Found: While GDPR and UK Data Protection Act include provisions for crime prevention, practical implementation

Found: Data Protection Advisor(s) to ensure that the processing of personal data complies with Data Protection Act

Found: Although the UK has the Human Rights Act 1998 and the Data Protection Act, the UK does not have specific

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, if she will made an assessment of the potential impact of SARs not being disclosed by NHS hospital trusts within the statutory one month timeframe.

Answered by Ian Murray - Minister of State (Department for Science, Innovation and Technology)

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA) provide individuals with the right to access their personal data, subject to relevant exemptions. A subject access request must be responded to within one month of receiving the request. The response time may be extended by a further two months if the request is complex, or if the individual has submitted a number of requests, provided the organisation informs the requestor within the one-month period and provides reasons for the delay.

NHS England has produced guidance for patients and service users on making a Subject Access Request (SAR), and for professionals to ensure they can respond to requests in a timely manner. It can be found here: https://transform.england.nhs.uk/information-governance/guidance/subject-access-requests/

The Information Commissioner’s Office (ICO) is responsible for monitoring and enforcing the data protection legislation independently of government, and is accountable to Parliament.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what steps her Department is taking to ensure the ICO's statutory duty to enforce SAR disclosures are met within a one month timeframe.

Answered by Ian Murray - Minister of State (Department for Science, Innovation and Technology)

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA) provide individuals with the right to access their personal data, subject to relevant exemptions. A subject access request must be responded to within one month of receiving the request. The response time may be extended by a further two months if the request is complex, or if the individual has submitted a number of requests, provided the organisation informs the requestor within the one-month period and provides reasons for the delay.

The Information Commissioner’s Office (ICO) is responsible for monitoring and enforcing the data protection legislation independently of government, and is accountable to Parliament.

Question to the Home Office:

To ask the Secretary of State for the Home Department, what recent assessment she has made of the potential impact of live facial recognition surveillance on the rights to privacy, freedom of assembly, and freedom of expression.

Answered by Sarah Jones - Minister of State (Home Office)

Passport photographs are not being enrolled into biometric databases accessible for live facial recognition searches. However, His Majesty’s Passport Office (HMPO) may conduct retrospective facial recognition searches against the passport database, on behalf of police forces, in relation to serious cases e.g. sexual offences, violent offences, serious and organised crime, or those that are of a national security interest. Guidance on this practice, and an Equality Impact Assessment has been published on the GOV.UK site.

When deploying facial recognition technology, police forces must comply with existing legislation including the Human Rights Act 1998, Equality Act 2010, Data Protection Act 2018, Police and Criminal Evidence Act 1984, as well as their own published policies. For live facial recognition, police forces must also follow the College of Policing’s Authorised Professional Practice (APP) on Live Facial Recognition. Forces also need to comply with the Surveillance Camera Code of Practice, which is supplemented by published policing policies.

On 4 December the Government launched a consultation on law enforcement use of biometrics, facial recognition and similar technologies. We are consulting on a new legal framework to create consistent, durable rules and appropriate safeguards for biometrics and facial recognition. This framework will aim to strike the right balance between public protection and privacy.

Question to the Home Office:

To ask the Secretary of State for the Home Department, whether passport photographs are being enrolled into biometric databases accessible for live facial recognition searches; and what assessment she has made of the privacy implications of this policy.

Answered by Sarah Jones - Minister of State (Home Office)

Passport photographs are not being enrolled into biometric databases accessible for live facial recognition searches. However, His Majesty’s Passport Office (HMPO) may conduct retrospective facial recognition searches against the passport database, on behalf of police forces, in relation to serious cases e.g. sexual offences, violent offences, serious and organised crime, or those that are of a national security interest. Guidance on this practice, and an Equality Impact Assessment has been published on the GOV.UK site.

