161 Approval of first guidance about regulatory action
(1) When the first guidance is produced under section 160(1)—
(a) the Commission must submit the final version to the Secretary of State, and
(b) the Secretary of State must lay the guidance before Parliament.
(2) If, within the 40-day period, either House of Parliament resolves not to approve the guidance—
(a) the Commission must not issue the guidance, and
(b) the Commission must produce another version of the guidance (and this section applies to that version).
(3) If, within the 40-day period, no such resolution is made—
(a) the Commission must issue the guidance, and
(b) the guidance comes into force at the end of the period of 21 days beginning with the day on which it is issued.
(4) Nothing in subsection (2)(a) prevents another version of the guidance being laid before Parliament.
(5) In this section, “the 40-day period” means—
(a) if the guidance is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or
(b) if the guidance is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
(6) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
(1) The Commission must produce and publish an annual report containing the information described in subsections (2) to (5).
(2) The report must include the following information about UK GDPR investigations—
(a) the number of investigations begun, continued or completed by the Commission during the reporting period,
(b) the different types of act and omission that were the subject matter of the investigations,
(c) the enforcement powers exercised by the Commission in the reporting period in connection with the investigations,
(d) the duration of investigations that ended in the reporting period, and
(e) the different types of outcome in investigations that ended in that period.
(3) The report must include information about the enforcement powers exercised by the Commission in the reporting period in connection with—
(a) processing of personal data by a competent authority for any of the law enforcement purposes, and
(b) processing of personal data to which Part 4 applies.
(4) The information included in the report in accordance with subsections (2) and (3) must include information about—
(a) the number of penalty notices given in the reporting period that were given more than 6 months after the notice of intent was given under paragraph 2 of Schedule 16, and
(b) the reasons why that happened.
(5) The report must include a review of how the Commission had regard to the guidance published under section 160 when exercising the Commission's enforcement powers as described in subsections (2)(c) and (3).
(6) In this section—
“enforcement powers” means the powers under—
Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR,
sections 142 to 159 of this Act,
paragraph 2(a), (b) and (c) of Schedule 13 to this Act, and
Schedules 15 and 16 to this Act;
“the law enforcement purposes” has the meaning given in section 31 of this Act;
“the reporting period” means the period to which the report relates;
“UK GDPR investigation” means an investigation required under Article 57(1)(h) of the UK GDPR (investigations on the application of the UK GDPR).
(1) A person who is given any of the following notices may appeal to the Tribunal—
(a) an information notice;
(b) an assessment notice;
(ba) an interview notice;
(c) an enforcement notice;
(d) a penalty notice;
(e) a penalty variation notice.
(2) A person who is given an enforcement notice may appeal to the Tribunal against the refusal of an application under section 153 for the cancellation or variation of the notice.
(3) A person who is given a penalty notice or a penalty variation notice may appeal to the Tribunal against the amount of the penalty specified in the notice, whether or not the person appeals against the notice.
(4) Where a determination is made under section 174 in respect of the processing of personal data, the controller or processor may appeal to the Tribunal against the determination.
(1) Subsections (2) to (4) apply where a person appeals to the Tribunal under section 162(1) or (3).
(2) The Tribunal may review any determination of fact on which the notice or decision against which the appeal is brought was based.
(3) If the Tribunal considers—
(a) that the notice or decision against which the appeal is brought is not in accordance with the law, or
(b) to the extent that the notice or decision involved an exercise of discretion by the Commission, that the Commission ought to have exercised the discretion differently,
the Tribunal must allow the appeal or substitute another notice or decision which the Commission could have given or made.
(4) Otherwise, the Tribunal must dismiss the appeal.
(5) On an appeal under section 162(2), if the Tribunal considers that the enforcement notice ought to be cancelled or varied by reason of a change in circumstances, the Tribunal must cancel or vary the notice.
(6) On an appeal under section 162(4), the Tribunal may cancel the Commission's determination.
(1) This section applies where an information notice, an assessment notice , an interview notice or an enforcement notice given to a person contains an urgency statement.
(2) The person may apply to the court for either or both of the following—
(a) the disapplication of the urgency statement in relation to some or all of the requirements of the notice;
(b) a change to the time at which, or the period within which, a requirement of the notice must be complied with.
(3) On an application under subsection (2), the court may do any of the following—
(a) direct that the notice is to have effect as if it did not contain the urgency statement;
(b) direct that the inclusion of the urgency statement is not to have effect in relation to a requirement of the notice;
(c) vary the notice by changing the time at which, or the period within which, a requirement of the notice must be complied with;
(d) vary the notice by making other changes required to give effect to a direction under paragraph (a) or (b) or in consequence of a variation under paragraph (c).
(4) The decision of the court on an application under this section is final.
(5) In this section, “urgency statement” means—
(a) in relation to an information notice, a statement under section 142(7)(a),
(b) in relation to an assessment notice, a statement under section 146(8)(a) or (9)(d),
(ba) in relation to an interview notice, a statement under section 148A(8)(a), and
(c) in relation to an enforcement notice, a statement under section 150(8)(a).
(1) A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act.
(2) A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means.
(3) If a controller receives a complaint under this section, the controller must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received.
(4) If a controller receives a complaint under this section, the controller must without undue delay—
(a) take appropriate steps to respond to the complaint, and
(b) inform the complainant of the outcome of the complaint.
(5) The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes—
(a) making enquiries into the subject matter of the complaint, to the extent appropriate, and
(b) informing the complainant about progress on the complaint.
