Data Protection Act 2018

Representation of data subjects U.K.

187 Representation of data subjects with their authority U.K.

(1) In relation to the processing of personal data to which the [F1 UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects)]—

(a) F2 ... enables a data subject to authorise a body or other organisation which meets the conditions set out in [F3 subsections (3) and (4)] to exercise the data subject's rights under Articles 77, 78 and 79 of the [F4 UK GDPR] (rights to lodge complaints and to an effective judicial remedy) on the data subject's behalf, and

(b) [F5 also authorises] such a body or organisation to exercise the data subject's rights under Article 82 of the [F6 UK GDPR] (right to compensation).

(2) In relation to the processing of personal data to which the [F7 UK GDPR] does not apply, a body or other organisation which meets the conditions in subsections (3) and (4), if authorised to do so by a data subject, may exercise some or all of the following rights of a data subject on the data subject's behalf—

(a) rights under section 165(2) [F8 and (4)(d)] (complaints to the Commissioner);

(b) rights under section 166(2) (orders for the Commissioner to progress complaints);

(c) rights under section 167(1) (compliance orders);

(d) the right to bring judicial review proceedings against the Commissioner.

(3) The first condition is that the body or organisation, by virtue of its constitution or an enactment—

(a) is required (after payment of outgoings) to apply the whole of its income and any capital it expends for charitable or public purposes,

(b) is prohibited from directly or indirectly distributing amongst its members any part of its assets (otherwise than for charitable or public purposes), and

(c) has objectives which are in the public interest.

(4) The second condition is that the body or organisation is active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data.

(5) In this Act, references to a “representative body”, in relation to a right of a data subject, are to a body or other organisation authorised to exercise the right on the data subject's behalf under Article 80 of the [F9 UK GDPR] or this section.

Textual Amendments

F1 Words in s. 187(1) substituted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F2 Words in s. 187(1)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F3 Words in s. 187(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F4 Words in s. 187(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F5 Words in s. 187(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F6 Words in s. 187(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F7 Words in s. 187(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F8 Words in s. 187(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F9 Words in s. 187(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 81(6) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

188 Representation of data subjects with their authority: collective proceedings E+W+N.I.

(1) The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a court or tribunal in England and Wales or Northern Ireland combining two or more relevant claims.

(2) In this section, “relevant claim”, in relation to a representative body, means a claim in respect of a right of a data subject which the representative body is authorised to exercise on the data subject's behalf under Article 80(1) of the [F10 UK GDPR] or section 187.

(3) The power under subsection (1) includes power—

(a) to make provision about the proceedings;

(b) to confer functions on a person, including functions involving the exercise of a discretion;

(c) to make different provision in relation to England and Wales and in relation to Northern Ireland.

(4) The provision mentioned in subsection (3)(a) includes provision about—

(a) the effect of judgments and orders;

(b) agreements to settle claims;

(c) the assessment of the amount of compensation;

(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;

(e) costs.

(5) Regulations under this section are subject to the negative resolution procedure.

Textual Amendments

F10 Words in s. 188(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 82 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

I1 S. 188 in force at Royal Assent for specified purposes, see s. 212(2)(f)

I2 S. 188 in force at 23.7.2018 in so far as not already in force by S.I. 2018/625, reg. 3(e)

189 Duty to review provision for representation of data subjects E+W+N.I.

(1) Before the end of the review period, the Secretary of State must—

(a) review the matters listed in subsection (2) in relation to England and Wales and Northern Ireland,

(b) prepare a report of the review, and

(c) lay a copy of the report before Parliament.

