commissioner, the Commissioner must as soon as reasonably practicable—
(a) make any alterations to the code that the Commissioner considers appropriate in the light of the report, and
(b) publish—
(i) the code in draft,
(ii) the report or a summary of it, and
(iii) in a case where a recommendation in the report to alter the code has not been accepted by the Commissioner, an explanation of why it has not been accepted.
(9) The Commissioner may pay remuneration and expenses to the members of the panel.
(10) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections, subject to subsection (11).
(11) The Secretary of State may by regulations provide that this section does not apply, or applies with modifications, in the case of—
(a) a code prepared under section 124A, or
(b) an amendment of such a code,
that is specified or described in the regulations.
(12) Regulations under this section are subject to the negative resolution procedure.
Impact assessments for codes of practice
124C (1) Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commissioner must carry out and publish an assessment of—
(a) who would be likely to be affected by the code, and
(b) the effect the code would be likely to have on them.
(2) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections.
94 Manifestly unfounded or excessive requests to the Commissioner
(1) The 2018 Act is amended in accordance with subsections (2) and (3).
(2) In section 135 (manifestly unfounded or excessive requests made to the Commissioner)—
(a) before subsection (1) insert—
(A1) This section makes provision about cases in which a request made to the Commissioner, to which the Commissioner is required or authorised to respond under the data protection legislation, is manifestly unfounded or excessive.
,
(b) in subsection (1) omit the words from the beginning to “excessive,”,
(c) after subsection (1) insert—
(1A) In subsection (1)—
(a) the reference in paragraph (a) to charging a reasonable fee is, in a case in which section 134 is relevant, a reference to doing so under that section, and
(b) paragraph (b) is not to be read as implying anything about whether the Commissioner may refuse to act on requests that are neither manifestly unfounded nor excessive.
,
(d) in subsection (3), for “(1)” substitute “(A1)”,
(e) omit subsection (4), and
(f) after that subsection insert—
(5) Article 57(3) of the UK GDPR (performance of Commissioner’s tasks generally to be free of charge for data subject) has effect subject to this section.
(3) In section 136(1) (guidance about fees), omit paragraph (b) and the “or” before it.
(4) In Article 57 of the UK GDPR (Commissioner’s tasks), omit paragraph 4.
In the 2018 Act, after section 139 insert—
Analysis of performance
139A (1) The Commissioner must prepare and publish an analysis of the Commissioner’s performance using key performance indicators.
(2) The analysis must be prepared and published at least annually.
(3) In this section, “key performance indicators” means factors by reference to which the Commissioner’s performance can be measured most effectively.
Documents and notices
.
(1) The 2018 Act is amended in accordance with subsections (2) and (3).
(2) Omit section 141 (notices from the Commissioner).
(3) After that section insert—
Notices from the Commissioner
141A (1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.
(2) The notice may be given to the person by—
(a) delivering it by hand to a relevant individual,
(b) leaving it at the person’s proper address,
(c) sending it by post to the person at that address, or
(d) sending it by email to the person’s email address.
(3) A “relevant individual” means—
(a) in the case of a notice to an individual, that individual;
(b) in the case of a notice to a body corporate (other than a partnership), an officer of that body;
(c) in the case of a notice to a partnership, a partner in the partnership or a person who has the control or management of the partnership business;
(d) in the case of a notice to an unincorporated body (other than a partnership), a member of its governing body.
(4) For the purposes of subsection (2)(b) and (c), and section 7 of the Interpretation Act 1978 (services of documents by post) in its application to those provisions, a person’s proper address is—
(a) in a case where the person has specified an address as one at which the person, or someone acting on the person’s behalf, will accept service of notices or other documents, that address;
(b) in any other case, the address determined in accordance with subsection (5).
(5) The address is—
(a) in a case where the person is a body corporate with a registered office in the United Kingdom, that office;
(b) in a case where paragraph (a) does not apply and the person is a body corporate, partnership or unincorporated body with a principal office in the United Kingdom, that office;
(c) in any other case, an address in the United Kingdom at which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of the person.
(6) A person’s email address is—
(a) an email address published for the time being by that person as an address for contacting that person, or
(b) if there is no such published address, an email address by means of which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of that person.
(7) A notice sent by email is treated as given 48 hours after it was sent, unless the contrary is proved.
(8) In this section, “officer”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body.
(9) This section does not limit other lawful means of giving a notice.
(4) In Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) (Commissioner’s enforcement powers), in paragraph 1(b), for “141” substitute “141A”.
(1) The 2018 Act is amended as follows.
(2) In section 142 (information notices)—
(a) in subsection (1)—
(i) in paragraph (a), after “information” insert “or documents”, and
(ii) in paragraph (b), after “information” insert “or documents”,
(b) in subsection (2)(b), after “information” insert “or documents”,
(c) in subsection (3)—
(i) in paragraph (a), after “information”, in both places it occurs, insert “or documents”,
(ii) in paragraph (b), after “information” insert “or documents”,
(iii) in paragraph (c), after “information” insert “or documents”, and
(iv) in paragraph (d), after “information” insert “or documents”,
(d) in subsection (5), after “information”, in the second place it occurs, insert “or documents”,
(e) in subsection (6), after “information”, in the second place it occurs, insert “or documents”, and
(f) in subsection (7)—
(i) in paragraph (a), for “is” substitute “or documents are”, and
(ii) in the words after paragraph (b), after “information” insert “or documents”.
(3) In section 143 (information notices: restrictions)—
(a) in subsection (1)(b)(ii), for “is” substitute “or documents are”,
(b) in subsection (2), after “information”, in the second place it occurs, insert “or documents”,
(c) in subsection (3), for “in respect” substitute “or documents to the extent that requiring the person to do so would result in the disclosure”,
(d) in subsection (4), for “in respect” substitute “or documents to the extent that requiring the person to do so would result in the disclosure”, and
(e) in subsection (6), after “information”, in the second place it occurs, insert “or documents”.
(4) In section 145 (information orders)—
(a) in subsection (2)—
(i) in paragraph (a), after “information”, in the first place it occurs, insert “or documents”, and
(ii) in paragraph (b), after “information” insert “or documents”, and
(b) in subsection (3)—
(i) in paragraph (a), after “information” insert “or documents”,
(ii) in paragraph (b), after “information” insert “or documents”, and
(iii) in paragraph (c), after “information” insert “or documents”.
(5) In section 148(1) (destroying or falsifying information and documents etc), in paragraph (a), after “information”, in the second place it occurs, insert “or a document”.
(6) In section 160 (guidance about regulatory action), in subsection (3)(a), for “is” substitute “or documents are”.
(7) In Schedule 17 (review of processing of personal data for the purposes of journalism), in paragraph 2(2) (information notices)—
(a) in paragraph (a), for “is” substitute “or documents are”, and
(b) in the words after paragraph (b), after “information” insert “or documents”.
(1) The 2018 Act is amended as follows.
(2) In section 146 (assessment notices)—
(a) in subsection (2), after paragraph (i), insert—
(j) make arrangements for an approved person to prepare a report on a specified matter;
(k) provide to the Commissioner a report prepared in pursuance of such arrangements.
,
(b) after subsection (3) insert—
(3A) An assessment notice that requires a controller or processor to make arrangements for an approved person to prepare a report may require the arrangements to include specified terms as to—
(a) the preparation of the report;
(b) the contents of the report;
(c) the form in which the report is to be provided;
(d) the date by which the report is to be completed.
,
(c) after subsection (11) insert—
(11A) Where the Commissioner gives an assessment notice that requires the controller or processor to make arrangements for an approved person to prepare a report, the controller or processor is liable for the payment of the approved person’s remuneration and expenses under the arrangements.
, and
(d) in subsection (12), before the definition of “domestic premises” insert—
“approved person”, in relation to a report, means a person approved to prepare the report in accordance with section 146A;
.
(3) After section 146 insert—
Assessment notices: approval of person to prepare report etc
146A (1) This section applies where an assessment notice requires a controller or processor to make arrangements for an approved person to prepare a report.
(2) The controller or processor must, within such period as is specified in the assessment notice, nominate to the Commissioner a person to prepare the report.
(3) If the Commissioner is satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor approve the nominated person to prepare the report.
