In this Act, unless the context otherwise requires—

• “data” means information which—

  1. a

     is being processed by means of equipment operating automatically in response to instructions given for that purpose,

  2. b

     is recorded with the intention that it should be processed by means of such equipment,

  3. c

     is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, F1. . .

  4. d

     does not fall within paragraph (a), (b) or (c) but forms part of an accessible record as defined by section 68; F2or

  5. e

     is recorded information held by a public authority and does not fall within any of paragraphs (a) to (d);

• “data controller” means, subject to subsection (4), a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed;

• “data processor”, in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller;

• “data subject” means an individual who is the subject of personal data;

• “personal data” means data which relate to a living individual who can be identified—

  1. a

     from those data, or

  2. b

     from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

  and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

• “processing”, in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including—

  1. a

     organisation, adaptation or alteration of the information or data,

  2. b

     retrieval, consultation or use of the information or data,

  3. c

     disclosure of the information or data by transmission, dissemination or otherwise making available, or

  4. d

     alignment, combination, blocking, erasure or destruction of the information or data;

• F3“public authority” means a public authority as defined by the Freedom of Information Act 2000 or a Scottish public authority as defined by the Freedom of Information (Scotland) Act 2002;

• “relevant filing system” means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible.

Where personal data are processed only for purposes for which they are required by or under any enactment to be processed, the person on whom the obligation to process the data is imposed by or under that enactment is for the purposes of this Act the data controller.

In paragraph (e) of the definition of “data” in subsection (1), the reference to information “held” by a public authority shall be construed in accordance with section 3(2) of the Freedom of Information Act 2000 F5or section 3(2), (4) and (5) of the Freedom of Information (Scotland) Act 2002.

References in this Act to the data protection principles are to the principles set out in Part I of Schedule 1.

Those principles are to be interpreted in accordance with Part II of Schedule 1.

Schedule 2 (which applies to all personal data) and Schedule 3 (which applies only to sensitive personal data) set out conditions applying for the purposes of the first principle; and Schedule 4 sets out cases in which the eighth principle does not apply.

Subject to section 27(1), it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller.

Subsection (1) is subject to regulation 50 of the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014.

A data controller falling within subsection (1)(b) must nominate for the purposes of this Act a representative established in the United Kingdom.

For the purposes of this Act and of the Freedom of Information Act 2000 there shall be an officer known as the Information Commissioner (in this Act referred to as “the Commissioner”).

The Commissioner shall be appointed by Her Majesty by Letters Patent.

F9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Schedule 5 has effect in relation to the Commissioner F10. . . .

In subsection (4) the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that subsection is not to be construed as excusing a data controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.

An individual making a request under this section may, in such cases as may be prescribed, specify that his request is limited to personal data of any prescribed description.

Subject to subsection (4), a data controller shall comply with a request under this section promptly and in any event before the end of the prescribed period beginning with the relevant day.

If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request.

In this section—

• “prescribed” means prescribed by the F13 Secretary of State by regulations;

• “the prescribed maximum” means such amount as may be prescribed;

• “the prescribed period” means forty days or such other period as may be prescribed;

• “the relevant day”, in relation to a request under this section, means the day on which the data controller receives the request or, if later, the first day on which the data controller has both the required fee and the information referred to in subsection (3).

Different amounts or periods may be prescribed under this section in relation to different cases.

The F14 Secretary of State may by regulations provide that, in such cases as may be prescribed, a request for information under any provision of subsection (1) of section 7 is to be treated as extending also to information under other provisions of that subsection.

Where a data controller has previously complied with a request made under section 7 by an individual, the data controller is not obliged to comply with a subsequent identical or similar request under that section by that individual unless a reasonable interval has elapsed between compliance with the previous request and the making of the current request.

In determining for the purposes of subsection (3) whether requests under section 7 are made at reasonable intervals, regard shall be had to the nature of the data, the purpose for which the data are processed and the frequency with which the data are altered.

