Section 71A — Data Protection Act 2018: Codes of conduct

Codes of conduct 71A 1 The Commissioner must encourage expert public bodies to produce codes of conduct intended to contribute to compliance with this Part.

2 Under subsection (1), the Commissioner must, among other things, encourage the production of codes which take account of the specific features of the various processing sectors.

3 For the purposes of this section—

a “ public body ” means a body or other person whose functions are, or include, functions of a public nature, and b a public body is “expert” if, in the Commissioner’s opinion, the body has the knowledge and experience needed to produce a code of conduct described in subsection (1).

4 A code of conduct described in subsection (1) may, for example, make provision with regard to—

a lawful and fair processing;

b the collection of personal data;

c the information provided to the public and to data subjects;

d the exercise of the rights of data subjects;

e the measures and procedures referred to in sections 56, 57 and 62;

f the notification of personal data breaches to the Commissioner and the communication of personal data breaches to data subjects;

g the transfer of personal data to third countries or international organisations;

h out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing.

5 The Commissioner must encourage expert public bodies to submit codes of conduct described in subsection (1) to the Commissioner in draft.

6 Where an expert public body does so, the Commissioner must—

a provide the body with an opinion on whether the code correctly reflects the requirements of this Part, b decide whether to approve the code, and c if the code is approved, register and publish the code.

7 Subsections (5) and (6) apply in relation to amendments of a code of conduct that is for the time being approved under this section as they apply in relation to a code.