Legalize / United Kingdom / Public General Act

Data (Use and Access) Act 2025

Type Public General Act

Publication 2025-06-19

Last updated 2026-03-31

State In force

Department Statute Law Database

Source legislation.gov.uk

articles Not indexed

Reform history JSON API

(Article 22A) (1) For the purposes of Articles 22B and 22C— (a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and (b) a decision is a significant decision, in relation to a data subject, if— (i) it produces a legal effect for the data subject, or (ii) it has a similarly significant effect for the data subject. (2) When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling. (Article 22B) (1) A significant decision based entirely or partly on processing described in Article 9(1) (processing of special categories of personal data) may not be taken based solely on automated processing, unless one of the following conditions is met. (2) The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent. (3) The second condition is that— (a) the decision is— (i) necessary for entering into, or performing, a contract between the data subject and a controller, or (ii) required or authorised by law, and (b) point (g) of Article 9(2) applies. (4) A significant decision may not be taken based solely on automated processing if the processing of personal data carried out by, or on behalf of, the decision-maker for the purposes of the decision is carried out entirely or partly in reliance on Article 6(1)(ea). (Article 22C) (1) Where a significant decision taken by or on behalf of a controller in relation to a data subject is— (a) based entirely or partly on personal data, and (b) based solely on automated processing, the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with paragraph 2 and any regulations under Article 22D(3). (2) The safeguards must consist of or include measures which— (a) provide the data subject with information about decisions described in paragraph 1 taken in relation to the data subject; (b) enable the data subject to make representations about such decisions; (c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions; (d) enable the data subject to contest such decisions. (Article 22D) (1) The Secretary of State may by regulations provide that, for the purposes of Article 22A(1)(a), there is, or is not, to be taken to be meaningful human involvement in the taking of a decision in cases described in the regulations. (2) The Secretary of State may by regulations provide that, for the purposes of Article 22A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant effect for the data subject. (3) The Secretary of State may by regulations make the following types of provision about the safeguards required under Article 22C(1)— (a) provision requiring the safeguards to include measures in addition to those described in Article 22C(2), (b) provision imposing requirements which supplement what Article 22C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in Article 22C(2) must be done or be capable of being done), and (c) provision about measures which are not to be taken to satisfy one or more of points (a) to (d) of Article 22C(2). (4) Regulations under paragraph 3 may not amend Article 22C. (5) Regulations under this Article are subject to the affirmative resolution procedure.

(2) The 2018 Act is amended in accordance with subsections (3) to (5).

(3) For sections 49 and 50 (law enforcement processing: automated individual decision-making) substitute—

(50A) (1) For the purposes of sections 50B and 50C— (a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and (b) a decision is a significant decision, in relation to a data subject, if— (i) it produces an adverse legal effect for the data subject, or (ii) it has a similarly significant adverse effect for the data subject. (2) When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling. (50B) (1) A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met. (2) The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent. (3) The second condition is that the decision is required or authorised by law. (50C) (1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is— (a) based entirely or partly on personal data, and (b) based solely on automated processing, the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4). (2) The safeguards must consist of or include measures which— (a) provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject; (b) enable the data subject to make representations about such decisions; (c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions; (d) enable the data subject to contest such decisions. (3) Subsections (1) and (2) do not apply in relation to a significant decision if— (a) exemption from those provisions is required for a reason listed in subsection (4), (b) the controller reconsiders the decision as soon as reasonably practicable, and (c) there is meaningful human involvement in the reconsideration of the decision. (4) Those reasons are— (a) to avoid obstructing an official or legal inquiry, investigation or procedure; (b) to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties; (c) to protect public security; (d) to safeguard national security; (e) to protect the rights and freedoms of others. (5) When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling. (50D) (1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations. (2) The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject. (3) Regulations under subsection (1) or (2) may amend section 50A. (4) The Secretary of State may by regulations make the following types of provision about the safeguards required under section 50C(1)— (a) provision requiring the safeguards to include measures in addition to those described in section 50C(2), (b) provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and (c) provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2). (5) Regulations under this section are subject to the affirmative resolution procedure.

(4) In section 96 (intelligence services processing: right not to be subject to automated decision-making)—

(a) in subsection (1), for “solely on” substitute “on entirely”,

(b) in subsection (3), after “section” insert “and section 97”, and

(4) For the purposes of this section and section 97, a decision is based on entirely automated processing if the decision-making process does not include an opportunity for a human being to accept, reject or influence the decision.

(5) In section 97 (intelligence services processing: right to intervene in automated decision-making)—

(a) in subsection (1)(a), for “solely on” substitute “on entirely”,

(b) in subsection (4)(b), for “solely on” substitute “on entirely”, and

(6) Schedule 6 to this Act contains minor and consequential amendments.

Obligations of controllers

Data protection by design: children’s higher protection matters

81

(1) Article 25 of the UK GDPR (data protection by design and by default) is amended as follows.

(2) After paragraph 1 insert—

(1A) In the case of processing carried out in the course of providing information society services which are likely to be accessed by children, when assessing what are appropriate technical and organisational measures in accordance with paragraph 1, the controller must take into account the children’s higher protection matters. (1B) The children’s higher protection matters are— (a) how children can best be protected and supported when using the services, and (b) the fact that children— (i) merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing, and (ii) have different needs at different ages and at different stages of development.

(3) In paragraph 3, for “1 and 2” substitute “1 to 2”.

(4) At the end insert—

(4) Paragraphs 1A and 1B are not to be read as implying anything about the matters that may be relevant to the assessment of what are appropriate technical and organisational measures for the purposes of paragraph 1 in cases other than those described in paragraph 1A. (5) In this Article, “information society services” does not include preventive or counselling services.

