Section 91

The 2018 Act is amended in accordance with subsections (2) to (4). Omit section 2(2) (duty of Commissioner when carrying out functions). After section 120 insert— It is the principal objective of the Commissioner, in carrying out functions under the data protection legislation— to secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest, and to promote public trust and confidence in the processing of personal data. In carrying out functions under the data protection legislation, the Commissioner must have regard to such of the following as appear to the Commissioner to be relevant in the circumstances— the desirability of promoting innovation; the desirability of promoting competition; the importance of the prevention, investigation, detection and prosecution of criminal offences; the need to safeguard public security and national security; the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing. The Commissioner must prepare a strategy for carrying out the Commissioner’s functions under the data protection legislation in accordance with the Commissioner’s duties under— sections 120A and 120B, section 108 of the Deregulation Act 2015 (exercise of regulatory functions: economic growth), and section 21 of the Legislative and Regulatory Reform Act 2006 (exercise of regulatory functions: principles). The Commissioner must— review the strategy from time to time, and revise the strategy as appropriate. The Commissioner must publish the strategy and any revised strategy. The Commissioner must, at such times as the Commissioner considers appropriate, consult the persons mentioned in subsection (2) about how the manner in which the Commissioner exercises functions under the data protection legislation may affect economic growth, innovation and competition. The persons are— such persons exercising regulatory functions as the Commissioner considers appropriate; such other persons as the Commissioner considers appropriate. In this section, “regulatory function” has the meaning given by section 111 of the Deregulation Act 2015. In section 139 (reporting to Parliament), after subsection (1) insert— In connection with the Commissioner’s functions under the data protection legislation, the report must contain (among other things)— a review of what the Commissioner has done during the reporting period to comply with the duties under— including a review of the operation of the strategy prepared and published under section 120C; sections 120A and 120B, section 108 of the Deregulation Act 2015, and section 21 of the Legislative and Regulatory Reform Act 2006, a review of what the Commissioner has done during the reporting period to comply with the duty under section 120D. In subsection (1A), “the reporting period” means the period to which the report relates. The Information Commissioner must prepare and publish a strategy in accordance with section 120C of the 2018 Act before the end of the period of 18 months beginning with the day on which this section comes into force.

← 10 · All articles · 1 →

Source: legislation.gov.uk · retrieved 2026-09-04