When deploying facial recognition technology, police forces must comply with existing legislation including the Human Rights Act 1998, Equality Act 2010, Data Protection Act 2018, Police and Criminal Evidence Act 1984, as well as their own published policies. For live facial recognition, police forces must also follow the College of Policing’s Authorised Professional Practice (APP) on Live Facial Recognition. Forces also need to comply with the Surveillance Camera Code of Practice, which is supplemented by published policing policies.

On 4 December the Government launched a consultation on law enforcement use of biometrics, facial recognition and similar technologies. We are consulting on a new legal framework to create consistent, durable rules and appropriate safeguards for biometrics and facial recognition. This framework will aim to strike the right balance between public protection and privacy.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, whether the 2017 Memorandum of Understanding between HMRC and the Cabinet Office has been updated since the introduction of the Data Protection Act 2018; and on what basis data transfers for honours probity checks continues.

Answered by Nick Thomas-Symonds - Paymaster General and Minister for the Cabinet Office

As noted in our answer to PQ 92590, the Memorandum of Understanding between the Cabinet Office and HMRC was last updated in 2023. The Memorandum of Understanding, which is published in full on gov.uk, sets out the legal and lawful basis by which data is transferred.

The 2023 Memorandum of Understanding is available at the following link:

https://www.gov.uk/government/publications/sharing-hmrc-information-to-assist-honours-committees-recommendations/memorandum-of-understanding-accessing-hmrc-information-to-assist-honours-committees-in-making-recommendations-about-awarding-honours-to-individ

Question to the Home Office:

To ask the Secretary of State for the Home Department, on what statutory basis live facial recognition technology is deployed by police forces in England and Wales; and whether her Department plans to introduce primary legislation before any expansion of its use.

Answered by Sarah Jones - Minister of State (Home Office)

There is an established basis for the police to use live facial recognition technology. When deploying facial recognition technology, police forces must comply with existing legislation including the Human Rights Act 1998, Equality Act 2010, Data Protection Act 2018, Police and Criminal Evidence Act 1984, as well as their own published policies. For live facial recognition, police forces must also follow the College of Policing’s Authorised Professional Practice (APP) on Live Facial Recognition. Forces also need to comply with the Surveillance Camera Code of Practice, which is supplemented by published policing policies.

On 4 December the Government launched a consultation on law enforcement use of biometrics, facial recognition and similar technologies. Although there is a legal basis for police use of facial recognition, the current legal framework is complicated, inflexible and difficult to understand, which in turn limits the extent to which facial recognition and similar technologies can be confidently used.

That is why the government is consulting on a new legal framework to inform potential legislation.

Question to the Home Office:

To ask the Secretary of State for the Home Department, what plans she has to allow for Parliamentary scrutiny of proposals to expand the use of live facial recognition technology.

Answered by Sarah Jones - Minister of State (Home Office)

There is an established basis for the police to use live facial recognition technology. When deploying facial recognition technology, police forces must comply with existing legislation including the Human Rights Act 1998, Equality Act 2010, Data Protection Act 2018, Police and Criminal Evidence Act 1984, as well as their own published policies. For live facial recognition, police forces must also follow the College of Policing’s Authorised Professional Practice (APP) on Live Facial Recognition. Forces also need to comply with the Surveillance Camera Code of Practice, which is supplemented by published policing policies.

On 4 December the Government launched a consultation on law enforcement use of biometrics, facial recognition and similar technologies. Although there is a legal basis for police use of facial recognition, the current legal framework is complicated, inflexible and difficult to understand, which in turn limits the extent to which facial recognition and similar technologies can be confidently used.

That is why the government is consulting on a new legal framework to inform potential legislation.

Question to the Home Office:

To ask the Secretary of State for the Home Department, whether she plans to prevent the expansion of live facial recognition technology beyond counter-terrorism and serious crime into routine policing, retail monitoring, or crowd surveillance.

