The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014

CHAPTER 3 Miscellaneous

Unlawful obtaining etc. of personal data within the scope of this Part

49.—(1) This regulation applies in relation to personal data processed by a UK competent authority which falls within regulation 28(1).

(2) A person shall not knowingly or recklessly, without the consent of a UK competent authority—

(a) obtain or disclose personal data to which this regulation applies or the information contained in such data; or

(b) procure the disclosure to another person of the information contained in personal data.

(3) Paragraph (2) does not apply to a person who shows—

(a) that the obtaining, disclosing or procuring—

(i) was necessary for the purpose of preventing or detecting crime; or

(ii) was required or authorised by or under any enactment, by any rule of law or by the order of a court;

(b) that he acted in the reasonable belief that he had in law the right to obtain or disclose the data or information or, as the case may be, to procure the disclosure of the information to the other person;

(c) that he acted in the reasonable belief that he would have had the consent of the relevant UK competent authority if that authority had known of the obtaining, disclosing or procuring and the circumstances of it; or

(d) that in the particular circumstances the obtaining, disclosing or procuring was justified as being in the public interest.

(4) A person who contravenes paragraph (2) is guilty of an offence.

(5) A person who sells personal data is guilty of an offence if he has obtained the data in contravention of paragraph (2).

(6) A person who offers to sell personal data is guilty of an offence if—

(a) he has obtained the data in contravention of paragraph (2); or

(b) he subsequently obtains the data in contravention of that subsection.

(7) For the purposes of paragraph (6), an advertisement indicating that personal data are or may be for sale is an offer to sell the data.

(8) For the purposes of paragraphs (5) to (7), “personal data” includes information extracted from personal data.

Application of the Data Protection Act 1998

50.—(1) The Act shall not apply to the processing of personal data to which this Part applies, except so far as regulations 27, 44 or 51 provide otherwise.

(2) Paragraph (1) is without prejudice to section 54 of the Act.

Other functions of the Commissioner

51.—(1) The following provisions of the Act apply for the purposes of this Part as they apply for the purposes of the Act, with the modifications set out in paragraph (2)—

(a) in Part 5 (enforcement)—

(i) sections 40, except subsections (4)(b), (9) and (10), and 41 (enforcement notices);

(ii) sections 42 (request for assessment) and 43, except subsection (10) (information notices);

(iii) section 47 (failure to comply with notice); and

(iv) sections 48, except subsection (4), and 49, except subsection (5) (appeals);

(b) in Part 6 (miscellaneous and general)—

(i) sections 51 to 52E (functions of the Commissioner);

(ii) section 54A (inspection of overseas information systems);

(iii) sections 55A to 55E (monetary penalties);

(iv) sections 58 and 59 (information);

(v) section 60 (except for subsection (4)(a) and (b)) (prosecutions and penalties);

(vi) section 63(1), (2) and (5) (application to Crown); and

(vii) sections 64(1)(c), (2) and (3) (transmission of notices etc. by electronic or other means) and 65 (service of notices by Commissioner).

(2) The modifications referred to in paragraph (1) are—

(a) any reference to a matter listed in the first column of the table in Schedule 5 is to be construed as a reference to the matter in the corresponding entry in the second column of that table; and

(b) a provision including a reference to a “special information notice” is to be read as if that reference were omitted.

Consequential provisions

52.  The Act is amended as follows—

(a) in section 5(1) (application of Act), after subsection (1) insert—

“(1A) Subsection (1) is subject to regulation 50 of the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014.”;

(b) in section 54 (international co-operation)—

(i) in subsection (1)(b), after “the Data Protection Directive” insert “and the Data Protection Framework Decision”;

(ii) in subsection (3) omit the “and” after paragraph (a);

(iii) after subsection (3)(b) insert—

“, and

(c) the exercise within the United Kingdom at the request of a supervisory authority in another EEA State, in cases falling within the scope of the Data Protection Framework Decision as it applies to that State, of functions of the Commissioner specified in the order.”;

(iv) in subsection (8), after the definition of “the Convention” insert—

““the Data Protection Framework Decision” means the Council Framework Decision 2008/977/JHA of 27th November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters;”.