Section 7(1)(d) is not to be regarded as requiring the provision of information as to the logic involved in any decision-taking if, and to the extent that, the information constitutes a trade secret.

The information to be supplied pursuant to a request under section 7 must be supplied by reference to the data in question at the time when the request is received, except that it may take account of any amendment or deletion made between that time and the time when the information is supplied, being an amendment or deletion that would have been made regardless of the receipt of the request.

For the purposes of section 7(4) and (5) another individual can be identified from the information being disclosed if he can be identified from that information, or from that and any other information which, in the reasonable belief of the data controller, is likely to be in, or to come into, the possession of the data subject making the request.

Where the data controller is a credit reference agency, section 7 has effect subject to the provisions of this section.

An individual making a request under section 7 may limit his request to personal data relevant to his financial standing, and shall be taken to have so limited his request unless the request shows a contrary intention.

In this section “unstructured personal data” means any personal data falling within paragraph (e) of the definition of “data” in section 1(1), other than information which is recorded as part of, or with the intention that it should form part of, any set of information relating to individuals to the extent that the set is structured by reference to individuals or by reference to criteria relating to individuals.

A public authority is not obliged to comply with subsection (1) of section 7 in relation to any unstructured personal data unless the request under that section contains a description of the data.

Even if the data are described by the data subject in his request, a public authority is not obliged to comply with subsection (1) of section 7 in relation to unstructured personal data if the authority estimates that the cost of complying with the request so far as relating to those data would exceed the appropriate limit.

Subsection (3) does not exempt the public authority from its obligation to comply with paragraph (a) of section 7(1) in relation to the unstructured personal data unless the estimated cost of complying with that paragraph alone in relation to those data would exceed the appropriate limit.

In subsections (3) and (4) “the appropriate limit” means such amount as may be prescribed by the F17 Secretary of State by regulations, and different amounts may be prescribed in relation to different cases.

Any estimate for the purposes of this section must be made in accordance with regulations under section 12(5) of the Freedom of Information Act 2000.

If a court is satisfied, on the application of any person who has given a notice under subsection (1) which appears to the court to be justified (or to be justified to any extent), that the data controller in question has failed to comply with the notice, the court may order him to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit.

The failure by a data subject to exercise the right conferred by subsection (1) or section 11(1) does not affect any other right conferred on him by this Part.

An individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing for the purposes of direct marketing personal data in respect of which he is the data subject.

If the court is satisfied, on the application of any person who has given a notice under subsection (1), that the data controller has failed to comply with the notice, the court may order him to take such steps for complying with the notice as the court thinks fit.

This section shall not apply in relation to the processing of such data as are mentioned in paragraph (1) of regulation 8 of the Telecommunications (Data Protection and Privacy) Regulations 1999 (processing of telecommunications billing data for certain marketing purposes) for the purposes mentioned in paragraph (2) of that regulation.

In this section “direct marketing” means the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals.

An individual is entitled at any time, by notice in writing to any data controller, to require the data controller to ensure that no decision taken by or on behalf of the data controller which significantly affects that individual is based solely on the processing by automatic means of personal data in respect of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct.

The data controller must, within twenty-one days of receiving a notice under subsection (2)(b) (“the data subject notice”) give the individual a written notice specifying the steps that he intends to take to comply with the data subject notice.

A notice under subsection (1) does not have effect in relation to an exempt decision; and nothing in subsection (2) applies to an exempt decision.

If a court is satisfied on the application of a data subject that a person taking a decision in respect of him (“the responsible person”) has failed to comply with subsection (1) or (2)(b), the court may order the responsible person to reconsider the decision, or to take a new decision which is not based solely on such processing as is mentioned in subsection (1).

An order under subsection (8) shall not affect the rights of any person other than the data subject and the responsible person.

