Section 73.
1In section 7 of the [1998 c. 29.] Data Protection Act 1998 (right of access to personal data), for subsection (3) there is substituted—
“(3)Where a data controller—
(a)reasonably requires further information in order to satisfy himself as to the identity of the person making a request under this section and to locate the information which that person seeks, and
(b)has informed him of that requirement,
the data controller is not obliged to comply with the request unless he is supplied with that further information.”
2After section 35 of that Act there is inserted—
Personal data are exempt from—
(a)the first data protection principle, except to the extent to which it requires compliance with the conditions in Schedules 2 and 3,
(b)the second, third, fourth and fifth data protection principles,
(c)section 7, and
(d)sections 10 and 14(1) to (3),
if the exemption is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.”
3After section 63 of that Act there is inserted—
(1)Subject to the following provisions of this section and to section 35A, this Act applies to the processing of personal data by or on behalf of either House of Parliament as it applies to the processing of personal data by other persons.
(2)Where the purposes for which and the manner in which any personal data are, or are to be, processed are determined by or on behalf of the House of Commons, the data controller in respect of those data for the purposes of this Act shall be the Corporate Officer of that House.
(3)Where the purposes for which and the manner in which any personal data are, or are to be, processed are determined by or on behalf of the House of Lords, the data controller in respect of those data for the purposes of this Act shall be the Corporate Officer of that House.
(4)Nothing in subsection (2) or (3) is to be taken to render the Corporate Officer of the House of Commons or the Corporate Officer of the House of Lords liable to prosecution under this Act, but section 55 and paragraph 12 of Schedule 9 shall apply to a person acting on behalf of either House as they apply to any other person.”
4In Schedule 2 to that Act (conditions relevant for the purposes of the first data protection principle: processing of any personal data) in paragraph 5 after paragraph (a) there is inserted—
“(aa)for the exercise of any functions of either House of Parliament,”.
5In Schedule 3 to that Act (conditions relevant for the purposes of the first data protection principle: processing of sensitive personal data) in paragraph 7 after paragraph (a) there is inserted—
“(aa)for the exercise of any functions of either House of Parliament,”.
6In Schedule 7 to that Act (miscellaneous exemptions) in paragraph 3(b) (honours) after “honour” there is inserted “or dignity”.
7In paragraph 10 of that Schedule (legal professional privilege), for the words “or, in Scotland, to confidentiality as between client and professional legal adviser,” there is substituted “or, in Scotland, to confidentiality of communications”.
8In Schedule 14 to that Act (transitional provisions), in paragraph 2(1) (which confers transitional exemption from the prohibition on processing without registration on those registered under the Data Protection Act 1984) the words “or, if earlier, 24th October 2001” are omitted.