Data Protection Act 1998

Functions of Commissioner

51General duties of Commissioner

(1)It shall be the duty of the Commissioner to promote the following of good practice by data controllers and, in particular, so to perform his functions under this Act as to promote the observance of the requirements of this Act by data controllers.

(2)The Commissioner shall arrange for the dissemination in such form and manner as he considers appropriate of such information as it may appear to him expedient to give to the public about the operation of this Act, about good practice, and about other matters within the scope of his functions under this Act, and may give advice to any person as to any of those matters.

(3)Where—

(a)the Secretary of State so directs by order, or

(b)the Commissioner considers it appropriate to do so,

the Commissioner shall, after such consultation with trade associations, data subjects or persons representing data subjects as appears to him to be appropriate, prepare and disseminate to such persons as he considers appropriate codes of practice for guidance as to good practice.

(4)The Commissioner shall also—

(a)where he considers it appropriate to do so, encourage trade associations to prepare, and to disseminate to their members, such codes of practice, and

(b)where any trade association submits a code of practice to him for his consideration, consider the code and, after such consultation with data subjects or persons representing data subjects as appears to him to be appropriate, notify the trade association whether in his opinion the code promotes the following of good practice.

(5)An order under subsection (3) shall describe the personal data or processing to which the code of practice is to relate, and may also describe the persons or classes of persons to whom it is to relate.

(6)The Commissioner shall arrange for the dissemination in such form and manner as he considers appropriate of—

(a)any Community finding as defined by paragraph 15(2) of Part II of Schedule 1,

(b)any decision of the European Commission, under the procedure provided for in Article 31(2) of the Data Protection Directive, which is made for the purposes of Article 26(3) or (4) of the Directive, and

(c)such other information as it may appear to him to be expedient to give to data controllers in relation to any personal data about the protection of the rights and freedoms of data subjects in relation to the processing of personal data in countries and territories outside the European Economic Area.

(7)The Commissioner may, with the consent of the data controller, assess any processing of personal data for the following of good practice and shall inform the data controller of the results of the assessment.

(8)The Commissioner may charge such sums as he may with the consent of the Secretary of State determine for any services provided by the Commissioner by virtue of this Part.

(9)In this section—

• “good practice” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, and includes (but is not limited to) compliance with the requirements of this Act;

• “trade association” includes any body representing data controllers.

52Reports and codes of practice to be laid before Parliament

(1)The Commissioner shall lay annually before each House of Parliament a general report on the exercise of his functions under this Act.

(2)The Commissioner may from time to time lay before each House of Parliament such other reports with respect to those functions as he thinks fit.

(3)The Commissioner shall lay before each House of Parliament any code of practice prepared under section 51(3) for complying with a direction of the Secretary of State, unless the code is included in any report laid under subsection (1) or (2).

53Assistance by Commissioner in cases involving processing for the special purposes

(1)An individual who is an actual or prospective party to any proceedings under section 7(9), 10(4), 12(8) or 14 or by virtue of section 13 which relate to personal data processed for the special purposes may apply to the Commissioner for assistance in relation to those proceedings.

(2)The Commissioner shall, as soon as reasonably practicable after receiving an application under subsection (1), consider it and decide whether and to what extent to grant it, but he shall not grant the application unless, in his opinion, the case involves a matter of substantial public importance.

(3)If the Commissioner decides to provide assistance, he shall, as soon as reasonably practicable after making the decision, notify the applicant, stating the extent of the assistance to be provided.

(4)If the Commissioner decides not to provide assistance, he shall, as soon as reasonably practicable after making the decision, notify the applicant of his decision and, if he thinks fit, the reasons for it.

(5)In this section—

(a)references to “proceedings” include references to prospective proceedings, and

(b)“applicant”, in relation to assistance under this section, means an individual who applies for assistance.

(6)Schedule 10 has effect for supplementing this section.

54International co-operation

(1)The Commissioner—

(a)shall continue to be the designated authority in the United Kingdom for the purposes of Article 13 of the Convention, and

(b)shall be the supervisory authority in the United Kingdom for the purposes of the Data Protection Directive.

(2)The Secretary of State may by order make provision as to the functions to be discharged by the Commissioner as the designated authority in the United Kingdom for the purposes of Article 13 of the Convention.

(3)The Secretary of State may by order make provision as to co-operation by the Commissioner with the European Commission and with supervisory authorities in other EEA States in connection with the performance of their respective duties and, in particular, as to—

(a)the exchange of information with supervisory authorities in other EEA States or with the European Commission, and

(b)the exercise within the United Kingdom at the request of a supervisory authority in another EEA State, in cases excluded by section 5 from the application of the other provisions of this Act, of functions of the Commissioner specified in the order.

(4)The Commissioner shall also carry out any data protection functions which the Secretary of State may by order direct him to carry out for the purpose of enabling Her Majesty’s Government in the United Kingdom to give effect to any international obligations of the United Kingdom.

(5)The Commissioner shall, if so directed by the Secretary of State, provide any authority exercising data protection functions under the law of a colony specified in the direction with such assistance in connection with the discharge of those functions as the Secretary of State may direct or approve, on such terms (including terms as to payment) as the Secretary of State may direct or approve.

(6)Where the European Commission makes a decision for the purposes of Article 26(3) or (4) of the Data Protection Directive under the procedure provided for in Article 31(2) of the Directive, the Commissioner shall comply with that decision in exercising his functions under paragraph 9 of Schedule 4 or, as the case may be, paragraph 8 of that Schedule.

(7)The Commissioner shall inform the European Commission and the supervisory authorities in other EEA States—

(a)of any approvals granted for the purposes of paragraph 8 of Schedule 4, and

(b)of any authorisations granted for the purposes of paragraph 9 of that Schedule.

(8)In this section—

• “the Convention” means the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data which was opened for signature on 28th January 1981;

• “data protection functions” means functions relating to the protection of individuals with respect to the processing of personal information.