Logging of law enforcement processing

82

In section 62 of the 2018 Act (logging of law enforcement processing)—

(a) in subsection (2)(a), omit “justification for, and”, and

(b) in subsection (3)(a), omit “justification for, and”.

Codes of conduct

General processing and codes of conduct

83

In Article 41 of the UK GDPR (monitoring of approved codes of conduct)—

(a) in paragraph 4, omit the words from “, including suspension” to the end, and

(b) after that paragraph insert—

(4A) If the action taken by a body under paragraph 4 consists of suspending or excluding a controller or processor from the code, the body must inform the Commissioner, giving reasons for taking that action.

Law enforcement processing and codes of conduct

84

(1) The 2018 Act is amended as follows.

(2) In section 55(1) (overview and scope of provisions about controllers and processors), at the end insert—

(e) makes provision about codes of conduct (see section 71A).

(3) In section 56 (general obligations of the controller), at the end insert—

(4) Adherence to a code of conduct approved under section 71A may be used by a controller as a means of demonstrating compliance with the requirements of this Part.

(4) In section 59 (processors), after subsection (7) insert—

(7A) Adherence to a code of conduct approved under section 71A may be used by a processor as a means of demonstrating sufficient guarantees as described in subsection (2).

(5) In section 66 (security of processing), at the end insert—

(3) Adherence to a code of conduct approved under section 71A may be used by a controller or processor as a means of demonstrating compliance with subsection (1).

(6) After section 71 insert—

(71A) (1) The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part. (2) Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors. (3) For the purposes of this section— (a) “public body” means a body or other person whose functions are, or include, functions of a public nature, and (b) a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1). (4) A code of conduct described in subsection (1) may, for example, make provision with regard to— (a) lawful and fair processing; (b) the collection of personal data; (c) the information provided to the public and to data subjects; (d) the exercise of the rights of data subjects; (e) the measures and procedures referred to in sections 56, 57 and 62; (f) the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects; (g) the transfer of personal data to third countries or international organisations; (h) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing. (5) The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft. (6) Where an expert public body does so, the Commissioner must— (a) provide the body with an opinion on whether the code correctly reflects the requirements of this Part, (b) decide whether to approve the code, and (c) if the code is approved, register and publish the code. (7) Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.

International transfers of personal data

Transfers of personal data to third countries and international organisations

85

(1) Schedule 7 amends Chapter 5 of the UK GDPR (general processing and transfers of personal data to third countries and international organisations).

(2) Schedule 8 amends Chapter 5 of Part 3 of the 2018 Act (law enforcement processing and transfers of personal data to third countries and international organisations).

(3) In Schedule 9—

(a) Part 1 contains minor and consequential amendments, and

(b) Part 2 contains transitional provision.

Safeguards for processing for research etc purposes

86

(1) The UK GDPR is amended in accordance with subsections (2) to (4).

(2) After Chapter 8 insert—

(Article 84A) (1) This Chapter makes provision about the processing of personal data— (a) for the purposes of scientific research or historical research, (b) for the purposes of archiving in the public interest, or (c) for statistical purposes. (2) Those purposes are referred to in this Chapter as “RAS purposes”. (Article 84B) (1) Personal data may only be processed for RAS purposes if— (a) the processing consists of the collection of the personal data (whether from the data subject or otherwise), (b) the processing is carried out in order to convert the personal data into information which can be processed in a manner which does not permit the identification of a data subject, or (c) without the processing, the RAS purposes cannot be fulfilled. (2) Processing of personal data for RAS purposes must be carried out subject to appropriate safeguards for the rights and freedoms of the data subject. (Article 84C) (1) This Article makes provision about when the requirement under Article 84B(2) for processing of personal data to be carried out subject to appropriate safeguards is satisfied. (2) The requirement is not satisfied if the processing is likely to cause substantial damage or substantial distress to a data subject to whom the personal data relates. (3) The requirement is not satisfied if the processing is carried out for the purposes of measures or decisions with respect to a particular data subject to whom the personal data relates, except where the purposes for which the processing is carried out include the purposes of approved medical research. (4) The requirement is only satisfied if the safeguards include technical and organisational measures for the purpose of ensuring respect for the principle of data minimisation (see Article 5(1)(c)), such as, for example, pseudonymisation. (5) In this Article— - “approved medical research” means medical research carried out by a person who has approval to carry out that research from—a research ethics committee recognised or established by the Health Research Authority under Chapter 2 of Part 3 of the Care Act 2014, ora body appointed by any of the following for the purpose of assessing the ethics of research involving individuals—the Secretary of State, the Scottish Ministers, the Welsh Ministers or a Northern Ireland department;a relevant NHS body;United Kingdom Research and Innovation or a body that is a Research Council for the purposes of the Science and Technology Act 1965;an institution that is a research institution for the purposes of Chapter 4A of Part 7 of the Income Tax (Earnings and Pensions) Act 2003 (see section 457 of that Act); - “relevant NHS body” means—an NHS trust or NHS foundation trust in England,an NHS trust or Local Health Board in Wales,a Health Board or Special Health Board constituted under section 2 of the National Health Service (Scotland) Act 1978,the Common Services Agency for the Scottish Health Service, orany of the health and social care bodies in Northern Ireland falling within paragraphs (b) to (e) of section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)). (Article 84D) (1) The Secretary of State may by regulations make further provision about when the requirement for appropriate safeguards under Article 84B(2) is, or is not, satisfied. (2) Regulations under this Article may not amend or revoke Article 84C(2), (3) or (4) (but may change the meaning of “approved medical research” for the purposes of Article 84C). (3) Regulations under this Article are subject to the affirmative resolution procedure.

(3) In the heading of Chapter 9, after “relating to” insert “other”.

(4) Omit Article 89 (safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes).

