18. The DPA 2018 came into force on 25th May 2018.
19. Section 29 of the DPA 2018 provides:
PART 3 LAW ENFORCEMENT PROCESSING
“29 Processing to which this Part applies
This Part applies to—
the processing by a competent authority of personal data wholly or partly by automated means, and
the processing by a competent authority otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system.
Any reference in this Part to the processing of personal data is to processing to which this Part applies. …”
Section 34 of the DPA 2018 provides an overview of the six data protection principles and the duties of the data protection controller:
“34 Overview and general duty of controller (1) This Chapter sets out the six data protection principles as follows— (a) section 35(1) sets out the first data protection principle (requirement that processing be lawful and fair); (b) section 36(1) sets out the second data protection principle (requirement that purposes of processing be specified, explicit and legitimate); (c) section 37 sets out the third data protection principle (requirement that personal data be adequate, relevant and not excessive); (d) section 38(1) sets out the fourth data protection principle (requirement that personal data be accurate and kept up to date); (e) section 39(1) sets out the fifth data protection principle (requirement that personal data be kept for no longer than is necessary); (f) section 40 sets out the sixth data protection principle (requirement that personal data be processed in a secure manner). (2) In addition— (a) each of sections 35 , 36, 38 and 39 makes provision to supplement the principle to which it relates, and (b) sections 41 and 42 make provision about the safeguards that apply in relation to certain types of processing. (3) The controller in relation to personal data is responsible for, and must be able to demonstrate, compliance with this Chapter.”
Section 35 of the DPA regulates "sensitive processing" and specifies the conditions that must be satisfied before it may take place. Section 35 provides as follows:
“35 The first data protection principle (1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair. (2) The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either— (a) the data subject has given consent to the processing for that purpose, or (b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority. (3) In addition, where the processing for any of the law enforcement purposes is sensitive processing, the processing is permitted only in the two cases set out in sub sections (4 ) and (5). (4) The first case is where— (a) the data subject has given consent to the processing for the law enforcement purpose as mentioned in sub section (2 )(a), and (b) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42). (5) The second case is where— (a) the processing is strictly necessary for the law enforcement purpose, (b) the processing meets at least one of the conditions in Schedule 8, and (c) at the time when the processing is carried out, the controller has an appropriate policy document in place (see section 42). (6) The Secretary of State may by regulations amend Schedule 8— (a) by adding conditions; (b) by omitting conditions added by regulations under paragraph (a). (7) Regulations under subsection (6) are subject to the affirmative resolution procedure. (8) In this section, "sensitive processing" means— (a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; (b) the processing of genetic data, or of biometric data, for the purpose of uniquely identifying an individual; (c) the processing of data concerning health; (d) the processing of data concerning an individual's sex life or sexual orientation.”
Section 35 reflects the language and scope of Article 10 of the Data Protection Law Enforcement Directive (2016/680/EU).
“ Article 10 Processing of special categories of personal data Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person , data concerning health or data concerning a natural person's sex life or sexual orientation shall be allowed only where strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and only…”
Definitions
Section 3(2) of the DPA 2018 defines “personal data” as:
“…any information relating to an identified or identifiable living individual", which means an individual "who can be identified, directly or indirectly, in particular by reference to— (a) an identifier such as a name, an identification number, location data or an online identifier, or (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual”.
Section 35(8) of the DPA 2018 defines “sensitive processing” as activities including:
“…the processing of… biometric data… for the purpose of uniquely identifying an individual.”
Section 205(1) of the DPA 2018 defines “biometric data” as: “…personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic data”.
Conditions
Section 35(5) prescribes conditions which must be satisfied before the processing of biometric data for law enforcement purposes may be permitted. These conditions are threefold: (a) the processing is strictly necessary for the law enforcement purpose; (b) the processing meets at least one of the conditions in Schedule 8; and (c) the controller has an appropriate policy document in place (see section 42).
The Schedule 8 conditions include:
“1. Statutory etc purposes This condition is met if the processing-
is necessary for the exercise of a function conferred on a person by an enactment or rule of law, and
is necessary for reasons of substantial public interest.