Data (Use and Access) Act 2025

(3A) (1) Sub-paragraph (2) applies where the Commissioner gives an interview notice to an individual during a relevant period. (2) If the interview notice— (a) states that, in the Commissioner’s opinion, it is necessary for the individual to comply with a requirement in the notice for the purposes of the relevant review, and (b) gives the Commissioner’s reasons for reaching that opinion, subsections (6) and (7) of section 148A do not apply but the notice must not require the individual to comply with the requirement before the end of the period of 24 hours beginning when the notice is given. (3) During a relevant period, section 148B has effect as if for subsection (8) there were substituted— (8) The Commissioner may not give an individual an interview notice with respect to the processing of personal data for the special purposes unless a determination under section 174 with respect to the data or the processing has taken effect.

, and

• (b) in paragraph 4 (applications in respect of urgent notices)—

• (i) for “or assessment notice” substitute “, assessment notice or interview notice”,

• (ii) for “or 3(2)(a)” substitute “, 3(2)(a) or 3A(2)(a)”, and

• (iii) for “or 146(8)(a)” substitute “, 146(8)(a) or 148A(8)(a)”.

Penalty notices

101

• (1) The 2018 Act is amended as follows.

• (2) In paragraph 2 of Schedule 16 (notice of intent to impose penalty), omit sub-paragraphs (2) and (3).

• (3) In paragraph 4 of that Schedule (giving a penalty notice)—

• (a) before sub-paragraph (1) insert—

(A1) This paragraph applies where the Commissioner gives a notice of intent to a person. (A2) Within the period of 6 months beginning when the notice is given, or as soon as reasonably practicable thereafter, the Commission must give to the person— (a) a penalty notice, or (b) written notice that the Commissioner has decided not to give a penalty notice to the person.

,

• (b) in sub-paragraph (1)—

• (i) at the beginning, insert “But”, and

• (ii) after “penalty notice” insert “to the person”, and

• (c) in sub-paragraph (2), for “a person” substitute “the person”.

• (4) In section 160 (guidance about regulatory action), in subsection (7), after paragraph (d) insert—

(e) provision about the circumstances in which the Commissioner would consider it necessary to comply with the duty in paragraph 4(A2) of Schedule 16 after the period of 6 months mentioned in that paragraph.

Annual report on regulatory action

102

• (1) The 2018 Act is amended as follows.

• (2) In section 139 (reporting to Parliament), before subsection (3) insert—

(2A) The report under this section may include the annual report under section 161A.

• (3) In the italic heading before section 160, at the end insert “and report”.

• (4) After section 161 insert—

(161A) (1) The Commissioner must produce and publish an annual report containing the information described in subsections (2) to (5). (2) The report must include the following information about UK GDPR investigations— (a) the number of investigations begun, continued or completed by the Commissioner during the reporting period, (b) the different types of act and omission that were the subject matter of the investigations, (c) the enforcement powers exercised by the Commissioner in the reporting period in connection with the investigations, (d) the duration of investigations that ended in the reporting period, and (e) the different types of outcome in investigations that ended in that period. (3) The report must include information about the enforcement powers exercised by the Commissioner in the reporting period in connection with— (a) processing of personal data by a competent authority for any of the law enforcement purposes, and (b) processing of personal data to which Part 4 applies. (4) The information included in the report in accordance with subsections (2) and (3) must include information about— (a) the number of penalty notices given in the reporting period that were given more than 6 months after the notice of intent was given under paragraph 2 of Schedule 16, and (b) the reasons why that happened. (5) The report must include a review of how the Commissioner had regard to the guidance published under section 160 when exercising the Commissioner’s enforcement powers as described in subsections (2)(c) and (3). (6) In this section— - “enforcement powers” means the powers under—Article 58(1)(c) and (d) and (2)(a) and (b) of the UK GDPR,sections 142 to 159 of this Act,paragraph 2(a), (b) and (c) of Schedule 13 to this Act, andSchedules 15 and 16 to this Act; - “the law enforcement purposes” has the meaning given in section 31 of this Act; - “the reporting period” means the period to which the report relates; - “UK GDPR investigation” means an investigation required under Article 57(1)(h) of the UK GDPR (investigations on the application of the UK GDPR).

Complaints by data subjects

103

• (1) The 2018 Act is amended in accordance with subsections (2) and (3).

• (2) Before section 165 (but after the italic heading before it) insert—

(164A) (1) A data subject may make a complaint to the controller if the data subject considers that, in connection with personal data relating to the data subject, there is an infringement of the UK GDPR or Part 3 of this Act. (2) A controller must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means. (3) If a controller receives a complaint under this section, the controller must acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received. (4) If a controller receives a complaint under this section, the controller must without undue delay— (a) take appropriate steps to respond to the complaint, and (b) inform the complainant of the outcome of the complaint. (5) The reference in subsection (4)(a) to taking appropriate steps to respond to the complaint includes— (a) making enquiries into the subject matter of the complaint, to the extent appropriate, and (b) informing the complainant about progress on the complaint. (164B) (1) The Secretary of State may by regulations require a controller to notify the Commissioner of the number of complaints made to the controller under section 164A in periods specified or described in the regulations. (2) Regulations under this section may provide that a controller is required to make a notification to the Commissioner in respect of a period only in circumstances specified in the regulations. (3) Regulations under this section may include— (a) provision about a matter listed in subsection (4), or (b) provision conferring power on the Commissioner to determine those matters. (4) The matters are— (a) the form and manner in which a notification must be made, (b) the time at which, or period within which, a notification must be made, and (c) how the number of complaints made to a controller during a period is to be calculated. (5) Regulations under this section are subject to the negative resolution procedure.

• (3) In section 165 (complaints by data subjects to the Commissioner)—

• (a) omit subsection (1), and

• (b) in subsection (2), after “infringement of” insert “the UK GDPR or”.

• (4) The UK GDPR is amended in accordance with subsections (5) and (6).

• (5) In Article 57 (Commissioner’s tasks)—

• (a) in paragraph 1, omit point (f), and

• (b) omit paragraph 2.

• (6) Omit Article 77 (right to lodge a complaint with the Commissioner).

• (7) Schedule 10 to this Act contains minor and consequential amendments.

Court procedure in connection with subject access requests

104

• (1) The 2018 Act is amended as follows.