(4) If the Commissioner is not satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor—
(a) inform the controller or processor that the Commissioner has decided not to approve the nominated person to prepare the report,
(b) inform the controller or processor of the reasons for that decision, and
(c) approve a person who the Commissioner is satisfied is a suitable person to prepare the report to do so.
(5) If the controller or processor does not nominate a person within the period specified in the assessment notice, the Commissioner must by written notice to the controller or processor approve a person who the Commissioner is satisfied is a suitable person to prepare the report to do so.
(6) It is the duty of the controller or processor to give the person approved to prepare the report all such assistance as the person may reasonably require to prepare the report.
(4) In section 155 (penalty notices), in subsection (1)—
(a) omit the “or” at the end of paragraph (a), and
(b) at the end of paragraph (b) insert
, or
(c) has failed to comply with a duty imposed on the person by section 146A(6).
(5) In section 160 (guidance about regulatory action), in subsection (4), after paragraph (a) insert—
(aa) provision specifying factors to be considered in determining whether to give an assessment notice to a person that imposes a requirement of a sort mentioned in section 146(2)(j);
(ab) provision about the factors the Commissioner may take into account when determining the suitability of a person to prepare a report of a sort mentioned in section 146(2)(j);
.
(1) The 2018 Act is amended as follows.
(2) After section 148 insert—
Interview notices
Interview notices
148A (1) This section applies where the Commissioner suspects that a controller or processor—
(a) has failed or is failing as described in section 149(2), or
(b) has committed or is committing an offence under this Act.
(2) For the purpose of investigating the suspected failure or offence, the Commissioner may, by written notice (an “interview notice”), require an individual within subsection (3) to—
(a) attend at a place specified in the notice, and
(b) answer questions with respect to any matter relevant to the investigation.
(3) An individual is within this subsection if the individual—
(a) is the controller or processor,
(b) is or was at any time employed by, or otherwise working for, the controller or processor, or
(c) is or was at any time concerned in the management or control of the controller or processor.
(4) An interview notice must specify the time at which the individual must attend at the specified place and answer questions (but see the restrictions in subsections (6) and (7)).
(5) An interview notice must—
(a) indicate the nature of the suspected failure or offence that is the subject of the investigation,
(b) provide information about the consequences of failure to comply with the notice, and
(c) provide information about the rights under sections 162 and 164 (appeals etc).
(6) An interview notice may not require an individual to attend at the specified place and answer questions before the end of the period within which an appeal can be brought against the notice.
(7) If an appeal is brought against an interview notice, the individual to whom the notice is given need not attend at the specified place and answer questions pending the determination or withdrawal of the appeal.
(8) If an interview notice—
(a) states that, in the Commissioner’s opinion, it is necessary for the individual to attend at the specified place and answer questions urgently, and
(b) gives the Commissioner’s reasons for reaching that opinion,
subsections (6) and (7) do not apply but the notice must not require the individual to attend at the specified place and answer questions before the end of the period of 24 hours beginning when the notice is given.
(9) The Commissioner may cancel or vary an interview notice by written notice to the individual to whom it was given.
Interview notices: restrictions
148B (1) An interview notice does not require an individual to answer questions to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.
(2) An interview notice does not require an individual to answer questions in respect of a communication which is made—
(a) between a professional legal adviser and the adviser’s client, and
(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
(3) An interview notice does not require an individual to answer questions in respect of a communication which is made—
(a) between a professional legal adviser and the adviser’s client or between such an adviser or client and another person,
(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and
(c) for the purposes of such proceedings.
(4) In subsections (2) and (3), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
(5) An interview notice does not require an individual to answer questions if doing so would, by revealing evidence of the commission of an offence, expose the individual to proceedings for that offence.
(6) The reference to an offence in subsection (5) does not include an offence under—
(a) this Act;
(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);
(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).
(7) A statement made by an individual in response to an interview notice may not be used in evidence against that individual on a prosecution for an offence under this Act (other than an offence under section 148C) unless in the proceedings—
(a) in giving evidence the individual provides information inconsistent with the statement, and
(b) evidence relating to the statement is adduced, or a question relating to it is asked, by that individual or on that individual’s behalf.
(8) The Commissioner may not give an interview notice with respect to the processing of personal data for the special purposes.
(9) The Commissioner may not give an interview notice to an individual for the purpose of investigating a suspected failure or offence if the controller or processor suspected of the failure or offence is a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters).
False statements made in response to interview notices
148C It is an offence for an individual, in response to an interview notice—
(a) to make a statement which the individual knows to be false in a material respect, or
(b) recklessly to make a statement which is false in a material respect.
(3) In section 149 (enforcement notices), in subsection (9)(b)—
(a) after “an assessment notice” insert “, an interview notice”, and
(b) after “147” insert “, 148A, 148B”.
(4) In section 155 (penalty notices), in subsection (1)(b), after “assessment notice” insert “, an interview notice”.
(5) In section 157 (maximum amount of penalty), in subsection (4), after “assessment notice” insert “, an interview notice”.
(6) In section 160 (guidance about regulatory action)—
(a) in subsection (1), after paragraph (b) insert—
(ba) interview notices,
, and
(b) after subsection (5) insert—
(5A) In relation to interview notices, the guidance must include—
(a) provision specifying factors to be considered in determining whether to give an interview notice to an individual;
(b) provision about the circumstances in which the Commissioner would consider it appropriate to give an interview notice to an individual in reliance on section 148A(8) (urgent cases);
(c) provision about the circumstances in which the Commissioner would consider it appropriate to vary the place or time specified in an interview notice at the request of the individual to whom the notice is given;
(d) provision about the nature of interviews carried out in accordance with an interview notice;
(e) provision about how the Commissioner will determine how to proceed if an individual does not comply with an interview notice.
(7) In section 162 (rights of appeal), in subsection (1), after paragraph (b) insert—
(ba) an interview notice;
.
(8) In section 164 (applications in respect of urgent notices)—
(a) in subsection (1), after “assessment notice” insert “, an interview notice”, and
(b) in subsection (5), after paragraph (b) (but before the “and” at the end of that paragraph) insert—
(ba) in relation to an interview notice, a statement under section 148A(8)(a),
.
(9) In section 181 (interpretation of Part 6), at the appropriate place, insert—
““interview notice” has the meaning given in section 148A;”.
(10) In section 196 (penalties for offences), in subsection (2), after “148,” insert “148C,”.
(11) In section 206 (index of defined expressions), at the appropriate place, insert—
interview notice (in Part 6) | section 181
.
(12) In Schedule 17 (review of processing of personal data for the purposes of journalism)—
(a) after paragraph 3 insert—
Interview notices
3A (1) Sub-paragraph (2) applies where the Commissioner gives an interview notice to an individual during a relevant period.
(2) If the interview notice—
(a) states that, in the Commissioner’s opinion, it is necessary for the individual to comply with a requirement in the notice for the purposes of the relevant review, and
(b) gives the Commissioner’s reasons for reaching that opinion,
subsections (6) and (7) of section 148A do not apply but the notice must not require the individual to comply with the requirement before the end of the period of 24 hours beginning when the notice is given.
(3) During a relevant period, section 148B has effect as if for subsection (8) there were substituted—
(8) The Commissioner may not give an individual an interview notice with respect to the processing of personal data for the special purposes unless a determination under section 174 with respect to the data or the processing has taken effect.
, and
(b) in paragraph 4 (applications in respect of urgent notices)—
(i) for “or assessment notice” substitute “, assessment notice or interview notice”,
(ii) for “or 3(2)(a)” substitute “, 3(2)(a) or 3A(2)(a)”, and
(iii) for “or 146(8)(a)” substitute “, 146(8)(a) or 148A(8)(a)”.
(1) The 2018 Act is amended as follows.
(2) In paragraph 2 of Schedule 16 (notice of intent to impose penalty), omit sub-paragraphs (2) and (3).
(3) In paragraph 4 of that Schedule (giving a penalty notice)—
(a) before sub-paragraph (1) insert—
(A1) This paragraph applies where the Commissioner gives a notice of intent to a person.
(A2) Within the period of 6 months beginning when the notice is given, or as soon as reasonably practicable thereafter, the Commission must give to the person—
(a) a penalty notice, or
(b) written notice that the Commissioner has decided not to give a penalty notice to the person.
,
(b) in sub-paragraph (1)—
(i) at the beginning, insert “But”, and
(ii) after “penalty notice” insert “to the person”, and
(c) in sub-paragraph (2), for “a person” substitute “the person”.
