Modifications etc. (not altering text)
C1Pt. V applied (with modifications) (1.3.2000) by S.I. 1999/2093, reg. 36(1), Sch. 4
Pt. V applied (with modifications) (1.3.2000) by S.I. 2000/190, art. 5(2)
C2Pt. V extended (with modifications) (11.12.2003) by The Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426), reg. 31, Sch. 1 (with regs. 4, 15(3), 28, 29)
C3Pt. V applied (with modifications) (3.12.2014) by The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141), regs. 1(b), 51(1)(a)
C4Pt. V amendment to earlier affecting provision S.I. 2003/2426 reg. 31 Sch. (6.4.2015) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2015 (S.I. 2015/355), regs. 1, reg. 2(3)-(5)
(1)The Commissioner must prepare and issue a code of practice as to the manner in which the Commissioner's functions under and in connection with section 41A are to be exercised.
(2)The code must in particular—
(a)specify factors to be considered in determining whether to serve an assessment notice on a data controller;
(b)specify descriptions of documents and information that—
(i)are not to be examined or inspected in pursuance of an assessment notice, or
(ii)are to be so examined or inspected only by persons of a description specified in the code;
(c)deal with the nature of inspections and examinations carried out in pursuance of an assessment notice;
(d)deal with the nature of interviews carried out in pursuance of an assessment notice;
(e)deal with the preparation, issuing and publication by the Commissioner of assessment reports in respect of data controllers that have been served with assessment notices.
(3)The provisions of the code made by virtue of subsection (2)(b) must, in particular, include provisions that relate to—
(a)documents and information concerning an individual's physical or mental health;
(b)documents and information concerning the provision of social care for an individual.
(4)An assessment report is a report which contains—
(a)a determination as to whether a data controller has complied or is complying with the data protection principles,
(b)recommendations as to any steps which the data controller ought to take, or refrain from taking, to ensure compliance with any of those principles, and
(c)such other matters as are specified in the code.
(5)The Commissioner may alter or replace the code.
(6)If the code is altered or replaced, the Commissioner must issue the altered or replacement code.
[F2(7) The Commissioner must consult the Secretary of State before issuing the code (or an altered or replacement code).]
(8)The Commissioner must arrange for the publication of the code (and any altered or replacement code) issued under this section in such form and manner as the Commissioner considers appropriate.
(9) In this section “ social care ” has the same meaning as in Part 1 of the Health and Social Care Act 2008 (see section 9(3) of that Act). ]
Textual Amendments
F1Ss. 41A-41C inserted (1.2.2010 as regards s. 41C and 6.4.2010 as regards ss. 41A, 41B) by Coroners and Justice Act 2009 (c. 25), ss. 173, 182 (with s. 180); S.I. 2010/145, art. 2, Sch. para. 15; S.I. 2010/816, art. 2, Sch. para. 12
F2S. 41C(7) substituted (1.9.2013) by Protection of Freedoms Act 2012 (c. 9), ss. 106(1), 120 (with s. 97); S.I. 2013/1906, art. 3(c)
Modifications etc. (not altering text)
C5S. 41C applied (with modifications) (22.7.2016) by The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696), reg. 1, Sch. 2 paras. 1(e), 2