• (2) For the italic heading before section 180 substitute—

.

• (3) After section 180 insert—

(180A) (1) This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under— (a) Article 15 of the UK GDPR (right of access by the data subject); (b) Article 20 of the UK GDPR (right to data portability); (c) section 45 of this Act (law enforcement processing: right of access by the data subject); (d) section 94 of this Act (intelligence services processing: right of access by the data subject). (2) The court may require the controller to make available for inspection by the court so much of the information as is available to the controller. (3) But, unless and until the question in subsection (1) has been determined in the data subject’s favour, the court may not require the information to be disclosed to the data subject or the data subject’s representatives, whether by discovery (or, in Scotland, recovery) or otherwise. (4) Where the question in subsection (1) relates to a right under a provision listed in subsection (1)(a), (c) or (d), this section does not confer power on the court to require the controller to carry out a search for information that is more extensive than the reasonable and proportionate search required by that provision.

Consequential amendments to the EITSET Regulations

105

• (1) Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) (Commissioner’s enforcement powers) is amended as follows.

• (2) In paragraph 1 (provisions of the 2018 Act applied for enforcement purposes)—

• (a) after paragraph (g) insert—

(ga) section 146A (assessment notices: approval of person to prepare report etc);

, and

• (b) after paragraph (i) insert—

(ia) section 148A (interview notices); (ib) section 148B (interview notices: restrictions); (ic) section 148C (false statements made in response to interview notices);

.

• (3) In paragraph 4(2) (modification of section 143 (information notices: restrictions))—

• (a) in paragraph (b), for “or 148” substitute “, 148 or 148C”, and

• (b) in paragraph (c), after “148” insert “or 148C”.

• (4) In paragraph 6 (modification of section 146 (assessment notices)), in sub-paragraph (2)—

• (a) for paragraph (b) substitute—

(b) subsection (2) has effect as if— (i) for “controller or processor” there were substituted “trust service provider”; (ii) paragraphs (h) and (i) were omitted;

,

• (b) in paragraph (c), for “subsections (7), (8), (9) and (10)” substitute “subsections (3A), (7), (8), (9), (10) and (11A)”, and

• (c) in paragraph (d), for “or 148” substitute “, 148 or 148C”.

• (5) After paragraph 6 insert—

(6A) Section 146A has effect as if for “controller or processor” (in each place) there were substituted “trust service provider”.

• (6) After paragraph 7 insert—

(7A) Section 148A has effect as if— (a) in subsection (1)— (i) for “controller or processor” there were substituted “trust service provider”; (ii) in paragraph (a), for “as described in section 149(2)” there were substituted “to comply with the eIDAS requirements”; (iii) in paragraph (b), for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”; (b) in subsection (3), for “controller or processor” (in each place) there were substituted “trust service provider”. (7B) (1) Section 148B has effect as if subsections (8) and (9) were omitted. (2) In that section— (a) subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “the eIDAS Regulation or the EITSET Regulations”; (b) subsection (6)(a) has effect as if for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”; (c) subsection (7) has effect as if for “this Act (other than an offence under section 148C)” there were substituted “section 144 or 148 or paragraph 15 of Schedule 15”.

• (7) In paragraph 12 (modification of Schedule 15 (powers of entry and inspection)), in sub-paragraph (2), in the substituted paragraph (a), for “or 148” substitute “, 148 or 148C”.

• (8) In paragraph 13 (modification of section 155 (penalty notices)), in sub-paragraph (3)(c), for “for “data subjects”” there were substituted “for the words from “data subjects” to the end”.

• (9) Omit paragraph 21 (modification of section 182 (regulations and consultation)) and the heading before it.

• (10) In paragraph 22 (modification of section 196 (penalties for offences)), in sub-paragraph (2)(b)—

• (a) after “148”, in the first place it occurs, insert “, 148C”, and

• (b) for “or 148” substitute “, 148 or 148C”.

Protection of prohibitions, restrictions and data subject’s rights

Protection of prohibitions, restrictions and data subject’s rights

106

• (1) The 2018 Act is amended in accordance with subsections (2) to (5).

• (2) After section 183 insert—

(183A) (1) A relevant enactment or rule of law which imposes a duty, or confers a power, to process personal data does not override a requirement under the main data protection legislation relating to the processing of personal data. (2) Subsection (1) does not apply— (a) to a relevant enactment forming part of the main data protection legislation, or (b) to the extent that an enactment makes express provision to the contrary referring to this section or to the main data protection legislation (or a provision of that legislation). (3) Subsection (1) does not prevent a duty or power to process personal data from being taken into account for the purpose of determining whether it is possible to rely on an exception to a requirement under the main data protection legislation that is available where there is such a duty or power. (4) In this section— - “the main data protection legislation” means the data protection legislation other than provision of or made under—Chapter 6 or 8 of the UK GDPR, orParts 5 to 7 of this Act; - “relevant enactment” means an enactment so far as passed or made on or after the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force; - “requirement” includes a prohibition or restriction. (5) The reference in subsection (1) to an enactment or rule of law which imposes a duty, or confers a power, to process personal data is a reference to an enactment or rule of law which, directly or indirectly, requires or authorises the processing of personal data, including (for example)— (a) by authorising one person to require another person to process personal data, or (b) by removing restrictions on processing personal data, and the references in subsection (3) to a duty or power are to be read accordingly.

• (3) Before section 184 (and the italic heading before it) insert—

(183B) (1) This section is about the relationship between— (a) a pre-commencement enactment which imposes a duty, or confers a power, to process personal data, and (b) a provision of the main data protection legislation containing a requirement relating to the processing of personal data. (2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act). (3) Where the provision described in subsection (1)(b) is a provision of, or made under, the UK GDPR, section 5(A2) of the European Union (Withdrawal) Act 2018 (assimilated direct legislation subject to domestic enactments) does not apply to the relationship. (4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision with similar effect to section 183A(1) (or applying that provision) is made in connection with one such relationship but not another. (5) In this section— (a) “the main data protection legislation” and “requirement” have the same meaning as in section 183A, and (b) “pre-commencement enactment” means an enactment so far as passed or made before the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force. (6) Section 183A(5) applies for the purposes of subsection (1)(a) of this section as it applies for the purposes of section 183A(1).

