96 Right not to be subject to automated decision-making
(1) The controller may not take a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to the data subject.
(2) Subsection (1) does not prevent such a decision being made on that basis if—
(a) the decision is required or authorised by law,
(b) the data subject has given consent to the decision being made on that basis, or
(c) the decision is a decision taken in the course of steps taken—
(i) for the purpose of considering whether to enter into a contract with the data subject,
(ii) with a view to entering into such a contract, or
(iii) in the course of performing such a contract.
(3) For the purposes of this section and section 97, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual.
(4) For the purposes of this section and section 97, a decision is based on entirely automated processing if the decision-making process does not include an opportunity for a human being to accept, reject or influence the decision.
97 Right to intervene in automated decision-making
(1) This section applies where—
(a) the controller takes a decision significantly affecting a data subject that is based on entirely automated processing of personal data relating to the data subject, and
(b) the decision is required or authorised by law.
(2) This section does not apply to such a decision if—
(a) the data subject has given consent to the decision being made on that basis, or
(b) the decision is a decision taken in the course of steps taken—
(i) for the purpose of considering whether to enter into a contract with the data subject,
(ii) with a view to entering into such a contract, or
(iii) in the course of performing such a contract.
(3) The controller must as soon as reasonably practicable notify the data subject that such a decision has been made.
(4) The data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller—
(a) to reconsider the decision, or
(b) to take a new decision that is not based on entirely automated processing.
(5) If a request is made to the controller under subsection (4), the controller must, before the end of the period of 1 month beginning with receipt of the request—
(a) consider the request, including any information provided by the data subject that is relevant to it, and
(b) by notice in writing inform the data subject of the outcome of that consideration.
(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(1) Where—
(a) the controller processes personal data relating to a data subject, and
(b) results produced by the processing are applied to the data subject,
the data subject is entitled to obtain from the controller, on request, knowledge of the reasoning underlying the processing.
(2) Where the data subject makes a request under subsection (1), the controller must comply with the request without undue delay.
(1) A data subject is entitled at any time, by notice given to the controller, to require the controller—
(a) not to process personal data relating to the data subject, or
(b) not to process such data for a specified purpose or in a specified manner,
on the ground that, for specified reasons relating to the situation of the data subject, the processing in question is an unwarranted interference with the interests or rights of the data subject.
(2) Where the controller—
(a) reasonably requires further information—
(i) in order that the controller be satisfied as to the identity of the individual giving notice under subsection (1), or
(ii) to locate the data to which the notice relates, and
(b) has informed that individual of that requirement,
the controller is not obliged to comply with the notice unless the controller is supplied with that further information.
(3) The controller must, before the end of 21 days beginning with the relevant time, give a notice to the data subject—
(a) stating that the controller has complied or intends to comply with the notice under subsection (1), or
(b) stating the controller's reasons for not complying with the notice to any extent and the extent (if any) to which the controller has complied or intends to comply with the notice under subsection (1).
(4) If the controller does not comply with a notice under subsection (1) to any extent, the data subject may apply to a court for an order that the controller take steps for complying with the notice.
(5) If the court is satisfied that the controller should comply with the notice (or should comply to any extent), the court may order the controller to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit.
(6) A court may make an order under subsection (5) in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for compliance with the obligation to which the order relates.
(7) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.
(8) In this section, “the relevant time”, in relation to a notice under subsection (1), means—
(a) when the controller receives the notice, or
(b) if later, when the controller receives the information (if any) required under subsection (2) in connection with the notice.
(1) If a court is satisfied on the application of a data subject that personal data relating to the data subject is inaccurate, the court may order the controller to rectify that data without undue delay.
(2) If a court is satisfied on the application of a data subject that the processing of personal data relating to the data subject would infringe any of sections 86 to 91, the court may order the controller to erase that data without undue delay.
(3) If personal data relating to the data subject must be maintained for the purposes of evidence, the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay.
(4) If—
(a) the data subject contests the accuracy of personal data, and
(b) the court is satisfied that the controller is not able to ascertain whether the data is accurate or not,
the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay.
(5) A court may make an order under this section in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for carrying out the rectification, erasure or restriction of processing that the court proposes to order.
(6) The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.
This Chapter sets out—
(a) the general obligations of controllers and processors (see sections 102 to 106);
(b) specific obligations of controllers and processors with respect to security (see section 107);
(c) specific obligations of controllers and processors with respect to personal data breaches (see section 108).