(4) In section 160 (guidance about regulatory action), in subsection (7), after paragraph (d) insert—
(e) provision about the circumstances in which the Commissioner would consider it necessary to comply with the duty in paragraph 4(A2) of Schedule 16 after the period of 6 months mentioned in that paragraph.
(1) The 2018 Act is amended as follows.
(2) In section 139 (reporting to Parliament), before subsection (3) insert—
(2A) The report under this section may include the annual report under section 161A.
(3) In the italic heading before section 160, at the end insert “and report”.
(4) After section 161 insert—
Annual report on regulatory action
161A (1) The Commissioner must produce and publish an annual report containing the information described in subsections (2) to (5).
(2) The report must include the following information about UK GDPR investigations—
(a) the number of investigations begun, continued or completed by the Commissioner during the reporting period,
(b) the different types of act and omission that were the subject matter of the investigations,
(c) the enforcement powers exercised by the Commissioner in the reporting period in connection with the investigations,
(d) the duration of investigations that ended in the reporting period, and
(e) the different types of outcome in investigations that ended in that period.
(3) The report must include information about the enforcement powers exercised by the Commissioner in the reporting period in connection with—
(a) processing of personal data by a competent authority for any of the law enforcement purposes, and
(b) processing of personal data to which Part 4 applies.
(4) The information included in the report in accordance with subsections (2) and (3) must include information about—
(a) the number of penalty notices given in the reporting period that were given more than 6 months after the notice of intent was given under paragraph 2 of Schedule 16, and
(b) the reasons why that happened.
(5) The report must include a review of how the Commissioner had regard to the guidance published under section 160 when exercising the Commissioner’s enforcement powers as described in subsections (2)(c) and (3).
(6) In this section—
“enforcement powers” means the powers under—
Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR,
sections 142 to 159 of this Act,
paragraph 2(a), (b) and (c) of Schedule 13 to this Act, and
Schedules 15 and 16 to this Act;
“the law enforcement purposes” has the meaning given in section 31 of this Act;
“the reporting period” means the period to which the report relates;
“UK GDPR investigation” means an investigation required under Article 57(1)(h) of the UK GDPR (investigations on the application of the UK GDPR).
(1) The 2018 Act is amended in accordance with subsections (2) and (3).
(2) Before section 165 (but after the italic heading before it) insert—
Complaints by data subjects to controllers
164A (1) A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act.
(2) A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.
(3) If a controller receives a complaint under this section, the controller must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received.
(4) If a controller receives a complaint under this section, the controller must without undue delay—
(a) take appropriate steps to respond to the complaint, and
(b) inform the complainant of the outcome of the complaint.
(5) The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes—
(a) making enquiries into the subject matter of the complaint, to the extent appropriate, and
(b) informing the complainant about progress on the complaint.
Controllers to notify the Commissioner of the number of complaints
164B (1) The Secretary of State may by regulations require a controller to notify the Commissioner of the number of complaints made to the controller under section 164A in periods specified or described in the regulations.
(2) Regulations under this section may provide that a controller is required to make a notification to the Commissioner in respect of a period only in circumstances specified in the regulations.
(3) Regulations under this section may include—
(a) provision about a matter listed in subsection (4), or
(b) provision conferring power on the Commissioner to determine those matters.
(4) The matters are—
(a) the form and manner in which a notification must be made,
(b) the time at which, or period within which, a notification must be made, and
(c) how the number of complaints made to a controller during a period is to be calculated.
(5) Regulations under this section are subject to the negative resolution procedure.
(3) In section 165 (complaints by data subjects to the Commissioner)—
(a) omit subsection (1), and
(b) in subsection (2), after “infringement of” insert “the UK GDPR or”.
(4) The UK GDPR is amended in accordance with subsections (5) and (6).
(5) In Article 57 (Commissioner’s tasks)—
(a) in paragraph 1, omit point (f), and
(b) omit paragraph 2.
(6) Omit Article 77 (right to lodge a complaint with the Commissioner).
(7) Schedule 10 to this Act contains minor and consequential amendments.
104 Court procedure in connection with subject access requests
(1) The 2018 Act is amended as follows.
(2) For the italic heading before section 180 substitute—
Jurisdiction and court procedure
.
(3) After section 180 insert—
Procedure in connection with subject access requests
180A (1) This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under—
(a) Article 15 of the UK GDPR (right of access by the data subject);
(b) Article 20 of the UK GDPR (right to data portability);
(c) section 45 of this Act (law enforcement processing: right of access by the data subject);
(d) section 94 of this Act (intelligence services processing: right of access by the data subject).
(2) The court may require the controller to make available for inspection by the court so much of the information as is available to the controller.
(3) But, unless and until the question in subsection (1) has been determined in the data subject’s favour, the court may not require the information to be disclosed to the data subject or the data subject’s representatives, whether by discovery (or, in Scotland, recovery) or otherwise.
(4) Where the question in subsection (1) relates to a right under a provision listed in subsection (1)(a), (c) or (d), this section does not confer power on the court to require the controller to carry out a search for information that is more extensive than the reasonable and proportionate search required by that provision.
105 Consequential amendments to the EITSET Regulations
(1) Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) (Commissioner’s enforcement powers) is amended as follows.
(2) In paragraph 1 (provisions of the 2018 Act applied for enforcement purposes)—
(a) after paragraph (g) insert—
(ga) section 146A (assessment notices: approval of person to prepare report etc);
, and
(b) after paragraph (i) insert—
(ia) section 148A (interview notices);
(ib) section 148B (interview notices: restrictions);
(ic) section 148C (false statements made in response to interview notices);
.
(3) In paragraph 4(2) (modification of section 143 (information notices: restrictions))—
(a) in paragraph (b), for “or 148” substitute “, 148 or 148C”, and
(b) in paragraph (c), after “148” insert “or 148C”.
(4) In paragraph 6 (modification of section 146 (assessment notices)), in sub-paragraph (2)—
(a) for paragraph (b) substitute—
(b) subsection (2) has effect as if—
(i) for “controller or processor” there were substituted “trust service provider”;
(ii) paragraphs (h) and (i) were omitted;
,
(b) in paragraph (c), for “subsections (7), (8), (9) and (10)” substitute “subsections (3A), (7), (8), (9), (10) and (11A)”, and
(c) in paragraph (d), for “or 148” substitute “, 148 or 148C”.
(5) After paragraph 6 insert—
Modification of section 146A (assessment notices: approval of person to prepare report etc)
6A Section 146A has effect as if for “controller or processor” (in each place) there were substituted “trust service provider”.
(6) After paragraph 7 insert—
Modification of section 148A (interview notices)
7A Section 148A has effect as if—
(a) in subsection (1)—
(i) for “controller or processor” there were substituted “trust service provider”;
(ii) in paragraph (a), for “as described in section 149(2)” there were substituted “to comply with the eIDAS requirements”;
(iii) in paragraph (b), for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”;
(b) in subsection (3), for “controller or processor” (in each place) there were substituted “trust service provider”.
Modification of section 148B (interview notices: restrictions)
7B (1) Section 148B has effect as if subsections (8) and (9) were omitted.
(2) In that section—
(a) subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “the eIDAS Regulation or the EITSET Regulations”;
(b) subsection (6)(a) has effect as if for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”;
(c) subsection (7) has effect as if for “this Act (other than an offence under section 148C)” there were substituted “section 144 or 148 or paragraph 15 of Schedule 15”.
(7) In paragraph 12 (modification of Schedule 15 (powers of entry and inspection)), in sub-paragraph (2), in the substituted paragraph (a), for “or 148” substitute “, 148 or 148C”.
(8) In paragraph 13 (modification of section 155 (penalty notices)), in sub-paragraph (3)(c), for “for “data subjects”” there were substituted “for the words from “data subjects” to the end”.
(9) Omit paragraph 21 (modification of section 182 (regulations and consultation)) and the heading before it.
(10) In paragraph 22 (modification of section 196 (penalties for offences)), in sub-paragraph (2)(b)—
(a) after “148”, in the first place it occurs, insert “, 148C”, and
(b) for “or 148” substitute “, 148 or 148C”.
106 Protection of prohibitions, restrictions and data subject’s rights
(1) The 2018 Act is amended in accordance with subsections (2) to (5).