• (4) In section 186 (data subject’s rights and other prohibitions and restrictions)—

• (a) for the heading substitute “Protection of data subject’s rights”,

• (b) in subsection (1) omit “, except as provided by or under the provisions listed in subsection (3)”,

• (c) after subsection (2) insert—

(2A) Subsection (1) does not apply— (a) to an enactment contained in, or made under, a provision listed in subsection (2), (b) to an enactment contained in, or made under, a provision listed in subsection (3), (c) to the extent that an enactment makes express provision to the contrary referring to this section or to a provision listed in subsection (2), or (d) to the extent that subsection (1) is disapplied by section 186A(3).

, and

• (d) in subsection (3)—

• (i) for “provisions providing exceptions” substitute “provisions referred to in subsection (2A)(b)”, and

• (ii) omit paragraph (c) (and the “and” after it).

• (5) After section 186 insert—

(186A) (1) This section is about the relationship between— (a) a pre-commencement enactment which prohibits or restricts the disclosure of information or authorises the withholding of information, and (b) a provision of the UK GDPR or this Act listed in section 186(2). (2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act). (3) Subsection (1) of section 186 does not apply to the relationship so far as there is a contrary intention, whether express or implied (taking account of, among other things, subsection (2) of this section). (4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision stating that section 186(1) applies (or with similar effect) is made in connection with one such relationship but not another. (5) In this section, “pre-commencement enactment” means an enactment so far as passed or made before the day on which section 106(4) of the Data (Use and Access) Act 2025 comes into force, other than an enactment contained in, or made under, a provision listed in section 186(2) or (3).

• (6) In section 5 of the European Union (Withdrawal) Act 2018 (exceptions to savings and incorporation), in subsection (A3)(a)—

• (a) for “section” substitute “sections 183A and”,

• (b) for “(data subject’s rights and other prohibitions and restrictions)” substitute “(protection of prohibitions, restrictions and data subject’s rights)”, and

• (c) at the end insert “(and see also section 183B(3) of that Act)”.

• (7) Subsections (3), (5) and (6)(c) are to be treated as having come into force on 1 January 2024.

Miscellaneous

Regulations under the UK GDPR

107

• (1) In the UK GDPR, after Chapter 9 insert—

(Article 91A) (1) This Article makes provision about regulations made by the Secretary of State under this Regulation (“UK GDPR regulations”). (2) Before making UK GDPR regulations, the Secretary of State must consult— (a) the Commissioner, and (b) such other persons as the Secretary of State considers appropriate. (3) Paragraph 2 does not apply to regulations made under Article 49 or 49A where the Secretary of State has made an urgency statement in respect of them. (4) UK GDPR regulations may— (a) make different provision for different purposes; (b) include consequential, supplementary, incidental, transitional, transitory or saving provision. (5) UK GDPR regulations are to be made by statutory instrument. (6) For the purposes of this Regulation, where regulations are subject to “the negative resolution procedure”, the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament. (7) For the purposes of this Regulation, where regulations are subject to “the affirmative resolution procedure”, the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament. (8) For the purposes of this Regulation, where regulations are subject to “the made affirmative resolution procedure”— (a) the statutory instrument containing the regulations must be laid before Parliament after being made, together with the urgency statement in respect of them, and (b) the regulations cease to have effect at the end of the period of 120 days beginning with the day on which the instrument is made, unless within that period the instrument is approved by a resolution of each House of Parliament. (9) In calculating the period of 120 days, no account is to be taken of any whole days that fall within a period during which— (a) Parliament is dissolved or prorogued, or (b) both Houses of Parliament are adjourned for more than 4 days. (10) Where regulations cease to have effect as a result of paragraph 8, that does not— (a) affect anything previously done under the regulations, or (b) prevent the making of new regulations. (11) Any provision that may be included in UK GDPR regulations subject to the negative resolution procedure may be made by regulations made under this Regulation or another enactment that are subject to the affirmative resolution procedure or the made affirmative resolution procedure. (12) A requirement under this Article to consult may be satisfied by consultation before, as well as by consultation after, the provision conferring the power to make regulations comes into force. (13) In this Article, “urgency statement”, in relation to regulations, means a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.

• (2) In section 3(9) of the 2018 Act (definition of “data protection legislation”), in paragraph (d), after “Act” insert “or the UK GDPR”.

Further minor provision about data protection

108

Schedule 11 contains further minor provision about data protection.

Chapter 2 — Privacy and electronic communications

The PEC Regulations

109

In this Chapter, “the PEC Regulations” means the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426).

Interpretation of the PEC Regulations

110

• (1) Regulation 2 of the PEC Regulations (interpretation) is amended as follows.

• (2) In paragraph (1)—

• (a) in the definition of “call”, at the end insert “, and a reference to making a call includes a reference to attempting to establish such a connection”,

• (b) in the definition of “communication”—

• (i) for “exchanged or conveyed between” substitute “transmitted to”, and

• (ii) for “conveyed”, in the second place it occurs, substitute “transmitted”, and

• (c) at the appropriate place insert—

• “direct marketing” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;

.

• (3) After paragraph (1) insert—

(1A) In the application of these Regulations in relation to— (a) information that is sent but not received, (b) a communication that is transmitted but not received, (c) an electronic mail that is sent but not received, or (d) an unsuccessful attempt to make a call, a reference to the recipient of the information, communication, electronic mail or call is to be read as a reference to the intended recipient.

• (4) In paragraph (4) omit “, without prejudice to paragraph (3),”.

• (5) After that paragraph insert—

(5) References in these Regulations to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of the Periods of Time Regulation, except that Article 3(4) of that Regulation does not apply to the interpretation of a reference to a period in regulation 16A. (6) In paragraph (5), “the Periods of Time Regulation” means Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.

Duty to notify the Commissioner of personal data breach: time periods

111

• (1) In regulation 5A of the PEC Regulations (personal data breach)—

• (a) in paragraph (2), after “delay” insert “and, where feasible, not later than 72 hours after having become aware of it”, and

• (b) after paragraph (3) insert—

(3A) Where notification under paragraph (2) is not made within 72 hours, it must be accompanied by reasons for the delay.

• (2) In regulation 5C of the PEC Regulations (personal data breach: fixed monetary penalty)—

• (a) in paragraph (4)(f), for “from the service of the notice of intent” substitute “beginning when the notice of intent is served”, and

• (b) in paragraph (5), for “21 days of receipt of the notice of intent” substitute “the period of 21 days beginning when the notice of intent is received”.

