(1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.
(2) The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—
(a) the data subject has given consent to the processing for that purpose, or
(b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority.
(3) In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in subsections (4) and (5).
(4) The first case is where—
(a) the data subject has given consent to the processing for the law enforcement purpose as mentioned in subsection (2)(a), and
(b) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).
(5) The second case is where—
(a) the processing is strictly necessary for the law enforcement purpose,
(b) the processing meets at least one of the conditions in Schedule 8, and
(c) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42).
(6) The Secretary of State may by regulations amend Schedule 8—
(a) by adding conditions;
(b) by varying or omitting conditions added by regulations under paragraph (a).
(7) Regulations under subsection (6) are subject to the affirmative resolution procedure.
(8) In this Part, “sensitive processing” means—
(a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
(b) the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual;
(c) the processing of data concerning health;
(d) the processing of data concerning an individual's sex life or sexual orientation.
(1) The second data protection principle is that—
(a) the law enforcement purpose for which personal data is collected (whether from the data subject or otherwise) must be specified, explicit and legitimate, and
(b) personal data so collected must not be processed by or on behalf of a controller in a manner that is incompatible with the purpose for which the controller collected it.
(2) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4).
(3) Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that—
(a) the controller is authorised by law to process the data for the other purpose, and
(b) the processing is necessary and proportionate to that other purpose.
(4) Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.
The third data protection principle is that personal data processed for any of the law enforcement purposes must be adequate, relevant and not excessive in relation to the purpose for which it is processed.
(1) The fourth data protection principle is that—
(a) personal data processed for any of the law enforcement purposes must be accurate and, where necessary, kept up to date, and
(b) every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the law enforcement purpose for which it is processed, is erased or rectified without delay.
(2) In processing personal data for any of the law enforcement purposes, personal data based on facts must, so far as possible, be distinguished from personal data based on personal assessments.
(3) In processing personal data for any of the law enforcement purposes, a clear distinction must, where relevant and as far as possible, be made between personal data relating to different categories of data subject, such as—
(a) persons suspected of having committed or being about to commit a criminal offence;
(b) persons convicted of a criminal offence;
(c) persons who are or may be victims of a criminal offence;
(d) witnesses or other persons with information about offences.
(4) All reasonable steps must be taken to ensure that personal data which is inaccurate, incomplete or no longer up to date is not transmitted or made available for any of the law enforcement purposes.
(5) For that purpose—
(a) the quality of personal data must be verified before it is transmitted or made available,
(b) in all transmissions of personal data, the necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of the data and the extent to which it is up to date must be included, and
(c) if, after personal data has been transmitted, it emerges that the data was incorrect or that the transmission was unlawful, the recipient must be notified without delay.
(1) The fifth data protection principle is that personal data processed for any of the law enforcement purposes must be kept for no longer than is necessary for the purpose for which it is processed.
(2) Appropriate time limits must be established for the periodic review of the need for the continued storage of personal data for any of the law enforcement purposes.
The sixth data protection principle is that personal data processed for any of the law enforcement purposes must be so processed in a manner that ensures appropriate security of the personal data, using appropriate technical or organisational measures (and, in this principle, “appropriate security” includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage).
(1) This section is about processing of personal data that is carried out in reliance on the consent of the data subject.
(2) The controller must be able to demonstrate that the data subject consented to the processing.
(3) If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made—
(a) in a manner which clearly distinguishes the request from the other matters,
(b) in an intelligible and easily accessible form, and
(c) in clear and plain language.
(4) Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding.
(5) The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal).
(6) Processing may only be carried out in reliance on consent if—
(a) before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and
(b) it is as easy for the data subject to withdraw the consent as to give it.
(7) When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service.
(1) This section applies in relation to the processing of personal data for a law enforcement purpose where the processing is carried out—
(a) for archiving purposes in the public interest,
(b) for scientific or historical research purposes, or
(c) for statistical purposes.
(2) The processing is not permitted if—
(a) it is carried out for the purposes of, or in connection with, measures or decisions with respect to a particular data subject, or
(b) it is likely to cause substantial damage or substantial distress to a data subject.