(2) After section 183 insert—
Prohibitions and restrictions etc on processing
Protection of prohibitions and restrictions etc on processing: relevant enactments
183A (1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main data protection legislation relating to the processing of personal data.
(2) Subsection (1) does not apply—
(a) to a relevant enactment forming part of the main data protection legislation, or
(b) to the extent that an enactment makes express provision to the contrary referring to this section or to the main data protection legislation (or a provision of that legislation).
(3) Subsection (1) does not prevent a duty or power to process personal data from being taken into account for the purpose of determining whether it is possible to rely on an exception to a requirement under the main data protection legislation that is available where there is such a duty or power.
(4) In this section—
“the main data protection legislation” means the data protection legislation other than provision of or made under—
Chapter 6 or 8 of the UK GDPR, or
Parts 5 to 7 of this Act;
“relevant enactment” means an enactment so far as passed or made on or after the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force;
“requirement” includes a prohibition or restriction.
(5) The reference in subsection (1) to an enactment or rule of law which imposes a duty, or confers a power, to process personal data is a reference to an enactment or rule of law which, directly or indirectly, requires or authorises the processing of personal data, including (for example)—
(a) by authorising one person to require another person to process personal data, or
(b) by removing restrictions on processing personal data,
and the references in subsection (3) to a duty or power are to be read accordingly.
(3) Before section 184 (and the italic heading before it) insert—
Protection of prohibitions and restrictions etc on processing: other enactments
183B (1) This section is about the relationship between—
(a) a pre-commencement enactment which imposes a duty, or confers a power, to process personal data, and
(b) a provision of the main data protection legislation containing a requirement relating to the processing of personal data.
(2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).
(3) Where the provision described in subsection (1)(b) is a provision of, or made under, the UK GDPR, section 5(A2) of the European Union (Withdrawal) Act 2018 (assimilated direct legislation subject to domestic enactments) does not apply to the relationship.
(4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision with similar effect to section 183A(1) (or applying that provision) is made in connection with one such relationship but not another.
(5) In this section—
(a) “the main data protection legislation” and “requirement” have the same meaning as in section 183A, and
(b) “pre-commencement enactment” means an enactment so far as passed or made before the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force.
(6) Section 183A(5) applies for the purposes of subsection (1)(a) of this section as it applies for the purposes of section 183A(1).
(4) In section 186 (data subject’s rights and other prohibitions and restrictions)—
(a) for the heading substitute “Protection of data subject’s rights”,
(b) in subsection (1) omit “, except as provided by or under the provisions listed in subsection (3)”,
(c) after subsection (2) insert—
(2A) Subsection (1) does not apply—
(a) to an enactment contained in, or made under, a provision listed in subsection (2),
(b) to an enactment contained in, or made under, a provision listed in subsection (3),
(c) to the extent that an enactment makes express provision to the contrary referring to this section or to a provision listed in subsection (2), or
(d) to the extent that subsection (1) is disapplied by section 186A(3).
, and
(d) in subsection (3)—
(i) for “provisions providing exceptions” substitute “provisions referred to in subsection (2A)(b)”, and
(ii) omit paragraph (c) (and the “and” after it).
(5) After section 186 insert—
Protection of data subject’s rights: further provision
186A (1) This section is about the relationship between—
(a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises the withholding of information, and
(b) a provision of the UK GDPR or this Act listed in section 186(2).
(2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).
(3) Subsection (1) of section 186 does not apply to the relationship so far as there is a contrary intention, whether express or implied (taking account of, among other things, subsection (2) of this section).
(4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision stating that section 186(1) applies (or with similar effect) is made in connection with one such relationship but not another.
(5) In this section, “pre-commencement enactment” means an enactment so far as passed or made before the day on which section 106(4) of the Data (Use and Access) Act 2025 comes into force, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).
(6) In section 5 of the European Union (Withdrawal) Act 2018 (exceptions to savings and incorporation), in subsection (A3)(a)—
(a) for “section” substitute “sections 183A and”,
(b) for “(data subject’s rights and other prohibitions and restrictions)” substitute “(protection of prohibitions, restrictions and data subject’s rights)”, and
(c) at the end insert “(and see also section 183B(3) of that Act)”.
(7) Subsections (3), (5) and (6)(c) are to be treated as having come into force on 1 January 2024.
(1) In the UK GDPR, after Chapter 9 insert—
CHAPTER 9A Regulations
Regulations made by Secretary of State
Article 91A 1. This Article makes provision about regulations made by the Secretary of State under this Regulation (“UK GDPR regulations”).
2. Before making UK GDPR regulations, the Secretary of State must consult—
(a) the Commissioner, and
(b) such other persons as the Secretary of State considers appropriate.
3. Paragraph 2 does not apply to regulations made under Article 49 or 49A where the Secretary of State has made an urgency statement in respect of them.
4. UK GDPR regulations may—
(a) make different provision for different purposes;
(b) include consequential, supplementary, incidental, transitional, transitory or saving provision.
5. UK GDPR regulations are to be made by statutory instrument.
6. For the purposes of this Regulation, where regulations are subject to “the negative resolution procedure”, the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
7. For the purposes of this Regulation, where regulations are subject to “the affirmative resolution procedure”, the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.
8. For the purposes of this Regulation, where regulations are subject to “the made affirmative resolution procedure”—
(a) the statutory instrument containing the regulations must be laid before Parliament after being made, together with the urgency statement in respect of them, and
(b) the regulations cease to have effect at the end of the period of 120 days beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament.
9. In calculating the period of 120 days, no account is to be taken of any whole days that fall within a period during which—
(a) Parliament is dissolved or prorogued, or
(b) both Houses of Parliament are adjourned for more than 4 days.
10. Where regulations cease to have effect as a result of paragraph 8, that does not—
(a) affect anything previously done under the regulations, or
(b) prevent the making of new regulations.
11. Any provision that may be included in UK GDPR regulations subject to the negative resolution procedure may be made by regulations made under this Regulation or another enactment that are subject to the affirmative resolution procedure or the made affirmative resolution procedure.
12. A requirement under this Article to consult may be satisfied by consultation before, as well as by consultation after, the provision conferring the power to make regulations comes into force.
13. In this Article, “urgency statement”, in relation to regulations, means a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.
(2) In section 3(9) of the 2018 Act (definition of “data protection legislation”), in paragraph (d), after “Act” insert “or the UK GDPR”.
(1) Regulation 2 of the PEC Regulations (interpretation) is amended as follows.
(2) In paragraph (1)—
(a) in the definition of “call”, at the end insert “, and a reference to making a call includes a reference to attempting to establish such a connection”,
(b) in the definition of “communication”—
(i) for “exchanged or conveyed between” substitute “transmitted to”, and
(ii) for “conveyed”, in the second place it occurs, substitute “transmitted”, and
(c) at the appropriate place insert—
“direct marketing” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;
.
(3) After paragraph (1) insert—
(1A) In the application of these Regulations in relation to—
(a) information that is sent but not received,
(b) a communication that is transmitted but not received,
(c) an electronic mail that is sent but not received, or
(d) an unsuccessful attempt to make a call,
a reference to the recipient of the information, communication, electronic mail or call is to be read as a reference to the intended recipient.
(4) In paragraph (4) omit “, without prejudice to paragraph (3),”.
(5) After that paragraph insert—
(5) References in these Regulations to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of the Periods of Time Regulation, except that Article 3(4) of that Regulation does not apply to the interpretation of a reference to a period in regulation 16A.
(6) In paragraph (5), “the Periods of Time Regulation” means Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.
111 Duty to notify the Commissioner of personal data breach: time periods
(1) In regulation 5A of the PEC Regulations (personal data breach)—
(a) in paragraph (2), after “delay” insert “and, where feasible, not later than 72 hours after having become aware of it”, and
(b) after paragraph (3) insert—
(3A) Where notification under paragraph (2) is not made within 72 hours, it must be accompanied by reasons for the delay.
(2) In regulation 5C of the PEC Regulations (personal data breach: fixed monetary penalty)—
(a) in paragraph (4)(f), for “from the service of the notice of intent” substitute “beginning when the notice of intent is served”, and
(b) in paragraph (5), for “21 days of receipt of the notice of intent” substitute “the period of 21 days beginning when the notice of intent is received”.
