Data Protection Act 1998U.K.
5.—(1) The Assembly Commission shall be treated as a Crown body for the purposes of the Data Protection Act 1998M1 to the extent specified in this article.
(2) For the purposes of the following provisions the Assembly Commission shall be treated as a government department—
(a)section 63(2) and (5) (application to Crown),
(b)paragraph 5 of Schedule 2 (conditions relating to processing of data for the purposes of functions of the Crown), and
(c)paragraph 7 of Schedule 3 (conditions relating to processing of sensitive data for the purposes of functions of the Crown).
(3) References in the provisions mentioned in paragraph (4) to—
(a)employment by or under the Crown, or
(b)a person in the service of the Crown,
shall be treated as including employment as a member of staff of the Assembly or (as the case may be) a person so employed.
(4) The provisions are—
(a)section 33A(2) (exemptions for certain data relating to employment under the Crown),
(b)section 63(5) (application of certain provisions to persons in service of Crown), and
(c)paragraph 4 of Schedule 7 (data relating to person's suitability for employment by or under Crown).