(2) Those matters are—

(a) the operation of Article 80(1) of the [F11 UK GDPR],

(b) the operation of section 187,

(c) the merits of exercising the power under Article 80(2) of the [F11 UK GDPR] (power to enable a body or other organisation which meets the conditions in Article 80(1) of the [F11 UK GDPR] to exercise some or all of a data subject's rights under Articles 77, 78 and 79 of the [F11 UK GDPR] without being authorised to do so by the data subject),

(d) the merits of making equivalent provision in relation to data subjects' rights under Article 82 of the [F11 UK GDPR] (right to compensation), and

(e) the merits of making provision for a children's rights organisation to exercise some or all of a data subject's rights under Articles 77, 78, 79 and 82 of the [F11 UK GDPR] on behalf of a data subject who is a child, with or without being authorised to do so by the data subject.

(3) “The review period” is the period of 30 months beginning when section 187 comes into force.

(4) In carrying out the review, the Secretary of State must—

(a) consider the particular needs of children separately from the needs of adults,

(b) have regard to the fact that children have different needs at different stages of development,

(c) carry out an analysis of the particular challenges that children face in authorising, and deciding whether to authorise, other persons to act on their behalf under Article 80(1) of the [F12 UK GDPR] or section 187,

(d) consider the support and advice available to children in connection with the exercise of their rights under Articles 77, 78, 79 and 82 of the [F13 UK GDPR] by another person on their behalf and the merits of making available other support or advice, and

(e) have regard to the United Kingdom's obligations under the United Nations Convention on the Rights of the Child.

(5) Before preparing the report under subsection (1), the Secretary of State must consult the Commissioner and such other persons as the Secretary of State considers appropriate, including—

(a) persons active in the field of protection of data subjects' rights and freedoms with regard to the protection of their personal data,

(b) children and parents,

(c) children's rights organisations and other persons who appear to the Secretary of State to represent the interests of children,

(d) child development experts, and

(e) trade associations.

(6) In this section—

• “children's rights organisation” means a body or other organisation which—

  (a)

  is active in representing the interests of children, and

  (b)

  has objectives which are in the public interest;

• “trade association” includes a body representing controllers or processors;

• “the United Nations Convention on the Rights of the Child” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.

Textual Amendments

F11 Words in s. 189(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 83(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F12 Words in s. 189(4)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 83(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F13 Words in s. 189(4)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 83(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

I3 S. 189 in force at 23.7.2018 by S.I. 2018/625, reg. 3(f)

190 Post-review powers to make provision about representation of data subjects E+W+N.I.

(1) After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations—

(a) exercise the powers under Article 80(2) of the [F14 UK GDPR] in relation to England and Wales and Northern Ireland,

(b) make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the [F14 UK GDPR] to exercise a data subject's rights under Article 82 of the [F14 UK GDPR] in England and Wales and Northern Ireland without being authorised to do so by the data subject, and

(c) make provision described in section 189(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.

(2) The powers under subsection (1) include power—

(a) to make provision enabling a data subject to prevent a body or other organisation from exercising, or continuing to exercise, the data subject's rights;

(b) to make provision about proceedings before a court or tribunal where a body or organisation exercises a data subject's rights;

(c) to make provision for bodies or other organisations to bring proceedings before a court or tribunal combining two or more claims in respect of a right of a data subject;

(d) to confer functions on a person, including functions involving the exercise of a discretion;

(e) to amend sections 166 to 168, 180, 187, 203, 205 and 206;

(f) to insert new sections and Schedules into Part 6 or 7 ;

(g) to make different provision in relation to England and Wales and in relation to Northern Ireland.

(3) The powers under subsection (1)(a) and (b) include power to make provision in relation to data subjects who are children or data subjects who are not children or both.

(4) The provision mentioned in subsection (2)(b) and (c) includes provision about—

(a) the effect of judgments and orders;

(b) agreements to settle claims;

(c) the assessment of the amount of compensation;

(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;

(e) costs.

(5) Regulations under this section are subject to the affirmative resolution procedure.

Textual Amendments

F14 Words in s. 190(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 84 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement Information

I4 S. 190 in force at Royal Assent for specified purposes, see s. 212(2)(f)

I5 S. 190 in force at 23.7.2018 in so far as not already in force by S.I. 2018/625, reg. 3(g)