Each controller must implement appropriate measures—
(a) to ensure, and
(b) to be able to demonstrate, in particular to the Commission,
that the processing of personal data complies with the requirements of this Part.
(1) Where a controller proposes that a particular type of processing of personal data be carried out by or on behalf of the controller, the controller must, prior to the processing, consider the impact of the proposed processing on the rights and freedoms of data subjects.
(2) A controller must implement appropriate technical and organisational measures which are designed to ensure that—
(a) the data protection principles are implemented, and
(b) risks to the rights and freedoms of data subjects are minimised.
(1) Where two or more controllers jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.
(2) Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.
(3) The arrangement must designate the controller which is to be the contact point for data subjects.
(1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.
(2) The controller may use only a processor who undertakes—
(a) to implement appropriate measures that are sufficient to secure that the processing complies with this Part;
(b) to provide to the controller such information as is necessary for demonstrating that the processing complies with this Part.
(3) If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.
106 Processing under the authority of the controller or processor
A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—
(a) on instructions from the controller, or
(b) to comply with a legal obligation.
(1) Each controller and each processor must implement security measures appropriate to the risks arising from the processing of personal data.
(2) In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—
(a) prevent unauthorised processing or unauthorised interference with the systems used in connection with it,
(b) ensure that it is possible to establish the precise details of any processing that takes place,
(c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and
(d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.
(1) If a controller becomes aware of a serious personal data breach in relation to personal data for which the controller is responsible, the controller must notify the Commission of the breach without undue delay.
(2) Where the notification to the Commission is not made within 72 hours, the notification must be accompanied by reasons for the delay.
(3) Subject to subsection (4), the notification must include—
(a) a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
(b) the name and contact details of the contact point from whom more information can be obtained;
(c) a description of the likely consequences of the personal data breach;
(d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
(4) Where and to the extent that it is not possible to provide all the information mentioned in subsection (3) at the same time, the information may be provided in phases without undue further delay.
(5) If a processor becomes aware of a personal data breach (in relation to data processed by the processor), the processor must notify the controller without undue delay.
(6) Subsection (1) does not apply in relation to a personal data breach if the breach also constitutes a relevant error within the meaning given by section 231(9) of the Investigatory Powers Act 2016.
(7) For the purposes of this section, a personal data breach is serious if the breach seriously interferes with the rights and freedoms of a data subject.
109 Transfers of personal data outside the United Kingdom
(1) A controller may not transfer personal data to—
(a) a country or territory outside the United Kingdom, or
(b) an international organisation,
unless the transfer falls within subsection (2).
(2) A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out—
(a) for the purposes of the controller's statutory functions, or
(b) for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994.
(1) A provision mentioned in subsection (2) does not apply to personal data to which this Part applies if exemption from the provision is required for the purpose of safeguarding national security.
(2) The provisions are—
(a) Chapter 2 of this Part (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and 10;
(b) Chapter 3 of this Part (rights of data subjects);
(c) in Chapter 4 of this Part, section 108 (communication of a personal data breach to the Commission);
(d) in Part 5—
(i) section 119 (inspection in accordance with international obligations);
(ii) in Schedule 13 (other general functions of the Commission), paragraphs 1(a) and (g) and 2;
(e) in Part 6—
(i) sections 142 to 154 and Schedule 15 (Commission's notices and powers of entry and inspection);
(ii) sections 170 to 173 (offences relating to personal data);
(iii) sections 174 to 176 (provision relating to the special purposes).
(1) Subject to subsection (3), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions mentioned in section 110(2) is, or at any time was, required for the purpose of safeguarding national security in respect of any personal data is conclusive evidence of that fact.
(2) A certificate under subsection (1)—
(a) may identify the personal data to which it applies by means of a general description, and
(b) may be expressed to have prospective effect.
(3) Any person directly affected by the issuing of a certificate under subsection (1) may appeal to the Tribunal against the certificate.
(4) If on an appeal under subsection (3), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may—
(a) allow the appeal, and
(b) quash the certificate.
(5) Where, in any proceedings under or by virtue of this Act, it is claimed by a controller that a certificate under subsection (1) which identifies the personal data to which it applies by means of a general description applies to any personal data, another party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question.
(6) But, subject to any determination under subsection (7), the certificate is to be conclusively presumed so to apply.
(7) On an appeal under subsection (5), the Tribunal may determine that the certificate does not so apply.
(8) A document purporting to be a certificate under subsection (1) is to be—
(a) received in evidence, and
(b) deemed to be such a certificate unless the contrary is proved.