164B Controllers to notify the Commission of the number of complaints
(1) The Secretary of State may by regulations require a controller to notify the Commission of the number of complaints made to the controller under section 164A in periods specified or described in the regulations.
(2) Regulations under this section may provide that a controller is required to make a notification to the Commission in respect of a period only in circumstances specified in the regulations.
(3) Regulations under this section may include—
(a) provision about a matter listed in subsection (4), or
(b) provision conferring power on the Commission to determine those matters.
(4) The matters are—
(a) the form and manner in which a notification must be made,
(b) the time at which, or period within which, a notification must be made, and
(c) how the number of complaints made to a controller during a period is to be calculated.
(5) Regulations under this section are subject to the negative resolution procedure.
(1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(2) A data subject may make a complaint to the Commission if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the UK GDPR or Part 3 or 4 of this Act.
(3) The Commission must facilitate the making of complaints under subsection (2) by taking steps such as providing a complaint form which can be completed electronically and by other means.
(4) If the Commission receives a complaint under subsection (2), the Commission must—
(a) take appropriate steps to respond to the complaint,
(b) inform the complainant of the outcome of the complaint,
(c) inform the complainant of the rights under section 166, and
(d) if asked to do so by the complainant, provide the complainant with further information about how to pursue the complaint.
(5) The reference in subsection (4)(a) to taking appropriate steps in response to a complaint includes—
(a) investigating the subject matter of the complaint, to the extent appropriate, and
(b) informing the complainant about progress on the complaint, including about whether further investigation or co-ordination with a foreign designated authority is necessary.
(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(7) In this section—
“foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;
...
166 Orders to progress complaints to the Commission
(1) This section applies where, after a data subject makes a complaint under section 165 ..., the Commission—
(a) fails to take appropriate steps to respond to the complaint,
(b) fails to provide the complainant with information about progress on the complaint, or of the outcome of the complaint, before the end of the period of 3 months beginning when the Commission received the complaint, or
(c) if the Commission's consideration of the complaint is not concluded during that period, fails to provide the complainant with such information during a subsequent period of 3 months.
(2) The Tribunal may, on an application by the data subject, make an order requiring the Commission—
(a) to take appropriate steps to respond to the complaint, or
(b) to inform the complainant of progress on the complaint, or of the outcome of the complaint, within a period specified in the order.
(3) An order under subsection (2)(a) may require the Commission—
(a) to take steps specified in the order;
(b) to conclude an investigation, or take a specified step, within a period specified in the order.
(4) Section 165(5) applies for the purposes of subsections (1)(a) and (2)(a) as it applies for the purposes of section 165(4)(a).
(1) This section applies if, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation in contravention of that legislation.
(2) A court may make an order for the purposes of securing compliance with the data protection legislation which requires the controller in respect of the processing, or a processor acting on behalf of that controller—
(a) to take steps specified in the order, or
(b) to refrain from taking steps specified in the order.
(3) The order may, in relation to each step, specify the time at which, or the period within which, it must be taken.
(4) In subsection (1)—
(a) the reference to an application by a data subject includes an application made in exercise of the right under Article 79(1) of the UK GDPR (right to an effective remedy against a controller or processor);
(b) the reference to the data protection legislation does not include Part 4 of this Act or regulations made under that Part.
(5) In relation to a joint controller in respect of the processing of personal data to which Part 3 applies whose responsibilities are determined in an arrangement under section 58, a court may only make an order under this section if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.
(1) In Article 82 of the UK GDPR (right to compensation for material or non-material damage), “non-material damage” includes distress.
(2) Subsection (3) applies where—
(a) in accordance with rules of court, proceedings under Article 82 of the UK GDPR are brought by a representative body on behalf of a person, and
(b) a court orders the payment of compensation.
(3) The court may make an order providing for the compensation to be paid on behalf of the person to—
(a) the representative body, or
(b) such other person as the court thinks fit.
169 Compensation for contravention of other data protection legislation
(1) A person who suffers damage by reason of a contravention of a requirement of the data protection legislation, other than the UK GDPR, is entitled to compensation for that damage from the controller or the processor, subject to subsections (2) and (3).
(2) Under subsection (1)—
(a) a controller involved in processing of personal data is liable for any damage caused by the processing, and
(b) a processor involved in processing of personal data is liable for damage caused by the processing only if the processor—
(i) has not complied with an obligation under the data protection legislation specifically directed at processors, or
(ii) has acted outside, or contrary to, the controller's lawful instructions.
(3) A controller or processor is not liable as described in subsection (2) if the controller or processor proves that the controller or processor is not in any way responsible for the event giving rise to the damage.
(4) A joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities are determined in an arrangement under section 58 or 104 is only liable as described in subsection (2) if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.
(5) In this section, “damage” includes financial loss and damage not involving financial loss, such as distress.
(1) It is an offence for a person knowingly or recklessly—
(a) to obtain or disclose personal data without the consent of the controller,
(b) to procure the disclosure of personal data to another person without the consent of the controller, or
(c) after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained.
(2) It is a defence for a person charged with an offence under subsection (1) to prove that the obtaining, disclosing, procuring or retaining—
(a) was necessary for the purposes of preventing , investigating or detecting crime,
(b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
(c) in the particular circumstances, was justified as being in the public interest.
