(g) in Part 7, section 187 (representation of data subjects).
(3) The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—
(a) section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;
(b) section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);
(c) section 42 (safeguards: sensitive processing);
(d) Schedule 8 (conditions for sensitive processing).
(4) The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—
(a) the following provisions of section 73—
(i) subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);
(ii) subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);
(b) section 78 (subsequent transfers). ”
(8) In section 79 (national security: certificate)—
(a) omit subsections (1) to (3),
(b) after subsection (3) insert—
“ (3A) Subject to subsection (5), a certificate signed by a Minister of the Crown certifying that exemption from all or any of the provisions listed in section 78A(2) is, or at any time was, required in relation to any personal data for the purposes of safeguarding national security is conclusive evidence of that fact. ” ,
(c) in subsection (4), for “subsection (1)” substitute “subsection (3A)—
“ (a) may identify the personal data to which it applies by means of a general description, and
(b)” ,
(d) in subsection (5), for “subsection (1)” substitute “subsection (3A)” ,
(e) in subsection (7)—
(i) for “a restriction falls within a general description in a certificate issued under subsection (1)” substitute “a certificate under subsection (3A) which identifies the personal data to which it applies by means of a general description applies to any personal data” , and
(ii) for “the restriction does not fall within that description” substitute “the certificate does not apply to the personal data in question” ,
(f) in subsection (8)—
(i) for “the restriction” substitute “the certificate” , and
(ii) for “to fall within the general description” substitute “so to apply” ,
(g) in subsection (10), for “subsection (1)” substitute “subsection (3A)” ,