(9) A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (1) is—
(a) in any legal proceedings, evidence of that certificate, and
(b) in any legal proceedings in Scotland, sufficient evidence of that certificate.
(10) The power conferred by subsection (1) on a Minister of the Crown is exercisable only by—
(a) a Minister who is a member of the Cabinet, or
(b) the Attorney General or the Advocate General for Scotland.
(1) The Secretary of State may by regulations amend Schedule 11—
(a) by adding exemptions from any provision of this Part;
(b) by omitting exemptions added by regulations under paragraph (a).
(2) Regulations under this section are subject to the affirmative resolution procedure.
115 General functions under the UK GDPR and safeguards
(1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(2) General functions are conferred on the Commission by—
(a) Article 57 of the UK GDPR (tasks), and
(b) Article 58 of the UK GDPR (powers),
(and see also sections 28(5), 120A and 120B).
(3) The Commission's functions in relation to the processing of personal data to which the UK GDPR applies include—
(a) a duty to advise Parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of individuals' rights and freedoms with regard to the processing of personal data, and
(b) a power to issue, on the Commission's own initiative or on request, opinions to Parliament, the government or other institutions and bodies as well as to the public on any issue related to the protection of personal data.
(4) The Commission's functions under Article 58 of the UK GDPR are subject to the safeguards in subsections (5) to (9).
(5) The Commission's power under Article 58(1)(a) of the UK GDPR (power to require a controller or processor to provide information that the Commission requires for the performance of the Commission's tasks under the UK GDPR) is exercisable only by giving an information notice under section 142.
(6) The Commission's power under Article 58(1)(b) of the UK GDPR (power to carry out data protection audits) is exercisable only in accordance with section 146.
(7) The Commission's powers under Article 58(1)(e) and (f) of the UK GDPR (power to obtain information from controllers and processors and access to their premises) are exercisable only—
(a) in accordance with Schedule 15 (see section 154), or
(b) to the extent that they are exercised in conjunction with the power under Article 58(1)(b) of the UK GDPR, in accordance with section 146.
(8) The following powers are exercisable only by giving an enforcement notice under section 149—
(a) the Commission's powers under Article 58(2)(c) to (g) and (j) of the UK GDPR (certain corrective powers);
(b) the Commission's powers under Article 58(2)(h) to order a certification body to withdraw, or not to issue, a certification under Articles 42 and 43 of the UK GDPR.
(9) The Commission's powers under Articles 58(2)(i) and 83 of the UK GDPR (administrative fines) are exercisable only by giving a penalty notice under section 155.
(10) This section is without prejudice to other functions conferred on the Commission, whether by the UK GDPR, this Act or otherwise.
(A1) The Commission is responsible for monitoring the application of Part 3 of this Act, in order to protect the fundamental rights and freedoms of individuals in relation to processing by a competent authority for any of the law enforcement purposes (as defined in Part 3) and to facilitate the free flow of personal data.
(1) The Commission —
(a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(b) is to ... the designated authority in the United Kingdom for the purposes of Article 13 of the Data Protection Convention.
(2) Schedule 13 confers general functions on the Commission in connection with processing to which the UK GDPR does not apply (and see also sections 120A and 120B).
(3) This section and Schedule 13 are without prejudice to other functions conferred on the Commission, whether by this Act or otherwise.
Nothing in this Act or the UK GDPR permits or requires the Commission to exercise functions in relation to the processing of personal data by—
(a) an individual acting in a judicial capacity, or
(b) a court or tribunal acting in its judicial capacity ...
....
119 Inspection of personal data in accordance with international obligations
(1) The Commission may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2).
(2) The power under subsection (1) is exercisable only if the personal data—
(a) is processed wholly or partly by automated means, or
(b) is processed otherwise than by automated means and forms part of a filing system or is intended to form part of a filing system.
(3) The power under subsection (1) includes power to inspect, operate and test equipment which is used for the processing of personal data.
(4) Before exercising the power under subsection (1), the Commission must by written notice inform the controller and any processor that the Commission intends to do so.
(5) Subsection (4) does not apply if the Commission considers that the case is urgent.
(6) It is an offence—
(a) intentionally to obstruct a person exercising the power under subsection (1), or
(b) to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.
(7) Paragraphs (c) and (d) of section 3(14) do not apply to references in this section to personal data, the processing of personal data, a controller or a processor.
119A Standard clauses for transfers to third countries etc
(1) The Commission may issue a document specifying standard data protection clauses which the Commission considers are capable of securing that the data protection test set out in Article 46 of the UK GDPR or section 75 of this Act (or both) is met in relation to transfers of personal data.
