44.—(1) Sections 7 (right of access to personal data), 8 (provisions supplementary to section 7) and 67 (orders, regulations and rules) of the Act apply in relation to the processing of personal data to which this Part applies, with the following modifications.
(2) Section 7 shall have effect as if—
(a)a reference to a “data controller” were a reference to a “UK competent authority” within the meaning of regulation 27(1);
(b)in subsection (1)—
(i)the references to sections 9 and 9A of the Act were omitted; and.
(ii)in paragraph (d), the words between “relating to him” and “has constituted or is likely to constitute” were omitted;
(c)after subsection (4) there was inserted—
“(4A) Subsection (1) does not require a UK competent authority to provide any information if, having due regard to the legitimate interests of the person concerned, refusal to do so is a necessary and proportionate measure to—
(a)avoid obstructing an official or legal inquiry, investigation or procedure;
(b)avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
(c)protect public security;
(d)protect national security; or
(e)protect the data subject or the rights and freedoms of others.
(4B) Where a UK competent authority refuses to provide information or restricts access to it in response to a request made under subsection (1), the authority must give the data subject written notice of its decision, which must also set out—
(a)except where a reason under subsection (4A) exists, the factual or legal reasons on which the decision is based; and
(b)notice of the data subject’s entitlement to appeal to the Commissioner or to a court.”; and
(d)subsection (12) were omitted.
(3) Section 8 shall have effect as if—
(a)a reference to a “data controller” were a reference to a “UK competent authority” within the meaning of regulation 27(1); and
(b)subsection (5) were omitted.