Data (Use and Access) Act 2025

Prospective

90 Joint processing: consequential amendments U.K.

(1) The 2018 Act is amended in accordance with subsections (2) to (9).

(2) In section 1(5) (overview: Part 4), at the end insert “(and certain processing carried out by competent authorities jointly with the intelligence services)”.

(3) In section 29 (processing to which Part 3 applies), after subsection (1) insert—

“(1A) This Part does not apply to processing to which Part 4 applies by virtue of a designation notice (see section 82A).”

(4) In section 83 (meaning of “controller” and “processor” in Part 4)—

(a) before subsection (1) insert—

“(A1) For the purposes of this Part—

(a) an intelligence service is the “controller” in relation to the processing of personal data if it satisfies subsection (1) alone or jointly with others, and

(b) a qualifying competent authority is the “controller” in relation to the processing of personal data that is the subject of a designation notice that is for the time being in force if the authority satisfies subsection (1) jointly with others.”,

(b) in subsection (1), for the words before paragraph (a) substitute “This subsection is satisfied by a person who—”, and

(c) in subsection (2), for “intelligence service on which” substitute “person on whom”.

(5) In section 84 (other definitions)—

(a) after subsection (2) insert—

“(2A) “Designation notice” has the meaning given in section 82A.”, and

(b) before subsection (7) insert—

“(6B) “Withdrawal notice” has the meaning given in section 82C.”

(6) In section 104(1) (joint controllers), for “intelligence services” substitute “controllers”.

(7) In section 202(1)(a)(i) (proceedings in the First-tier Tribunal: contempt) after “79,” insert “82E,”.

(8) In section 203(1) (Tribunal Procedure Rules), after “79,” insert “82E,”.

(9) In section 206 (index of defined expressions), in the Table—

(a) in the entry for “competent authority”—

(i) for “Part 3” substitute “Parts 3 and 4”, and

(ii) for “section 30” substitute “sections 30 and 82”, and

(b) at the appropriate places insert—

“designation notice (in Part 4)

section 84”;

“qualifying competent authority (in Part 4)

section 82”;

“withdrawal notice (in Part 4)

section 84”.

(10) In section 199(2)(a) of the Investigatory Powers Act 2016 (bulk personal datasets: meaning of “personal data”), after “section 82(1) of that Act” insert “by an intelligence service”.

Commencement Information

I1 S. 90 not in force at Royal Assent, see s. 142(1)