(3) It is also a defence for a person charged with an offence under subsection (1) to prove that—
(a) the person acted in the reasonable belief that the person had a legal right to do the obtaining, disclosing, procuring or retaining,
(b) the person acted in the reasonable belief that the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it, or
(c) the person acted—
(i) for the special purposes,
(ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
(iii) in the reasonable belief that in the particular circumstances the obtaining, disclosing, procuring or retaining was justified as being in the public interest.
(4) It is an offence for a person to sell personal data if the person obtained the data in circumstances in which an offence under subsection (1) was committed.
(5) It is an offence for a person to offer to sell personal data if the person—
(a) has obtained the data in circumstances in which an offence under subsection (1) was committed, or
(b) subsequently obtains the data in such circumstances.
(6) For the purposes of subsection (5), an advertisement indicating that personal data is or may be for sale is an offer to sell the data.
(7) In this section—
(a) references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the UK GDPR or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);
(b) where there is more than one controller, such references are references to the consent of one or more of them.
171 Re-identification of de-identified personal data
(1) It is an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data.
(2) For the purposes of this section and section 172—
(a) personal data is “de-identified” if it has been processed in such a manner that it can no longer be attributed, without more, to a specific data subject;
(b) a person “re-identifies” information if the person takes steps which result in the information no longer being de-identified within the meaning of paragraph (a).
(3) It is a defence for a person charged with an offence under subsection (1) to prove that the re-identification—
(a) was necessary for the purposes of preventing , investigating or detecting crime,
(b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
(c) in the particular circumstances, was justified as being in the public interest.
(4) It is also a defence for a person charged with an offence under subsection (1) to prove that—
(a) the person acted in the reasonable belief that the person—
(i) is the data subject to whom the information relates,
(ii) had the consent of that data subject, or
(iii) would have had such consent if the data subject had known about the re-identification and the circumstances of it,
(b) the person acted in the reasonable belief that the person—
(i) is the controller responsible for de-identifying the personal data,
(ii) had the consent of that controller, or
(iii) would have had such consent if that controller had known about the re-identification and the circumstances of it,
(c) the person acted—
(i) for the special purposes,
(ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
(iii) in the reasonable belief that in the particular circumstances the re-identification was justified as being in the public interest, or
(d) the effectiveness testing conditions were met (see section 172).
(5) It is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified where the person does so—
(a) without the consent of the controller responsible for de-identifying the personal data, and
(b) in circumstances in which the re-identification was an offence under subsection (1).
(6) It is a defence for a person charged with an offence under subsection (5) to prove that the processing—
(a) was necessary for the purposes of preventing , investigating or detecting crime,
(b) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
(c) in the particular circumstances, was justified as being in the public interest.
(7) It is also a defence for a person charged with an offence under subsection (5) to prove that—
(a) the person acted in the reasonable belief that the processing was lawful,
(b) the person acted in the reasonable belief that the person—
(i) had the consent of the controller responsible for de-identifying the personal data, or
(ii) would have had such consent if that controller had known about the processing and the circumstances of it, or
(c) the person acted—
(i) for the special purposes,
(ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
(iii) in the reasonable belief that in the particular circumstances the processing was justified as being in the public interest.
(8) In this section—
(a) references to the consent of a controller do not include the consent of a person who is a controller by virtue of Article 28(10) of the UK GDPR or section 59(8) or 105(3) of this Act (processor to be treated as controller in certain circumstances);
(b) where there is more than one controller, such references are references to the consent of one or more of them.
(1) For the purposes of section 171, in relation to a person who re-identifies information that is de-identified personal data, “the effectiveness testing conditions” means the conditions in subsections (2) and (3).
(2) The first condition is that the person acted—
(a) with a view to testing the effectiveness of the de-identification of personal data,
(b) without intending to cause, or threaten to cause, damage or distress to a person, and
(c) in the reasonable belief that, in the particular circumstances, re-identifying the information was justified as being in the public interest.
(3) The second condition is that the person notified the Commission or the controller responsible for de-identifying the personal data about the re-identification—
(a) without undue delay, and
(b) where feasible, not later than 72 hours after becoming aware of it.
(4) Where there is more than one controller responsible for de-identifying personal data, the requirement in subsection (3) is satisfied if one or more of them is notified.
173 Alteration etc of personal data to prevent disclosure to data subject
(1) Subsection (3) applies where—
(a) a request has been made in exercise of a data subject access right, and
(b) the person making the request would have been entitled to receive information in response to that request.
(2) In this section, “data subject access right” means a right under—
(a) Article 15 of the UK GDPR (right of access by the data subject);
(b) Article 20 of the UK GDPR (right to data portability);
(c) section 45 of this Act (law enforcement processing: right of access by the data subject);
(d) section 94 of this Act (intelligence services processing: right of access by the data subject).
(3) It is an offence for a person listed in subsection (4) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of all or part of the information that the person making the request would have been entitled to receive.
(4) Those persons are—
(a) the controller, and
(b) a person who is employed by the controller, an officer of the controller or subject to the direction of the controller.
(5) It is a defence for a person charged with an offence under subsection (3) to prove that—
(a) the alteration, defacing, blocking, erasure, destruction or concealment of the information would have occurred in the absence of a request made in exercise of a data subject access right, or
(b) the person acted in the reasonable belief that the person making the request was not entitled to receive the information in response to the request.
(1) In this Part, “the special purposes” means one or more of the following—
(a) the purposes of journalism;
(b) academic purposes;
(c) artistic purposes;
(d) literary purposes.
