After section 35 of that Act there is inserted—

“35A Parliamentary privilege.

Personal data are exempt from—

(a)

the first data protection principle, except to the extent to which it requires compliance with the conditions in Schedules 2 and 3,

(b)

the second, third, fourth and fifth data protection principles,

(c)

section 7, and

(d)

sections 10 and 14(1) to (3),

if the exemption is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.”

After section 63 of that Act there is inserted—

“63A Application to Parliament.

(1)

Subject to the following provisions of this section and to section 35A, this Act applies to the processing of personal data by or on behalf of either House of Parliament as it applies to the processing of personal data by other persons.

(2)

Where the purposes for which and the manner in which any personal data are, or are to be, processed are determined by or on behalf of the House of Commons, the data controller in respect of those data for the purposes of this Act shall be the Corporate Officer of that House.

(3)

Where the purposes for which and the manner in which any personal data are, or are to be, processed are determined by or on behalf of the House of Lords, the data controller in respect of those data for the purposes of this Act shall be the Corporate Officer of that House.

(4)

Nothing in subsection (2) or (3) is to be taken to render the Corporate Officer of the House of Commons or the Corporate Officer of the House of Lords liable to prosecution under this Act, but section 55 and paragraph 12 of Schedule 9 shall apply to a person acting on behalf of either House as they apply to any other person.”

In Schedule 2 to that Act (conditions relevant for the purposes of the first data protection principle: processing of any personal data) in paragraph 5 after paragraph (a) there is inserted—

“(aa)

for the exercise of any functions of either House of Parliament,”.

In Schedule 3 to that Act (conditions relevant for the purposes of the first data protection principle: processing of sensitive personal data) in paragraph 7 after paragraph (a) there is inserted—

“(aa)

for the exercise of any functions of either House of Parliament,”.