(1) This section applies for the purposes of section 35(4) and (5) (which require a controller to have an appropriate policy document in place when carrying out sensitive processing in reliance on the consent of the data subject or, as the case may be, in reliance on a condition specified in Schedule 8).
(2) The controller has an appropriate policy document in place in relation to the sensitive processing if the controller has produced a document which—
(a) explains the controller's procedures for securing compliance with the data protection principles (see section 34(1)) in connection with sensitive processing in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, and
(b) explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, giving an indication of how long such personal data is likely to be retained.
(3) Where personal data is processed on the basis that an appropriate policy document is in place, the controller must during the relevant period—
(a) retain the appropriate policy document,
(b) review and (if appropriate) update it from time to time, and
(c) make it available to the Commission, on request, without charge.
(4) The record maintained by the controller under section 61(1) and, where the sensitive processing is carried out by a processor on behalf of the controller, the record maintained by the processor under section 61(3) must include the following information—
(a) whether the sensitive processing is carried out in reliance on the consent of the data subject or, if not, which condition in Schedule 8 is relied on,
(b) how the processing satisfies section 35 (lawfulness of processing), and
(c) whether the personal data is retained and erased in accordance with the policies described in subsection (2)(b) and, if it is not, the reasons for not following those policies.
(5) In this section, “relevant period”, in relation to sensitive processing in reliance on the consent of the data subject or in reliance on a condition specified in Schedule 8, means a period which—
(a) begins when the controller starts to carry out the sensitive processing in reliance on the data subject's consent or (as the case may be) in reliance on that condition, and
(b) ends at the end of the period of 6 months beginning when the controller ceases to carry out the processing.
(1) The Secretary of State may by regulations—
(a) make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,
(b) make provision so that added processing is not sensitive processing for the purposes of this Part,
(c) make provision so that a protected condition in Schedule 8 may or may not be relied on in connection with added processing, and
(d) make provision varying such a condition as it relates to added processing.
(2) In subsection (1)—
“added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);
“protected condition in Schedule 8” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).
(3) Regulations under this section may amend this Part and sections 205 and 206.
(4) Regulations under this section are subject to the affirmative resolution procedure.
(1) This Chapter—
(a) imposes general duties on the controller to make information available (see sections 44 and 45A);
(b) confers a right of access by the data subject (see sections 45 and 45A);
(c) confers rights on the data subject with respect to the rectification of personal data and the erasure of personal data or the restriction of its processing (see sections 46 to 48);
(d) regulates automated decision-making (see sections 50A to 50D);
(e) makes supplementary provision (see sections 51 to 54).
(2) This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.
(3) But sections 44 to 48 do not apply in relation to the processing of relevant personal data in the course of a criminal investigation or criminal proceedings, including proceedings for the purpose of executing a criminal penalty.
(4) In subsection (3), “relevant personal data” means personal data contained in a judicial decision or in other documents relating to the investigation or proceedings which are created by or on behalf of a court or other judicial authority.
(5) In this Chapter, “the controller”, in relation to a data subject, means the controller in relation to personal data relating to the data subject.
(1) The controller must make available to data subjects the following information (whether by making the information generally available to the public or in any other way)—
(a) the identity and the contact details of the controller;
(b) where applicable, the contact details of the data protection officer (see sections 69 to 71);
(c) the purposes for which the controller processes personal data;
(d) the existence of the rights of data subjects to request from the controller—
(i) access to personal data (see section 45),
(ii) rectification of personal data (see section 46), and
(iii) erasure of personal data or the restriction of its processing (see section 47);
(da) the existence of the right to make a complaint to the controller (see section 164A);
(e) the existence of the right to lodge a complaint with the Commission (see section 165) and the contact details of the Commission.
(2) The controller must also, in specific cases for the purpose of enabling the exercise of a data subject's rights under this Part, give the data subject the following—
(a) information about the legal basis for the processing;
(b) information about the period for which the personal data will be stored or, where that is not possible, about the criteria used to determine that period;
(c) where applicable, information about the categories of recipients of the personal data (including recipients in third countries or international organisations);
(d) such further information as is necessary to enable the exercise of the data subject's rights under this Part.