(2) In this Part, “special purposes proceedings” means legal proceedings against a controller or processor which relate, wholly or partly, to personal data processed for the special purposes and which are—
(a) proceedings under section 167 (including proceedings on an application under Article 79 of the UK GDPR), or
(b) proceedings under Article 82 of the UK GDPR or section 169.
(3) The Commission may make a written determination, in relation to the processing of personal data, that—
(a) the personal data is not being processed only for the special purposes;
(b) the personal data is not being processed with a view to the publication by a person of journalistic, academic, artistic or literary material which has not previously been published by the controller.
(4) The Commission must give written notice of the determination to the controller and the processor.
(5) The notice must provide information about the rights of appeal under section 162.
(6) The determination does not take effect until one of the following conditions is satisfied—
(a) the period for the controller or the processor to appeal against the determination has ended without an appeal having been brought, or
(b) an appeal has been brought against the determination and—
(i) the appeal and any further appeal in relation to the determination has been decided or has otherwise ended, and
(ii) the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought.
175 Provision of assistance in special purposes proceedings
(1) An individual who is a party, or prospective party, to special purposes proceedings may apply to the Commission for assistance in those proceedings.
(2) As soon as reasonably practicable after receiving an application under subsection (1), the Commission must decide whether, and to what extent, to grant it.
(3) The Commission must not grant the application unless, in the Commission's opinion, the case involves a matter of substantial public importance.
(4) If the Commission decides not to provide assistance, the Commission must, as soon as reasonably practicable, notify the applicant of the decision, giving reasons for the decision.
(5) If the Commission decides to provide assistance, the Commission must—
(a) as soon as reasonably practicable, notify the applicant of the decision, stating the extent of the assistance to be provided, and
(b) secure that the person against whom the proceedings are, or are to be, brought is informed that the Commission is providing assistance.
(6) The assistance that may be provided by the Commission includes—
(a) paying costs in connection with the proceedings, and
(b) indemnifying the applicant in respect of liability to pay costs, expenses or damages in connection with the proceedings.
(7) In England and Wales or Northern Ireland, the recovery of expenses incurred by the Commission in providing an applicant with assistance under this section (as taxed or assessed in accordance with rules of court) is to constitute a first charge for the benefit of the Commission—
(a) on any costs which, by virtue of any judgment or order of the court, are payable to the applicant by any other person in respect of the matter in connection with which the assistance is provided, and
(b) on any sum payable to the applicant under a compromise or settlement arrived at in connection with that matter to avoid, or bring to an end, any proceedings.
(8) In Scotland, the recovery of such expenses (as taxed or assessed in accordance with rules of court) is to be paid to the Commission, in priority to other debts—
(a) out of any expenses which, by virtue of any judgment or order of the court, are payable to the applicant by any other person in respect of the matter in connection with which the assistance is provided, and
(b) out of any sum payable to the applicant under a compromise or settlement arrived at in connection with that matter to avoid, or bring to an end, any proceedings.
(1) In any special purposes proceedings before a court, if the controller or processor claims, or it appears to the court, that any personal data to which the proceedings relate—
(a) is being processed only for the special purposes,
(b) is being processed with a view to the publication by any person of journalistic, academic, artistic or literary material, and
(c) has not previously been published by the controller,
the court must stay or, in Scotland, sist the proceedings.
(2) In considering, for the purposes of subsection (1)(c), whether material has previously been published, publication in the immediately preceding 24 hours is to be ignored.
(3) Under subsection (1), the court must stay or sist the proceedings until either of the following conditions is met—
(a) a determination of the Commission under section 174 with respect to the personal data or the processing takes effect;
(b) where the proceedings were stayed or sisted on the making of a claim, the claim is withdrawn.
177 Guidance about how to seek redress against media organisations
(1) The Commission must produce and publish guidance about the steps that may be taken where an individual considers that a media organisation is failing or has failed to comply with the data protection legislation.
(2) In this section, “media organisation” means a body or other organisation whose activities consist of or include journalism.
(3) The guidance must include provision about relevant complaints procedures, including—
(a) who runs them,
(b) what can be complained about, and
(c) how to make a complaint.
(4) For the purposes of subsection (3), relevant complaints procedures include procedures for making complaints to the Commission, the Office of Communications, the British Broadcasting Corporation and other persons who produce or enforce codes of practice for media organisations.
(5) The guidance must also include provision about—
(a) the powers available to the Commission in relation to a failure to comply with the data protection legislation,
(b) when a claim in respect of such a failure may be made before a court and how to make such a claim,
(c) alternative dispute resolution procedures,
(d) the rights of bodies and other organisations to make complaints and claims on behalf of data subjects, and
(e) the Commission's power to provide assistance in special purpose proceedings.
(6) The Commission—
(a) may alter or replace the guidance, and
(b) must publish any altered or replacement guidance.
(7) The Commissioner must produce and publish the first guidance under this section before the end of the period of 1 year beginning when this Act is passed.
178 Review of processing of personal data for the purposes of journalism
(1) The Commission must—
(a) review the extent to which, during each review period, the processing of personal data for the purposes of journalism complied with—
(i) the data protection legislation, and
(ii) good practice in the processing of personal data for the purposes of journalism,
(b) prepare a report of the review, and
(c) submit the report to the Secretary of State.
(2) In this section—
“good practice in the processing of personal data for the purposes of journalism” has the same meaning as in section 124;
“review period” means—
the period of 4 years beginning with the day on which Chapter 2 of Part 2 of this Act comes into force, and
each subsequent period of 5 years beginning with the day after the day on which the previous review period ended.