A notice under subsection (1)(a) or (b) must state the data subject’s reasons for believing that the data are inaccurate or incomplete or, as the case may be, his reasons for believing that they are held in a way incompatible with the legitimate purposes pursued by the data controller.

If the court is satisfied, on the application of any person who has given a notice under subsection (1) which appears to the court to be justified (or to be justified to any extent) that the data controller in question has failed to comply with the notice, the court may order him to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit.

For the purposes of this section personal data are incomplete if, and only if, the data, although not inaccurate, are such that their incompleteness would constitute a contravention of the third or fourth data protection principles, if those principles applied to the data.

An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.

In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.

If a court is satisfied on the application of a data subject that personal data of which the applicant is the subject are inaccurate, the court may order the data controller to rectify, block, erase or destroy those data and any other personal data in respect of which he is the data controller and which contain an expression of opinion which appears to the court to be based on the inaccurate data.

Where the court makes an order under subsection (4) it may, where it considers it reasonably practicable, order the data controller to notify third parties to whom the data have been disclosed of the rectification, blocking, erasure or destruction.

In determining whether it is reasonably practicable to require such notification as is mentioned in subsection (3) or (5) the court shall have regard, in particular, to the number of persons who would have to be notified.

The jurisdiction conferred by sections 7 to 14 is exercisable F177 in England and Wales by the High Court or the county court or, in Northern Ireland, by the High Court or a county court or, in Scotland, by the Court of Session or the sheriff.

For the purpose of determining any question whether an applicant under subsection (9) of section 7 is entitled to the information which he seeks (including any question whether any relevant data are exempt from that section by virtue of Part IV) a court may require the information constituting any data processed by or on behalf of the data controller and any information as to the logic involved in any decision-taking as mentioned in section 7(1)(d) to be made available for its own inspection but shall not, pending the determination of that question in the applicant’s favour, require the information sought by the applicant to be disclosed to him or his representatives whether by discovery (or, in Scotland, recovery) or otherwise.

In this Part—

• “fees regulations” means regulations made by the F23 Secretary of State under section 18(5) or 19(4) or (7);

• “notification regulations” means regulations made by the F23 Secretary of State under the other provisions of this Part;

• “prescribed”, except where used in relation to fees regulations, means prescribed by notification regulations.

Subject to the following provisions of this section, personal data must not be processed unless an entry in respect of the data controller is included in the register maintained by the Commissioner under section 19 (or is treated by notification regulations made by virtue of section 19(3) as being so included).

Except where the processing is assessable processing for the purposes of section 22, subsection (1) does not apply in relation to personal data consisting of information which falls neither within paragraph (a) of the definition of “data” in section 1(1) nor within paragraph (b) of that definition.

If it appears to the F24 Secretary of State that processing of a particular description is unlikely to prejudice the rights and freedoms of data subjects, notification regulations may provide that, in such cases as may be prescribed, subsection (1) is not to apply in relation to processing of that description.

Subsection (1) does not apply in relation to any processing whose sole purpose is the maintenance of a public register.

Any data controller who wishes to be included in the register maintained under section 19 shall give a notification to the Commissioner under this section.

Notification regulations made by virtue of subsection (2) may provide for the determination by the Commissioner, in accordance with any requirements of the regulations, of the form in which the registrable particulars and the description mentioned in subsection (2)(b) are to be specified, including in particular the detail required for the purposes of section 16(1)(c), (d), (e) and (f) and subsection (2)(b).

The notification must be accompanied by such fee as may be prescribed by fees regulations.

Notification regulations may prescribe the information about the data controller which is required for the purpose of verifying the fee payable under subsection (5).

Notification regulations may provide for any fee paid under subsection (5) or section 19(4) to be refunded in prescribed circumstances.

Notification regulations may make provision as to the time as from which any entry in respect of a data controller is to be treated for the purposes of section 17 as having been made in the register.

No entry shall be retained in the register for more than the relevant time except on payment of such fee as may be prescribed by fees regulations.