(3) In Article 2 of Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications (notification to the Commissioner)—
(a) in paragraph 2—
(i) in the first subparagraph, for the words from “no” to “feasible” substitute “without undue delay and, where feasible, not later than 72 hours after having become aware of it”,
(ii) in the second subparagraph, after “shall” insert “, subject to paragraph 3,”, and
(iii) after the third subparagraph insert—
This paragraph is to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.
, and
(b) for paragraph 3 substitute—
3. To the extent that the information set out in Annex 1 is not available to be included in the notification, it may be provided in phases without undue further delay.
112 Storing information in the terminal equipment of a subscriber or user
(1) The PEC Regulations are amended in accordance with subsections (2) and (3).
(2) For regulation 6 (storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user) substitute—
Storing information in the terminal equipment of a subscriber or user
6. (1) Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user.
(2) In paragraph (1) and Schedule A1—
(a) a reference (however expressed) to storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user includes a reference to instigating the storage or access, and
(b) except as otherwise provided, a reference (however expressed) to gaining access to information stored in the terminal equipment of a subscriber or user includes a reference to collecting or monitoring information automatically emitted by the terminal equipment.
(3) After regulation 6 insert—
Power to provide exceptions to regulation 6(1)
6A. (1) The Secretary of State may by regulations made by statutory instrument—
(a) amend these Regulations—
(i) by adding an exception to the prohibition in regulation 6(1), or
(ii) by omitting or varying an exception to that prohibition, and
(b) make consequential, supplementary, incidental, transitional, transitory or saving provision, including provision amending these Regulations.
(2) Regulations under paragraph (1) may make different provision for different purposes.
(3) Before making regulations under paragraph (1), the Secretary of State must consult—
(a) the Information Commissioner, and
(b) such other persons as the Secretary of State considers appropriate.
(4) A statutory instrument containing regulations under paragraph (1) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.
(4) Schedule 12 to this Act inserts Schedule A1 to the PEC Regulations.
(5) A requirement to consult under regulation 6A of the PEC Regulations (inserted by subsection (3) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
113 Emergency alerts: interpretation of time periods
In regulation 16A of the PEC Regulations (emergency alerts), in paragraph (6), for the words from “7 days” to “paragraph (3)(b)” substitute “the period of 7 days beginning with the day on which the time period specified by the relevant public authority pursuant to paragraph (3)(b) expires”.
114 Use of electronic mail for direct marketing by charities
(1) Regulation 22 of the PEC Regulations (use of electronic mail for direct marketing purposes) is amended as follows.
(2) In paragraph (2), after “paragraph (3)” insert “or (3A)”.
(3) After paragraph (3) insert—
(3A) A charity may send or instigate the sending of electronic mail for the purposes of direct marketing where—
(a) the sole purpose of the direct marketing is to further one or more of the charity’s charitable purposes;
(b) the charity obtained the contact details of the recipient of the electronic mail in the course of the recipient—
(i) expressing an interest in one or more of the purposes that were the charity’s charitable purposes at that time; or
(ii) offering or providing support to further one or more of those purposes; and
(c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of their contact details for the purposes of direct marketing by the charity, at the time that the details were initially collected, and, where the recipient did not initially refuse the use of the details, at the time of each subsequent communication.
(4) After paragraph (4) insert—
(5) In this regulation, “charity” means—
(a) a charity as defined in section 1(1) of the Charities Act 2011,
(b) a charity as defined in section 1(1) of the Charities Act (Northern Ireland) 2008 (c. 12 (N.I.)), including an institution treated as such a charity for the purposes of that Act by virtue of the Charities Act 2008 (Transitional Provision) Order (Northern Ireland) 2013 (S.R. (N.I.) 2013 No. 211), and
(c) a body entered in the Scottish Charity Register, other than a body which no longer meets the charity test in section 7 of the Charities and Trustee Investment (Scotland) Act 2005 (asp 10),
and, in relation to such a charity, institution or body, “charitable purpose” has the meaning given in the relevant Act.
(1) The PEC Regulations are amended in accordance with subsections (2) to (8).
(2) In regulation 5 (security of public electronic communications services), omit paragraph (6).
(3) Omit regulation 5B (personal data breach: audit).
(4) In regulation 5C (personal data breach: fixed monetary penalty)—
(a) in paragraph (10)—
(i) omit “and Northern Ireland”, and
(ii) in paragraph (a), for “a county court” substitute “the county court”, and
(b) after paragraph (11) insert—
(12) In Northern Ireland, the penalty is recoverable—
(a) if a county court so orders, as if it were payable under an order of that court;
(b) if the High Court so orders, as if it were payable under an order of that court.
(13) The Secretary of State may by regulations made by statutory instrument amend this regulation so as to substitute a different amount for the amount for the time being specified in paragraph (2) or (5).
(14) Regulations under paragraph (13) may make transitional provision.
(15) Before making regulations under paragraph (13), the Secretary of State must consult—
(a) the Information Commissioner, and
(b) such other persons as the Secretary of State considers appropriate.
(16) A statutory instrument containing regulations under this regulation may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.
(5) For regulation 31 substitute—
Information Commissioner’s enforcement powers
31. (1) Schedule 1 provides for certain provisions of Parts 5 to 7 of the Data Protection Act 2018 to apply with modifications for the purposes of enforcing these Regulations.
(2) In regulations 32 and 33, “enforcement functions” means the functions of the Information Commissioner under those provisions, as applied by that Schedule.
(6) Omit regulation 31A (third party information notices).
(7) Omit regulation 31B (appeals against third party information notices).
(8) For Schedule 1 substitute the Schedule set out in Schedule 13 to this Act.
(9) In paragraph 58(1) of Schedule 20 to the Data Protection Act 2018 (transitional provision relating to the PEC Regulations) for “regulations 2, 31 and 31B of, and Schedule 1 to,” substitute “regulation 2 of”.
(10) A requirement to consult under regulation 5C(15) of the PEC Regulations (inserted by subsection (4)(b) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
(1) The PEC Regulations are amended as follows.
(2) After regulation 32 insert—
Codes of conduct
32A. (1) The Commissioner must encourage representative bodies to produce codes of conduct intended to contribute to compliance with these Regulations.
(2) Under paragraph (1), the Commissioner must encourage representative bodies to produce codes which take account of, among other things, the specific features of different sectors.
(3) A code of conduct described in paragraph (1) may, for example, make provision with regard to—
(a) rights and obligations under these Regulations;
(b) out-of-court proceedings and other dispute resolution procedures for resolving disputes arising in connection with these Regulations.
(4) The Commissioner must encourage representative bodies to submit codes of conduct described in paragraph (1) to the Commissioner in draft.
(5) Where a representative body does so, the Commissioner must—
(a) provide the representative body with an opinion on whether the code correctly reflects the requirements of these Regulations,
(b) decide whether to approve the code, and
(c) if the code is approved, register and publish the code.
(6) The Commissioner may only approve a code if, among other things—
(a) the code contains a mechanism for monitoring whether persons who undertake to apply the code comply with its provisions, and
(b) in relation to persons other than public bodies, the mechanism involves monitoring by a body which is accredited for that purpose by the Commissioner under regulation 32B.
(7) In relation to amendments of a code of conduct that is for the time being approved under this regulation—
(a) paragraphs (4) and (5) apply as they apply in relation to a code, and
(b) the requirements in paragraph (6) must be satisfied by the code as amended.
(8) A code of conduct described in paragraph (1) may be contained in the same document as a code of conduct described in Article 40 of the UK GDPR (and a provision contained in such a document may be a provision of both codes).
(9) In this regulation—
“public body” has the meaning given in section 7 of the Data Protection Act 2018 (for the purposes of the UK GDPR);
“representative body” means an association or other body representing categories of—
communications providers, or
other persons engaged in activities regulated by these Regulations;
“the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.
Accreditation of bodies monitoring compliance with codes of conduct
32B. (1) The Commissioner may, in accordance with this regulation, accredit a body for the purpose of monitoring whether persons other than public bodies comply with a code of conduct described in regulation 32A(1).
(2) The Commissioner may accredit a body only where the Commissioner is satisfied that the body has—
(a) demonstrated its independence,
(b) demonstrated that it has an appropriate level of expertise in relation to the subject matter of the code,
(c) established procedures which allow it—
(i) to assess a person’s eligibility to apply the code,
(ii) to monitor compliance with the code, and
(iii) to review the operation of the code periodically,
(d) established procedures and structures to handle complaints about infringements of the code or about the manner in which the code has been, or is being, implemented by a person,
(e) made arrangements to publish information about the procedures and structures described in sub-paragraph (d), and
(f) demonstrated that it does not have a conflict of interest.