(3) An example of where further information may be necessary as mentioned in subsection (2)(d) is where the personal data being processed was collected without the knowledge of the data subject.
(4) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (2) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
(a) avoid obstructing an official or legal inquiry, investigation or procedure;
(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
(c) protect public security;
(d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(e) protect the rights and freedoms of others.
(5) Where the provision of information to a data subject under subsection (2) is restricted under subsection (4), wholly or partly, the controller must inform the data subject in writing without undue delay—
(a) that the provision of information has been restricted,
(b) of the reasons for the restriction,
(c) of the data subject's right to make a request to the Commission under section 51,
(ca) of the data subject’s right to make a complaint to the controller under section 164A,
(d) of the data subject's right to lodge a complaint with the Commission under section 165, and
(e) of the data subject's right to apply to a court under section 167.
(6) Subsection (5)(a) and (b) do not apply to the extent that complying with them would undermine the purpose of the restriction.
(7) The controller must—
(a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (2) in reliance on subsection (4), and
(b) if requested to do so by the Commission, make the record available to the Commission.
(1) A data subject is entitled to obtain from the controller—
(a) confirmation as to whether or not personal data concerning him or her is being processed, and
(b) where that is the case, access to the personal data and the information set out in subsection (2).
(2) That information is—
(a) the purposes of and legal basis for the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipients to whom the personal data has been disclosed (including recipients or categories of recipients in third countries or international organisations);
(d) the period for which it is envisaged that the personal data will be stored or, where that is not possible, the criteria used to determine that period;
(e) the existence of the data subject's rights to request from the controller—
(i) rectification of personal data (see section 46), and
(ii) erasure of personal data or the restriction of its processing (see section 47);
(ea) the existence of the data subject’s right to make a complaint to the controller (see section 164A);
(f) the existence of the data subject's right to lodge a complaint with the Commission (see section 165) and the contact details of the Commission;
(g) communication of the personal data undergoing processing and of any available information as to its origin.
(2A) Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.
(3) Where a data subject makes a request under subsection (1), the information to which the data subject is entitled must be provided in writing —
(a) without undue delay, and
(b) in any event, before the end of the applicable time period (as to which see section 54).
(4) The controller may restrict, wholly or partly, the rights conferred by subsection (1) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
(a) avoid obstructing an official or legal inquiry, investigation or procedure;
(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
(c) protect public security;
(d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(e) protect the rights and freedoms of others.
(5) Where the rights of a data subject under subsection (1) are restricted under subsection (4), wholly or partly, the controller must inform the data subject in writing without undue delay and in any event before the end of the applicable time period (as to which see section 54)—
(a) that the rights of the data subject have been restricted,
(b) of the reasons for the restriction,
(c) of the data subject's right to make a request to the Commission under section 51,
(ca) of the data subject’s right to make a complaint to the controller under section 164A,
(d) of the data subject's right to lodge a complaint with the Commission under section 165, and
(e) of the data subject's right to apply to a court under section 167.
(6) Subsection (5)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.
(7) The controller must—
(a) record the reasons for a decision to restrict (whether wholly or partly) the rights of a data subject under subsection (1) in reliance on subsection (4), and
(b) if requested to do so by the Commission, make the record available to the Commission.
45A Exemption from sections 44 and 45: legal professional privilege
(1) Sections 44(2) and 45(1) do not require the controller to give the data subject—
(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or
(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.
(2) A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—
(a) the decision to rely on the exemption,
(b) the reason for the decision,
(c) the data subject’s right to make a request to the Commission under section 51,
(ca) the data subject’s right to make a complaint to the controller under section 164A,
(d) the data subject’s right to lodge a complaint with the Commission under section 165, and
(e) the data subject’s right to apply to a court under section 167.
(3) Subsection (2)(a) and (b) do not apply to the extent that complying with them would—
(a) undermine a claim described in subsection (1)(a), or
(b) conflict with a duty described in subsection (1)(b).