In subsection (4) “the relevant time” means twelve months or such other period as may be prescribed by notification regulations; and different periods may be prescribed in relation to different cases.

The Commissioner shall, on payment of such fee, if any, as may be prescribed by fees regulations, supply any member of the public with a duly certified copy in writing of the particulars contained in any entry made in the register.

Nothing in subsection (6) or (7) applies to information which is included in an entry in the register only by reason of it falling within section 16(1)(h).

For the purpose specified in subsection (2), notification regulations shall include provision imposing on every person in respect of whom an entry as a data controller is for the time being included in the register maintained under section 19 a duty to notify to the Commissioner, in such circumstances and at such time or times and in such form as may be prescribed, such matters relating to the registrable particulars and measures taken as mentioned in section 18(2)(b) as may be prescribed.

Subsection (3) of section 18 has effect in relation to notification regulations made by virtue of subsection (1) as it has effect in relation to notification regulations made by virtue of subsection (2) of that section.

On receiving any notification under notification regulations made by virtue of subsection (1), the Commissioner shall make such amendments of the relevant entry in the register maintained under section 19 as are necessary to take account of the notification.

If section 17(1) is contravened, the data controller is guilty of an offence.

Any person who fails to comply with the duty imposed by notification regulations made by virtue of section 20(1) is guilty of an offence.

It shall be a defence for a person charged with an offence under subsection (2) to show that he exercised all due diligence to comply with the duty.

Subject to subsection (4), the Commissioner shall, within the period of twenty-eight days beginning with the day on which he receives a notification which relates to assessable processing, give a notice to the data controller stating the extent to which the Commissioner is of the opinion that the processing is likely or unlikely to comply with the provisions of this Act.

Before the end of the period referred to in subsection (3) the Commissioner may, by reason of special circumstances, extend that period on one occasion only by notice to the data controller by such further period not exceeding fourteen days as the Commissioner may specify in the notice.

Where subsection (5) is contravened, the data controller is guilty of an offence.

The F27 Secretary of State may by order amend subsections (3), (4) and (5) by substituting for the number of days for the time being specified there a different number specified in the order.

In this section “the relevant particulars” means the particulars referred to in paragraphs (a) to (f) of section 16(1).

This section has effect subject to any exemption conferred for the purposes of this section by notification regulations.

Any data controller who fails to comply with the duty imposed by subsection (1) is guilty of an offence.

It shall be a defence for a person charged with an offence under subsection (4) to show that he exercised all due diligence to comply with the duty.

As soon as practicable after the passing of this Act, the Commissioner shall submit to the Secretary of State proposals as to the provisions to be included in the first notification regulations.

The Commissioner shall keep under review the working of notification regulations and may from time to time submit to the F29 Secretary of State proposals as to amendments to be made to the regulations.

The F29 Secretary of State may from time to time require the Commissioner to consider any matter relating to notification regulations and to submit to him proposals as to amendments to be made to the regulations in connection with that matter.

Fees regulations prescribing fees for the purposes of any provision of this Part may provide for different fees to be payable in different cases.

References in any of the data protection principles or any provision of Parts II and III to personal data or to the processing of personal data do not include references to data or processing which by virtue of this Part are exempt from that principle or other provision.

In this Part “the non-disclosure provisions” means the provisions specified in subsection (4) to the extent to which they are inconsistent with the disclosure in question.

Except as provided by this Part, the subject information provisions shall have effect notwithstanding any enactment or rule of law prohibiting or restricting the disclosure, or authorising the withholding, of information.

Subject to subsection (4), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions mentioned in subsection (1) is or at any time was required for the purpose there mentioned in respect of any personal data shall be conclusive evidence of that fact.

A certificate under subsection (2) may identify the personal data to which it applies by means of a general description and may be expressed to have prospective effect.

Any person directly affected by the issuing of a certificate under subsection (2) may appeal to the Tribunal against the certificate.