(5) The 2018 Act is amended in accordance with subsections (6) and (7).

(6) Omit section 19 (processing for archiving, research and statistical purposes: safeguards) and the italic heading before it.

(7) In section 41(1) (safeguards: archiving), for “necessary” substitute “carried out”.

Section 86: consequential provision

87

(1) In the UK GDPR—

(a) in Article 5(1)(e) (storage limitation), for “Article 89(1)” to “data subject” substitute “Article 84B”,

(b) in Article 9(2)(j) (processing of special categories of personal data), for “in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act)” substitute “, is carried out in accordance with Article 84B and is”,

(d) in Article 21(6) (right to object), omit “pursuant to Article 89(1)”.

(2) In the 2018 Act—

(a) in section 24(4) (manual unstructured data held by FOI public authorities), after paragraph (b) insert—

(ba) Chapter 8A (safeguards for processing for research, archiving or statistical purposes);

(b) in paragraph 4(b) of Schedule 1 (special categories of personal data and criminal convictions etc data: research etc), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”, and

(i) in paragraph 27(3)(a) (research and statistics), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”, and

(ii) in paragraph 28(3) (archiving), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”.

(3) In section 279(2) of the Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13) (information for research), for “Article 89(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics)” substitute “Article 84A of the UK GDPR (research, archives and statistics)”.

National security

National security exemption

88

(1) The 2018 Act is amended in accordance with subsections (2) to (10).

(2) In section 26(2)(f) (national security and defence exemption), before sub-paragraph (i) insert—

(ai) Article 77 (right to lodge a complaint with the Commissioner);

(3) In section 44 (controller’s general duties to provide information to data subject)—

(a) in subsection (4), omit paragraph (d) (grounds for restricting information provided: national security),

(b) in subsection (5), after “restricted” insert “under subsection (4)”, and

(4) In section 45 (right of access by the data subject)—

(a) in subsection (4), omit paragraph (d) (grounds for restricting information provided: national security),

(b) in subsection (5), after “restricted” insert “under subsection (4)”, and

(5) In section 48 (requests by data subject for rectification or erasure of personal data)—

(a) in subsection (3), omit paragraph (d) (grounds for restricting information provided: national security),

(b) in subsection (4)—

(i) for “(1)” substitute “(1)(b)(i)”, and

(ii) after “restricted” insert “under subsection (3)”, and

(6) In section 68(7) (communication of a personal data breach to the data subject: grounds for restricting information provided), omit paragraph (d) (national security).

(7) In Chapter 6 of Part 3 (law enforcement processing: supplementary), before section 79 insert—

(78A) (1) A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security. (2) The provisions are— (a) Chapter 2 of this Part (principles), except for the provisions listed in subsection (3); (b) Chapter 3 of this Part (rights of the data subject); (c) in Chapter 4 of this Part— (i) section 67 (notification of personal data breach to the Commissioner); (ii) section 68 (communication of personal data breach to the data subject); (d) Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4); (e) in Part 5— (i) section 119 (inspection in accordance with international obligations); (ii) in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2; (f) in Part 6— (i) sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection); (ii) sections 170 to 173 (offences relating to personal data); (g) in Part 7, section 187 (representation of data subjects). (3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are— (a) section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful; (b) section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing); (c) section 42 (safeguards: sensitive processing); (d) Schedule 8 (conditions for sensitive processing). (4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are— (a) the following provisions of section 73— (i) subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose); (ii) subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State); (b) section 78 (subsequent transfers).

(8) In section 79 (national security: certificate)—

(a) omit subsections (1) to (3),

(b) after subsection (3) insert—

(3A) Subject to subsection (5), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 78A(2) is, or at any time was, required in relation to any personal data for the purposes of safeguarding national security is conclusive evidence of that fact.

(a) may identify the personal data to which it applies by means of a general description, and (b)

(d) in subsection (5), for “subsection (1)” substitute “subsection (3A)”,

(e) in subsection (7)—

(i) for “a restriction falls within a general description in a certificate issued under subsection (1)” substitute “a certificate under subsection (3A) which identifies the personal data to which it applies by means of a general description applies to any personal data”, and

(ii) for “the restriction does not fall within that description” substitute “the certificate does not apply to the personal data in question”,

(f) in subsection (8)—

(i) for “the restriction” substitute “the certificate”, and

(ii) for “to fall within the general description” substitute “so to apply”,

(g) in subsection (10), for “subsection (1)” substitute “subsection (3A)”,

(h) in subsection (11), for “subsection (1)” substitute “subsection (3A)”,

(i) in subsection (12), for “subsection (1)” substitute “subsection (3A)”, and

(j) omit subsection (13).

(9) In section 110(2) (intelligence services processing: national security)—

(a) in paragraph (a), after “Chapter 2” insert “of this Part”,

(b) in paragraph (b), after “Chapter 3” insert “of this Part”, and

(10) In section 186(3) (data subject’s rights etc: exceptions), after paragraph (c) insert—

(ca) in Part 3 of this Act, section 78A, and

(11) In the provisions listed in subsection (12), for “subsection (4) of that section” substitute “section 45(4) or 78A of that Act”.

(12) The provisions are—

(a) section 40(4A)(b) and (5B)(d) of the Freedom of Information Act 2000 (personal data which is exempt information);

(b) section 38(3A)(b) of the Freedom of Information (Scotland) Act 2002 (asp 13) (personal data which is exempt information);

(c) regulation 13(3A)(b) and (5B)(d) of the Environmental Information Regulations 2004 (S.I. 2004/3391) (restriction on disclosure of personal data);

(d) regulation 11(4A)(b) of the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520) (restriction on disclosure of personal data);

(e) regulation 45(1C)(b) of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042) (personal data which is sensitive information);

(f) regulation 39(1C)(b) of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494) (personal data which is sensitive information).