(3) The Commissioner must prepare and publish guidance about how the Commissioner proposes to take decisions about accreditation under this regulation.
(4) A body accredited under this regulation in relation to a code must take appropriate action where a person infringes the code.
(5) If the action taken by a body under paragraph (4) consists of suspending or excluding a person from the code, the body must inform the Commissioner, giving reasons for taking that action.
(6) The Commissioner must revoke the accreditation of a body under this regulation if the Commissioner considers that the body—
(a) no longer meets the requirements for accreditation, or
(b) has failed, or is failing, to comply with paragraph (4) or (5).
(7) In this regulation, “public body” has the same meaning as in regulation 32A.
Effect of codes of conduct
32C. Adherence to a code of conduct approved under regulation 32A may be used by a person as a means of demonstrating compliance with these Regulations.
(3) In regulation 33 (technical advice to the Commissioner)—
(a) omit “, in connection with his enforcement functions,” and
(b) at the end insert
where the request is made in connection with—
(a) the Commissioner’s enforcement functions, or
(b) the Commissioner’s functions under regulation 32A or 32B (codes of conduct).
(4) In Schedule 1 (Commissioner’s enforcement powers) (inserted by Schedule 13 to this Act), in paragraph 18(b)(ii) (maximum amount of penalty), for “or 24” substitute “, 24 or 32B(4) or (5)”.
(1) The Data Protection Act 2018 is amended in accordance with subsections (2) to (5).
(2) After section 114 insert—
The Information Commission
The Information Commission
114A (1) A body corporate called the Information Commission is established.
(2) Schedule 12A makes further provision about the Commission.
(3) In section 3 (terms relating to the processing of personal data), after subsection (8) insert—
(8A) “The Commission” means the Information Commission (see section 114A).
(4) In section 205(2) (references to periods of time)—
(a) omit paragraph (l), and
(b) after that paragraph insert—
(la) paragraph 22(6) of Schedule 12A;
.
(5) In section 206 (index of defined expressions), in the Table, at the appropriate place insert—
the Commission | section 3
.
(6) Schedule 14 to this Act—
(a) inserts Schedule 12A to the Data Protection Act 2018, and
(b) makes transitional provision relating to—
(i) the person who holds the office of Information Commissioner immediately before the day on which Schedule 14 comes into force, and
(ii) consultation about certain appointments.
118 Abolition of the office of Information Commissioner
(1) The office of Information Commissioner is abolished.
(2) Accordingly, the Data Protection Act 2018 is amended as follows.
(3) In section 3 (terms relating to the processing of personal data) omit subsection (8).
(4) Omit section 114 (the Information Commissioner) and the italic heading before that section.
(5) In section 206 (index of defined expressions), in the Table, omit the entry for the Commissioner.
(6) In section 214(1) (extent)—
(a) omit “and” at the end of paragraph (a), and
(b) omit paragraph (b).
(7) Omit Schedule 12 (the Information Commissioner).
119 Transfer of functions to the Information Commission
(1) The functions of the Information Commissioner are transferred to the Information Commission.
(2) So far as is appropriate in consequence of subsection (1), a reference to the Information Commissioner (however expressed) in an enactment or other document whenever passed or made (including this Act) is to be treated as a reference to the Information Commission.
(3) In this section, “enactment” includes—
(a) an enactment comprised in subordinate legislation (as defined in section 21 of the Interpretation Act 1978),
(b) an enactment comprised in, or in an instrument made under, a Measure or Act of Senedd Cymru,
(c) an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament,
(d) an enactment comprised in, or in an instrument made under, Northern Ireland legislation, and
(e) assimilated direct legislation.
120 Transfer of property etc to the Information Commission
(1) The Secretary of State may make a scheme for the transfer of property, rights and liabilities from the Information Commissioner to the Information Commission.
(2) The things that may be transferred under a transfer scheme include—
(a) property, rights and liabilities that could not otherwise be transferred;
(b) property acquired, and rights and liabilities arising, after the making of the scheme.
(3) A transfer scheme may—
(a) make provision about the continuing effect of things done by the Information Commissioner in respect of anything transferred;
(b) make provision about the continuation of things (including legal proceedings) in the process of being done by, on behalf of or in relation to the Information Commissioner in respect of anything transferred;
(c) make provision for references to the Information Commissioner in an instrument or other document in respect of anything transferred under a transfer scheme to be treated as references to the Information Commission;
(d) make provision which is the same as or similar to the Transfer of Undertakings (Protection of Employment) Regulations 2006 (S.I. 2006/246);
(e) make other consequential, supplementary, incidental or transitional provision.
(4) A transfer scheme may provide—
(a) for modifications by agreement;
(b) for modifications to have effect from the date when the original scheme came into effect.
(5) In this section, references to rights and liabilities include rights and liabilities relating to a contract of employment.
121 Information standards for health and adult social care in England
Schedule 15 makes provision about information standards for health and adult social care in England (under Part 9 of the Health and Social Care Act 2012) and information technology.
123 Disclosure of information to improve public service delivery to undertakings
(1) Section 35 of the Digital Economy Act 2017 (disclosure of information to improve public service delivery) is amended as follows.
(2) In subsection (9)—
(a) in paragraph (a), for “or households” substitute “, households or undertakings”, and
(b) in paragraph (b), for “or households” substitute “, households or undertakings”.
(3) In subsection (10)—
(a) the words after “its purpose” become paragraph (a), and
(b) at the end of that paragraph, insert
, or
(b) the assisting of undertakings in connection with any trade, business or charitable purpose.
(4) After subsection (12) insert—
(13) In this section “undertaking” means—
(a) any person, other than a public authority, carrying on a trade or business, whether or not with a view to profit, or
(b) any body, or the trustees of a trust, established for charitable purposes only.
(14) In this section, in so far as it forms part of the law of Scotland or Northern Ireland, “charitable purpose” has the same meaning as it has in the law of England and Wales (see section 2 of the Charities Act 2011).
124 Retention of information by providers of internet services in connection with death of child
(1) The Online Safety Act 2023 is amended as follows.
(2) In section 100 (power to require information)—
(a) omit subsection (7);
(b) after subsection (8) insert—
(8A) The power to give a notice conferred by subsection (1) does not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).
(3) In section 101 (information in connection with investigation into death of child)—
(a) before subsection (1) insert—
(A1) Subsection (C1) applies if a senior coroner (in England and Wales), a procurator fiscal (in Scotland) or a coroner (in Northern Ireland) (“the investigating authority”)—
(a) notifies OFCOM that they are conducting an investigation in connection with the death of a child, and
(b) provides OFCOM with the details in subsection (B1).
(B1) The details are—
(a) the name of the child who has died,
(b) the child’s date of birth,
(c) any email addresses used by the child (so far as the investigating authority knows), and
(d) if any regulated service has been brought to the attention of the investigating authority as being of interest in connection with the child’s death, the name of the service.
(C1) Where this subsection applies, OFCOM—
(a) must give a notice to the provider of a service within subsection (E1) requiring the provider to ensure the retention of information relating to the use of the service by the child who has died, and
(b) may give a notice to any other relevant person requiring the person to ensure the retention of information relating to the use of a service within subsection (E1) by that child.
(D1) The references in subsection (C1) to ensuring the retention of information relating to the child’s use of a service include taking all reasonable steps, without delay, to prevent the deletion of such information by the routine operation of systems or processes.
(E1) A service is within this subsection if it is—
(a) a regulated service of a kind described in regulations made by the Secretary of State, or
(b) a regulated service notified to OFCOM by the investigating authority as described in subsection (B1)(d).
(F1) A notice under subsection (C1) may require information described in that subsection to be retained only if it is information—
(a) of a kind which OFCOM have power to require under a notice under subsection (1) (see, in particular, subsection (2)(a) to (d)), or
(b) which a person might need to retain to enable the person to provide information in response to a notice under subsection (1) (if such a notice were given).
(G1) OFCOM must share with the investigating authority any information they receive in response to requirements mentioned in section 102(5A)(d) that are included in a notice under subsection (C1).