(4) The controller must—
(a) record the reason for a decision to rely on the exemption in subsection (1), and
(b) if requested to do so by the Commission, make the record available to the Commission.
(5) The reference in subsection (1) to sections 44(2) and 45(1) includes sections 35 to 40 so far as their provisions correspond to the rights and obligations provided for in sections 44(2) and 45(1).
(1) The controller must, if so requested by a data subject, rectify without undue delay inaccurate personal data relating to the data subject.
(2) Where personal data is inaccurate because it is incomplete, the controller must, if so requested by a data subject, complete it.
(3) The duty under subsection (2) may, in appropriate cases, be fulfilled by the provision of a supplementary statement.
(4) Where the controller would be required to rectify personal data under this section but the personal data must be maintained for the purposes of evidence, the controller must (instead of rectifying the personal data) restrict its processing.
(1) The controller must erase personal data without undue delay where—
(a) the processing of the personal data would infringe section 35, 36(1) to (3), 37, 38(1), 39(1), 40, 41 or 42, or
(b) the controller has a legal obligation to erase the data.
(2) Where the controller would be required to erase personal data under subsection (1) but the personal data must be maintained for the purposes of evidence, the controller must (instead of erasing the personal data) restrict its processing.
(3) Where a data subject contests the accuracy of personal data (whether in making a request under this section or section 46 or in any other way), but it is not possible to ascertain whether it is accurate or not, the controller must restrict its processing.
(4) A data subject may request the controller to erase personal data or to restrict its processing (but the duties of the controller under this section apply whether or not such a request is made).
(1) Where a data subject requests the rectification or erasure of personal data or the restriction of its processing, the controller must inform the data subject in writing—
(a) whether the request has been granted, and
(b) if it has been refused—
(i) of the reasons for the refusal,
(ii) of the data subject's right to make a request to the Commission under section 51,
(iia) of the data subject’s right to make a complaint to the controller under section 164A,
(iii) of the data subject's right to lodge a complaint with the Commission under section 165, and
(iv) of the data subject's right to apply to a court under section 167.
(2) The controller must comply with the duty under subsection (1)—
(a) without undue delay, and
(b) in any event, before the end of the applicable time period (see section 54).
(3) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1)(b)(i) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and proportionate measure to—
(a) avoid obstructing an official or legal inquiry, investigation or procedure;
(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
(c) protect public security;
(d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(e) protect the rights and freedoms of others.
(4) Where the rights of a data subject under subsection (1)(b)(i) are restricted under subsection (3), wholly or partly, the controller must inform the data subject in writing without undue delay—
(a) that the rights of the data subject have been restricted,
(b) of the reasons for the restriction,
(ba) of the data subject’s right to make a complaint to the controller under section 164A,
(c) of the data subject's right to lodge a complaint with the Commission under section 165, and
(d) of the data subject's right to apply to a court under section 167.
(5) Subsection (4)(a) and (b) do not apply to the extent that the provision of the information would undermine the purpose of the restriction.
(6) The controller must—
(a) record the reasons for a decision to restrict (whether wholly or partly) the provision of information to a data subject under subsection (1)(b)(i) in reliance on subsection (3), and
(b) if requested to do so by the Commission, make the record available to the Commission.
(7) Where the controller rectifies personal data, it must notify the competent authority (if any) from which the inaccurate personal data originated.
(8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(9) Where the controller rectifies, erases or restricts the processing of personal data which has been disclosed by the controller—
(a) the controller must notify the recipients, and
(b) the recipients must similarly rectify, erase or restrict the processing of the personal data (so far as they retain responsibility for it).
(10) Where processing is restricted in accordance with section 47(3), the controller must inform the data subject before lifting the restriction.
50A Automated processing and significant decisions
(1) For the purposes of sections 50B and 50C—
(a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and
(b) a decision is a significant decision, in relation to a data subject, if—
(i) it produces an adverse legal effect for the data subject, or
(ii) it has a similarly significant adverse effect for the data subject.
(2) When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.
50B Restrictions on automated decision-making based on sensitive processing
(1) A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met.