If on an appeal under subsection (4), the Tribunal finds that, applying the principles applied by the court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may allow the appeal and quash the certificate.

Where in any proceedings under or by virtue of this Act it is claimed by a data controller that a certificate under subsection (2) which identifies the personal data to which it applies by means of a general description applies to any personal data, any other party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply to the personal data in question and, subject to any determination under subsection (7), the certificate shall be conclusively presumed so to apply.

On any appeal under subsection (6), the Tribunal may determine that the certificate does not so apply.

A document purporting to be a certificate under subsection (2) shall be received in evidence and deemed to be such a certificate unless the contrary is proved.

A document which purports to be certified by or on behalf of a Minister of the Crown as a true copy of a certificate issued by that Minister under subsection (2) shall in any legal proceedings be evidence (or, in Scotland, sufficient evidence) of that certificate.

The power conferred by subsection (2) on a Minister of the Crown shall not be exercisable except by a Minister who is a member of the Cabinet or by the Attorney General or the Lord Advocate.

No power conferred by any provision of Part V may be exercised in relation to personal data which by virtue of this section are exempt from that provision.

Schedule 6 shall have effect in relation to appeals under subsection (4) or (6) and the proceedings of the Tribunal in respect of any such appeal.

The F35 Secretary of State may by order exempt from the subject information provisions, or modify those provisions in relation to, personal data consisting of information as to the physical or mental health or condition of the data subject.

An order under this section may make different provision in relation to data consisting of information of different descriptions.

In this section—

• “education authority” and “further education” have the same meaning as in the M4Education (Scotland) Act 1980 (“the 1980 Act”), and

• “proprietor”—

  1. a

     in relation to a school in England or Wales, has the same meaning as in the M5Education Act 1996,

  2. b

     in relation to a school in Scotland, means—

     1. i

        F36in the case of a self-governing school, the board of management within the meaning of the M6Self-Governing Schools etc. (Scotland) Act 1989,

     2. ii

        in the case of an independent school, the proprietor within the meaning of the 1980 Act,

     3. iii

        in the case of a grant-aided school, the managers within the meaning of the 1980 Act, and

     4. iv

        in the case of a public school, the education authority within the meaning of the 1980 Act, and

  3. c

     in relation to a school in Northern Ireland, has the same meaning as in the M7Education and Libraries (Northern Ireland) Order 1986 and includes, in the case of a controlled school, the Board of Governors of the school.

Personal data processed for the purposes of discharging functions to which this subsection applies are exempt from the subject information provisions in any case to the extent to which the application of those provisions to the data would be likely to prejudice the proper discharge of those functions.

Personal data processed for the purpose of discharging any function which is conferred by or under Part XVI of the Financial Services and Markets Act 2000 on the body established by the Financial Services Authority for the purposes of that Part are exempt from the subject information provisions in any case to the extent to which the application of those provisions to the data would be likely to prejudice the proper discharge of the function.

Personal data processed for the purposes of discharging any function of the Legal Services Board are exempt from the subject information provisions in any case to the extent to which the application of those provisions to the data would be likely to prejudice the proper discharge of the function.

Personal data processed for the purposes of the function of considering a complaint under the scheme established under Part 6 of the Legal Services Act 2007 (legal complaints) are exempt from the subject information provisions in any case to the extent to which the application of those provisions to the data would be likely to prejudice the proper discharge of the function.

Personal data processed by a CPC enforcer for the purpose of discharging any function conferred on such a body by or under the CPC Regulation are exempt from the subject information provisions in any case to the extent to which the application of those provisions to the data would be likely to prejudice the proper discharge of that function.

Personal data processed for the purpose of the function of considering a complaint under section 113(1) or (2) or 114(1) or (3) of the Health and Social Care (Community Health and Standards) Act 2003, or section 24D, 26 F52 . . . or 26ZB of the Children Act 1989, are exempt from the subject information provisions in any case to the extent to which the application of those provisions to the data would be likely to prejudice the proper discharge of that function.

