The data subject shall have the right to mandate F1a body or other organisation which meets the conditions in section 187(3) and (4) of the 2018 Act to F2make a complaint under section 164A or 165 of the 2018 Act on his or her behalf, to exercise the rights referred to in Articles F3... 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf F4... .

F5The Secretary of State may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to F6make a complaint under section 164A or 165 of the 2018 Act and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.

The Secretary of State may exercise the power under paragraph 2 of this Article only by making regulations under section 190 of the 2018 Act.