(2) The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.
(3) The second condition is that the decision is required or authorised by law.
(1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—
(a) based entirely or partly on personal data, and
(b) based solely on automated processing,
the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).
(2) The safeguards must consist of or include measures which—
(a) provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;
(b) enable the data subject to make representations about such decisions;
(c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;
(d) enable the data subject to contest such decisions.
(3) Subsections (1) and (2) do not apply in relation to a significant decision if—
(a) exemption from those provisions is required for a reason listed in subsection (4),
(b) the controller reconsiders the decision as soon as reasonably practicable, and
(c) there is meaningful human involvement in the reconsideration of the decision.
(4) Those reasons are—
(a) to avoid obstructing an official or legal inquiry, investigation or procedure;
(b) to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
(c) to protect public security;
(d) to safeguard national security;
(e) to protect the rights and freedoms of others.
(5) When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.
50D Further provision about automated decision-making
(1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations.
(2) The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject.
(3) Regulations under subsection (1) or (2) may amend section 50A.
(4) The Secretary of State may by regulations make the following types of provision about the safeguards required under section 50C(1)—
(a) provision requiring the safeguards to include measures in addition to those described in section 50C(2),
(b) provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and
(c) provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2).
(5) Regulations under this section are subject to the affirmative resolution procedure.
(1) This section applies where a controller—
(a) restricts under section 44(4) the information provided to the data subject under section 44(2) (duty of the controller to give the data subject additional information),
(b) restricts under section 45(4) the data subject's rights under section 45(1) (right of access),
(ba) relies on the exemption from sections 44(2) and 45(1) in section 45A (legal professional privilege), or
(c) refuses a request by the data subject for rectification under section 46 or for erasure or restriction of processing under section 47.
(2) The data subject may—
(a) where subsection (1)(a) or (b) applies, request the Commission to check that the restriction imposed by the controller was lawful;
(aa) where subsection (1)(ba) applies, request the Commission to check that the controller was entitled to rely on the exemption;
(b) where subsection (1)(c) applies, request the Commission to check that the refusal of the data subject's request was lawful.
(3) The Commission must take such steps as appear to the Commission to be appropriate to respond to a request under subsection (2) (which may include the exercise of any of the powers conferred by sections 142 and 146).
(4) After taking those steps, the Commission must inform the data subject—
(a) where subsection (1)(a) or (b) applies, whether the Commission is satisfied that the restriction imposed by the controller was lawful;
(aa) where subsection (1)(ba) applies, whether the Commission is satisfied that the controller was entitled to rely on the exemption;
(b) where subsection (1)(c) applies, whether the Commission is satisfied that the controller's refusal of the data subject's request was lawful.
(5) The Commission must also inform the data subject of the data subject's right to apply to a court under section 167.
(6) Where the Commission is not satisfied as mentioned in subsection (4)(a) , (aa) or (b), the Commission may also inform the data subject of any further steps that the Commission is considering taking under Part 6 .
(1) The controller must take reasonable steps to ensure that any information that is required by or under this Chapter to be provided to the data subject is provided in a concise, intelligible and easily accessible form, using clear and plain language.
(2) Subject to subsection (3), the information may be provided in any form, including electronic form.
(3) Where information is provided in response to a request made by the data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D, the controller must provide the information in the same form as the request where it is practicable to do so.
(4) Where the controller has reasonable doubts about the identity of an individual making a request under or by virtue of any of sections 45, 46, 47, 50C or 50D, the controller may—
(a) request the provision of additional information to enable the controller to confirm the identity, and
(b) delay dealing with the request until the identity is confirmed.
(5) Subject to section 53, any information that is required by or under this Chapter to be provided to the data subject must be provided free of charge.
(6) The controller must facilitate the exercise of the rights of the data subject arising under or by virtue of sections 45 to 50D.
53 Manifestly unfounded or excessive requests by the data subject
(1) Where a request made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D is manifestly unfounded or excessive, the controller may—
(a) charge a reasonable fee for dealing with the request, or
(b) refuse to act on the request.
