Data Protection Act 1998

Part III U.K. Notification by data controllers

16 Preliminary. U.K.

(1) In this Part “the registrable particulars”, in relation to a data controller, means—

(a) his name and address,

(b) if he has nominated a representative for the purposes of this Act, the name and address of the representative,

(c) a description of the personal data being or to be processed by or on behalf of the data controller and of the category or categories of data subject to which they relate,

(d) a description of the purpose or purposes for which the data are being or are to be processed,

(e) a description of any recipient or recipients to whom the data controller intends or may wish to disclose the data,

(f) the names, or a description of, any countries or territories outside the European Economic Area to which the data controller directly or indirectly transfers, or intends or may wish directly or indirectly to transfer, the data,

[F1 (ff) where the data controller is a public authority, a statement of that fact,] and

(g) in any case where—

(i) personal data are being, or are intended to be, processed in circumstances in which the prohibition in subsection (1) of section 17 is excluded by subsection (2) or (3) of that section, and

(ii) the notification does not extend to those data,

a statement of that fact.

(2) In this Part—

• “fees regulations” means regulations made by the [F2 Secretary of State] under section 18(5) or 19(4) or (7);

• “notification regulations” means regulations made by the [F2 Secretary of State] under the other provisions of this Part;

• “prescribed”, except where used in relation to fees regulations, means prescribed by notification regulations.

(3) For the purposes of this Part, so far as it relates to the addresses of data controllers—

(a) the address of a registered company is that of its registered office, and

(b) the address of a person (other than a registered company) carrying on a business is that of his principal place of business in the United Kingdom.

Textual Amendments

F1 S. 16(1)(ff) inserted (1.1.2005) by 2000 c. 36, ss. 71, 87(3) (with ss. 56, 78); S.I. 2004/1909, art. 2; S.I. 2004/3122, art. 2

F2 Words in s. 16 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(a)

Commencement Information

I1 S. 16 wholly in force at 1.3.2000; s. 16 in force for certain purposes at Royal Assent see s. 75(2)(i); s. 16 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)

17 Prohibition on processing without registration. U.K.

(1) Subject to the following provisions of this section, personal data must not be processed unless an entry in respect of the data controller is included in the register maintained by the Commissioner under section 19 (or is treated by notification regulations made by virtue of section 19(3) as being so included).

(2) Except where the processing is assessable processing for the purposes of section 22, subsection (1) does not apply in relation to personal data consisting of information which falls neither within paragraph (a) of the definition of “data” in section 1(1) nor within paragraph (b) of that definition.

(3) If it appears to the [F3 Secretary of State] that processing of a particular description is unlikely to prejudice the rights and freedoms of data subjects, notification regulations may provide that, in such cases as may be prescribed, subsection (1) is not to apply in relation to processing of that description.

(4) Subsection (1) does not apply in relation to any processing whose sole purpose is the maintenance of a public register.

Textual Amendments

F3 Words in s. 17 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(a)

Modifications etc. (not altering text)

C1 S. 17(1) excluded (1.3.2000) by S.I. 2000/188, reg. 3

18 Notification by data controllers. U.K.

(1) Any data controller who wishes to be included in the register maintained under section 19 shall give a notification to the Commissioner under this section.

(2) A notification under this section must specify in accordance with notification regulations—

(a) the registrable particulars, and

(b) a general description of measures to be taken for the purpose of complying with the seventh data protection principle.

(3) Notification regulations made by virtue of subsection (2) may provide for the determination by the Commissioner, in accordance with any requirements of the regulations, of the form in which the registrable particulars and the description mentioned in subsection (2)(b) are to be specified, including in particular the detail required for the purposes of section 16(1)(c), (d), (e) and (f) and subsection (2)(b).

(4) Notification regulations may make provision as to the giving of notification—

(a) by partnerships, or

(b) in other cases where two or more persons are the data controllers in respect of any personal data.

(5) The notification must be accompanied by such fee as may be prescribed by fees regulations.

(6) Notification regulations may provide for any fee paid under subsection (5) or section 19(4) to be refunded in prescribed circumstances.

Commencement Information

I2 S. 18 wholly in force at 1.3.2000; s. 18 in force for certain purposes at Royal Assent see s. 75(2)(i); s. 18 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)

19 Register of notifications. U.K.

(1) The Commissioner shall—

(a) maintain a register of persons who have given notification under section 18, and

(b) make an entry in the register in pursuance of each notification received by him under that section from a person in respect of whom no entry as data controller was for the time being included in the register.

(2) Each entry in the register shall consist of—

(a) the registrable particulars notified under section 18 or, as the case requires, those particulars as amended in pursuance of section 20(4), and

(b) such other information as the Commissioner may be authorised or required by notification regulations to include in the register.