• (3) In Article 2 of Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications (notification to the Commissioner)—

• (a) in paragraph 2—

• (i) in the first subparagraph, for the words from “no” to “feasible” substitute “without undue delay and, where feasible, not later than 72 hours after having become aware of it”,

• (ii) in the second subparagraph, after “shall” insert “, subject to paragraph 3,”, and

• (iii) after the third subparagraph insert—

This paragraph is to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.

, and

• (b) for paragraph 3 substitute—

(3) To the extent that the information set out in Annex 1 is not available to be included in the notification, it may be provided in phases without undue further delay.

Storing information in the terminal equipment of a subscriber or user

112

• (1) The PEC Regulations are amended in accordance with subsections (2) and (3).

• (2) For regulation 6 (storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user) substitute—

(6) (1) Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user. (2) In paragraph (1) and Schedule A1— (a) a reference (however expressed) to storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user includes a reference to instigating the storage or access, and (b) except as otherwise provided, a reference (however expressed) to gaining access to information stored in the terminal equipment of a subscriber or user includes a reference to collecting or monitoring information automatically emitted by the terminal equipment.

• (3) After regulation 6 insert—

(6A) (1) The Secretary of State may by regulations made by statutory instrument— (a) amend these Regulations— (i) by adding an exception to the prohibition in regulation 6(1), or (ii) by omitting or varying an exception to that prohibition, and (b) make consequential, supplementary, incidental, transitional, transitory or saving provision, including provision amending these Regulations. (2) Regulations under paragraph (1) may make different provision for different purposes. (3) Before making regulations under paragraph (1), the Secretary of State must consult— (a) the Information Commissioner, and (b) such other persons as the Secretary of State considers appropriate. (4) A statutory instrument containing regulations under paragraph (1) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

• (4) Schedule 12 to this Act inserts Schedule A1 to the PEC Regulations.

• (5) A requirement to consult under regulation 6A of the PEC Regulations (inserted by subsection (3) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.

Emergency alerts: interpretation of time periods

113

In regulation 16A of the PEC Regulations (emergency alerts), in paragraph (6), for the words from “7 days” to “paragraph (3)(b)” substitute “the period of 7 days beginning with the day on which the time period specified by the relevant public authority pursuant to paragraph (3)(b) expires”.

Use of electronic mail for direct marketing by charities

114

• (1) Regulation 22 of the PEC Regulations (use of electronic mail for direct marketing purposes) is amended as follows.

• (2) In paragraph (2), after “paragraph (3)” insert “or (3A)”.

• (3) After paragraph (3) insert—

(3A) A charity may send or instigate the sending of electronic mail for the purposes of direct marketing where— (a) the sole purpose of the direct marketing is to further one or more of the charity’s charitable purposes; (b) the charity obtained the contact details of the recipient of the electronic mail in the course of the recipient— (i) expressing an interest in one or more of the purposes that were the charity’s charitable purposes at that time; or (ii) offering or providing support to further one or more of those purposes; and (c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of their contact details for the purposes of direct marketing by the charity, at the time that the details were initially collected, and, where the recipient did not initially refuse the use of the details, at the time of each subsequent communication.

• (4) After paragraph (4) insert—

(5) In this regulation, “charity” means— (a) a charity as defined in section 1(1) of the Charities Act 2011, (b) a charity as defined in section 1(1) of the Charities Act (Northern Ireland) 2008 (c. 12 (N.I.)), including an institution treated as such a charity for the purposes of that Act by virtue of the Charities Act 2008 (Transitional Provision) Order (Northern Ireland) 2013 (S.R. (N.I.) 2013 No. 211), and (c) a body entered in the Scottish Charity Register, other than a body which no longer meets the charity test in section 7 of the Charities and Trustee Investment (Scotland) Act 2005 (asp 10), and, in relation to such a charity, institution or body, “charitable purpose” has the meaning given in the relevant Act.

Commissioner’s enforcement powers

115

• (1) The PEC Regulations are amended in accordance with subsections (2) to (8).

• (2) In regulation 5 (security of public electronic communications services), omit paragraph (6).

• (3) Omit regulation 5B (personal data breach: audit).

• (4) In regulation 5C (personal data breach: fixed monetary penalty)—

• (a) in paragraph (10)—

• (i) omit “and Northern Ireland”, and

• (ii) in paragraph (a), for “a county court” substitute “the county court”, and

• (b) after paragraph (11) insert—

(12) In Northern Ireland, the penalty is recoverable— (a) if a county court so orders, as if it were payable under an order of that court; (b) if the High Court so orders, as if it were payable under an order of that court. (13) The Secretary of State may by regulations made by statutory instrument amend this regulation so as to substitute a different amount for the amount for the time being specified in paragraph (2) or (5). (14) Regulations under paragraph (13) may make transitional provision. (15) Before making regulations under paragraph (13), the Secretary of State must consult— (a) the Information Commissioner, and (b) such other persons as the Secretary of State considers appropriate. (16) A statutory instrument containing regulations under this regulation may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

• (5) For regulation 31 substitute—

(31) (1) Schedule 1 provides for certain provisions of Parts 5 to 7 of the Data Protection Act 2018 to apply with modifications for the purposes of enforcing these Regulations. (2) In regulations 32 and 33, “enforcement functions” means the functions of the Information Commissioner under those provisions, as applied by that Schedule.

• (6) Omit regulation 31A (third party information notices).

• (7) Omit regulation 31B (appeals against third party information notices).

• (8) For Schedule 1 substitute the Schedule set out in Schedule 13 to this Act.

• (9) In paragraph 58(1) of Schedule 20 to the Data Protection Act 2018 (transitional provision relating to the PEC Regulations) for “regulations 2, 31 and 31B of, and Schedule 1 to,” substitute “regulation 2 of”.

• (10) A requirement to consult under regulation 5C(15) of the PEC Regulations (inserted by subsection (4)(b) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.

Codes of conduct

116

• (1) The PEC Regulations are amended as follows.

