Section 78A — Data Protection Act 2018: National security exemption

National security exemption 78A 1 A provision mentioned in subsection (2) does not apply to personal data processed for law enforcement purposes if exemption from the provision is required for the purposes of safeguarding national security.

2 The provisions are—

a Chapter 2 of this Part (principles), except for the provisions listed in subsection (3);

b Chapter 3 of this Part (rights of the data subject);

c in Chapter 4 of this Part—

i section 67 (notification of personal data breach to the Commissioner);

ii section 68 (communication of personal data breach to the data subject);

d Chapter 5 of this Part (transfers of personal data to third countries etc), except for the provisions listed in subsection (4);

e in Part 5—

i section 119 (inspection in accordance with international obligations);

ia section 119A (standard clauses for transfers to third countries);

ii in Schedule 13 (other general functions of the Commissioner), paragraphs 1(1)(a) and (g) and 2;

f in Part 6—

i sections 142 to 154 and Schedule 15 (Commissioner’s notices and powers of entry and inspection);

ii sections 170 to 173 (offences relating to personal data);

g in Part 7, section 187 (representation of data subjects).

3 The provisions of Chapter 2 of this Part (principles) which are excepted from the list in subsection (2) are—

a section 35(1) (the first data protection principle) so far as it requires processing of personal data to be lawful;

b section 35(2) to (5) (lawfulness of processing and restrictions on sensitive processing);

c section 42 (safeguards: sensitive processing);

d Schedule 8 (conditions for sensitive processing).

4 The provisions of Chapter 5 of this Part (transfers of personal data to third countries etc) which are excepted from the list in subsection (2) are—

a the following provisions of section 73—

i subsection (1)(a) (conditions for transfer), so far as it relates to the condition in subsection (2) of that section, and subsection (2) (transfer must be necessary for a law enforcement purpose);

ii subsections (1)(b), (5) and (6) (conditions for transfer of personal data originally made available by a member State);

b section 78 (subsequent transfers).