(2) An example of a request that may be excessive is one that merely repeats the substance of previous requests.
(3) In any proceedings where there is an issue as to whether a request described in subsection (1) is manifestly unfounded or excessive, it is for the controller to show that it is.
(4) The Secretary of State may by regulations specify limits on the fees that a controller may charge in accordance with subsection (1)(a).
(4A) The Secretary of State may by regulations—
(a) require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in accordance with subsection (1)(a), and
(b) specify what the guidance must include.
(5) Regulations under this section are subject to the negative resolution procedure.
(6) If, in reliance on subsection (1)(b), the controller does not take action on the request, the controller must inform the data subject of—
(a) the reasons for not doing so, and
(b) the data subject’s right to lodge a complaint with the Commission.
(7) The controller must comply with subsection (6)—
(a) without undue delay, and
(b) in any event, before the end of the applicable time period (as to which see section 54).
(1) This section defines “the applicable time period” for the purposes of sections 45(3)(b) and (5) , 48(2)(b) and 53(7).
(2) “The applicable time period” means the period of one month beginning with the relevant time , subject to subsection (3A).
(3) “The relevant time” means the latest of the following—
(a) when the controller receives the request in question;
(b) when the controller receives the information (if any) requested in connection with a request under section 52(4);
(c) when the fee (if any) charged in connection with the request under section 53 is paid.
(3A) The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—
(a) the complexity of requests made by the data subject, or
(b) the number of such requests.
(3B) A notice under subsection (3A) must—
(a) be given before the end of the period of one month beginning with the relevant time, and
(b) state the reasons for the delay.
(3C) Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under section 45(1) relates—
(a) the controller may ask the data subject to provide the further information, and
(b) the period beginning with the day on which the controller makes the request and ending with the day on which the controller receives the information does not count towards—
(i) the applicable time period, or
(ii) the period described in subsection (3B)(a).
(3D) An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.
(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(1) This Chapter—
(a) sets out the general obligations of controllers and processors (see sections 56 to 65);
(b) sets out specific obligations of controllers and processors with respect to security (see section 66);
(c) sets out specific obligations of controllers and processors with respect to personal data breaches (see sections 67 and 68);
(d) makes provision for the designation, position and tasks of data protection officers (see sections 69 to 71);
(e) makes provision about codes of conduct (see section 71A).
(2) This Chapter applies only in relation to the processing of personal data for a law enforcement purpose.
(3) Where a controller is required by any provision of this Chapter to implement appropriate technical and organisational measures, the controller must (in deciding what measures are appropriate) take into account—
(a) the latest developments in technology,
(b) the cost of implementation,
(c) the nature, scope, context and purposes of processing, and
(d) the risks for the rights and freedoms of individuals arising from the processing.
(1) Each controller must implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that the processing of personal data complies with the requirements of this Part.
(2) Where proportionate in relation to the processing, the measures implemented to comply with the duty under subsection (1) must include appropriate data protection policies.
(3) The technical and organisational measures implemented under subsection (1) must be reviewed and updated where necessary.
(4) Adherence to a code of conduct approved under section 71A may be used by a controller as a means of demonstrating compliance with the requirements of this Part.
(1) Each controller must implement appropriate technical and organisational measures which are designed—
(a) to implement the data protection principles in an effective manner, and
(b) to integrate into the processing itself the safeguards necessary for that purpose.
(2) The duty under subsection (1) applies both at the time of the determination of the means of processing the data and at the time of the processing itself.
(3) Each controller must implement appropriate technical and organisational measures for ensuring that, by default, only personal data which is necessary for each specific purpose of the processing is processed.
(4) The duty under subsection (3) applies to—
(a) the amount of personal data collected,
(b) the extent of its processing,
(c) the period of its storage, and
(d) its accessibility.
(5) In particular, the measures implemented to comply with the duty under subsection (3) must ensure that, by default, personal data is not made accessible to an indefinite number of people without an individual's intervention.
(1) Where two or more competent authorities jointly determine the purposes and means of processing personal data, they are joint controllers for the purposes of this Part.
(2) Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined under or by virtue of an enactment.