(3) The Commission must start a review under this section, in respect of a review period, within the period of 6 months beginning when the review period ends.
(4) The Commission must submit the report of a review under this section to the Secretary of State—
(a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(b) ... before the end of the period of 12 months beginning when the Commission started the review.
(5) The report must include consideration of the extent of compliance (as described in subsection (1)(a)) in each part of the United Kingdom.
(6) The Secretary of State must—
(a) lay the report before Parliament, and
(b) send a copy of the report to—
(i) the Scottish Ministers,
(ii) the Welsh Ministers, and
(iii) the Executive Office in Northern Ireland.
(7) Schedule 17 makes further provision for the purposes of a review under this section.
179 Effectiveness of the media's dispute resolution procedures
(1) The Secretary of State must, before the end of each review period, lay before Parliament a report produced by the Secretary of State or an appropriate person on—
(a) the use of relevant alternative dispute resolution procedures, during that period, in cases involving a failure, or alleged failure, by a relevant media organisation to comply with the data protection legislation, and
(b) the effectiveness of those procedures in such cases.
(2) In this section—
“appropriate person” means a person who the Secretary of State considers has appropriate experience and skills to produce a report described in subsection (1);
“relevant alternative dispute resolution procedures” means alternative dispute resolution procedures provided by persons who produce or enforce codes of practice for relevant media organisations;
“relevant media organisation” means a body or other organisation whose activities consist of or include journalism, other than a broadcaster;
“review period” means—
the period of 3 years beginning when this Act is passed, and
each subsequent period of 3 years.
(3) The Secretary of State must send a copy of the report to—
(a) the Scottish Ministers,
(b) the Welsh Ministers, and
(c) the Executive Office in Northern Ireland.
(1) The jurisdiction conferred on a court by the provisions listed in subsection (2) is exercisable—
(a) in England and Wales, by the High Court or the county court,
(b) in Northern Ireland, by the High Court or a county court, and
(c) in Scotland, by the Court of Session or the sheriff,
subject to subsections (3) and (4).
(2) Those provisions are—
(a) section 145 (information orders);
(b) section 152 (enforcement notices and processing for the special purposes);
(c) section 156 (penalty notices and processing for the special purposes);
(d) section 167 and Article 79 of the UK GDPR (compliance orders);
(e) sections 168 and 169 and Article 82 of the UK GDPR (compensation).
(3) In relation to the processing of personal data to which Part 4 applies, the jurisdiction conferred by the provisions listed in subsection (2) is exercisable only by the High Court or, in Scotland, the Court of Session.
(4) In relation to an information notice which contains a statement under section 142(7), the jurisdiction conferred on a court by section 145 is exercisable only by the High Court or, in Scotland, the Court of Session.
(5) The jurisdiction conferred on a court by section 164 (applications in respect of urgent notices) is exercisable only by the High Court or, in Scotland, the Court of Session.
180A Procedure in connection with subject access requests
(1) This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under—
(a) Article 15 of the UK GDPR (right of access by the data subject);
(b) Article 20 of the UK GDPR (right to data portability);
(c) section 45 of this Act (law enforcement processing: right of access by the data subject);
(d) section 94 of this Act (intelligence services processing: right of access by the data subject).
(2) The court may require the controller to make available for inspection by the court so much of the information as is available to the controller.
(3) But, unless and until the question in subsection (1) has been determined in the data subject’s favour, the court may not require the information to be disclosed to the data subject or the data subject’s representatives, whether by discovery (or, in Scotland, recovery) or otherwise.
(4) Where the question in subsection (1) relates to a right under a provision listed in subsection (1)(a), (c) or (d), this section does not confer power on the court to require the controller to carry out a search for information that is more extensive than the reasonable and proportionate search required by that provision.
In this Part—
“assessment notice” has the meaning given in section 146;
“certification provider” has the meaning given in section 17;
“enforcement notice” has the meaning given in section 149;
“information notice” has the meaning given in section 142;
“interview notice” has the meaning given in section 148A;
“penalty notice” has the meaning given in section 155;
“penalty variation notice” has the meaning given in Schedule 16;
...
(1) Regulations under this Act are to be made by statutory instrument.
(2) Before making regulations under this Act, the Secretary of State must consult—
(a) the Commission, and
(b) such other persons as the Secretary of State considers appropriate.
(3) Subsection (2) does not apply to regulations made under—
(a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(b) section 30;
(c) section 211;
(d) section 212;
(e) section 213;
(f) paragraph 15 of Schedule 2.
(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(5) Regulations under this Act may—
(a) make different provision for different purposes;
(b) include consequential, supplementary, incidental, transitional, transitory or saving provision.
(6) For the purposes of this Act, where regulations are subject to “the negative resolution procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
(7) For the purposes of this Act, where regulations are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.
(8) For the purposes of this Act, regulations are subject to “the made affirmative resolution procedure” if—
(a) the statutory instrument containing the regulations must be laid before Parliament after being made, together with an urgency statement in respect of them, and
(b) the regulations cease to have effect at the end of a period beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament.
(9) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(10) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(11) Any provision that may be included in regulations under this Act subject to the negative resolution procedure may be made by regulations made under this Act or another enactment that are subject to the affirmative resolution procedure or the made affirmative resolution procedure.
(12) If a draft of a statutory instrument containing regulations under section 7 would, apart from this subsection, be treated for the purposes of the standing orders of either House of Parliament as a hybrid instrument, it is to proceed in that House as if it were not such an instrument.
