(1)Before making regulations under section 108(1) or (5) the Secretary of State must consult—
(a)the Information Commissioner,
(b)such representatives of persons likely to be affected by the regulations as the Secretary of State thinks appropriate, and
(c)such other persons as the Secretary of State thinks appropriate.
(2)In making regulations under section 108(1), the Secretary of State must have regard to the desirability of securing that the charges payable to the Information Commissioner under such regulations are sufficient to offset—
(a)expenses incurred by the Commissioner in discharging the Commissioner’s functions—
(i)under the Data Protection Act 1998,
(ii)under or by virtue of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426),
(iii)under the General Data Protection Regulation,
(iv)under regulations which implement the General Data Protection Regulation or the Criminal Data Directive,
(v)by virtue of section 108, and
(vi)under this section,
(b)any expenses of the Secretary of State in respect of the Commissioner so far as attributable to those functions,
(c)to the extent that the Secretary of State considers appropriate, any deficit previously incurred (whether before or after the passing of this Act) in respect of the expenses mentioned in paragraph (a), and
(d)to the extent that the Secretary of State considers appropriate, expenses incurred by the Secretary of State in respect of the inclusion of any officers or staff of the Commissioner in any scheme under section 1 of the Superannuation Act 1972.
(3)In subsection (2)—
“the Criminal Data Directive” means Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA;
“the General Data Protection Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
(4)The Secretary of State may from time to time require the Information Commissioner to provide information about the expenses referred to in subsection (2)(a).
(5)The Information Commissioner must keep under review the working of regulations under section 108(1) or (5) and may from time to time submit proposals to the Secretary of State for amendments to be made to the regulations.
(6)The Secretary of State must review the working of regulations under section 108(1) or (5)—
(a)at the end of the period of five years beginning with the making of the first set of regulations under that section, and
(b)at the end of each subsequent five year period.