Intelligence services

Joint processing by intelligence services and competent authorities

89

(1) Part 4 of the 2018 Act (intelligence services processing) is amended as follows.

(2) In section 82 (processing to which Part 4 applies)—

(a) before subsection (1) insert—

(A1) This Part— (a) applies to processing of personal data by an intelligence service, and (b) applies to processing of personal data by a qualifying competent authority where the processing is the subject of a designation notice that is for the time being in force (see sections 82A to 82E).

(b) in subsection (1)—

(i) after “applies” insert “only”,

(ii) in paragraph (a), for “the processing by an intelligence service” substitute “processing”, and

(iii) in paragraph (b), for “the processing by an intelligence service” substitute “processing”,

(2A) In this Part— - “competent authority” has the same meaning as in Part 3; - “qualifying competent authority” means a competent authority specified or described in regulations made by the Secretary of State.

, and

(d) after subsection (3) insert—

(4) Regulations under this section are subject to the affirmative resolution procedure.

(3) After section 82 insert—

(82A) (1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where— (a) an application for designation of the processing is made in accordance with this section, and (b) the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security. (2) The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service. (3) The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to— (a) a country or territory outside the United Kingdom, or (b) an international organisation. (4) A designation notice must— (a) specify or describe the processing and qualifying competent authority that are designated, and (b) be given to the applicants for the designation (and see also section 82D). (5) An application for designation of processing of personal data by a qualifying competent authority must be made jointly by— (a) the qualifying competent authority, and (b) the intelligence service with which the processing is to be carried out. (6) An application may be made in respect of more than one qualifying competent authority and in respect of processing with more than one intelligence service. (7) The application must— (a) describe the processing, including the intended purposes and means of processing, and (b) explain why the applicants consider that designation is required for the purposes of safeguarding national security. (8) Before giving a designation notice, the Secretary of State must consult the Commissioner. (9) In this section, “joint controller”, in relation to processing of personal data, means a controller whose responsibilities for compliance with this Part in relation to the processing are determined in an arrangement under section 104. (82B) (1) A designation notice must state when it comes into force. (2) A designation notice ceases to be in force at the earliest of the following times— (a) at the end of the period of 5 years beginning when the notice comes into force; (b) (if relevant) at the end of a shorter period specified in the notice; (c) when the notice is withdrawn under section 82C. (3) The Secretary of State may give a further designation notice in respect of processing that is, or has been, the subject of a previous designation notice. (82C) (1) Subsections (2) to (4) apply where processing is the subject of a designation notice for the time being in force. (2) A person who applied for the designation of the processing must notify the Secretary of State without undue delay if the person considers that the designation is no longer required for the purposes of safeguarding national security. (3) A person who applied for the designation of the processing must, on a request from the Secretary of State, provide— (a) a description of the processing that is being, or is intended to be, carried out in reliance on the notice, and (b) an explanation of why the person considers that designation of the processing continues to be required for the purposes of safeguarding national security. (4) The Secretary of State must at least annually— (a) review each designation notice that is for the time being in force, and (b) consider whether designation of the processing which is the subject of the notice continues to be required for the purposes of safeguarding national security. (5) The Secretary of State— (a) may withdraw a designation notice by giving a further notice (a “withdrawal notice”) to the persons who applied for the designation, and (b) must give a withdrawal notice if the Secretary of State considers that designation of some or all of the processing to which the notice applies is no longer required for the purposes of safeguarding national security (whether as a result of a review required under subsection (4) or otherwise). (6) A withdrawal notice must— (a) withdraw the designation notice completely, and (b) state when it comes into force. (7) In determining when a withdrawal notice required under subsection (5)(b) comes into force, the Secretary of State must consider— (a) the desirability of the processing ceasing to be designated as soon as possible, and (b) where relevant, the time needed to effect an orderly transition to new arrangements for the processing of personal data. (82D) (1) Where the Secretary of State gives a designation notice— (a) the Secretary of State must send a copy of the notice to the Commissioner, and (b) the Commissioner must publish a record of the notice. (2) The record must contain— (a) the Secretary of State’s name, (b) the date on which the notice was given, (c) the date on which the notice ceases to have effect (if not previously withdrawn), and (d) subject to subsection (3), the rest of the text of the notice. (3) The Commissioner must not publish the text, or a part of the text, of the notice if— (a) the Secretary of State has determined that publishing the text or that part of the text— (i) would be against the interests of national security, (ii) would be contrary to the public interest, or (iii) might jeopardise the safety of any person, and (b) the Secretary of State has notified the Commissioner of that determination. (4) The Commissioner must keep the record of the notice available to the public while the notice is in force. (5) Where the Secretary of State gives a withdrawal notice, the Secretary of State must send a copy of the notice to the Commissioner. (82E) (1) A person directly affected by a designation notice may appeal to the Tribunal against the notice. (2) If, on an appeal under this section, the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Secretary of State did not have reasonable grounds for giving the notice, the Tribunal may— (a) allow the appeal, and (b) quash the notice.

Joint processing: consequential amendments

90

(1) The 2018 Act is amended in accordance with subsections (2) to (9).

(2) In section 1(5) (overview: Part 4), at the end insert “(and certain processing carried out by competent authorities jointly with the intelligence services)”.

(3) In section 29 (processing to which Part 3 applies), after subsection (1) insert—

(1A) This Part does not apply to processing to which Part 4 applies by virtue of a designation notice (see section 82A).

(4) In section 83 (meaning of “controller” and “processor” in Part 4)—

(a) before subsection (1) insert—

(A1) For the purposes of this Part— (a) an intelligence service is the “controller” in relation to the processing of personal data if it satisfies subsection (1) alone or jointly with others, and (b) a qualifying competent authority is the “controller” in relation to the processing of personal data that is the subject of a designation notice that is for the time being in force if the authority satisfies subsection (1) jointly with others.