(2) The Commission may issue a document that amends or withdraws a document issued under subsection (1).
(3) A document issued under this section—
(a) must specify when it comes into force,
(aa) may make provision generally or in relation to types of transfer described in the document,
(b) may make different provision for different purposes, and
(c) may include transitional provision or savings.
(4) Before issuing a document under this section, the Commission must consult the Secretary of State and such of the following as the Commission considers appropriate—
(a) trade associations;
(b) data subjects;
(c) persons who appear to the Commission to represent the interests of data subjects.
(5) After a document is issued under this section—
(a) the Commission must send a copy to the Secretary of State, and
(b) the Secretary of State must lay it before Parliament.
(6) If, within the 40-day period, either House of Parliament resolves not to approve the document then, with effect from the end of the day on which the resolution is passed, the document is to be treated as not having been issued under this section (so that the document, and any amendment or withdrawal made by the document, is to be disregarded for the purposes of Article 46(2)(d) of the UK GDPR).
(7) Nothing in subsection (6)—
(a) affects any transfer of personal data previously made in reliance on the document, or
(b) prevents a further document being laid before Parliament.
(8) The Commission must publish—
(a) a document issued under this section, and
(b) a notice identifying any document which, under subsection (6), is treated as not having been issued under this section.
(9) The Commission must keep under review the clauses specified in a document issued under this section for the time being in force.
(10) In this section, “the 40-day period” means—
(a) if the document is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or
(b) if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
(11) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
(12) In this section, “trade association” includes a body representing controllers or processors.
(1) The Commission must, in relation to third countries and international organisations, take appropriate steps to—
(a) develop international co-operation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;
(b) provide international mutual assistance in the enforcement of legislation for the protection of personal data, subject to appropriate safeguards for the protection of personal data and ... fundamental rights and freedoms;
(c) engage relevant stakeholders in discussion and activities aimed at furthering international co-operation in the enforcement of legislation for the protection of personal data;
(d) promote the exchange and documentation of legislation and practice for the protection of personal data, including legislation and practice relating to jurisdictional conflicts with third countries.
(2) Subsection (1) applies only in connection with the processing of personal data to which the UK GDPR does not apply; for the equivalent duty in connection with the processing of personal data to which the UK GDPR applies, see Article 50 of the UK GDPR (international co-operation for the protection of personal data).
(2A) The Commission may contribute to the activities of international organisations with data protection functions.
(3) The Commission must carry out data protection functions which the Secretary of State directs the Commission to carry out for the purpose of enabling Her Majesty's Government in the United Kingdom to give effect to an international obligation of the United Kingdom.
(4) The Commission may provide an authority carrying out data protection functions under the law of a British overseas territory with assistance in carrying out those functions.
(5) The Secretary of State may direct that assistance under subsection (4) is to be provided on terms, including terms as to payment, specified or approved by the Secretary of State.
(6) In this section—
“data protection functions” means functions relating to the protection of individuals with respect to the processing of personal data;
“mutual assistance in the enforcement of legislation for the protection of personal data” includes assistance in the form of notification, complaint referral, investigative assistance and information exchange;
“third country” means a country or territory outside the United Kingdom.
(7) Section 3(14)(c) does not apply to references to personal data and the processing of personal data in this section.
It is the principal objective of the Commission, in carrying out functions under the data protection legislation—
(a) to secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and
(b) to promote public trust and confidence in the processing of personal data.
120B Duties in relation to functions under the data protection legislation
In carrying out functions under the data protection legislation, the Commission must have regard to such of the following as appear to the Commission to be relevant in the circumstances—
(a) the desirability of promoting innovation;
(b) the desirability of promoting competition;
(c) the importance of the prevention, investigation, detection and prosecution of criminal offences;
(d) the need to safeguard public security and national security;
(e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing.
(1) The Commission must prepare a strategy for carrying out the Commission's functions under the data protection legislation in accordance with the Commission's duties under—
(a) sections 120A and 120B,
(b) section 108 of the Deregulation Act 2015 (exercise of regulatory functions: economic growth), and
(c) section 21 of the Legislative and Regulatory Reform Act 2006 (exercise of regulatory functions: principles).
(2) The Commission must—
(a) review the strategy from time to time, and
(b) revise the strategy as appropriate.
(3) The Commission must publish the strategy and any revised strategy.
(1) The Commission must, at such times as the Commission considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which the Commission exercises functions under the data protection legislation may affect economic growth, innovation and competition.