;
(b) in subsection (3), for “power conferred by subsection (1) includes” substitute “powers conferred by this section include”;
(c) after subsection (5) insert—
(5A) The powers to give a notice conferred by this section do not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).
(4) In section 102 (information notices)—
(a) in subsection (1), for “101(1)” substitute “101(C1) or (1)”;
(b) in subsection (3)—
(i) after “information notice” insert “under section 100(1) or 101(1)”;
(ii) omit the “and” at the end of paragraph (c);
(iii) after paragraph (c) insert—
(ca) specify when the information must be provided (which may be on or by a specified date, within a specified period, or at specified intervals), and
;
(c) omit subsection (4);
(d) after subsection (5) insert—
(5A) An information notice under section 101(C1) must—
(a) specify or describe the information to be retained,
(b) specify why OFCOM require the information to be retained,
(c) require the information to be retained for the period of one year beginning with the date of the notice,
(d) require the person to whom the notice is given—
(i) if the child to whom the notice relates used the service in question, to notify OFCOM by a specified date of steps taken to ensure the retention of information;
(ii) if the child did not use the service, or the person does not hold any information of the kind required, to notify OFCOM of that fact by a specified date, and
(e) contain information about the consequences of not complying with the notice.
(5B) If OFCOM give an information notice to a person under section 101(C1), they may, in response to information received from the investigating authority, extend the period for which the person is required to retain information by a maximum period of six months.
(5C) The power conferred by subsection (5B) is exercisable—
(a) by giving the person a notice varying the notice under section 101(C1) and stating the further period for which information must be retained and the reason for the extension;
(b) any number of times.
;
(e) after subsection (9) insert—
(9A) OFCOM must cancel an information notice under section 101(C1) by notice to the person to whom it was given if advised by the investigating authority that the information in question no longer needs to be retained.
;
(f) in subsection (10), after the definition of “information” insert—
“the investigating authority” has the same meaning as in section 101;
.
(5) In section 109 (offences in connection with information notices)—
(a) in subsection (2)(b), for “all reasonable steps” substitute “all of the steps that it was reasonable, and reasonably practicable, to take”;
(b) after subsection (6) insert—
(6A) A person who is given an information notice under section 101(C1) commits an offence if—
(a) the person deletes or alters, or causes or permits the deletion or alteration of, any information required by the notice to be retained, and
(b) the person’s intention was to prevent the information being available, or (as the case may be) to prevent it being available in unaltered form, for the purposes of any official investigation into the death of the child to whom the notice relates.
(6B) For the purposes of subsection (6A) information has been deleted if it is irrecoverable (however that occurred).
(6) In section 110 (senior managers’ liability: information offences)—
(a) after subsection (6) insert—
(6A) An individual named as a senior manager of an entity commits an offence if—
(a) the entity commits an offence under section 109(6A) (deletion etc of information), and
(b) the individual has failed to take all reasonable steps to prevent that offence being committed.
;
(b) in subsection (7), for “or (6)” substitute “, (6) or (6A)”.
(7) In section 113 (penalties for information offences), in subsection (2)—
(a) for “(4) or (5)” substitute “(4), (5) or (6A)”;
(b) for “(5) or (6)” substitute “(5), (6) or (6A)”.
(8) In section 114 (co-operation and disclosure of information: overseas regulators), in subsection (7), omit the definition of “the data protection legislation”.
(9) In section 225 (Parliamentary procedure for regulations), in subsection (10), after paragraph (c) insert—
(ca) regulations under section 101(E1)(a),
.
(10) In section 236(1) (interpretation)—
(a) after the definition of “country” insert—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);
;
(b) in the definition of “information notice”, for “101(1)” substitute “101(C1) or (1)”.
(11) In section 237 (index of defined terms), after the entry for “CSEA content” insert—
the data protection legislation | section 236
.
125 Information for research about online safety matters
(1) The Online Safety Act 2023 is amended in accordance with subsections (2) to (4).
(2) After section 154 insert—
Information for research about online safety matters
154A (1) The Secretary of State may by regulations require providers of regulated services to provide information for purposes related to the carrying out of independent research into online safety matters.
(2) Regulations under this section may (for example) provide for—
(a) the making of applications by persons seeking information;
(b) the procedure to be followed in the making and determination of applications;
(c) the grounds on which applications are to be determined;
(d) the imposition of requirements described in subsection (1) to be effected by means of notices given to providers of regulated services (“researcher access notices”);
(e) the contents of researcher access notices;
(f) the procedure to be followed in the giving of researcher access notices;
(g) the form in which, and the means by which, information is to be provided;
(h) the safeguards to be applied in respect of the handling of information;
(i) the charging of fees payable by applicants for information under the regulations and by providers of regulated services;
(j) the enforcement of requirements imposed by the regulations;
(k) appeals in respect of decisions taken under the regulations.
(3) Provision about enforcement under subsection (2)(j) may include provision—
(a) about investigations (including the making of reports);
(b) conferring powers of entry, inspection and audit;
(c) imposing monetary penalties;
(d) creating offences, but such provision may not impose a penalty for an offence that is greater than a penalty of any of the descriptions mentioned in section 113.
(4) Regulations under this section—
(a) may authorise or require anything that is to be done under, or for the purposes of, the regulations to be done by an appropriate person;
(b) may confer a discretion on an appropriate person for the purposes of provision under paragraph (a);
(c) may apply (with or without modifications) other provisions of this Act.
(5) Regulations under this section may apply generally or only in relation to specified descriptions of—
(a) regulated services;
(b) persons carrying out independent research;
(c) research into online safety matters or the purposes of such research;
(d) information,
and provision made by virtue of section 224(1) in connection with this section may, in particular, make different provision for different descriptions of services, researchers, research or information.
(6) Regulations under this section may not require—
(a) processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed under the regulations to provide information is to be taken into account);
(b) provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings.
(7) Before making regulations under this section the Secretary of State must consult—
(a) OFCOM,
(b) the Information Commissioner,
(c) persons who appear to the Secretary of State to represent providers of regulated services,
(d) persons who appear to the Secretary of State to represent the interests of persons carrying out independent research into online safety matters, and
(e) such other persons as the Secretary of State considers appropriate.
(8) For the purposes of this section—
(a) “independent research” is research carried out other than on behalf of a provider of a regulated service;
(b) references to an “appropriate person” are references to—
(i) OFCOM, or
(ii) such other person as the Secretary of State considers appropriate to carry out functions under regulations made under this section (and the regulations may include provision establishing a body for this purpose).
(3) In section 162 (OFCOM’s report about researchers’ access to information), omit subsections (7) to (10).
(4) In section 225 (Parliamentary procedure for regulations), for subsections (8) and (9) substitute—
(8) A statutory instrument containing (whether alone or with other provision) the first regulations under the following provisions may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament—
(a) section 154A(1);
(b) paragraph 1(1) of Schedule 11.
(9) Any other statutory instrument containing regulations under a provision mentioned in subsection (8) is subject to annulment in pursuance of a resolution of either House of Parliament.
(5) The requirement to consult under section 154A(7) of the Online Safety Act 2023 (as inserted by subsection (2) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
126 Retention of biometric data and recordable offences
(1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (10).
(2) In section 18A(3) (retention of material: general), after “recordable offence” insert “or recordable-equivalent offence”.
(3) Section 18E (supplementary provision) is amended in accordance with subsections (4) to (10).
(4) In subsection (1), after the definition of “recordable offence” insert—
“recordable-equivalent offence” means an offence under the law of a country or territory outside England and Wales and Northern Ireland where the act constituting the offence would constitute a recordable offence if done in England and Wales or Northern Ireland (whether or not the act constituted such an offence when the person was convicted);
.
(5) In subsection (3), in the words before paragraph (a), after “offence” insert “in England and Wales or Northern Ireland”.
(6) After subsection (5) insert—
(5A) For the purposes of section 18A, a person is to be treated as having been convicted of an offence in a country or territory outside England and Wales and Northern Ireland if, in respect of such an offence, a court exercising jurisdiction under the law of that country or territory has made a finding equivalent to—
(a) a finding that the person is not guilty by reason of insanity, or
(b) a finding that the person is under a disability and did the act charged against the person in respect of the offence.
(7) In subsection (6)(a)—
(a) after “convicted” insert
—
(i)
, and
(b) after “offence,” insert
or
(ii) in a country or territory outside England and Wales and Northern Ireland, of a recordable-equivalent offence,
.