(b) in subsection (1), for the words before paragraph (a) substitute “This subsection is satisfied by a person who—”, and

(5) In section 84 (other definitions)—

(a) after subsection (2) insert—

(2A) “Designation notice” has the meaning given in section 82A.

, and

(b) before subsection (7) insert—

(6B) “Withdrawal notice” has the meaning given in section 82C.

(6) In section 104(1) (joint controllers), for “intelligence services” substitute “controllers”.

(7) In section 202(1)(a)(i) (proceedings in the First-tier Tribunal: contempt) after “79,” insert “82E,”.

(8) In section 203(1) (Tribunal Procedure Rules), after “79,” insert “82E,”.

(9) In section 206 (index of defined expressions), in the Table—

(a) in the entry for “competent authority”—

(i) for “Part 3” substitute “Parts 3 and 4”, and

(ii) for “section 30” substitute “sections 30 and 82”, and

(b) at the appropriate places insert—

designation notice (in Part 4)	section 84

;

qualifying competent authority (in Part 4)	section 82

;

withdrawal notice (in Part 4)	section 84

(10) In section 199(2)(a) of the Investigatory Powers Act 2016 (bulk personal datasets: meaning of “personal data”), after “section 82(1) of that Act” insert “by an intelligence service”.

Information Commissioner’s role

Duties of the Commissioner in carrying out functions

91

(1) The 2018 Act is amended in accordance with subsections (2) to (4).

(2) Omit section 2(2) (duty of Commissioner when carrying out functions).

(3) After section 120 insert—

(120A) It is the principal objective of the Commissioner, in carrying out functions under the data protection legislation— (a) to secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and (b) to promote public trust and confidence in the processing of personal data. (120B) In carrying out functions under the data protection legislation, the Commissioner must have regard to such of the following as appear to the Commissioner to be relevant in the circumstances— (a) the desirability of promoting innovation; (b) the desirability of promoting competition; (c) the importance of the prevention, investigation, detection and prosecution of criminal offences; (d) the need to safeguard public security and national security; (e) the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing. (120C) (1) The Commissioner must prepare a strategy for carrying out the Commissioner’s functions under the data protection legislation in accordance with the Commissioner’s duties under— (a) sections 120A and 120B, (b) section 108 of the Deregulation Act 2015 (exercise of regulatory functions: economic growth), and (c) section 21 of the Legislative and Regulatory Reform Act 2006 (exercise of regulatory functions: principles). (2) The Commissioner must— (a) review the strategy from time to time, and (b) revise the strategy as appropriate. (3) The Commissioner must publish the strategy and any revised strategy. (120D) (1) The Commissioner must, at such times as the Commissioner considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which the Commissioner exercises functions under the data protection legislation may affect economic growth, innovation and competition. (2) The persons are— (a) such persons exercising regulatory functions as the Commissioner considers appropriate; (b) such other persons as the Commissioner considers appropriate. (3) In this section, “regulatory function” has the meaning given by section 111 of the Deregulation Act 2015.

(4) In section 139 (reporting to Parliament), after subsection (1) insert—

(1A) In connection with the Commissioner’s functions under the data protection legislation, the report must contain (among other things)— (a) a review of what the Commissioner has done during the reporting period to comply with the duties under— (i) sections 120A and 120B, (ii) section 108 of the Deregulation Act 2015, and (iii) section 21 of the Legislative and Regulatory Reform Act 2006, including a review of the operation of the strategy prepared and published under section 120C; (b) a review of what the Commissioner has done during the reporting period to comply with the duty under section 120D. (1B) In subsection (1A), “the reporting period” means the period to which the report relates.

(5) The Information Commissioner must prepare and publish a strategy in accordance with section 120C of the 2018 Act before the end of the period of 18 months beginning with the day on which this section comes into force.

Codes of practice for the processing of personal data

92

(1) The 2018 Act is amended in accordance with subsections (2) to (6).

(2) After section 124 insert—

(124A) (1) The Commissioner must prepare appropriate codes of practice giving guidance as to good practice in the processing of personal data if required to do so by regulations made by the Secretary of State. (2) Regulations under this section— (a) must describe the personal data or processing to which the code of practice is to relate, and (b) may describe the persons or classes of person to whom it is to relate. (3) Where a code under this section is in force, the Commissioner may prepare amendments of the code or a replacement code. (4) Before preparing a code or amendments under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate— (a) trade associations; (b) data subjects; (c) persons who appear to the Commissioner to represent the interests of data subjects. (5) A code under this section may include transitional provision or savings. (6) Regulations under this section are subject to the negative resolution procedure. (7) In this section— - “good practice in the processing of personal data” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, including compliance with the requirements of the data protection legislation; - “trade association” includes a body representing controllers or processors.

(3) In section 125 (approval of codes prepared under sections 121 to 124)—

(a) in the heading, for “124” substitute “124A”,

(b) in subsection (1), for “or 124” substitute “, 124 or 124A”,

(d) for subsection (5) substitute—

(5) If the Commissioner is prevented by subsection (3) from issuing a code that is not a replacement code, the Commissioner must prepare another version of the code.

, and

(e) in subsection (9), for “or 124” substitute “, 124 or 124A”.

(4) In section 126 (publication and review of codes issued under section 125(4)), in subsection (4), for “or 124(2)” substitute “, 124(2) or 124A(3)”.

(5) Omit section 128 (other codes of practice).

(6) In section 129 (consensual audits), in subsection (3), for “128” substitute “124A”.

(7) In section 19AC of the Registration Service Act 1953 (code of practice), in subsection (11), for “128” substitute “124A”.