(2) The persons are—
(a) such persons exercising regulatory functions as the Commission considers appropriate;
(b) such other persons as the Commission considers appropriate.
(3) In this section, “regulatory function” has the meaning given by section 111 of the Deregulation Act 2015.
(1) The Commission must prepare a code of practice which contains—
(a) practical guidance in relation to the sharing of personal data in accordance with the requirements of the data protection legislation, and
(b) such other guidance as the Commission considers appropriate to promote good practice in the sharing of personal data.
(2) Where a code under this section is in force, the Commission may prepare amendments of the code or a replacement code.
(3) Before preparing a code or amendments under this section, the Commission must consult the Secretary of State and such of the following as the Commission considers appropriate—
(a) trade associations;
(b) data subjects;
(c) persons who appear to the Commission to represent the interests of data subjects.
(4) A code under this section may include transitional provision or savings.
(5) In this section—
“good practice in the sharing of personal data” means such practice in the sharing of personal data as appears to the Commission to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
“the sharing of personal data” means the disclosure of personal data by transmission, dissemination or otherwise making it available;
“trade association” includes a body representing controllers or processors.
(1) The Commission must prepare a code of practice which contains—
(a) practical guidance in relation to the carrying out of direct marketing in accordance with the requirements of the data protection legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426), and
(b) such other guidance as the Commission considers appropriate to promote good practice in direct marketing.
(2) Where a code under this section is in force, the Commission may prepare amendments of the code or a replacement code.
(3) Before preparing a code or amendments under this section, the Commission must consult the Secretary of State and such of the following as the Commission considers appropriate—
(a) trade associations;
(b) data subjects;
(c) persons who appear to the Commission to represent the interests of data subjects.
(4) A code under this section may include transitional provision or savings.
(5) In this section—
“direct marketing” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;
“good practice in direct marketing” means such practice in direct marketing as appears to the Commission to be desirable having regard to the interests of data subjects and others, including compliance with the requirements mentioned in subsection (1)(a);
“trade association” includes a body representing controllers or processors.
(1) The Commission must prepare a code of practice which contains such guidance as the Commission considers appropriate on standards of age-appropriate design of relevant information society services which are likely to be accessed by children.
(2) Where a code under this section is in force, the Commission may prepare amendments of the code or a replacement code.
(3) Before preparing a code or amendments under this section, the Commission must consult the Secretary of State and such other persons as the Commission considers appropriate, including—
(a) children,
(b) parents,
(c) persons who appear to the Commission to represent the interests of children,
(d) child development experts, and
(e) trade associations.
(4) In preparing a code or amendments under this section, the Commission must have regard—
(a) to the fact that children have different needs at different ages, and
(b) to the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.
(5) A code under this section may include transitional provision or savings.
(6) Any transitional provision included in the first code under this section must cease to have effect before the end of the period of 12 months beginning when the code comes into force.
(7) In this section—
“age-appropriate design” means the design of services so that they are appropriate for use by, and meet the development needs of, children;
“information society services” has the same meaning as in the UK GDPR, but does not include preventive or counselling services;
“relevant information society services” means information society services which involve the processing of personal data to which the UK GDPR applies;
“standards of age-appropriate design of relevant information society services” means such standards of age-appropriate design of such services as appear to the Commission to be desirable having regard to the best interests of children;
“trade association” includes a body representing controllers or processors;
“the United Nations Convention on the Rights of the Child” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.
(1) The Commission must prepare a code of practice which contains—
(a) practical guidance in relation to the processing of personal data for the purposes of journalism in accordance with the requirements of the data protection legislation, and
(b) such other guidance as the Commission considers appropriate to promote good practice in the processing of personal data for the purposes of journalism.
(2) Where a code under this section is in force, the Commission may prepare amendments of the code or a replacement code.
(3) Before preparing a code or amendments under this section, the Commission must consult such of the following as the Commission considers appropriate—
(a) trade associations;
(b) data subjects;
(c) persons who appear to the Commission to represent the interests of data subjects.
(4) A code under this section may include transitional provision or savings.
(5) In this section—
“good practice in the processing of personal data for the purposes of journalism” means such practice in the processing of personal data for those purposes as appears to the Commission to be desirable having regard to—
the interests of data subjects and others ..., and
the special importance of the public interest in the freedom of expression and information;
and includes compliance with the requirements of the data protection legislation;
“trade association” includes a body representing controllers or processors.
(1) The Commission must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by regulations made by the Secretary of State.
