Data Protection Act 2018

Section 118

SCHEDULE 14 Co-operation and mutual assistance

PART 1 Law Enforcement Directive

Co-operation

1 (1) The Commissioner may provide information or assistance to an LED supervisory authority to the extent that, in the opinion of the Commissioner, providing that information or assistance is necessary for the performance of the recipient’s data protection functions.

(2) The Commissioner may ask an LED supervisory authority to provide information or assistance which the Commissioner requires for the performance of the Commissioner’s data protection functions.

(3) In this paragraph, “data protection functions” means functions relating to the protection of individuals with respect to the processing of personal data.

Requests for information and assistance from LED supervisory authorities

2 (1) This paragraph applies where the Commissioner receives a request from an LED supervisory authority for information or assistance referred to in Article 41 of the Law Enforcement Directive and the request—

(a) explains the purpose of and reasons for the request, and

(b) contains all other information necessary to enable the Commissioner to respond.

(2) The Commissioner must—

(a) take all appropriate measures required to reply to the request without undue delay and, in any event, before the end of the period of 1 month beginning with receipt of the request, and

(b) inform the LED supervisory authority of the results or, as the case may be, of the progress of the measures taken in order to respond to the request.

(3) The Commissioner must not refuse to comply with the request unless—

(a) the Commissioner does not have power to do what is requested, or

(b) complying with the request would infringe the Law Enforcement Directive, EU legislation or the law of the United Kingdom or a part of the United Kingdom.

(4) If the Commissioner refuses to comply with a request from an LED supervisory authority, the Commissioner must inform the authority of the reasons for the refusal.

(5) As a general rule, the Commissioner must provide information requested by LED supervisory authorities by electronic means using a standardised format.

Fees

3 (1) Subject to sub-paragraph (2), any information or assistance that is required to be provided by this Part of this Schedule must be provided free of charge.

(2) The Commissioner may enter into agreements with other LED supervisory authorities for the Commissioner and other authorities to indemnify each other for expenditure arising from the provision of assistance in exceptional circumstances.

Restrictions on use of information

4 Where the Commissioner receives information from an LED supervisory authority as a result of a request under paragraph 1(2), the Commissioner may use the information only for the purposes specified in the request.

LED supervisory authority

5 In this Part of this Schedule, “LED supervisory authority” means a supervisory authority for the purposes of Article 41 of the Law Enforcement Directive in a member State other than the United Kingdom.

PART 2 Data Protection Convention

Co-operation between the Commissioner and foreign designated authorities

6 (1) The Commissioner must, at the request of a foreign designated authority—

(a) provide that authority with such information referred to in Article 13(3)(a) of the Data Protection Convention (information on law and administrative practice in the field of data protection) as is the subject of the request, and

(b) take appropriate measures in accordance with Article 13(3)(b) of the Data Protection Convention for providing that authority with information relating to the processing of personal data in the United Kingdom.

(2) The Commissioner may ask a foreign designated authority—

(a) to provide the Commissioner with information referred to in Article 13(3) of the Data Protection Convention, or

(b) to take appropriate measures to provide such information.

Assisting persons resident outside the UK with requests under Article 14 of the Convention

7 (1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in the United Kingdom is made by a person resident outside the United Kingdom, including where the request is forwarded to the Commissioner through the Secretary of State or a foreign designated authority.

(2) The Commissioner must take appropriate measures to assist the person to exercise those rights.

Assisting UK residents with requests under Article 8 of the Convention

8 (1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in a country or territory (other than the United Kingdom) specified in the request is—

(a) made by a person resident in the United Kingdom, and

(b) submitted through the Commissioner under Article 14(2) of the Convention.

(2) If the Commissioner is satisfied that the request contains all necessary particulars referred to in Article 14(3) of the Data Protection Convention, the Commissioner must send the request to the foreign designated authority in the specified country or territory.

(3) Otherwise, the Commissioner must, where practicable, notify the person making the request of the reasons why the Commissioner is not required to assist.

Restrictions on use of information

9 Where the Commissioner receives information from a foreign designated authority as a result of—

(a) a request made by the Commissioner under paragraph 6(2), or

(b) a request received by the Commissioner under paragraph 6(1) or 7,

the Commissioner may use the information only for the purposes specified in the request.

Foreign designated authority

10 In this Part of this Schedule, “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Data Protection Convention.