(13) A requirement under a provision of this Act to consult may be satisfied by consultation before, as well as by consultation after, the provision comes into force.
(14) For the purposes of this section, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for regulations to come into force without delay.
183 Power to reflect changes to the Data Protection Convention
(1) The Secretary of State may by regulations make such provision as the Secretary of State considers necessary or appropriate in connection with an amendment of, or an instrument replacing, the Data Protection Convention which has effect, or is expected to have effect, in the United Kingdom.
(2) The power under subsection (1) includes power—
(a) to amend or replace the definition of “the Data Protection Convention” in section 3;
(b) to amend Chapter 3 of Part 2 of this Act;
(c) to amend Part 4 of this Act;
(d) to make provision about the functions of the Commission, courts or tribunals in connection with relevant processing of personal data, including provision amending Parts 5 to 7 of this Act;
(e) to make provision about the functions of the Commission in connection with the Data Protection Convention or an instrument replacing that Convention, including provision amending Parts 5 to 7 of this Act;
(f) to consequentially amend this Act.
(2A) In subsection (2)(d), “relevant processing of personal data” means—
(a) processing of personal data described in Article 2(1)(a) or (b) or (1A) of the UK GDPR, and
(b) processing of personal data to which Part 4 of this Act applies.
(3) Regulations under this section are subject to the affirmative resolution procedure.
(4) Regulations under this section may not be made after the end of the period of 3 years beginning with the day on which this Act is passed.
183A Protection of prohibitions and restrictions etc on processing: relevant enactments
(1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main data protection legislation relating to the processing of personal data.
(2) Subsection (1) does not apply—
(a) to a relevant enactment forming part of the main data protection legislation, or
(b) to the extent that an enactment makes express provision to the contrary referring to this section or to the main data protection legislation (or a provision of that legislation).
(3) Subsection (1) does not prevent a duty or power to process personal data from being taken into account for the purpose of determining whether it is possible to rely on an exception to a requirement under the main data protection legislation that is available where there is such a duty or power.
(4) In this section—
“the main data protection legislation” means the data protection legislation other than provision of or made under—
Chapter 6 or 8 of the UK GDPR, or
Parts 5 to 7 of this Act;
“relevant enactment” means an enactment so far as passed or made on or after 20th August 2025;
“requirement” includes a prohibition or restriction.
(5) The reference in subsection (1) to an enactment or rule of law which imposes a duty, or confers a power, to process personal data is a reference to an enactment or rule of law which, directly or indirectly, requires or authorises the processing of personal data, including (for example)—
(a) by authorising one person to require another person to process personal data, or
(b) by removing restrictions on processing personal data,
and the references in subsection (3) to a duty or power are to be read accordingly.
183B Protection of prohibitions and restrictions etc on processing: other enactments
(1) This section is about the relationship between—
(a) a pre-commencement enactment which imposes a duty, or confers a power, to process personal data, and
(b) a provision of the main data protection legislation containing a requirement relating to the processing of personal data.
(2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).
(3) Where the provision described in subsection (1)(b) is a provision of, or made under, the UK GDPR, section 5(A2) of the European Union (Withdrawal) Act 2018 (assimilated direct legislation subject to domestic enactments) does not apply to the relationship.
(4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision with similar effect to section 183A(1) (or applying that provision) is made in connection with one such relationship but not another.
(5) In this section—
(a) “the main data protection legislation” and “requirement” have the same meaning as in section 183A, and
(b) “pre-commencement enactment” means an enactment so far as passed or made before 20th August 2025.
(6) Section 183A(5) applies for the purposes of subsection (1)(a) of this section as it applies for the purposes of section 183A(1).
184 Prohibition of requirement to produce relevant records
(1) It is an offence for a person (“P1”) to require another person to provide P1 with, or give P1 access to, a relevant record in connection with—
(a) the recruitment of an employee by P1,
(b) the continued employment of a person by P1, or
(c) a contract for the provision of services to P1.
(2) It is an offence for a person (“P2”) to require another person to provide P2 with, or give P2 access to, a relevant record if—
(a) P2 is involved in the provision of goods, facilities or services to the public or a section of the public, and
(b) the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or to a third party.
(3) It is a defence for a person charged with an offence under subsection (1) or (2) to prove that imposing the requirement—
(a) was required or authorised by an enactment, by a rule of law or by the order of a court or tribunal, or
(b) in the particular circumstances, was justified as being in the public interest.
(4) The imposition of the requirement referred to in subsection (1) or (2) is not to be regarded as justified as being in the public interest on the ground that it would assist in the prevention , investigation or detection of crime, given —
(a) Part 5 of the Police Act 1997 (certificates of criminal records etc), and
(b) Part 1 of the Disclosure (Scotland) Act 2020 (disclosure of criminal history and other information).
(5) In subsections (1) and (2), the references to a person who requires another person to provide or give access to a relevant record include a person who asks another person to do so—
(a) knowing that, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request, or
(b) being reckless as to whether, in the circumstances, it would be reasonable for the other person to feel obliged to comply with the request,
and the references to a “requirement” in subsections (3) and (4) are to be interpreted accordingly.
(6) In this section—
“employment” means any employment, including—
work under a contract for services or as an office-holder,
work under an apprenticeship,
work experience as part of a training course or in the course of training for employment, and
voluntary work,
and “employee” is to be interpreted accordingly;
“relevant record” has the meaning given in Schedule 18 and references to a relevant record include—
a part of such a record, and
a copy of, or of part of, such a record.