(3) The arrangement must designate the controller which is to be the contact point for data subjects.
(1) This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller.
(2) The controller may use only a processor who provides guarantees to implement appropriate technical and organisational measures that are sufficient to secure that the processing will—
(a) meet the requirements of this Part, and
(b) ensure the protection of the rights of the data subject.
(3) The processor used by the controller may not engage another processor (“a sub-processor”) without the prior written authorisation of the controller, which may be specific or general.
(4) Where the controller gives a general written authorisation to a processor, the processor must inform the controller if the processor proposes to add to the number of sub-processors engaged by it or to replace any of them (so that the controller has the opportunity to object to the proposal).
(5) The processing by the processor must be governed by a contract in writing between the controller and the processor setting out the following—
(a) the subject-matter and duration of the processing;
(b) the nature and purpose of the processing;
(c) the type of personal data and categories of data subjects involved;
(d) the obligations and rights of the controller and processor.
(6) The contract must, in particular, provide that the processor must—
(a) act only on instructions from the controller,
(b) ensure that the persons authorised to process personal data are subject to an appropriate duty of confidentiality,
(c) assist the controller by any appropriate means to ensure compliance with the rights of the data subject under this Part,
(d) at the end of the provision of services by the processor to the controller—
(i) either delete or return to the controller (at the choice of the controller) the personal data to which the services relate, and
(ii) delete copies of the personal data unless subject to a legal obligation to store the copies,
(e) make available to the controller all information necessary to demonstrate compliance with this section, and
(f) comply with the requirements of this section for engaging sub-processors.
(7) The terms included in the contract in accordance with subsection (6)(a) must provide that the processor may transfer personal data to a third country or international organisation only if instructed by the controller to make the particular transfer.
(7A) Adherence to a code of conduct approved under section 71A may be used by a processor as a means of demonstrating sufficient guarantees as described in subsection (2).
(8) If a processor determines, in breach of this Part, the purposes and means of processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing.
60 Processing under the authority of the controller or processor
A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except—
(a) on instructions from the controller, or
(b) to comply with a legal obligation.
(1) Each controller must maintain a record of all categories of processing activities for which the controller is responsible.
(2) The controller's record must contain the following information—
(a) the name and contact details of the controller;
(b) where applicable, the name and contact details of the joint controller;
(c) where applicable, the name and contact details of the data protection officer;
(d) the purposes of the processing;
(e) the categories of recipients to whom personal data has been or will be disclosed (including recipients in third countries or international organisations);
(f) a description of the categories of—
(i) data subject, and
(ii) personal data;
(g) where applicable, details of the use of profiling;
(h) where applicable, the categories of transfers of personal data to a third country or an international organisation;
(i) an indication of the legal basis for the processing operations, including transfers, for which the personal data is intended;
(j) where possible, the envisaged time limits for erasure of the different categories of personal data;
(k) where possible, a general description of the technical and organisational security measures referred to in section 66.
(3) Each processor must maintain a record of all categories of processing activities carried out on behalf of a controller.
(4) The processor's record must contain the following information—
(a) the name and contact details of the processor and of any other processors engaged by the processor in accordance with section 59(3);
(b) the name and contact details of the controller on behalf of which the processor is acting;
(c) where applicable, the name and contact details of the data protection officer;
(d) the categories of processing carried out on behalf of the controller;
(e) where applicable, details of transfers of personal data to a third country or an international organisation where explicitly instructed to do so by the controller, including the identification of that third country or international organisation;
(f) where possible, a general description of the technical and organisational security measures referred to in section 66.
(5) The controller and the processor must make the records kept under this section available to the Commission on request.
(1) A controller (or, where personal data is processed on behalf of the controller by a processor, the processor) must keep logs for at least the following processing operations in automated processing systems—
(a) collection;
(b) alteration;
(c) consultation;
(d) disclosure (including transfers);
(e) combination;
(f) erasure.
(2) The logs of consultation must make it possible to establish—
(a) the ... date and time of, the consultation, and
(b) so far as possible, the identity of the person who consulted the data.
