Data Protection Act 2018 (c. 12)

PART 7 Supplementary and final provision

Representation of data subjects

187 Representation of data subjects with their authority

(1) In relation to the processing of personal data to which the GDPR applies—

(a) Article 80(1) of the GDPR (representation of data subjects) enables a data subject to authorise a body or other organisation which meets the conditions set out in that Article to exercise the data subject’s rights under Articles 77, 78 and 79 of the GDPR (rights to lodge complaints and to an effective judicial remedy) on the data subject’s behalf, and

(b) a data subject may also authorise such a body or organisation to exercise the data subject’s rights under Article 82 of the GDPR (right to compensation).

(2) In relation to the processing of personal data to which the GDPR does not apply, a body or other organisation which meets the conditions in subsections (3) and (4), if authorised to do so by a data subject, may exercise some or all of the following rights of a data subject on the data subject’s behalf—

(a) rights under section 165(2), (4)(d) and (6)(c) (complaints to the Commissioner);

(b) rights under section 166(2) (orders for the Commissioner to progress complaints);

(c) rights under section 167(1) (compliance orders);

(d) the right to bring judicial review proceedings against the Commissioner.

(3) The first condition is that the body or organisation, by virtue of its constitution or an enactment—

(a) is required (after payment of outgoings) to apply the whole of its income and any capital it expends for charitable or public purposes,

(b) is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes), and

(c) has objectives which are in the public interest.

(4) The second condition is that the body or organisation is active in the field of protection of data subjects’ rights and freedoms with regard to the protection of their personal data.

(5) In this Act, references to a “representative body”, in relation to a right of a data subject, are to a body or other organisation authorised to exercise the right on the data subject’s behalf under Article 80 of the GDPR or this section.

188 Representation of data subjects with their authority: collective proceedings

(1) The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a court or tribunal in England and Wales or Northern Ireland combining two or more relevant claims.

(2) In this section, “relevant claim”, in relation to a representative body, means a claim in respect of a right of a data subject which the representative body is authorised to exercise on the data subject’s behalf under Article 80(1) of the GDPR or section 187.

(3) The power under subsection (1) includes power—

(a) to make provision about the proceedings;

(b) to confer functions on a person, including functions involving the exercise of a discretion;

(c) to make different provision in relation to England and Wales and in relation to Northern Ireland.

(4) The provision mentioned in subsection (3)(a) includes provision about—

(a) the effect of judgments and orders;

(b) agreements to settle claims;

(c) the assessment of the amount of compensation;

(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;

(e) costs.

(5) Regulations under this section are subject to the negative resolution procedure.

189 Duty to review provision for representation of data subjects

(1) Before the end of the review period, the Secretary of State must—

(a) review the matters listed in subsection (2) in relation to England and Wales and Northern Ireland,

(b) prepare a report of the review, and

(c) lay a copy of the report before Parliament.

(2) Those matters are—

(a) the operation of Article 80(1) of the GDPR,

(b) the operation of section 187,

(c) the merits of exercising the power under Article 80(2) of the GDPR (power to enable a body or other organisation which meets the conditions in Article 80(1) of the GDPR to exercise some or all of a data subject’s rights under Articles 77, 78 and 79 of the GDPR without being authorised to do so by the data subject),

(d) the merits of making equivalent provision in relation to data subjects’ rights under Article 82 of the GDPR (right to compensation), and

(e) the merits of making provision for a children’s rights organisation to exercise some or all of a data subject’s rights under Articles 77, 78, 79 and 82 of the GDPR on behalf of a data subject who is a child, with or without being authorised to do so by the data subject.

(3) “The review period” is the period of 30 months beginning when section 187 comes into force.

(4) In carrying out the review, the Secretary of State must—

(a) consider the particular needs of children separately from the needs of adults,

(b) have regard to the fact that children have different needs at different stages of development,

(c) carry out an analysis of the particular challenges that children face in authorising, and deciding whether to authorise, other persons to act on their behalf under Article 80(1) of the GDPR or section 187,

(d) consider the support and advice available to children in connection with the exercise of their rights under Articles 77, 78, 79 and 82 of the GDPR by another person on their behalf and the merits of making available other support or advice, and

(e) have regard to the United Kingdom’s obligations under the United Nations Convention on the Rights of the Child.

(5) Before preparing the report under subsection (1), the Secretary of State must consult the Commissioner and such other persons as the Secretary of State considers appropriate, including—

(a) persons active in the field of protection of data subjects’ rights and freedoms with regard to the protection of their personal data,

(b) children and parents,

(c) children’s rights organisations and other persons who appear to the Secretary of State to represent the interests of children,

(d) child development experts, and

(e) trade associations.

(6) In this section—

• “children’s rights organisation” means a body or other organisation which—

  (a)

  is active in representing the interests of children, and

  (b)

  has objectives which are in the public interest;

• “trade association” includes a body representing controllers or processors;

• “the United Nations Convention on the Rights of the Child” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.

190 Post-review powers to make provision about representation of data subjects

(1) After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations—

(a) exercise the powers under Article 80(2) of the GDPR in relation to England and Wales and Northern Ireland,

(b) make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the GDPR to exercise a data subject’s rights under Article 82 of the GDPR in England and Wales and Northern Ireland without being authorised to do so by the data subject, and

(c) make provision described in section 189(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.

(2) The powers under subsection (1) include power—

(a) to make provision enabling a data subject to prevent a body or other organisation from exercising, or continuing to exercise, the data subject’s rights;

(b) to make provision about proceedings before a court or tribunal where a body or organisation exercises a data subject’s rights;

(c) to make provision for bodies or other organisations to bring proceedings before a court or tribunal combining two or more claims in respect of a right of a data subject;

(d) to confer functions on a person, including functions involving the exercise of a discretion;

(e) to amend sections 166 to 168, 180, 187, 203, 205 and 206;

(f) to insert new sections and Schedules into Part 6 or 7 ;

(g) to make different provision in relation to England and Wales and in relation to Northern Ireland.

(3) The powers under subsection (1)(a) and (b) include power to make provision in relation to data subjects who are children or data subjects who are not children or both.

(4) The provision mentioned in subsection (2)(b) and (c) includes provision about—

(a) the effect of judgments and orders;

(b) agreements to settle claims;

(c) the assessment of the amount of compensation;

(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;

(e) costs.

(5) Regulations under this section are subject to the affirmative resolution procedure.