4Data processing

1

An authorised person may process personal data held by the person in connection with any of the person's functions where that person considers it necessary for the purposes of implementing, operating or facilitating the doing of anything under or by virtue of this Act.

2

The processing of personal data in accordance with subsection (1) does not breach—

a

any obligation of confidence owed by the person processing the personal data, or

b

any other restriction on the processing of personal data (however imposed).

3

But nothing in subsection (1) authorises the processing of personal data which—

a

contravenes the data protection legislation, or

b

is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

4

Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (3)(b) has effect as if it included a reference to that Part.

5

Subsection (1) does not limit the circumstances in which personal data may be processed apart from this section.

6

In this section—

  • “authorised person” means—

    1. a

      the Secretary of State, the Treasury, the Commissioners for Her Majesty's Revenue and Customs, the Scottish Ministers, the Welsh Ministers and a Northern Ireland department;

    2. b

      an NHS body (as defined in section 275 of the National Health Service Act 2006 or in section 206 of the National Health Service (Wales) Act 2006);

    3. c

      a health service body listed in section 17A(2)(a) to (e) of the National Health Service (Scotland) Act 1978 or in article 8(2)(a) to (e) of the Health and Personal Social Services (Northern Ireland) Order 1991 (S.R. & O. (N.I.) 1991 No. 194);

    4. d

      a provider of healthcare (not falling within paragraph (b) or (c));

    5. e

      any other person authorised, or falling within a description of persons authorised, by regulations made by the Secretary of State for the purposes of this section;

  • “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

  • “personal data” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).