(8) In the Statistics and Registration Service Act 2007—

(a) in section 45 (information held by HMRC), in subsection (4A), for “128” substitute “124A”,

(b) in section 45A (information held by other public authorities), in subsection (8), for “128” substitute “124A”,

(c) in section 45E (further provisions about powers in sections 45B, 45C and 45D), in subsection (16), for “128” substitute “124A”, and

(d) in section 53A (disclosure by the Board to devolved administrations), in subsection (9), for “128” substitute “124A”.

(9) In the Digital Economy Act 2017—

(a) in section 43 (code of practice), in subsection (13), for “128” substitute “124A”,

(b) in section 52 (code of practice), in subsection (13), for “128” substitute “124A”,

(d) in section 70 (code of practice), in subsection (15), for “128” substitute “124A”.

Codes of practice: panels and impact assessments

93

In the 2018 Act, after section 124A (inserted by section 92 of this Act) insert—

(124B) (1) This section applies where a code is prepared under section 121, 122, 123, 124 or 124A, subject to subsection (11). (2) The Commissioner must establish a panel of individuals to consider the code. (3) The panel must consist of— (a) individuals the Commissioner considers have expertise in the subject matter of the code, and (b) individuals the Commissioner considers— (i) are likely to be affected by the code, or (ii) represent persons likely to be affected by the code. (4) Before the panel begins to consider the code, the Commissioner must— (a) publish the code in draft, and (b) publish a statement that— (i) states that a panel has been established to consider the code, (ii) identifies the members of the panel, (iii) explains the process by which they were selected, and (iv) explains the reasons for their selection. (5) Where at any time it appears to the Commissioner that a member of the panel is not willing or able to serve as a member of the panel, the Commissioner may select another individual to be a member of the panel. (6) Where the Commissioner selects an individual to be a member of the panel under subsection (5), the Commissioner must publish a statement that— (a) identifies the member of the panel, (b) explains the process by which the member was selected, and (c) explains the reasons for the member’s selection. (7) The Commissioner must make arrangements— (a) for the members of the panel to consider the code with one another (whether in person or otherwise), and (b) for the panel to prepare and submit to the Commissioner a report on the code within such reasonable period as is determined by the Commissioner. (8) If the panel submits to the Commissioner a report on the code within the period determined by the Commissioner, the Commissioner must as soon as reasonably practicable— (a) make any alterations to the code that the Commissioner considers appropriate in the light of the report, and (b) publish— (i) the code in draft, (ii) the report or a summary of it, and (iii) in a case where a recommendation in the report to alter the code has not been accepted by the Commissioner, an explanation of why it has not been accepted. (9) The Commissioner may pay remuneration and expenses to the members of the panel. (10) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections, subject to subsection (11). (11) The Secretary of State may by regulations provide that this section does not apply, or applies with modifications, in the case of— (a) a code prepared under section 124A, or (b) an amendment of such a code, that is specified or described in the regulations. (12) Regulations under this section are subject to the negative resolution procedure. (124C) (1) Where a code is prepared under section 121, 122, 123, 124 or 124A, the Commissioner must carry out and publish an assessment of— (a) who would be likely to be affected by the code, and (b) the effect the code would be likely to have on them. (2) This section applies in relation to amendments prepared under section 121, 122, 123, 124 or 124A as it applies in relation to codes prepared under those sections.

Manifestly unfounded or excessive requests to the Commissioner

94

(1) The 2018 Act is amended in accordance with subsections (2) and (3).

(2) In section 135 (manifestly unfounded or excessive requests made to the Commissioner)—

(a) before subsection (1) insert—

(A1) This section makes provision about cases in which a request made to the Commissioner, to which the Commissioner is required or authorised to respond under the data protection legislation, is manifestly unfounded or excessive.

(b) in subsection (1) omit the words from the beginning to “excessive,”,

(1A) In subsection (1)— (a) the reference in paragraph (a) to charging a reasonable fee is, in a case in which section 134 is relevant, a reference to doing so under that section, and (b) paragraph (b) is not to be read as implying anything about whether the Commissioner may refuse to act on requests that are neither manifestly unfounded nor excessive.

(d) in subsection (3), for “(1)” substitute “(A1)”,

(e) omit subsection (4), and

(f) after that subsection insert—

(5) Article 57(3) of the UK GDPR (performance of Commissioner’s tasks generally to be free of charge for data subject) has effect subject to this section.

(3) In section 136(1) (guidance about fees), omit paragraph (b) and the “or” before it.

(4) In Article 57 of the UK GDPR (Commissioner’s tasks), omit paragraph 4.

Analysis of performance

95

In the 2018 Act, after section 139 insert—

(139A) (1) The Commissioner must prepare and publish an analysis of the Commissioner’s performance using key performance indicators. (2) The analysis must be prepared and published at least annually. (3) In this section, “key performance indicators” means factors by reference to which the Commissioner’s performance can be measured most effectively.

Notices from the Commissioner

96

(1) The 2018 Act is amended in accordance with subsections (2) and (3).

(2) Omit section 141 (notices from the Commissioner).