(3) Notification regulations may make provision as to the time as from which any entry in respect of a data controller is to be treated for the purposes of section 17 as having been made in the register.

(4) No entry shall be retained in the register for more than the relevant time except on payment of such fee as may be prescribed by fees regulations.

(5) In subsection (4) “the relevant time” means twelve months or such other period as may be prescribed by notification regulations; and different periods may be prescribed in relation to different cases.

(6) The Commissioner—

(a) shall provide facilities for making the information contained in the entries in the register available for inspection (in visible and legible form) by members of the public at all reasonable hours and free of charge, and

(b) may provide such other facilities for making the information contained in those entries available to the public free of charge as he considers appropriate.

(7) The Commissioner shall, on payment of such fee, if any, as may be prescribed by fees regulations, supply any member of the public with a duly certified copy in writing of the particulars contained in any entry made in the register.

Modifications etc. (not altering text)

C2 S. 19(4) applied (with modifications) (1.3.2000) by S.I. 2000/188, reg. 15(2)(3) (as amended by S.I. 2001/3214, reg. 2(2))

C3 S. 19(5) applied (with modifications) (1.3.2000) by S.I. 2000/188, reg. 15(2)(3)

Commencement Information

I3 S. 19 wholly in force at 1.3.2000; s. 19 in force for certain purposes at Royal Assent see s. 75(2)(i); s. 19 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)

20 Duty to notify changes. U.K.

(1) For the purpose specified in subsection (2), notification regulations shall include provision imposing on every person in respect of whom an entry as a data controller is for the time being included in the register maintained under section 19 a duty to notify to the Commissioner, in such circumstances and at such time or times and in such form as may be prescribed, such matters relating to the registrable particulars and measures taken as mentioned in section 18(2)(b) as may be prescribed.

(2) The purpose referred to in subsection (1) is that of ensuring, so far as practicable, that at any time—

(a) the entries in the register maintained under section 19 contain current names and addresses and describe the current practice or intentions of the data controller with respect to the processing of personal data, and

(b) the Commissioner is provided with a general description of measures currently being taken as mentioned in section 18(2)(b).

(3) Subsection (3) of section 18 has effect in relation to notification regulations made by virtue of subsection (1) as it has effect in relation to notification regulations made by virtue of subsection (2) of that section.

(4) On receiving any notification under notification regulations made by virtue of subsection (1), the Commissioner shall make such amendments of the relevant entry in the register maintained under section 19 as are necessary to take account of the notification.

21 Offences. U.K.

(1) If section 17(1) is contravened, the data controller is guilty of an offence.

(2) Any person who fails to comply with the duty imposed by notification regulations made by virtue of section 20(1) is guilty of an offence.

(3) It shall be a defence for a person charged with an offence under subsection (2) to show that he exercised all due diligence to comply with the duty.

22 Preliminary assessment by Commissioner. U.K.

(1) In this section “assessable processing” means processing which is of a description specified in an order made by the [F4 Secretary of State] as appearing to him to be particularly likely—

(a) to cause substantial damage or substantial distress to data subjects, or

(b) otherwise significantly to prejudice the rights and freedoms of data subjects.

(2) On receiving notification from any data controller under section 18 or under notification regulations made by virtue of section 20 the Commissioner shall consider—

(a) whether any of the processing to which the notification relates is assessable processing, and

(b) if so, whether the assessable processing is likely to comply with the provisions of this Act.

(3) Subject to subsection (4), the Commissioner shall, within the period of twenty-eight days beginning with the day on which he receives a notification which relates to assessable processing, give a notice to the data controller stating the extent to which the Commissioner is of the opinion that the processing is likely or unlikely to comply with the provisions of this Act.

(4) Before the end of the period referred to in subsection (3) the Commissioner may, by reason of special circumstances, extend that period on one occasion only by notice to the data controller by such further period not exceeding fourteen days as the Commissioner may specify in the notice.

(5) No assessable processing in respect of which a notification has been given to the Commissioner as mentioned in subsection (2) shall be carried on unless either—

(a) the period of twenty-eight days beginning with the day on which the notification is received by the Commissioner (or, in a case falling within subsection (4), that period as extended under that subsection) has elapsed, or

(b) before the end of that period (or that period as so extended) the data controller has received a notice from the Commissioner under subsection (3) in respect of the processing.

(6) Where subsection (5) is contravened, the data controller is guilty of an offence.

(7) The [F4 Secretary of State] may by order amend subsections (3), (4) and (5) by substituting for the number of days for the time being specified there a different number specified in the order.