(3) The logs of disclosure must make it possible to establish—
(a) the ... date and time of, the disclosure, and
(b) so far as possible—
(i) the identity of the person who disclosed the data, and
(ii) the identity of the recipients of the data.
(4) The logs kept under subsection (1) may be used only for one or more of the following purposes—
(a) to verify the lawfulness of processing;
(b) to assist with self-monitoring by the controller or (as the case may be) the processor, including the conduct of internal disciplinary proceedings;
(c) to ensure the integrity and security of personal data;
(d) the purposes of criminal proceedings.
(5) The controller or (as the case may be) the processor must make the logs available to the Commission on request.
(1) Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing, carry out a data protection impact assessment.
(2) A data protection impact assessment is an assessment of the impact of the envisaged processing operations on the protection of personal data.
(3) A data protection impact assessment must include the following—
(a) a general description of the envisaged processing operations;
(b) an assessment of the risks to the rights and freedoms of data subjects;
(c) the measures envisaged to address those risks;
(d) safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Part, taking into account the rights and legitimate interests of the data subjects and other persons concerned.
(4) In deciding whether a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must take into account the nature, scope, context and purposes of the processing.
(1) This section applies where a controller intends to create a filing system and process personal data forming part of it.
(2) The controller must consult the Commission prior to the processing if a data protection impact assessment prepared under section 64 indicates that the processing of the data would result in a high risk to the rights and freedoms of individuals (in the absence of measures to mitigate the risk).
(3) Where the controller is required to consult the Commission under subsection (2), the controller must give the Commission—
(a) the data protection impact assessment prepared under section 64, and
(b) any other information requested by the Commission to enable the Commission to make an assessment of the compliance of the processing with the requirements of this Part.
(4) Where the Commission is of the opinion that the intended processing referred to in subsection (1) would infringe any provision of this Part, the Commission must provide written advice to the controller and, where the controller is using a processor, to the processor.
(5) The written advice must be provided before the end of the period of 6 weeks beginning with receipt of the request for consultation by the controller or the processor.
(6) The Commission may extend the period of 6 weeks by a further period of 1 month, taking into account the complexity of the intended processing.
(7) If the Commission extends the period of 6 weeks, the Commission must—
(a) inform the controller and, where applicable, the processor of any such extension before the end of the period of 1 month beginning with receipt of the request for consultation, and
(b) provide reasons for the delay.
(1) Each controller and each processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks arising from the processing of personal data.
(2) In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to—
(a) prevent unauthorised processing or unauthorised interference with the systems used in connection with it,
(b) ensure that it is possible to establish the precise details of any processing that takes place,
(c) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and
(d) ensure that stored personal data cannot be corrupted if a system used in connection with the processing malfunctions.
(3) Adherence to a code of conduct approved under section 71A may be used by a controller or processor as a means of demonstrating compliance with subsection (1).
67 Notification of a personal data breach to the Commission
(1) If a controller becomes aware of a personal data breach in relation to personal data for which the controller is responsible, the controller must notify the breach to the Commission—
(a) without undue delay, and
(b) where feasible, not later than 72 hours after becoming aware of it.
(2) Subsection (1) does not apply if the personal data breach is unlikely to result in a risk to the rights and freedoms of individuals.
(3) Where the notification to the Commission is not made within 72 hours, the notification must be accompanied by reasons for the delay.
(4) Subject to subsection (5), the notification must include—
(a) a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
(b) the name and contact details of the data protection officer or other contact point from whom more information can be obtained;
(c) a description of the likely consequences of the personal data breach;
(d) a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
(5) Where and to the extent that it is not possible to provide all the information mentioned in subsection (4) at the same time, the information may be provided in phases without undue further delay.
(6) The controller must record the following information in relation to a personal data breach—
(a) the facts relating to the breach,
(b) its effects, and
(c) the remedial action taken.
(7) The information mentioned in subsection (6) must be recorded in such a way as to enable the Commission to verify compliance with this section.
(8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(9) If a processor becomes aware of a personal data breach (in relation to personal data processed by the processor), the processor must notify the controller without undue delay.