185 Avoidance of certain contractual terms relating to health records
(1) A term or condition of a contract is void in so far as it purports to require an individual to supply another person with a record which—
(a) consists of the information contained in a health record, and
(b) has been or is to be obtained by a data subject in the exercise of a data subject access right.
(2) A term or condition of a contract is also void in so far as it purports to require an individual to produce such a record to another person.
(3) The references in subsections (1) and (2) to a record include a part of a record and a copy of all or part of a record.
(4) In this section, “data subject access right” means a right under—
(a) Article 15 of the UK GDPR (right of access by the data subject);
(b) Article 20 of the UK GDPR (right to data portability);
(c) section 45 of this Act (law enforcement processing: right of access by the data subject);
(d) section 94 of this Act (intelligence services processing: right of access by the data subject).
(1) An enactment or rule of law prohibiting or restricting the disclosure of information, or authorising the withholding of information, does not remove or restrict the obligations and rights provided for in the provisions listed in subsection (2) ....
(2) The provisions providing obligations and rights are—
(a) Chapter III of the UK GDPR (rights of the data subject),
(b) Chapter 3 of Part 3 of this Act (law enforcement processing: rights of the data subject), and
(c) Chapter 3 of Part 4 of this Act (intelligence services processing: rights of the data subject).
(2A) Subsection (1) does not apply—
(a) to an enactment contained in, or made under, a provision listed in subsection (2),
(b) to an enactment contained in, or made under, a provision listed in subsection (3),
(c) to the extent that an enactment makes express provision to the contrary referring to this section or to a provision listed in subsection (2), or
(d) to the extent that subsection (1) is disapplied by section 186A(3).
(3) The provisions referred to in subsection (2A)(b) are—
(a) in Chapter 2 of Part 2 of this Act, sections 15 and 16 and Schedules 2, 3 and 4,
(b) in Chapter 3 of Part 2 of this Act, sections ... 24, 25 and 26,
(c) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(ca) in Part 3 of this Act, section 78A, and
(d) in Part 4 of this Act, Chapter 6 .
186A Protection of data subject’s rights: further provision
(1) This section is about the relationship between—
(a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises the withholding of information, and
(b) a provision of the UK GDPR or this Act listed in section 186(2).
(2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).
(3) Subsection (1) of section 186 does not apply to the relationship so far as there is a contrary intention, whether express or implied (taking account of, among other things, subsection (2) of this section).
(4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision stating that section 186(1) applies (or with similar effect) is made in connection with one such relationship but not another.
(5) In this section, “pre-commencement enactment” means an enactment so far as passed or made before 20th August 2025, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).
187 Representation of data subjects with their authority
(1) In relation to the processing of personal data to which the UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects)—
(a) ... enables a data subject to authorise a body or other organisation which meets the conditions set out in subsections (3) and (4) to exercise the data subject's rights under sections 164A and 165 (complaints) and Articles 78 and 79 of the UK GDPR (rights ... to an effective judicial remedy) on the data subject's behalf, and
(b) also authorises such a body or organisation to exercise the data subject's rights under Article 82 of the UK GDPR (right to compensation).
(2) In relation to the processing of personal data to which the UK GDPR does not apply, a body or other organisation which meets the conditions in subsections (3) and (4), if authorised to do so by a data subject, may exercise some or all of the following rights of a data subject on the data subject's behalf—
(za) the right under section 164A (complaints to the controller);
(a) rights under section 165 (complaints to the Commission);
(b) rights under section 166(2) (orders for the Commission to progress complaints);
(c) rights under section 167(1) (compliance orders);
(d) the right to bring judicial review proceedings against the Commission.
(3) The first condition is that the body or organisation, by virtue of its constitution or an enactment—
(a) is required (after payment of outgoings) to apply the whole of its income and any capital it expends for charitable or public purposes,
(b) is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes), and
(c) has objectives which are in the public interest.
(4) The second condition is that the body or organisation is active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data.
(5) In this Act, references to a “representative body”, in relation to a right of a data subject, are to a body or other organisation authorised to exercise the right on the data subject's behalf under Article 80 of the UK GDPR or this section.
188 Representation of data subjects with their authority: collective proceedings
(1) The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a court or tribunal in England and Wales or Northern Ireland combining two or more relevant claims.
(2) In this section, “relevant claim”, in relation to a representative body, means a claim in respect of a right of a data subject which the representative body is authorised to exercise on the data subject's behalf under Article 80(1) of the UK GDPR or section 187.
(3) The power under subsection (1) includes power—
(a) to make provision about the proceedings;
(b) to confer functions on a person, including functions involving the exercise of a discretion;
(c) to make different provision in relation to England and Wales and in relation to Northern Ireland.
(4) The provision mentioned in subsection (3)(a) includes provision about—
(a) the effect of judgments and orders;
(b) agreements to settle claims;
(c) the assessment of the amount of compensation;
(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;
(e) costs.
(5) Regulations under this section are subject to the negative resolution procedure.
189 Duty to review provision for representation of data subjects
(1) Before the end of the review period, the Secretary of State must—
(a) review the matters listed in subsection (2) in relation to England and Wales and Northern Ireland,
(b) prepare a report of the review, and
(c) lay a copy of the report before Parliament.
