The appropriate authority must ensure that the computerised information management system and its operation comply with legislation on data security in force in the relevant constituent territory of Great Britain.