(3) After that section insert—

(141A) (1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner. (2) The notice may be given to the person by— (a) delivering it by hand to a relevant individual, (b) leaving it at the person’s proper address, (c) sending it by post to the person at that address, or (d) sending it by email to the person’s email address. (3) A “relevant individual” means— (a) in the case of a notice to an individual, that individual; (b) in the case of a notice to a body corporate (other than a partnership), an officer of that body; (c) in the case of a notice to a partnership, a partner in the partnership or a person who has the control or management of the partnership business; (d) in the case of a notice to an unincorporated body (other than a partnership), a member of its governing body. (4) For the purposes of subsection (2)(b) and (c), and section 7 of the Interpretation Act 1978 (services of documents by post) in its application to those provisions, a person’s proper address is— (a) in a case where the person has specified an address as one at which the person, or someone acting on the person’s behalf, will accept service of notices or other documents, that address; (b) in any other case, the address determined in accordance with subsection (5). (5) The address is— (a) in a case where the person is a body corporate with a registered office in the United Kingdom, that office; (b) in a case where paragraph (a) does not apply and the person is a body corporate, partnership or unincorporated body with a principal office in the United Kingdom, that office; (c) in any other case, an address in the United Kingdom at which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of the person. (6) A person’s email address is— (a) an email address published for the time being by that person as an address for contacting that person, or (b) if there is no such published address, an email address by means of which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of that person. (7) A notice sent by email is treated as given 48 hours after it was sent, unless the contrary is proved. (8) In this section, “officer”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body. (9) This section does not limit other lawful means of giving a notice.

(4) In Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) (Commissioner’s enforcement powers), in paragraph 1(b), for “141” substitute “141A”.

Enforcement

Power of the Commissioner to require documents

97

(1) The 2018 Act is amended as follows.

(2) In section 142 (information notices)—

(a) in subsection (1)—

(i) in paragraph (a), after “information” insert “or documents”, and

(ii) in paragraph (b), after “information” insert “or documents”,

(b) in subsection (2)(b), after “information” insert “or documents”,

(i) in paragraph (a), after “information”, in both places it occurs, insert “or documents”,

(ii) in paragraph (b), after “information” insert “or documents”,

(iii) in paragraph (c), after “information” insert “or documents”, and

(iv) in paragraph (d), after “information” insert “or documents”,

(d) in subsection (5), after “information”, in the second place it occurs, insert “or documents”,

(e) in subsection (6), after “information”, in the second place it occurs, insert “or documents”, and

(f) in subsection (7)—

(i) in paragraph (a), for “is” substitute “or documents are”, and

(ii) in the words after paragraph (b), after “information” insert “or documents”.

(3) In section 143 (information notices: restrictions)—

(a) in subsection (1)(b)(ii), for “is” substitute “or documents are”,

(b) in subsection (2), after “information”, in the second place it occurs, insert “or documents”,

(c) in subsection (3), for “in respect” substitute “or documents to the extent that requiring the person to do so would result in the disclosure”,

(d) in subsection (4), for “in respect” substitute “or documents to the extent that requiring the person to do so would result in the disclosure”, and

(e) in subsection (6), after “information”, in the second place it occurs, insert “or documents”.

(4) In section 145 (information orders)—

(a) in subsection (2)—

(i) in paragraph (a), after “information”, in the first place it occurs, insert “or documents”, and

(ii) in paragraph (b), after “information” insert “or documents”, and

(b) in subsection (3)—

(i) in paragraph (a), after “information” insert “or documents”,

(ii) in paragraph (b), after “information” insert “or documents”, and

(iii) in paragraph (c), after “information” insert “or documents”.

(5) In section 148(1) (destroying or falsifying information and documents etc), in paragraph (a), after “information”, in the second place it occurs, insert “or a document”.

(6) In section 160 (guidance about regulatory action), in subsection (3)(a), for “is” substitute “or documents are”.

(7) In Schedule 17 (review of processing of personal data for the purposes of journalism), in paragraph 2(2) (information notices)—

(a) in paragraph (a), for “is” substitute “or documents are”, and

(b) in the words after paragraph (b), after “information” insert “or documents”.

Power of the Commissioner to require a report

98

(1) The 2018 Act is amended as follows.

(2) In section 146 (assessment notices)—

(a) in subsection (2), after paragraph (i), insert—

(j) make arrangements for an approved person to prepare a report on a specified matter; (k) provide to the Commissioner a report prepared in pursuance of such arrangements.

(b) after subsection (3) insert—

(3A) An assessment notice that requires a controller or processor to make arrangements for an approved person to prepare a report may require the arrangements to include specified terms as to— (a) the preparation of the report; (b) the contents of the report; (c) the form in which the report is to be provided; (d) the date by which the report is to be completed.

(11A) Where the Commissioner gives an assessment notice that requires the controller or processor to make arrangements for an approved person to prepare a report, the controller or processor is liable for the payment of the approved person’s remuneration and expenses under the arrangements.

, and

(d) in subsection (12), before the definition of “domestic premises” insert—

“approved person”, in relation to a report, means a person approved to prepare the report in accordance with section 146A;

(3) After section 146 insert—

(146A) (1) This section applies where an assessment notice requires a controller or processor to make arrangements for an approved person to prepare a report. (2) The controller or processor must, within such period as is specified in the assessment notice, nominate to the Commissioner a person to prepare the report. (3) If the Commissioner is satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor approve the nominated person to prepare the report. (4) If the Commissioner is not satisfied that the nominated person is a suitable person to prepare the report, the Commissioner must by written notice to the controller or processor— (a) inform the controller or processor that the Commissioner has decided not to approve the nominated person to prepare the report, (b) inform the controller or processor of the reasons for that decision, and (c) approve a person who the Commissioner is satisfied is a suitable person to prepare the report to do so. (5) If the controller or processor does not nominate a person within the period specified in the assessment notice, the Commissioner must by written notice to the controller or processor approve a person who the Commissioner is satisfied is a suitable person to prepare the report to do so. (6) It is the duty of the controller or processor to give the person approved to prepare the report all such assistance as the person may reasonably require to prepare the report.

(4) In section 155 (penalty notices), in subsection (1)—

(a) omit the “or” at the end of paragraph (a), and

(b) at the end of paragraph (b) insert

, or (c) has failed to comply with a duty imposed on the person by section 146A(6).