Answered by Sarah Jones - Minister of State (Home Office)

Live facial recognition technology, which involves processing live video footage of people passing a camera, is used in England and Wales to help locate people who are wanted by the police, in public spaces. The College of Policing has produced national guidance in the form of an Authorised Professional Practice (APP), setting out when the police can use live facial recognition and the categories of people they can look for. These include individuals wanted by the police or the courts, suspects, missing or vulnerable people, or those posing a risk of harm to themselves or others. In each case, inclusion on a watchlist must be justified and authorised, and must pass the tests of necessity, proportionality and use for a policing purpose.

On 4 December the Government launched a consultation on establishing a new legal framework which focuses on the use of facial recognition and similar technologies by law enforcement organisations, for a law enforcement purpose.

The consultation seeks views on whether seriousness of harm should be a factor to decide how and when law enforcement organisations can acquire, retain, and use biometrics, facial recognition, and similar technology. The consultation also asks for views on what factors are relevant to consider when assessing ‘seriousness’ of harm and for which purposes should law enforcement organisations be allowed to use these technologies.

The consultation also explains that the new legal framework will apply to law enforcement organisations. This would include all police forces in England and Wales, and national and specialist law enforcement agencies like the British Transport Police and National Crime Agency and for law enforcement activity by other public bodies such as the Environment Agency, HMRC or Border Force.

We are aware that facial recognition and similar technologies are used more broadly across the public and private sectors. For example, we know that nightclubs use it to help identify barred patrons. Where that is the case they must comply with all relevant existing legislation including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and guidance, with the Information Commissioner’s Office (ICO) as the principal regulator.

Through the consultation we will therefore also consider whether public and private sector organisations ought to have due regard to the new legal framework and especially to any best practice established as a result.

Question to the Home Office:

To ask the Secretary of State for the Home Department, whether she plans to expand the use of live facial recognition technology for non-criminal matters.

Answered by Sarah Jones - Minister of State (Home Office)

Live facial recognition technology, which involves processing live video footage of people passing a camera, is used in England and Wales to help locate people who are wanted by the police, in public spaces. The College of Policing has produced national guidance in the form of an Authorised Professional Practice (APP), setting out when the police can use live facial recognition and the categories of people they can look for. These include individuals wanted by the police or the courts, suspects, missing or vulnerable people, or those posing a risk of harm to themselves or others. In each case, inclusion on a watchlist must be justified and authorised, and must pass the tests of necessity, proportionality and use for a policing purpose.

On 4 December the Government launched a consultation on establishing a new legal framework which focuses on the use of facial recognition and similar technologies by law enforcement organisations, for a law enforcement purpose.

The consultation seeks views on whether seriousness of harm should be a factor to decide how and when law enforcement organisations can acquire, retain, and use biometrics, facial recognition, and similar technology. The consultation also asks for views on what factors are relevant to consider when assessing ‘seriousness’ of harm and for which purposes should law enforcement organisations be allowed to use these technologies.

The consultation also explains that the new legal framework will apply to law enforcement organisations. This would include all police forces in England and Wales, and national and specialist law enforcement agencies like the British Transport Police and National Crime Agency and for law enforcement activity by other public bodies such as the Environment Agency, HMRC or Border Force.

We are aware that facial recognition and similar technologies are used more broadly across the public and private sectors. For example, we know that nightclubs use it to help identify barred patrons. Where that is the case they must comply with all relevant existing legislation including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and guidance, with the Information Commissioner’s Office (ICO) as the principal regulator.

Through the consultation we will therefore also consider whether public and private sector organisations ought to have due regard to the new legal framework and especially to any best practice established as a result.

Question to the Home Office:

To ask the Secretary of State for the Home Department, whether her Department will review the classification of neighbour harassment involving intrusive CCTV surveillance.

Answered by Sarah Jones - Minister of State (Home Office)

The police have a range of powers to deal with any behaviour that causes harassment, alarm or distress to others. The Government fully supports the police in their use of these powers to maintain public order and keep communities safe.