Textual Amendments

F4 Words in s. 22 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(a)

Commencement Information

I4 S. 22 wholly in force at 1.3.2000; s. 22 in force for certain purposes at Royal Assent see s. 75(2)(i); s. 22 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)

23 Power to make provision for appointment of data protection supervisors. U.K.

(1) The [F5 Secretary of State] may by order—

(a) make provision under which a data controller may appoint a person to act as a data protection supervisor responsible in particular for monitoring in an independent manner the data controller’s compliance with the provisions of this Act, and

(b) provide that, in relation to any data controller who has appointed a data protection supervisor in accordance with the provisions of the order and who complies with such conditions as may be specified in the order, the provisions of this Part are to have effect subject to such exemptions or other modifications as may be specified in the order.

(2) An order under this section may—

(a) impose duties on data protection supervisors in relation to the Commissioner, and

(b) confer functions on the Commissioner in relation to data protection supervisors.

Textual Amendments

F5 Words in s. 23 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(a)

Commencement Information

I5 S. 23 wholly in force at 1.3.2000; s. 23 in force for certain purposes at Royal Assent see s. 75(2)(i); s. 23 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)

24 Duty of certain data controllers to make certain information available. U.K.

(1) Subject to subsection (3), where personal data are processed in a case where—

(a) by virtue of subsection (2) or (3) of section 17, subsection (1) of that section does not apply to the processing, and

(b) the data controller has not notified the relevant particulars in respect of that processing under section 18,

the data controller must, within twenty-one days of receiving a written request from any person, make the relevant particulars available to that person in writing free of charge.

(2) In this section “the relevant particulars” means the particulars referred to in paragraphs (a) to (f) of section 16(1).

(3) This section has effect subject to any exemption conferred for the purposes of this section by notification regulations.

(4) Any data controller who fails to comply with the duty imposed by subsection (1) is guilty of an offence.

(5) It shall be a defence for a person charged with an offence under subsection (4) to show that he exercised all due diligence to comply with the duty.

25 Functions of Commissioner in relation to making of notification regulations. U.K.

(1) As soon as practicable after the passing of this Act, the Commissioner shall submit to the Secretary of State proposals as to the provisions to be included in the first notification regulations.

(2) The Commissioner shall keep under review the working of notification regulations and may from time to time submit to the [F6 Secretary of State] proposals as to amendments to be made to the regulations.

(3) The [F6 Secretary of State] may from time to time require the Commissioner to consider any matter relating to notification regulations and to submit to him proposals as to amendments to be made to the regulations in connection with that matter.

(4) Before making any notification regulations, the [F6 Secretary of State] shall—

(a) consider any proposals made to him by the Commissioner under [F7 subsection (2) or (3)], and

(b) consult the Commissioner.

Textual Amendments

F6 Words in s. 25 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(a)

F7 Words in s. 25(4)(a) substituted (26.11.2001) by S.I. 2001/3500, art. 8, Sch. 2 Pt. I para. 6(2)

Commencement Information

I6 S. 25 wholly in force at 1.3.2000; s. 25(1)(4) in force at Royal Assent see s. 75(2)(i); s. 25 in force at 1.3.2000 insofar as not already in force by S.I. 2000/183, art. 2(1)

26 Fees regulations. U.K.

(1) Fees regulations prescribing fees for the purposes of any provision of this Part may provide for different fees to be payable in different cases.

(2) In making any fees regulations, the [F8 Secretary of State] shall have regard to the desirability of securing that the fees payable to the Commissioner are sufficient to offset—

(a) the expenses incurred by the Commissioner and the Tribunal in discharging their functions [F9 under this Act]and any expenses of the Secretary of State in respect of the Commissioner or the Tribunal [F10 so far as attributable to their functions under this Act], and

(b) to the extent that the Secretary of State considers appropriate—

(i) any deficit previously incurred (whether before or after the passing of this Act) in respect of the expenses mentioned in paragraph (a), and

(ii) expenses incurred or to be incurred by the Secretary of State in respect of the inclusion of any officers or staff of the Commissioner in any scheme under section 1 of the M1 Superannuation Act 1972.

Textual Amendments

F8 Words in s. 26 substituted (19.8.2003) by The Secretary of State for Constitutional Affairs Order 2003 (S.I. 2003/1887), art. 9, Sch. 2 para. 9(1)(a)

F9 Words in s. 26(2)(a) inserted (30.11.2000) by 2000 c. 36, ss. 18(4), 87(1)(i), Sch. 2 Pt. II para. 17 (with ss. 7(1)(7), 56, 78)

F10 Words in s. 26(2)(a) inserted (30.11.2000) by 2000 c. 36, ss. 18(4), 87(1)(i), Sch. 2 Pt. II para. 17 (with ss. 7(1)(7), 56, 78)

Marginal Citations

M1 1972 c. 11.