For the purposes of this Act “publish”, in relation to journalistic, literary or artistic material, means make available to the public or any section of the public.

For the purposes of the second data protection principle, the further processing of personal data only for research purposes in compliance with the relevant conditions is not to be regarded as incompatible with the purposes for which they were obtained.

Personal data which are processed only for research purposes in compliance with the relevant conditions may, notwithstanding the fifth data protection principle, be kept indefinitely.

Personal data are exempt from the non-disclosure provisions where the disclosure is required by or under any enactment, by any rule of law or by the order of a court.

The F59 Secretary of State may by order exempt from the subject information provisions personal data consisting of information the disclosure of which is prohibited or restricted by or under any enactment if and to the extent that he considers it necessary for the safeguarding of the interests of the data subject or the rights and freedoms of any other individual that the prohibition or restriction ought to prevail over those provisions.

The F59 Secretary of State may by order exempt from the non-disclosure provisions any disclosures of personal data made in circumstances specified in the order, if he considers the exemption is necessary for the safeguarding of the interests of the data subject or the rights and freedoms of any other individual.

In deciding whether to serve an enforcement notice, the Commissioner shall consider whether the contravention has caused or is likely to cause any person damage or distress.

An enforcement notice in respect of a contravention of the fourth data protection principle which requires the data controller to rectify, block, erase or destroy any inaccurate data may also require the data controller to rectify, block, erase or destroy any other data held by him and containing an expression of opinion which appears to the Commissioner to be based on the inaccurate data.

Subject to subsection (8), an enforcement notice must not require any of the provisions of the notice to be complied with before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the notice need not be complied with pending the determination or withdrawal of the appeal.

If by reason of special circumstances the Commissioner considers that an enforcement notice should be complied with as a matter of urgency he may include in the notice a statement to that effect and a statement of his reasons for reaching that conclusion; and in that event subsection (7) shall not apply but the notice must not require the provisions of the notice to be complied with before the end of the period of seven days beginning with the day on which the notice is served.

Notification regulations (as defined by section 16(2)) may make provision as to the effect of the service of an enforcement notice on any entry in the register maintained under section 19 which relates to the person on whom the notice is served.

This section has effect subject to section 46(1).

If the Commissioner considers that all or any of the provisions of an enforcement notice need not be complied with in order to ensure compliance with the data protection principle or principles to which it relates, he may cancel or vary the notice by written notice to the person on whom it was served.

A person on whom an enforcement notice has been served may, at any time after the expiry of the period during which an appeal can be brought against that notice, apply in writing to the Commissioner for the cancellation or variation of that notice on the ground that, by reason of a change of circumstances, all or any of the provisions of that notice need not be complied with in order to ensure compliance with the data protection principle or principles to which that notice relates.

The Commissioner may serve a data controller within subsection (2) with a notice (in this Act referred to as an “assessment notice”) for the purpose of enabling the Commissioner to determine whether the data controller has complied or is complying with the data protection principles.

In subsection (3) references to the Commissioner include references to the Commissioner's officers and staff.

An assessment notice must also contain particulars of the rights of appeal conferred by section 48.

The Commissioner may cancel an assessment notice by written notice to the data controller on whom it was served.

Where a public authority has been designated by an order under subsection (2)(b) the Secretary of State must reconsider, at intervals of no greater than 5 years, whether it continues to be appropriate for the authority to be designated.

Where a description of persons has been designated by an order under subsection (2)(c) the Secretary of State must reconsider, at intervals of no greater than 5 years, whether it continues to be necessary for the description to be designated having regard to the matters mentioned in subsection (10).

In this section—

• “public authority” includes any body, office-holder or other person in respect of which—

  1. a

     an order may be made under section 4 or 5 of the Freedom of Information Act 2000, or

  2. b

     an order may be made under section 4 or 5 of the Freedom of Information (Scotland) Act 2002;

• “specified” means specified in an assessment notice.

