Data Protection Act 2018, Section 172 is up to date with all changes known to be in force on or before 01 March 2025. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
(1)For the purposes of section 171, in relation to a person who re-identifies information that is de-identified personal data, “the effectiveness testing conditions” means the conditions in subsections (2) and (3).
(2)The first condition is that the person acted—
(a)with a view to testing the effectiveness of the de-identification of personal data,
(b)without intending to cause, or threaten to cause, damage or distress to a person, and
(c)in the reasonable belief that, in the particular circumstances, re-identifying the information was justified as being in the public interest.
(3)The second condition is that the person notified the Commissioner or the controller responsible for de-identifying the personal data about the re-identification—
(a)without undue delay, and
(b)where feasible, not later than 72 hours after becoming aware of it.
(4)Where there is more than one controller responsible for de-identifying personal data, the requirement in subsection (3) is satisfied if one or more of them is notified.
The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
All content is available under the Open Government Licence v3.0 except where otherwise stated. This site additionally contains content derived from EUR-Lex, reused under the terms of the Commission Decision 2011/833/EU on the reuse of documents from the EU institutions. For more information see the EUR-Lex public statement on re-use.