• (2) After regulation 32 insert—

(32A) (1) The Commissioner must encourage representative bodies to produce codes of conduct intended to contribute to compliance with these Regulations. (2) Under paragraph (1), the Commissioner must encourage representative bodies to produce codes which take account of, among other things, the specific features of different sectors. (3) A code of conduct described in paragraph (1) may, for example, make provision with regard to— (a) rights and obligations under these Regulations; (b) out-of-court proceedings and other dispute resolution procedures for resolving disputes arising in connection with these Regulations. (4) The Commissioner must encourage representative bodies to submit codes of conduct described in paragraph (1) to the Commissioner in draft. (5) Where a representative body does so, the Commissioner must— (a) provide the representative body with an opinion on whether the code correctly reflects the requirements of these Regulations, (b) decide whether to approve the code, and (c) if the code is approved, register and publish the code. (6) The Commissioner may only approve a code if, among other things— (a) the code contains a mechanism for monitoring whether persons who undertake to apply the code comply with its provisions, and (b) in relation to persons other than public bodies, the mechanism involves monitoring by a body which is accredited for that purpose by the Commissioner under regulation 32B. (7) In relation to amendments of a code of conduct that is for the time being approved under this regulation— (a) paragraphs (4) and (5) apply as they apply in relation to a code, and (b) the requirements in paragraph (6) must be satisfied by the code as amended. (8) A code of conduct described in paragraph (1) may be contained in the same document as a code of conduct described in Article 40 of the UK GDPR (and a provision contained in such a document may be a provision of both codes). (9) In this regulation— - “public body” has the meaning given in section 7 of the Data Protection Act 2018 (for the purposes of the UK GDPR); - “representative body” means an association or other body representing categories of—communications providers, orother persons engaged in activities regulated by these Regulations; - “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018. (32B) (1) The Commissioner may, in accordance with this regulation, accredit a body for the purpose of monitoring whether persons other than public bodies comply with a code of conduct described in regulation 32A(1). (2) The Commissioner may accredit a body only where the Commissioner is satisfied that the body has— (a) demonstrated its independence, (b) demonstrated that it has an appropriate level of expertise in relation to the subject matter of the code, (c) established procedures which allow it— (i) to assess a person’s eligibility to apply the code, (ii) to monitor compliance with the code, and (iii) to review the operation of the code periodically, (d) established procedures and structures to handle complaints about infringements of the code or about the manner in which the code has been, or is being, implemented by a person, (e) made arrangements to publish information about the procedures and structures described in sub-paragraph (d), and (f) demonstrated that it does not have a conflict of interest. (3) The Commissioner must prepare and publish guidance about how the Commissioner proposes to take decisions about accreditation under this regulation. (4) A body accredited under this regulation in relation to a code must take appropriate action where a person infringes the code. (5) If the action taken by a body under paragraph (4) consists of suspending or excluding a person from the code, the body must inform the Commissioner, giving reasons for taking that action. (6) The Commissioner must revoke the accreditation of a body under this regulation if the Commissioner considers that the body— (a) no longer meets the requirements for accreditation, or (b) has failed, or is failing, to comply with paragraph (4) or (5). (7) In this regulation, “public body” has the same meaning as in regulation 32A. (32C) Adherence to a code of conduct approved under regulation 32A may be used by a person as a means of demonstrating compliance with these Regulations.

• (3) In regulation 33 (technical advice to the Commissioner)—

• (a) omit “, in connection with his enforcement functions,” and

• (b) at the end insert

where the request is made in connection with— (a) the Commissioner’s enforcement functions, or (b) the Commissioner’s functions under regulation 32A or 32B (codes of conduct).

• (4) In Schedule 1 (Commissioner’s enforcement powers) (inserted by Schedule 13 to this Act), in paragraph 18(b)(ii) (maximum amount of penalty), for “or 24” substitute “, 24 or 32B(4) or (5)”.

Part 6 — The Information Commission

The Information Commission

117

• (1) The Data Protection Act 2018 is amended in accordance with subsections (2) to (5).

• (2) After section 114 insert—

(114A) (1) A body corporate called the Information Commission is established. (2) Schedule 12A makes further provision about the Commission.

• (3) In section 3 (terms relating to the processing of personal data), after subsection (8) insert—

(8A) “The Commission” means the Information Commission (see section 114A).

• (4) In section 205(2) (references to periods of time)—

• (a) omit paragraph (l), and

• (b) after that paragraph insert—

(la) paragraph 22(6) of Schedule 12A;

.

• (5) In section 206 (index of defined expressions), in the Table, at the appropriate place insert—

the Commission	section 3

.

• (6) Schedule 14 to this Act—

• (a) inserts Schedule 12A to the Data Protection Act 2018, and

• (b) makes transitional provision relating to—

• (i) the person who holds the office of Information Commissioner immediately before the day on which Schedule 14 comes into force, and

• (ii) consultation about certain appointments.

Abolition of the office of Information Commissioner

118

• (1) The office of Information Commissioner is abolished.

• (2) Accordingly, the Data Protection Act 2018 is amended as follows.

• (3) In section 3 (terms relating to the processing of personal data) omit subsection (8).

• (4) Omit section 114 (the Information Commissioner) and the italic heading before that section.

• (5) In section 206 (index of defined expressions), in the Table, omit the entry for the Commissioner.

• (6) In section 214(1) (extent)—

• (a) omit “and” at the end of paragraph (a), and

• (b) omit paragraph (b).

• (7) Omit Schedule 12 (the Information Commissioner).

Transfer of functions to the Information Commission

119

• (1) The functions of the Information Commissioner are transferred to the Information Commission.

• (2) So far as is appropriate in consequence of subsection (1), a reference to the Information Commissioner (however expressed) in an enactment or other document whenever passed or made (including this Act) is to be treated as a reference to the Information Commission.

• (3) In this section, “enactment” includes—

• (a) an enactment comprised in subordinate legislation (as defined in section 21 of the Interpretation Act 1978),

• (b) an enactment comprised in, or in an instrument made under, a Measure or Act of Senedd Cymru,

• (c) an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament,

• (d) an enactment comprised in, or in an instrument made under, Northern Ireland legislation, and

• (e) assimilated direct legislation.

Transfer of property etc to the Information Commission

120

• (1) The Secretary of State may make a scheme for the transfer of property, rights and liabilities from the Information Commissioner to the Information Commission.

• (2) The things that may be transferred under a transfer scheme include—

• (a) property, rights and liabilities that could not otherwise be transferred;

• (b) property acquired, and rights and liabilities arising, after the making of the scheme.