(2) Those matters are—
(a) the operation of Article 80(1) of the UK GDPR,
(b) the operation of section 187,
(c) the merits of exercising the power under Article 80(2) of the UK GDPR (power to enable a body or other organisation which meets the conditions in Article 80(1) of the UK GDPR to exercise some or all of a data subject's rights under Articles 77, 78 and 79 of the UK GDPR without being authorised to do so by the data subject),
(d) the merits of making equivalent provision in relation to data subjects' rights under Article 82 of the UK GDPR (right to compensation), and
(e) the merits of making provision for a children's rights organisation to exercise some or all of a data subject's rights under Articles 77, 78, 79 and 82 of the UK GDPR on behalf of a data subject who is a child, with or without being authorised to do so by the data subject.
(3) “The review period” is the period of 30 months beginning when section 187 comes into force.
(4) In carrying out the review, the Secretary of State must—
(a) consider the particular needs of children separately from the needs of adults,
(b) have regard to the fact that children have different needs at different stages of development,
(c) carry out an analysis of the particular challenges that children face in authorising, and deciding whether to authorise, other persons to act on their behalf under Article 80(1) of the UK GDPR or section 187,
(d) consider the support and advice available to children in connection with the exercise of their rights under Articles 77, 78, 79 and 82 of the UK GDPR by another person on their behalf and the merits of making available other support or advice, and
(e) have regard to the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.
(5) Before preparing the report under subsection (1), the Secretary of State must consult the Commission and such other persons as the Secretary of State considers appropriate, including—
(a) persons active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data,
(b) children and parents,
(c) children's rights organisations and other persons who appear to the Secretary of State to represent the interests of children,
(d) child development experts, and
(e) trade associations.
(6) In this section—
“children's rights organisation” means a body or other organisation which—
is active in representing the interests of children, and
has objectives which are in the public interest;
“trade association” includes a body representing controllers or processors;
“the United Nations Convention on the Rights of the Child” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.
190 Post-review powers to make provision about representation of data subjects
(1) After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations—
(a) exercise the powers under Article 80(2) of the UK GDPR in relation to England and Wales and Northern Ireland,
(b) make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the UK GDPR to exercise a data subject's rights under Article 82 of the UK GDPR in England and Wales and Northern Ireland without being authorised to do so by the data subject, and
(c) make provision described in section 189(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.
(2) The powers under subsection (1) include power—
(a) to make provision enabling a data subject to prevent a body or other organisation from exercising, or continuing to exercise, the data subject's rights;
(b) to make provision about proceedings before a court or tribunal where a body or organisation exercises a data subject's rights;
(c) to make provision for bodies or other organisations to bring proceedings before a court or tribunal combining two or more claims in respect of a right of a data subject;
(d) to confer functions on a person, including functions involving the exercise of a discretion;
(e) to amend sections 166 to 168, 180, 187, 203, 205 and 206;
(f) to insert new sections and Schedules into Part 6 or 7 ;
(g) to make different provision in relation to England and Wales and in relation to Northern Ireland.
(3) The powers under subsection (1)(a) and (b) include power to make provision in relation to data subjects who are children or data subjects who are not children or both.
(4) The provision mentioned in subsection (2)(b) and (c) includes provision about—
(a) the effect of judgments and orders;
(b) agreements to settle claims;
(c) the assessment of the amount of compensation;
(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;
(e) costs.
(5) Regulations under this section are subject to the affirmative resolution procedure.
(1) The Secretary of State may prepare a document, called the Framework for Data Processing by Government, which contains guidance about the processing of personal data in connection with the exercise of functions of—
(a) the Crown, a Minister of the Crown or a United Kingdom government department, and
(b) a person with functions of a public nature who is specified or described in regulations made by the Secretary of State.
(2) The document may make provision relating to all of those functions or only to particular functions or persons.
(3) The document may not make provision relating to, or to the functions of, a part of the Scottish Administration, the Welsh Government, a Northern Ireland Minister or a Northern Ireland department.
(4) The Secretary of State may from time to time prepare amendments of the document or a replacement document.
(5) Before preparing a document or amendments under this section, the Secretary of State must consult—
(a) the Commission, and
(b) any other person the Secretary of State considers it appropriate to consult.
(6) Regulations under subsection (1)(b) are subject to the negative resolution procedure.
(7) In this section, “Northern Ireland Minister” includes the First Minister and deputy First Minister in Northern Ireland.
(1) Before issuing a document prepared under section 191, the Secretary of State must lay it before Parliament.
(2) If, within the 40-day period, either House of Parliament resolves not to approve the document, the Secretary of State must not issue it.
(3) If no such resolution is made within that period—
(a) the Secretary of State must issue the document, and
(b) the document comes into force at the end of the period of 21 days beginning with the day on which it is issued.
(4) Nothing in subsection (2) prevents another version of the document being laid before Parliament.
(5) In this section, “the 40-day period” means—
(a) if the document is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or
(b) if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days.
(6) In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days.
(7) This section applies in relation to amendments prepared under section 191 as it applies in relation to a document prepared under that section.
(1) The Secretary of State must publish a document issued under section 192(3).
(2) Where an amendment of a document is issued under section 192(3), the Secretary of State must publish—
(a) the amendment, or
(b) the document as amended by it.
(3) The Secretary of State must keep under review the document issued under section 192(3) for the time being in force.
(4) Where the Secretary of State becomes aware that the terms of such a document could result in a breach of an international obligation of the United Kingdom, the Secretary of State must exercise the power under section 191(4) with a view to remedying the situation.