(2) Regulations under this section—
(a) must describe the personal data or processing to which the code of practice is to relate, and
(b) may describe the persons or classes of person to whom it is to relate.
(3) Where a code under this section is in force, the Commission may prepare amendments of the code or a replacement code.
(4) Before preparing a code or amendments under this section, the Commission must consult the Secretary of State and such of the following as the Commission considers appropriate—
(a) trade associations;
(b) data subjects;
(c) persons who appear to the Commission to represent the interests of data subjects.
(5) A code under this section may include transitional provision or savings.
(6) Regulations under this section are subject to the negative resolution procedure.
(7) In this section—
“good practice in the processing of personal data” means such practice in the processing of personal data as appears to the Commission to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation;
“trade association” includes a body representing controllers or processors.
(1) This section applies where a code is prepared under section 121, 122, 123, 124 or 124A, subject to subsection (11).
(2) The Commission must establish a panel of individuals to consider the code.
(3) The panel must consist of—
(a) individuals the Commission considers have expertise in the subject matter of the code, and
(b) individuals the Commission considers—
(i) are likely to be affected by the code, or
(ii) represent persons likely to be affected by the code.
(4) Before the panel begins to consider the code, the Commission must—
(a) publish the code in draft, and
(b) publish a statement that—
(i) states that a panel has been established to consider the code,
(ii) identifies the members of the panel,
(iii) explains the process by which they were selected, and
(iv) explains the reasons for their selection.
(5) Where at any time it appears to the Commission that a member of the panel is not willing or able to serve as a member of the panel, the Commission may select another individual to be a member of the panel.
(6) Where the Commission selects an individual to be a member of the panel under subsection (5), the Commission must publish a statement that—
(a) identifies the member of the panel,
(b) explains the process by which the member was selected, and
(c) explains the reasons for the member’s selection.
(7) The Commission must make arrangements—
(a) for the members of the panel to consider the code with one another (whether in person or otherwise), and
(b) for the panel to prepare and submit to the Commission a report on the code within such reasonable period as is determined by the Commission.
(8) If the panel submits to the Commission a report on the code within the period determined by the Commission, the Commission must as soon as reasonably practicable—
(a) make any alterations to the code that the Commission considers appropriate in the light of the report, and
(b) publish—
(i) the code in draft,
(ii) the report or a summary of it, and
(iii) in a case where a recommendation in the report to alter the code has not been accepted by the Commission, an explanation of why it has not been accepted.
(9) The Commission may pay remuneration and expenses to the members of the panel.
(10) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections, subject to subsection (11).
(11) The Secretary of State may by regulations provide that this section does not apply, or applies with modifications, in the case of—
(a) a code prepared under section 124A, or
(b) an amendment of such a code,
that is specified or described in the regulations.
(12) Regulations under this section are subject to the negative resolution procedure.
(1) Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commission must carry out and publish an assessment of—
(a) who would be likely to be affected by the code, and
(b) the effect the code would be likely to have on them.
(2) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections.
125 Approval of codes prepared under sections 121 to 124A
(1) When a code is prepared under section 121, 122, 123 , 124 or 124A—
(a) the Commission must submit the final version to the Secretary of State, and
(b) the Secretary of State must lay the code before Parliament.
(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(3) If, within the 40-day period, either House of Parliament resolves not to approve a code prepared under section 121, 122, 123 , 124 or 124A, the Commission must not issue the code.
(4) If no such resolution is made within that period—
(a) the Commission must issue the code, and
(b) the code comes into force at the end of the period of 21 days beginning with the day on which it is issued.
(5) If the Commission is prevented by subsection (3) from issuing a code that is not a replacement code, the Commission must prepare another version of the code.
(6) Nothing in subsection (3) prevents another version of the code being laid before Parliament.
(7) In this section, “the 40-day period” means—
(a) if the code is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or
(b) if the code is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
(8) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
(9) This section, other than subsection (5), applies in relation to amendments prepared under section 121, 122, 123 , 124 or 124A as it applies in relation to codes prepared under those sections.
126 Publication and review of codes issued under section 125(4)
(1) The Commission must publish a code issued under section 125(4).
(2) Where an amendment of a code is issued under section 125(4), the Commission must publish—
(a) the amendment, or
(b) the code as amended by it.
(3) The Commission must keep under review each code issued under section 125(4) for the time being in force.
(4) Where the Commission becomes aware that the terms of such a code could result in a breach of an international obligation of the United Kingdom, the Commission must exercise the power under section 121(2), 122(2), 123(2) , 124(2) or 124A(3) with a view to remedying the situation.