Section 82A — Data Protection Act 2018: Designation of processing by a qualifying competent authority

Designation of processing by a qualifying competent authority 82A 1 For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—

a an application for designation of the processing is made in accordance with this section, and b the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.

2 The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.

3 The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—

a a country or territory outside the United Kingdom, or b an international organisation.

4 A designation notice must—

a specify or describe the processing and qualifying competent authority that are designated, and b be given to the applicants for the designation (and see also section 82D).

5 An application for designation of processing of personal data by a qualifying competent authority must be made jointly by—

a the qualifying competent authority, and b the intelligence service with which the processing is to be carried out.

6 An application may be made in respect of more than one qualifying competent authority and in respect of processing with more than one intelligence service.

7 The application must—

a describe the processing, including the intended purposes and means of processing, and b explain why the applicants consider that designation is required for the purposes of safeguarding national security.

8 Before giving a designation notice, the Secretary of State must consult the Commissioner.

9 In this section, “ joint controller ”, in relation to processing of personal data, means a controller whose responsibilities for compliance with this Part in relation to the processing are determined in an arrangement under section 104.