• (3) A transfer scheme may—

• (a) make provision about the continuing effect of things done by the Information Commissioner in respect of anything transferred;

• (b) make provision about the continuation of things (including legal proceedings) in the process of being done by, on behalf of or in relation to the Information Commissioner in respect of anything transferred;

• (c) make provision for references to the Information Commissioner in an instrument or other document in respect of anything transferred under a transfer scheme to be treated as references to the Information Commission;

• (d) make provision which is the same as or similar to the Transfer of Undertakings (Protection of Employment) Regulations 2006 (S.I. 2006/246);

• (e) make other consequential, supplementary, incidental or transitional provision.

• (4) A transfer scheme may provide—

• (a) for modifications by agreement;

• (b) for modifications to have effect from the date when the original scheme came into effect.

• (5) In this section, references to rights and liabilities include rights and liabilities relating to a contract of employment.

Part 7 — Other provision about use of, or access to, data

Information standards for health and social care

Information standards for health and adult social care in England

121

Schedule 15 makes provision about information standards for health and adult social care in England (under Part 9 of the Health and Social Care Act 2012) and information technology.

Smart meter communication services

Grant of smart meter communication licences

122

Schedule 16 makes provision in connection with the grant of smart meter communication licences.

Information to improve public service delivery

Disclosure of information to improve public service delivery to undertakings

123

• (1) Section 35 of the Digital Economy Act 2017 (disclosure of information to improve public service delivery) is amended as follows.

• (2) In subsection (9)—

• (a) in paragraph (a), for “or households” substitute “, households or undertakings”, and

• (b) in paragraph (b), for “or households” substitute “, households or undertakings”.

• (3) In subsection (10)—

• (a) the words after “its purpose” become paragraph (a), and

• (b) at the end of that paragraph, insert

, or (b) the assisting of undertakings in connection with any trade, business or charitable purpose.

• (4) After subsection (12) insert—

(13) In this section “undertaking” means— (a) any person, other than a public authority, carrying on a trade or business, whether or not with a view to profit, or (b) any body, or the trustees of a trust, established for charitable purposes only. (14) In this section, in so far as it forms part of the law of Scotland or Northern Ireland, “charitable purpose” has the same meaning as it has in the law of England and Wales (see section 2 of the Charities Act 2011).

Retention of information by providers of internet services

Retention of information by providers of internet services in connection with death of child

124

• (1) The Online Safety Act 2023 is amended as follows.

• (2) In section 100 (power to require information)—

• (a) omit subsection (7);

• (b) after subsection (8) insert—

(8A) The power to give a notice conferred by subsection (1) does not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).

• (3) In section 101 (information in connection with investigation into death of child)—

• (a) before subsection (1) insert—

(A1) Subsection (C1) applies if a senior coroner (in England and Wales), a procurator fiscal (in Scotland) or a coroner (in Northern Ireland) (“the investigating authority”)— (a) notifies OFCOM that they are conducting an investigation in connection with the death of a child, and (b) provides OFCOM with the details in subsection (B1). (B1) The details are— (a) the name of the child who has died, (b) the child’s date of birth, (c) any email addresses used by the child (so far as the investigating authority knows), and (d) if any regulated service has been brought to the attention of the investigating authority as being of interest in connection with the child’s death, the name of the service. (C1) Where this subsection applies, OFCOM— (a) must give a notice to the provider of a service within subsection (E1) requiring the provider to ensure the retention of information relating to the use of the service by the child who has died, and (b) may give a notice to any other relevant person requiring the person to ensure the retention of information relating to the use of a service within subsection (E1) by that child. (D1) The references in subsection (C1) to ensuring the retention of information relating to the child’s use of a service include taking all reasonable steps, without delay, to prevent the deletion of such information by the routine operation of systems or processes. (E1) A service is within this subsection if it is— (a) a regulated service of a kind described in regulations made by the Secretary of State, or (b) a regulated service notified to OFCOM by the investigating authority as described in subsection (B1)(d). (F1) A notice under subsection (C1) may require information described in that subsection to be retained only if it is information— (a) of a kind which OFCOM have power to require under a notice under subsection (1) (see, in particular, subsection (2)(a) to (d)), or (b) which a person might need to retain to enable the person to provide information in response to a notice under subsection (1) (if such a notice were given). (G1) OFCOM must share with the investigating authority any information they receive in response to requirements mentioned in section 102(5A)(d) that are included in a notice under subsection (C1).

;

• (b) in subsection (3), for “power conferred by subsection (1) includes” substitute “powers conferred by this section include”;

• (c) after subsection (5) insert—

(5A) The powers to give a notice conferred by this section do not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).

• (4) In section 102 (information notices)—

• (a) in subsection (1), for “101(1)” substitute “101(C1) or (1)”;

• (b) in subsection (3)—

• (i) after “information notice” insert “under section 100(1) or 101(1)”;

• (ii) omit the “and” at the end of paragraph (c);

• (iii) after paragraph (c) insert—

(ca) specify when the information must be provided (which may be on or by a specified date, within a specified period, or at specified intervals), and

;

• (c) omit subsection (4);

• (d) after subsection (5) insert—

(5A) An information notice under section 101(C1) must— (a) specify or describe the information to be retained, (b) specify why OFCOM require the information to be retained, (c) require the information to be retained for the period of one year beginning with the date of the notice, (d) require the person to whom the notice is given— (i) if the child to whom the notice relates used the service in question, to notify OFCOM by a specified date of steps taken to ensure the retention of information; (ii) if the child did not use the service, or the person does not hold any information of the kind required, to notify OFCOM of that fact by a specified date, and (e) contain information about the consequences of not complying with the notice. (5B) If OFCOM give an information notice to a person under section 101(C1), they may, in response to information received from the investigating authority, extend the period for which the person is required to retain information by a maximum period of six months. (5C) The power conferred by subsection (5B) is exercisable— (a) by giving the person a notice varying the notice under section 101(C1) and stating the further period for which information must be retained and the reason for the extension; (b) any number of times.

;

• (e) after subsection (9) insert—

(9A) OFCOM must cancel an information notice under section 101(C1) by notice to the person to whom it was given if advised by the investigating authority that the information in question no longer needs to be retained.

;

• (f) in subsection (10), after the definition of “information” insert—

• “the investigating authority” has the same meaning as in section 101;

.

