Data Protection Act 1998

Functions of CommissionerU.K.

51 General duties of Commissioner.U.K.

(1)It shall be the duty of the Commissioner to promote the following of good practice by data controllers and, in particular, so to perform his functions under this Act as to promote the observance of the requirements of this Act by data controllers.

(2)The Commissioner shall arrange for the dissemination in such form and manner as he considers appropriate of such information as it may appear to him expedient to give to the public about the operation of this Act, about good practice, and about other matters within the scope of his functions under this Act, and may give advice to any person as to any of those matters.

(3)Where—

(a)the [F1 Secretary of State] so directs by order, or

(b)the Commissioner considers it appropriate to do so,

the Commissioner shall, after such consultation with trade associations, data subjects or persons representing data subjects as appears to him to be appropriate, prepare and disseminate to such persons as he considers appropriate codes of practice for guidance as to good practice.

(4)The Commissioner shall also—

(a)where he considers it appropriate to do so, encourage trade associations to prepare, and to disseminate to their members, such codes of practice, and

(b)where any trade association submits a code of practice to him for his consideration, consider the code and, after such consultation with data subjects or persons representing data subjects as appears to him to be appropriate, notify the trade association whether in his opinion the code promotes the following of good practice.

(5)An order under subsection (3) shall describe the personal data or processing to which the code of practice is to relate, and may also describe the persons or classes of persons to whom it is to relate.

[F2(5A)In determining the action required to discharge the duties imposed by subsections (1) to (4), the Commissioner may take account of any action taken to discharge the duty imposed by section 52A (data-sharing code).]

(6)The Commissioner shall arrange for the dissemination in such form and manner as he considers appropriate of—

(a)any Community finding as defined by paragraph 15(2) of Part II of Schedule 1,

(b)any decision of the European Commission, under the procedure provided for in Article 31(2) of the Data Protection Directive, which is made for the purposes of Article 26(3) or (4) of the Directive, and

(c)such other information as it may appear to him to be expedient to give to data controllers in relation to any personal data about the protection of the rights and freedoms of data subjects in relation to the processing of personal data in countries and territories outside the European Economic Area.

(7)The Commissioner may, with the consent of the data controller, assess any processing of personal data for the following of good practice and shall inform the data controller of the results of the assessment.

(8)The Commissioner may charge such sums as he may with the consent of the [F1 Secretary of State] determine for any services provided by the Commissioner by virtue of this Part.

(9)In this section—

• “good practice” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, and includes (but is not limited to) compliance with the requirements of this Act;

• “trade association” includes any body representing data controllers.

52 Reports and codes of practice to be laid before Parliament.U.K.

(1)The Commissioner shall lay annually before each House of Parliament a general report on the exercise of his functions under this Act.

(2)The Commissioner may from time to time lay before each House of Parliament such other reports with respect to those functions as he thinks fit.

(3)The Commissioner shall lay before each House of Parliament any code of practice prepared under section 51(3) for complying with a direction of the [F3 Secretary of State] , unless the code is included in any report laid under subsection (1) or (2).

[F452AData-sharing codeU.K.

(1)The Commissioner must prepare a code of practice which contains—

(a)practical guidance in relation to the sharing of personal data in accordance with the requirements of this Act, and

(b)such other guidance as the Commissioner considers appropriate to promote good practice in the sharing of personal data.

(2)For this purpose “good practice” means such practice in the sharing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, and includes (but is not limited to) compliance with the requirements of this Act.

(3)Before a code is prepared under this section, the Commissioner must consult such of the following as the Commissioner considers appropriate—

(a)trade associations (within the meaning of section 51);

(b)data subjects;

(c)persons who appear to the Commissioner to represent the interests of data subjects.

(4)In this section a reference to the sharing of personal data is to the disclosure of the data by transmission, dissemination or otherwise making it available.

[F452BData-sharing code: procedureU.K.

(1)When a code is prepared under section 52A, it must be submitted to the Secretary of State for approval.

(2)Approval may be withheld only if it appears to the Secretary of State that the terms of the code could result in the United Kingdom being in breach of any of its Community obligations or any other international obligation.

(3)The Secretary of State must—

(a)if approval is withheld, publish details of the reasons for withholding it;

(b)if approval is granted, lay the code before Parliament.

(4)If, within the 40-day period, either House of Parliament resolves not to approve the code, the code is not to be issued by the Commissioner.

(5)If no such resolution is made within that period, the Commissioner must issue the code.

(6)Where—

(a)the Secretary of State withholds approval, or

(b)such a resolution is passed,

the Commissioner must prepare another code of practice under section 52A.

(7)Subsection (4) does not prevent a new code being laid before Parliament.

(8)A code comes into force at the end of the period of 21 days beginning with the day on which it is issued.

(9)A code may include transitional provision or savings.

(10)In this section “the 40-day period” means the period of 40 days beginning with the day on which the code is laid before Parliament (or, if it is not laid before each House of Parliament on the same day, the later of the 2 days on which it is laid).

(11)In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.]

[F452CAlteration or replacement of data-sharing codeU.K.

(1)The Commissioner—

(a)must keep the data-sharing code under review, and

(b)may prepare an alteration to that code or a replacement code.

(2)Where, by virtue of a review under subsection (1)(a) or otherwise, the Commissioner becomes aware that the terms of the code could result in the United Kingdom being in breach of any of its Community obligations or any other international obligation, the Commissioner must exercise the power under subsection (1)(b) with a view to remedying the situation.

(3)Before an alteration or replacement code is prepared under subsection (1), the Commissioner must consult such of the following as the Commissioner considers appropriate—

(a)trade associations (within the meaning of section 51);

(b)data subjects;

(c)persons who appear to the Commissioner to represent the interests of data subjects.