(8) In subsection (6)(b)—
(a) omit “of a recordable offence”, and
(b) for “a recordable offence, other than a qualifying offence” substitute “an offence, other than a qualifying offence or qualifying-equivalent offence”.
(9) In subsection (7), for “subsection (6)” substitute “this section”.
(10) After subsection (7) insert—
(7A) In subsection (6), “qualifying-equivalent offence” means an offence under the law of a country or territory outside England and Wales and Northern Ireland where the act constituting the offence would constitute a qualifying offence if done in England and Wales or Northern Ireland (whether or not the act constituted such an offence when the person was convicted).
(11) The amendments made by this section apply only in connection with the retention of section 18 material that is or was obtained or acquired by a law enforcement authority—
(a) on or after the commencement day, or
(b) in the period of 3 years ending immediately before the commencement day.
(12) Subsection (13) of this section applies where—
(a) at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day,
(b) at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material, and
(c) at the pre-commencement time, the law enforcement authority could have retained the material under section 18A of the Counter-Terrorism Act 2008, as it has effect taking account of the amendments made by subsections (2) to (10) of this section, if those amendments had been in force.
(13) Where this subsection applies—
(a) the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but
(b) the material may not be used in evidence against the person to whom the material relates—
(i) in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or
(ii) in criminal proceedings in any other country or territory.
(14) In this section—
“the commencement day” means the day on which this Act is passed;
“law enforcement authority” has the meaning given by section 18E(1) of the Counter-Terrorism Act 2008;
“section 18 material” has the meaning given by section 18(2) of that Act.
(15) For the purposes of this section, proceedings in relation to an offence are instituted—
(a) in England and Wales, when they are instituted for the purposes of Part 1 of the Prosecution of Offences Act 1985 (see section 15(2) of that Act);
(b) in Northern Ireland, when they are instituted for the purposes of Part 2 of the Justice (Northern Ireland) Act 2002 (see section 44(1) and (2) of that Act);
(c) in Scotland, when they are instituted for the purposes of Part 3 of the Proceeds of Crime Act 2002 (see section 151(1) and (2) of that Act).
(1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (6).
(2) Section 18A (retention of material: general) is amended in accordance with subsections (3) to (5).
(3) In subsection (1), for “subsection (5)” substitute “subsections (4) to (9)”.
(4) In subsection (4)(a), after “relates” insert “(a “pseudonymised form”)”.
(5) After subsection (6) insert—
(7) Section 18 material which is not a DNA sample may be retained indefinitely by a law enforcement authority if—
(a) the authority obtains or acquires the material directly or indirectly from an overseas law enforcement authority,
(b) the authority obtains or acquires the material in a form which includes information which identifies the person to whom the material relates,
(c) as soon as reasonably practicable after obtaining or acquiring the material, the authority takes the steps necessary for it to hold the material in a pseudonymised form, and
(d) having taken those steps, the law enforcement authority continues to hold the material in a pseudonymised form.
(8) In a case where section 18 material is being retained by a law enforcement authority under subsection (7), if—
(a) the law enforcement authority ceases to hold the material in a pseudonymised form, and
(b) the material relates to a person who has no previous convictions or only one exempt conviction,
the material may be retained by the law enforcement authority until the end of the retention period specified in subsection (9).
(9) The retention period is the period of 3 years beginning with the date on which the law enforcement authority first ceases to hold the material in a pseudonymised form.
(6) In section 18E(1) (supplementary provision)—
(a) in the definition of “law enforcement authority”, for paragraph (d) substitute—
(d) an overseas law enforcement authority;
, and
(b) after that definition insert—
“overseas law enforcement authority” means a person formed or existing under the law of a country or territory outside the United Kingdom so far as exercising functions which—
correspond to those of a police force, or
otherwise involve the investigation or prosecution of offences;
.
(7) The amendments made by this section apply only in connection with the retention of section 18 material that is or was obtained or acquired by a law enforcement authority—
(a) on or after the commencement day, or
(b) in the period of 3 years ending immediately before the commencement day.
(8) Subsections (9) to (12) of this section apply where, at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day.
(9) Where the law enforcement authority holds the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) and (d) of the Counter-Terrorism Act 2008 as having—
(a) taken the steps necessary for it to hold the material in a pseudonymised form as soon as reasonably practicable after obtaining or acquiring the material, and
(b) continued to hold the material in a pseudonymised form until the commencement day.
(10) Where the law enforcement authority does not hold the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) of the Counter-Terrorism Act 2008 as taking the steps necessary for it to hold the material in a pseudonymised form as soon as reasonably practicable after obtaining or acquiring the material if it takes those steps on, or as soon as reasonably practicable after, the commencement day.
(11) Subsection (12) of this section applies where, at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material but—
(a) at the pre-commencement time, the law enforcement authority could have retained the material under section 18A(7) to (9) of the Counter-Terrorism Act 2008 (as inserted by this section) if those provisions had been in force, or
(b) on or after the commencement day, the law enforcement authority may retain the material under those provisions by virtue of subsection (9) or (10) of this section.
(12) Where this subsection applies—
(a) the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but
(b) the material may not be used in evidence against the person to whom the material relates—
(i) in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or
(ii) in criminal proceedings in any other country or territory.
(13) In this section—
“the commencement day”, “law enforcement authority” and “section 18 material” have the meaning given in section 126(14);
“in a pseudonymised form” has the meaning given by section 18A(4) of the Counter-Terrorism Act 2008 (as amended by this section);
“instituted”, in relation to proceedings, has the meaning given in section 126(15).
(1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (4).
(2) In section 18(4) (destruction of national security material not subject to existing statutory restrictions), after “18A” insert “, 18AA”.
(3) After section 18A insert—
Retention of material from INTERPOL
18AA (1) This section applies to section 18 material which is not a DNA sample where the law enforcement authority obtained or acquired the material as part of a request for assistance, or a notification of a threat, sent to the United Kingdom via INTERPOL’s systems.
(2) The law enforcement authority may retain the material until the National Central Bureau informs the authority that the request or notification has been cancelled or withdrawn.
(3) If the law enforcement authority is the National Central Bureau, it may retain the material until it becomes aware that the request or notification has been cancelled or withdrawn.
(4) In this section—
“INTERPOL” means the organisation called the International Criminal Police Organization - INTERPOL;
“the National Central Bureau” means the body appointed for the time being in accordance with INTERPOL’s constitution to serve as the United Kingdom’s National Central Bureau.
(5) The reference in subsection (1) to material obtained or acquired as part of a request or notification includes material obtained or acquired as part of a communication, sent to the United Kingdom via INTERPOL’s systems, correcting, updating or otherwise supplementing the request or notification.
Retention of material from INTERPOL: supplementary
18AB (1) The Secretary of State may by regulations amend section 18AA to make such changes as the Secretary of State considers appropriate in consequence of—
(a) changes to the name of the organisation which, when section 18AA was enacted, was called the International Criminal Police Organization - INTERPOL (“the organisation”),
(b) changes to arrangements made by the organisation which involve fingerprints or DNA profiles being provided to members of the organisation (whether changes to existing arrangements or changes putting in place new arrangements), or
(c) changes to the organisation’s arrangements for liaison between the organisation and its members or between its members.
(2) Regulations under this section are subject to affirmative resolution procedure.
(4) In section 18BA(5)(a) (retention of further fingerprints), after “18A” insert “, 18AA”.
(5) Section 18AA of the Counter-Terrorism Act 2008 applies in relation to section 18 material obtained or acquired by a law enforcement authority before the commencement day (as well as material obtained or acquired on or after that day), except where the law enforcement authority was informed, or became aware, as described in subsection (2) or (3) of that section before the commencement day.
(6) Subsection (7) of this section applies where—
(a) at the beginning of the commencement day, a law enforcement authority has section 18 material,
(b) at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material, but
(c) at the pre-commencement time, the law enforcement authority could have retained the material under section 18AA of that Act (as inserted by this section) if it had been in force.
(7) Where this subsection applies—
(a) the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but
(b) the material may not be used in evidence against the person to whom the material relates—
(i) in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or
(ii) in criminal proceedings in any other country or territory.
(8) In this section—
“the commencement day”, “law enforcement authority” and “section 18 material” have the meaning given in section 126(14);
“instituted”, in relation to proceedings, has the meaning given in section 126(15).