• (5) In section 109 (offences in connection with information notices)—

• (a) in subsection (2)(b), for “all reasonable steps” substitute “all of the steps that it was reasonable, and reasonably practicable, to take”;

• (b) after subsection (6) insert—

(6A) A person who is given an information notice under section 101(C1) commits an offence if— (a) the person deletes or alters, or causes or permits the deletion or alteration of, any information required by the notice to be retained, and (b) the person’s intention was to prevent the information being available, or (as the case may be) to prevent it being available in unaltered form, for the purposes of any official investigation into the death of the child to whom the notice relates. (6B) For the purposes of subsection (6A) information has been deleted if it is irrecoverable (however that occurred).

• (6) In section 110 (senior managers’ liability: information offences)—

• (a) after subsection (6) insert—

(6A) An individual named as a senior manager of an entity commits an offence if— (a) the entity commits an offence under section 109(6A) (deletion etc of information), and (b) the individual has failed to take all reasonable steps to prevent that offence being committed.

;

• (b) in subsection (7), for “or (6)” substitute “, (6) or (6A)”.

• (7) In section 113 (penalties for information offences), in subsection (2)—

• (a) for “(4) or (5)” substitute “(4), (5) or (6A)”;

• (b) for “(5) or (6)” substitute “(5), (6) or (6A)”.

• (8) In section 114 (co-operation and disclosure of information: overseas regulators), in subsection (7), omit the definition of “the data protection legislation”.

• (9) In section 225 (Parliamentary procedure for regulations), in subsection (10), after paragraph (c) insert—

(ca) regulations under section 101(E1)(a),

.

• (10) In section 236(1) (interpretation)—

• (a) after the definition of “country” insert—

• “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);

;

• (b) in the definition of “information notice”, for “101(1)” substitute “101(C1) or (1)”.

• (11) In section 237 (index of defined terms), after the entry for “CSEA content” insert—

the data protection legislation	section 236

.

Information for research about online safety matters

Information for research about online safety matters

125

• (1) The Online Safety Act 2023 is amended in accordance with subsections (2) to (4).

• (2) After section 154 insert—

(154A) (1) The Secretary of State may by regulations require providers of regulated services to provide information for purposes related to the carrying out of independent research into online safety matters. (2) Regulations under this section may (for example) provide for— (a) the making of applications by persons seeking information; (b) the procedure to be followed in the making and determination of applications; (c) the grounds on which applications are to be determined; (d) the imposition of requirements described in subsection (1) to be effected by means of notices given to providers of regulated services (“researcher access notices”); (e) the contents of researcher access notices; (f) the procedure to be followed in the giving of researcher access notices; (g) the form in which, and the means by which, information is to be provided; (h) the safeguards to be applied in respect of the handling of information; (i) the charging of fees payable by applicants for information under the regulations and by providers of regulated services; (j) the enforcement of requirements imposed by the regulations; (k) appeals in respect of decisions taken under the regulations. (3) Provision about enforcement under subsection (2)(j) may include provision— (a) about investigations (including the making of reports); (b) conferring powers of entry, inspection and audit; (c) imposing monetary penalties; (d) creating offences, but such provision may not impose a penalty for an offence that is greater than a penalty of any of the descriptions mentioned in section 113. (4) Regulations under this section— (a) may authorise or require anything that is to be done under, or for the purposes of, the regulations to be done by an appropriate person; (b) may confer a discretion on an appropriate person for the purposes of provision under paragraph (a); (c) may apply (with or without modifications) other provisions of this Act. (5) Regulations under this section may apply generally or only in relation to specified descriptions of— (a) regulated services; (b) persons carrying out independent research; (c) research into online safety matters or the purposes of such research; (d) information, and provision made by virtue of section 224(1) in connection with this section may, in particular, make different provision for different descriptions of services, researchers, research or information. (6) Regulations under this section may not require— (a) processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed under the regulations to provide information is to be taken into account); (b) provision of information in respect of which a claim to legal professional privilege, or (in Scotland) to confidentiality of communications, could be maintained in legal proceedings. (7) Before making regulations under this section the Secretary of State must consult— (a) OFCOM, (b) the Information Commissioner, (c) persons who appear to the Secretary of State to represent providers of regulated services, (d) persons who appear to the Secretary of State to represent the interests of persons carrying out independent research into online safety matters, and (e) such other persons as the Secretary of State considers appropriate. (8) For the purposes of this section— (a) “independent research” is research carried out other than on behalf of a provider of a regulated service; (b) references to an “appropriate person” are references to— (i) OFCOM, or (ii) such other person as the Secretary of State considers appropriate to carry out functions under regulations made under this section (and the regulations may include provision establishing a body for this purpose).

• (3) In section 162 (OFCOM’s report about researchers’ access to information), omit subsections (7) to (10).

• (4) In section 225 (Parliamentary procedure for regulations), for subsections (8) and (9) substitute—

(8) A statutory instrument containing (whether alone or with other provision) the first regulations under the following provisions may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament— (a) section 154A(1); (b) paragraph 1(1) of Schedule 11. (9) Any other statutory instrument containing regulations under a provision mentioned in subsection (8) is subject to annulment in pursuance of a resolution of either House of Parliament.

• (5) The requirement to consult under section 154A(7) of the Online Safety Act 2023 (as inserted by subsection (2) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.

Retention of biometric data

Retention of biometric data and recordable offences

126

• (1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (10).

• (2) In section 18A(3) (retention of material: general), after “recordable offence” insert “or recordable-equivalent offence”.

• (3) Section 18E (supplementary provision) is amended in accordance with subsections (4) to (10).

• (4) In subsection (1), after the definition of “recordable offence” insert—

• “recordable-equivalent offence” means an offence under the law of a country or territory outside England and Wales and Northern Ireland where the act constituting the offence would constitute a recordable offence if done in England and Wales or Northern Ireland (whether or not the act constituted such an offence when the person was convicted);

.

• (5) In subsection (3), in the words before paragraph (a), after “offence” insert “in England and Wales or Northern Ireland”.

• (6) After subsection (5) insert—

(5A) For the purposes of section 18A, a person is to be treated as having been convicted of an offence in a country or territory outside England and Wales and Northern Ireland if, in respect of such an offence, a court exercising jurisdiction under the law of that country or territory has made a finding equivalent to— (a) a finding that the person is not guilty by reason of insanity, or (b) a finding that the person is under a disability and did the act charged against the person in respect of the offence.