(5) In section 160 (guidance about regulatory action), in subsection (4), after paragraph (a) insert—

(aa) provision specifying factors to be considered in determining whether to give an assessment notice to a person that imposes a requirement of a sort mentioned in section 146(2)(j); (ab) provision about the factors the Commissioner may take into account when determining the suitability of a person to prepare a report of a sort mentioned in section 146(2)(j);

Assessment notices: removal of OFSTED restriction

99

In section 147 of the 2018 Act (assessment notices: restrictions), in subsection (6), omit paragraph (b) and the “or” before it.

Interview notices

100

(1) The 2018 Act is amended as follows.

(2) After section 148 insert—

(148A) (1) This section applies where the Commissioner suspects that a controller or processor— (a) has failed or is failing as described in section 149(2), or (b) has committed or is committing an offence under this Act. (2) For the purpose of investigating the suspected failure or offence, the Commissioner may, by written notice (an “interview notice”), require an individual within subsection (3) to— (a) attend at a place specified in the notice, and (b) answer questions with respect to any matter relevant to the investigation. (3) An individual is within this subsection if the individual— (a) is the controller or processor, (b) is or was at any time employed by, or otherwise working for, the controller or processor, or (c) is or was at any time concerned in the management or control of the controller or processor. (4) An interview notice must specify the time at which the individual must attend at the specified place and answer questions (but see the restrictions in subsections (6) and (7)). (5) An interview notice must— (a) indicate the nature of the suspected failure or offence that is the subject of the investigation, (b) provide information about the consequences of failure to comply with the notice, and (c) provide information about the rights under sections 162 and 164 (appeals etc). (6) An interview notice may not require an individual to attend at the specified place and answer questions before the end of the period within which an appeal can be brought against the notice. (7) If an appeal is brought against an interview notice, the individual to whom the notice is given need not attend at the specified place and answer questions pending the determination or withdrawal of the appeal. (8) If an interview notice— (a) states that, in the Commissioner’s opinion, it is necessary for the individual to attend at the specified place and answer questions urgently, and (b) gives the Commissioner’s reasons for reaching that opinion, subsections (6) and (7) do not apply but the notice must not require the individual to attend at the specified place and answer questions before the end of the period of 24 hours beginning when the notice is given. (9) The Commissioner may cancel or vary an interview notice by written notice to the individual to whom it was given. (148B) (1) An interview notice does not require an individual to answer questions to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament. (2) An interview notice does not require an individual to answer questions in respect of a communication which is made— (a) between a professional legal adviser and the adviser’s client, and (b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation. (3) An interview notice does not require an individual to answer questions in respect of a communication which is made— (a) between a professional legal adviser and the adviser’s client or between such an adviser or client and another person, (b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and (c) for the purposes of such proceedings. (4) In subsections (2) and (3), references to the client of a professional legal adviser include references to a person acting on behalf of the client. (5) An interview notice does not require an individual to answer questions if doing so would, by revealing evidence of the commission of an offence, expose the individual to proceedings for that offence. (6) The reference to an offence in subsection (5) does not include an offence under— (a) this Act; (b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath); (c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath); (d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements). (7) A statement made by an individual in response to an interview notice may not be used in evidence against that individual on a prosecution for an offence under this Act (other than an offence under section 148C) unless in the proceedings— (a) in giving evidence the individual provides information inconsistent with the statement, and (b) evidence relating to the statement is adduced, or a question relating to it is asked, by that individual or on that individual’s behalf. (8) The Commissioner may not give an interview notice with respect to the processing of personal data for the special purposes. (9) The Commissioner may not give an interview notice to an individual for the purpose of investigating a suspected failure or offence if the controller or processor suspected of the failure or offence is a body specified in section 23(3) of the Freedom of Information Act 2000 (bodies dealing with security matters). (148C) It is an offence for an individual, in response to an interview notice— (a) to make a statement which the individual knows to be false in a material respect, or (b) recklessly to make a statement which is false in a material respect.

(3) In section 149 (enforcement notices), in subsection (9)(b)—

(a) after “an assessment notice” insert “, an interview notice”, and

(b) after “147” insert “, 148A, 148B”.

(4) In section 155 (penalty notices), in subsection (1)(b), after “assessment notice” insert “, an interview notice”.

(5) In section 157 (maximum amount of penalty), in subsection (4), after “assessment notice” insert “, an interview notice”.

(6) In section 160 (guidance about regulatory action)—

(a) in subsection (1), after paragraph (b) insert—

(ba) interview notices,

, and

(b) after subsection (5) insert—

(5A) In relation to interview notices, the guidance must include— (a) provision specifying factors to be considered in determining whether to give an interview notice to an individual; (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an interview notice to an individual in reliance on section 148A(8) (urgent cases); (c) provision about the circumstances in which the Commissioner would consider it appropriate to vary the place or time specified in an interview notice at the request of the individual to whom the notice is given; (d) provision about the nature of interviews carried out in accordance with an interview notice; (e) provision about how the Commissioner will determine how to proceed if an individual does not comply with an interview notice.

(7) In section 162 (rights of appeal), in subsection (1), after paragraph (b) insert—

(ba) an interview notice;

(8) In section 164 (applications in respect of urgent notices)—

(a) in subsection (1), after “assessment notice” insert “, an interview notice”, and

(b) in subsection (5), after paragraph (b) (but before the “and” at the end of that paragraph) insert—

(ba) in relation to an interview notice, a statement under section 148A(8)(a),

(9) In section 181 (interpretation of Part 6), at the appropriate place, insert—

““interview notice” has the meaning given in section 148A;”.

(10) In section 196 (penalties for offences), in subsection (2), after “148,” insert “148C,”.

(11) In section 206 (index of defined expressions), at the appropriate place, insert—

interview notice (in Part 6)	section 181

(12) In Schedule 17 (review of processing of personal data for the purposes of journalism)—

(a) after paragraph 3 insert—

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.