Section 180A — Data Protection Act 2018: Procedure in connection with subject access requests

Procedure in connection with subject access requests 180A 1 This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under—

a Article 15 of the UK GDPR (right of access by the data subject);

b Article 20 of the UK GDPR (right to data portability);

c section 45 of this Act (law enforcement processing: right of access by the data subject);

d section 94 of this Act (intelligence services processing: right of access by the data subject).

2 The court may require the controller to make available for inspection by the court so much of the information as is available to the controller.

3 But, unless and until the question in subsection (1) has been determined in the data subject’s favour, the court may not require the information to be disclosed to the data subject or the data subject’s representatives, whether by discovery (or, in Scotland, recovery) or otherwise.

4 Where the question in subsection (1) relates to a right under a provision listed in subsection (1)(a), (c) or (d), this section does not confer power on the court to require the controller to carry out a search for information that is more extensive than the reasonable and proportionate search required by that provision.