• (7) In subsection (6)(a)—

• (a) after “convicted” insert

— (i)

, and

• (b) after “offence,” insert

or (ii) in a country or territory outside England and Wales and Northern Ireland, of a recordable-equivalent offence,

.

• (8) In subsection (6)(b)—

• (a) omit “of a recordable offence”, and

• (b) for “a recordable offence, other than a qualifying offence” substitute “an offence, other than a qualifying offence or qualifying-equivalent offence”.

• (9) In subsection (7), for “subsection (6)” substitute “this section”.

• (10) After subsection (7) insert—

(7A) In subsection (6), “qualifying-equivalent offence” means an offence under the law of a country or territory outside England and Wales and Northern Ireland where the act constituting the offence would constitute a qualifying offence if done in England and Wales or Northern Ireland (whether or not the act constituted such an offence when the person was convicted).

• (11) The amendments made by this section apply only in connection with the retention of section 18 material that is or was obtained or acquired by a law enforcement authority—

• (a) on or after the commencement day, or

• (b) in the period of 3 years ending immediately before the commencement day.

• (12) Subsection (13) of this section applies where—

• (a) at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day,

• (b) at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material, and

• (c) at the pre-commencement time, the law enforcement authority could have retained the material under section 18A of the Counter-Terrorism Act 2008, as it has effect taking account of the amendments made by subsections (2) to (10) of this section, if those amendments had been in force.

• (13) Where this subsection applies—

• (a) the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but

• (b) the material may not be used in evidence against the person to whom the material relates—

• (i) in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or

• (ii) in criminal proceedings in any other country or territory.

• (14) In this section—

• “the commencement day” means the day on which this Act is passed;

• “law enforcement authority” has the meaning given by section 18E(1) of the Counter-Terrorism Act 2008;

• “section 18 material” has the meaning given by section 18(2) of that Act.

• (15) For the purposes of this section, proceedings in relation to an offence are instituted—

• (a) in England and Wales, when they are instituted for the purposes of Part 1 of the Prosecution of Offences Act 1985 (see section 15(2) of that Act);

• (b) in Northern Ireland, when they are instituted for the purposes of Part 2 of the Justice (Northern Ireland) Act 2002 (see section 44(1) and (2) of that Act);

• (c) in Scotland, when they are instituted for the purposes of Part 3 of the Proceeds of Crime Act 2002 (see section 151(1) and (2) of that Act).

Retention of pseudonymised biometric data

127

• (1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (6).

• (2) Section 18A (retention of material: general) is amended in accordance with subsections (3) to (5).

• (3) In subsection (1), for “subsection (5)” substitute “subsections (4) to (9)”.

• (4) In subsection (4)(a), after “relates” insert “(a “pseudonymised form”)”.

• (5) After subsection (6) insert—

(7) Section 18 material which is not a DNA sample may be retained indefinitely by a law enforcement authority if— (a) the authority obtains or acquires the material directly or indirectly from an overseas law enforcement authority, (b) the authority obtains or acquires the material in a form which includes information which identifies the person to whom the material relates, (c) as soon as reasonably practicable after obtaining or acquiring the material, the authority takes the steps necessary for it to hold the material in a pseudonymised form, and (d) having taken those steps, the law enforcement authority continues to hold the material in a pseudonymised form. (8) In a case where section 18 material is being retained by a law enforcement authority under subsection (7), if— (a) the law enforcement authority ceases to hold the material in a pseudonymised form, and (b) the material relates to a person who has no previous convictions or only one exempt conviction, the material may be retained by the law enforcement authority until the end of the retention period specified in subsection (9). (9) The retention period is the period of 3 years beginning with the date on which the law enforcement authority first ceases to hold the material in a pseudonymised form.

• (6) In section 18E(1) (supplementary provision)—

• (a) in the definition of “law enforcement authority”, for paragraph (d) substitute—

(d) an overseas law enforcement authority;

, and

• (b) after that definition insert—

• “overseas law enforcement authority” means a person formed or existing under the law of a country or territory outside the United Kingdom so far as exercising functions which—correspond to those of a police force, orotherwise involve the investigation or prosecution of offences;

.

• (7) The amendments made by this section apply only in connection with the retention of section 18 material that is or was obtained or acquired by a law enforcement authority—

• (a) on or after the commencement day, or

• (b) in the period of 3 years ending immediately before the commencement day.

• (8) Subsections (9) to (12) of this section apply where, at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day.

• (9) Where the law enforcement authority holds the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) and (d) of the Counter-Terrorism Act 2008 as having—

• (a) taken the steps necessary for it to hold the material in a pseudonymised form as soon as reasonably practicable after obtaining or acquiring the material, and

• (b) continued to hold the material in a pseudonymised form until the commencement day.

• (10) Where the law enforcement authority does not hold the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) of the Counter-Terrorism Act 2008 as taking the steps necessary for it to hold the material in a pseudonymised form as soon as reasonably practicable after obtaining or acquiring the material if it takes those steps on, or as soon as reasonably practicable after, the commencement day.

• (11) Subsection (12) of this section applies where, at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material but—

• (a) at the pre-commencement time, the law enforcement authority could have retained the material under section 18A(7) to (9) of the Counter-Terrorism Act 2008 (as inserted by this section) if those provisions had been in force, or

• (b) on or after the commencement day, the law enforcement authority may retain the material under those provisions by virtue of subsection (9) or (10) of this section.

• (12) Where this subsection applies—

• (a) the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but

• (b) the material may not be used in evidence against the person to whom the material relates—

• (i) in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or

• (ii) in criminal proceedings in any other country or territory.

• (13) In this section—

• “the commencement day”, “law enforcement authority” and “section 18 material” have the meaning given in section 126(14);

• “in a pseudonymised form” has the meaning given by section 18A(4) of the Counter-Terrorism Act 2008 (as amended by this section);

• “instituted”, in relation to proceedings, has the meaning given in section 126(15).

Retention of biometric data from INTERPOL

128

• (1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (4).

• (2) In section 18(4) (destruction of national security material not subject to existing statutory restrictions), after “18A” insert “, 18AA”.

• (3) After section 18A insert—