Source: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-law-enforcement-processing/scope-and-key-definitions/
Timestamp: 2019-04-23 08:39:00
Document Index: 230637083

Matched Legal Cases: ['art 3', 'art 2', 'art 3', 'art 2', 'art 2', 'art 3', 'art 3', 'art 3', 'art 2', 'art 3', 'art 3', 'art 3', 'art 2', 'art 3', 'art 3']

Scope and key definitions | ICO
Part 3 only applies to competent authorities (or their processors) processing for criminal law enforcement purposes.
Processing for other general purposes such as HR will fall under the general processing regime in part 2 of the DPA 2018.
It applies to processing of personal data, which is information about identifiable living individuals.
Controllers determine how and why the data is processed. Processors process data on their behalf, but may share some accountability for the processing.
There are additional rules which apply to ‘sensitive processing’ of some specified types of particularly sensitive data.
What is a 'competent authority'?
Are we processing for law enforcement purposes?
What if we are processing for other general purposes?
What happens if our purpose changes?
What is sensitive processing?
Part 3 only applies to competent authorities processing for law enforcement purposes. So, it applies, but is not limited, to:
The appropriate regime is based on the law that applies to the controller. So if you are a processor carrying out a law enforcement function on behalf of a competent authority, you will also be processing under this law enforcement processing regime.
Any processing carried out by a competent authority which is not for the primary purpose of law enforcement will be covered by the general processing regime under part 2 of the DPA 2018 (read with the GDPR).
If you are a competent authority it is very likely that you are also processing personal data under the general processing regime. For example, this may include internal HR processes and procedures, as that processing isn’t strictly for law enforcement purposes.
Identifying the correct regime is important as there are many key differences between Part 2 and Part 3 of the DPA 2018, including differences on individuals’ rights, lawful basis for processing and governance.
A competent authority means:
a person specified in Schedule 7 of the DPA 2018; or
any other person if, and to the extent that, they have statutory functions to exercise public authority or public powers for the law enforcement purposes.
You need to check whether you are listed as a competent authority in Schedule 7 of the DPA 2018.
If you are not listed in Schedule 7, you may still be a competent authority if you have a legal power to process personal data for law enforcement purposes. For example, local authorities who prosecute trading standards offences or the Environment Agency when prosecuting environmental offences.
Relevant provisions in the DPA 2018 - See Section 30 and Schedule 7
If you are a competent authority, when you are deciding which regime applies, the key thing to consider is your primary purpose for the processing. This should help you identify whether the processing falls under the GDPR rules, or satisfies the criteria of the law enforcement purposes under Part 3 of the DPA 2018.
The law enforcement purposes are defined under section 31 of the DPA 2018 as:
‘The prevention, investigation detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’
So if you are a competent authority processing for one of those purposes, you should comply with the law enforcement processing regime.
A police officer is called to a disturbance where allegations of assault have been made. The officer attends the scene using their body-worn camera. Witnesses are interviewed and this footage is recorded on the body-worn camera.
The footage is recorded and processed to investigate the crime. So the processing is carried out for the prevention, investigation, detection or prosecution of criminal offences. Part 3 of the DPA 2018 applies.
Even if you are a competent authority, in some circumstances, you may also process data for general purposes, such as for your own HR purposes. If processing is not for the law enforcement purposes, it will fall under the general processing regime in Part 2 of the DPA 2018, and you should refer to our Guide to GDPR.
A police force want to obtain information from the public about their perception of the force in general. The results will help influence how the force engage with the public. They therefore conduct a survey to capture people’s views.
Personal information is collected about individuals, but the primary purpose of the processing is to gain an insight into their opinions of the force. So the processing is not to prevent and detect crime.
In this case, the relevant regime is the general processing regime, and you should read our Guide to the GDPR.
You may begin processing information under one regime, but as circumstances progress and the purpose changes, the processing of the data will come under another regime or take place under both simultaneously.
You may initially be processing data for general administrative purposes, but as the situation changes you may identify elements of criminality. The processing would then come under Part 3 of the DPA 2018. It may be easier to identify a change in regime if the data is passed to a specialist team or department to continue the processing for a specific purpose. For example, a dedicated fraud unit may obtain information originally collected under the general processing regime for the purposes of an investigation under Part 3 of the DPA 2018.
Likewise, in certain circumstances the processing of information by a competent authority may begin under the law enforcement processing regime in Part 3 of the DPA 2018, and as circumstances change, it may switch to the general processing regime in Part 2. Some information may end up being processed for different purposes and under both regimes.
Any information that is being processed for law enforcement purposes must adhere to the governance requirements of Part 3 of the DPA 2018. These include logging requirements, categorisation and obligations about the principles and rights of individuals.
A Police force is dealing with an internal disciplinary matter involving a member of staff. A complaint has been referred to a professional standards department about an officer’s conduct. The complaint is not of a criminal matter.
The processing involves the use of data from various internal sources, such as HR. The primary purpose for processing the data is to investigate staff conduct and behaviour, so will be processed under the general processing regime.
As the investigation progresses, an element of criminality is discovered. The relevant data is then passed to a specific team. They will process the data to investigate the criminal aspects, so will need to comply with the law enforcement processing regime under Part 3 of the DPA 2018.
The HR department may still be processing some of the data for HR-related matters, and that will still be processed under the general processing regime.
Any information relating to an identified or identifiable living individual. An identifying characteristic could include a name, ID number or location data. You should treat such information as personal data even if it can only be potentially linked to a living individual.
Relevant provisions in the Act - See Section 1
If you are processing jointly with another competent authority, you must designate a specific controller to be the contact point for data subjects.
If you are a processor, you are processing personal data on behalf of the controller for the law enforcement purposes, but you could be sharing some accountability with controllers. This means that you could be liable for breaches. You need to review and revise your contracts to ensure that they reflect your new obligations.
Relevant provisions in the Act - See Section 32
Sensitive processing is defined in section 35(8) as:
Biometric data is personal data that is obtained through specific technical processing relating to physical, physiological or behavioural characteristics of a person. This processing enables you to identify a particular person, eg fingerprint data and facial recognition.
For more information on the rules about sensitive processing, see our guide pages on the principles and conditions for sensitive processing.
Relevant provisions in the Act - See Sections 35 and 205