(4)Section 52B (other than subsection (6)) applies to an alteration or replacement code prepared under this section as it applies to the code as first prepared under section 52A.

(5)In this section “the data-sharing code” means the code issued under section 52B(5) (as altered or replaced from time to time).]

52DPublication of data-sharing codeU.K.

(1)The Commissioner must publish the code (and any replacement code) issued under section 52B(5).

(2)Where an alteration is so issued, the Commissioner must publish either—

(a)the alteration, or

(b)the code or replacement code as altered by it.

52EEffect of data-sharing codeU.K.

(1)A failure on the part of any person to act in accordance with any provision of the data-sharing code does not of itself render that person liable to any legal proceedings in any court or tribunal.

(2)The data-sharing code is admissible in evidence in any legal proceedings.

(3)If any provision of the data-sharing code appears to—

(a)the Tribunal or a court conducting any proceedings under this Act,

(b)a court or tribunal conducting any other legal proceedings, or

(c)the Commissioner carrying out any function under this Act,

to be relevant to any question arising in the proceedings, or in connection with the exercise of that jurisdiction or the carrying out of those functions, in relation to any time when it was in force, that provision of the code must be taken into account in determining that question.

(4)In this section “the data-sharing code” means the code issued under section 52B(5) (as altered or replaced from time to time).]

53 Assistance by Commissioner in cases involving processing for the special purposes.U.K.

(1)An individual who is an actual or prospective party to any proceedings under section 7(9), 10(4), 12(8) or 14 or by virtue of section 13 which relate to personal data processed for the special purposes may apply to the Commissioner for assistance in relation to those proceedings.

(2)The Commissioner shall, as soon as reasonably practicable after receiving an application under subsection (1), consider it and decide whether and to what extent to grant it, but he shall not grant the application unless, in his opinion, the case involves a matter of substantial public importance.

(3)If the Commissioner decides to provide assistance, he shall, as soon as reasonably practicable after making the decision, notify the applicant, stating the extent of the assistance to be provided.

(4)If the Commissioner decides not to provide assistance, he shall, as soon as reasonably practicable after making the decision, notify the applicant of his decision and, if he thinks fit, the reasons for it.

(5)In this section—

(a)references to “proceedings” include references to prospective proceedings, and

(b)“applicant”, in relation to assistance under this section, means an individual who applies for assistance.

(6)Schedule 10 has effect for supplementing this section.

54 International co-operation.U.K.

(1)The Commissioner—

(a)shall continue to be the designated authority in the United Kingdom for the purposes of Article 13 of the Convention, and

(b)shall be the supervisory authority in the United Kingdom for the purposes of the Data Protection Directive.

(2)The [F5 Secretary of State] may by order make provision as to the functions to be discharged by the Commissioner as the designated authority in the United Kingdom for the purposes of Article 13 of the Convention.

(3)The [F5 Secretary of State] may by order make provision as to co-operation by the Commissioner with the European Commission and with supervisory authorities in other EEA States in connection with the performance of their respective duties and, in particular, as to—

(a)the exchange of information with supervisory authorities in other EEA States or with the European Commission, and

(b)the exercise within the United Kingdom at the request of a supervisory authority in another EEA State, in cases excluded by section 5 from the application of the other provisions of this Act, of functions of the Commissioner specified in the order.

(4)The Commissioner shall also carry out any data protection functions which the [F5 Secretary of State] may by order direct him to carry out for the purpose of enabling Her Majesty’s Government in the United Kingdom to give effect to any international obligations of the United Kingdom.

(5)The Commissioner shall, if so directed by the [F5 Secretary of State] , provide any authority exercising data protection functions under the law of a colony specified in the direction with such assistance in connection with the discharge of those functions as the [F5 Secretary of State] may direct or approve, on such terms (including terms as to payment) as the [F5 Secretary of State] may direct or approve.

(6)Where the European Commission makes a decision for the purposes of Article 26(3) or (4) of the Data Protection Directive under the procedure provided for in Article 31(2) of the Directive, the Commissioner shall comply with that decision in exercising his functions under paragraph 9 of Schedule 4 or, as the case may be, paragraph 8 of that Schedule.

(7)The Commissioner shall inform the European Commission and the supervisory authorities in other EEA States—

(a)of any approvals granted for the purposes of paragraph 8 of Schedule 4, and

(b)of any authorisations granted for the purposes of paragraph 9 of that Schedule.

(8)In this section—

• “the Convention” means the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data which was opened for signature on 28th January 1981;

• “data protection functions” means functions relating to the protection of individuals with respect to the processing of personal information.

[F654AInspection of overseas information systemsU.K.

(1)The Commissioner may inspect any personal data recorded in—

(a)the Schengen information system,

(b)the Europol information system,

(c)the Customs information system.

(2)The power conferred by subsection (1) is exercisable only for the purpose of assessing whether or not any processing of the data has been or is being carried out in compliance with this Act.

(3)The power includes power to inspect, operate and test equipment which is used for the processing of personal data.

(4)Before exercising the power, the Commissioner must give notice in writing of his intention to do so to the data controller.

(5)But subsection (4) does not apply if the Commissioner considers that the case is one of urgency.

(6)Any person who—

(a)intentionally obstructs a person exercising the power conferred by subsection (1), or

(b)fails without reasonable excuse to give any person exercising the power any assistance he may reasonably require,

is guilty of an offence.

(7)In this section—

• “the Customs information system” means the information system established under Chapter II of the Convention on the Use of Information Technology for Customs Purposes,

• “the Europol information system” means the information system established under Title II of the Convention on the Establishment of a European Police Office,

• “the Schengen information system” means the information system established under Title IV of the Convention implementing the Schengen Agreement of 14th June 1985, or any system established in its place in pursuance of any Community obligation.]