A time specified in an assessment notice under section 41A(5) in relation to a requirement must not fall, and a period so specified must not begin, before the end of the period within which an appeal can be brought against the notice, and if such an appeal is brought the requirement need not be complied with pending the determination or withdrawal of the appeal.

If by reason of special circumstances the Commissioner considers that it is necessary for the data controller to comply with a requirement in an assessment notice as a matter of urgency, the Commissioner may include in the notice a statement to that effect and a statement of the reasons for that conclusion; and in that event subsection (1) applies in relation to the requirement as if for the words from “within” to the end there were substituted of 7 days beginning with the day on which the notice is served.

In subsection (3) references to the client of a professional legal adviser include references to any person representing such a client.

The Commissioner must prepare and issue a code of practice as to the manner in which the Commissioner's functions under and in connection with section 41A are to be exercised.

The Commissioner may alter or replace the code.

If the code is altered or replaced, the Commissioner must issue the altered or replacement code.

The Commissioner must consult the Secretary of State before issuing the code (or an altered or replacement code).

The Commissioner must arrange for the publication of the code (and any altered or replacement code) issued under this section in such form and manner as the Commissioner considers appropriate.

In this section “ social care ” has the same meaning as in Part 1 of the Health and Social Care Act 2008 (see section 9(3) of that Act).

A request may be made to the Commissioner by or on behalf of any person who is, or believes himself to be, directly affected by any processing of personal data for an assessment as to whether it is likely or unlikely that the processing has been or is being carried out in compliance with the provisions of this Act.

An information notice must also contain particulars of the rights of appeal conferred by section 48.

Subject to subsection (5), F62a period specified in an information notice under subsection (1B)(b) must not end, and a time so specified must not fall, before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the information need not be furnished pending the determination or withdrawal of the appeal.

If by reason of special circumstances the Commissioner considers that the information is required as a matter of urgency, he may include in the notice a statement to that effect and a statement of his reasons for reaching that conclusion; and in that event subsection (4) shall not apply, but the notice shall not require the information to be furnished before the end of the period of seven days beginning with the day on which the notice is served.

In subsection (6) references to the client of a professional legal adviser include references to any person representing such a client.

A person shall not be required by virtue of this section to furnish the Commissioner with any information if the furnishing of that information would, by revealing evidence of the commission of any offence F63, other than an offence under this Act or an offence within subsection (8A), expose him to proceedings for that offence.

The Commissioner may cancel an information notice by written notice to the person on whom it was served.

This section has effect subject to section 46(3).

A special information notice must also contain particulars of the rights of appeal conferred by section 48.

Subject to subsection (6), F67a period specified in a special information notice under subsection (1B)(b) must not end, and a time so specified must not fall, before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the information need not be furnished pending the determination or withdrawal of the appeal.

If by reason of special circumstances the Commissioner considers that the information is required as a matter of urgency, he may include in the notice a statement to that effect and a statement of his reasons for reaching that conclusion; and in that event subsection (5) shall not apply, but the notice shall not require the information to be furnished before the end of the period of seven days beginning with the day on which the notice is served.

In subsection (7) references to the client of a professional legal adviser include references to any person representing such a client.

A person shall not be required by virtue of this section to furnish the Commissioner with any information if the furnishing of that information would, by revealing evidence of the commission of any offence F68, other than an offence under this Act or an offence within subsection (9A), expose him to proceedings for that offence.

The Commissioner may cancel a special information notice by written notice to the person on whom it was served.

Notice of the determination shall be given to the data controller; and the notice must contain particulars of the right of appeal conferred by section 48.

A determination under subsection (1) shall not take effect until the end of the period within which an appeal can be brought and, where an appeal is brought, shall not take effect pending the determination or withdrawal of the appeal.