Individuals that use CCTV to film outside their property boundary have to comply fully with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. The Information Commissioner’s Office (ICO) has published guidance which details the obligations the CCTV user will need to comply with: https://ico.org.uk/for-the-public/home-cctv-systems/.

Where there is sufficient evidence of harassment or stalking from a domestic camera system, this may lead to prosecution for a criminal offence of harassment or stalking under the Protection from Harassment Act 1997. In addition to the Protection from Harassment Act 1997, another potential remedy in civil law is the tort of private nuisance, which is a common law tort that relates to a person’s private rights in relation to land.

Question to the Department for Science, Innovation & Technology:

To ask His Majesty's Government what steps they are taking to ensure robust governance, safety evaluation and transparency in their announced partnership with Google DeepMind, including the planned automated science laboratory and access to its AI models for public services.

Answered by Baroness Lloyd of Effra - Baroness in Waiting (HM Household) (Whip)

The non‑binding Memorandum of Understanding between DSIT and Google DeepMind establishes a partnership for collaboration to support delivery on this government’s AI Opportunities Action Plan. This includes concrete initiatives such as priority access for UK scientists to AI tools; deepening collaboration with the AI Security Institute on AI safety and security research; and support for the development of AI-ready datasets in strategically important domains such as fusion energy.

The automated lab announced alongside the MoU is an independent Google DeepMind initiative, fully funded by Google DeepMind. The UK Government is not involved in operating or funding the lab.

The partnership with Google DeepMind will support DSIT’s efforts to explore how AI can improve productivity and service delivery across government. However, any use of AI in public services will be subject to the highest standards of safety and security, including the Data Protection Act 2018 and UK GDPR, the Government’s Data Ethics Framework, and relevant departmental assurance and security processes.

Question to the Home Office:

To ask His Majesty's Government what plans they have to restrict the circumstances in which children may be added to facial recognition watchlists.

Answered by Lord Hanson of Flint - Minister of State (Home Office)

Facial recognition is a crucial tool that helps the police locate missing people, suspects, and those wanted by the courts.

In some cases, under the existing legal framework this includes vulnerable individuals such as missing children. When using facial recognition technology, police forces must comply with legislation including the Human Rights Act 1998, Equality Act 2010, Data Protection Act 2018, Police and Criminal Evidence Act 1984, as well as their own published policies. For live facial recognition, police forces must also follow the College of Policing’s Authorised Professional Practice (APP) on Live Facial Recognition.

This sets out the categories of people who may be included on a watchlist. These include individuals wanted by the police or the courts, suspects, missing or vulnerable people, or those posing a risk of harm to themselves or others. In each case, inclusion on a watchlist must be justified and authorised, and must pass the tests of necessity, proportionality and use for a policing purpose.

On 4^th December the Government launched a consultation on a new legal framework for law enforcement use of biometrics, facial recognition and similar technologies. During the consultation we want to hear views on when and how biometrics, facial recognition and similar technologies should be used, and what safeguards and oversight are needed.

Question to the Home Office:

To ask His Majesty's Government whether they plan to introduce limits on the circumstances in which police forces can add children to facial recognition watchlists.

Answered by Lord Hanson of Flint - Minister of State (Home Office)

Facial recognition is a crucial tool that helps the police locate missing people, suspects, and those wanted by the courts.

In some cases, under the existing legal framework this includes vulnerable individuals such as missing children. When using facial recognition technology, police forces must comply with legislation including the Human Rights Act 1998, Equality Act 2010, Data Protection Act 2018, Police and Criminal Evidence Act 1984, as well as their own published policies. For live facial recognition, police forces must also follow the College of Policing’s Authorised Professional Practice (APP) on Live Facial Recognition.

This sets out the categories of people who may be included on a watchlist. These include individuals wanted by the police or the courts, suspects, missing or vulnerable people, or those posing a risk of harm to themselves or others.In each case, inclusion on a watchlist must be justified and authorised, and must pass the tests of necessity, proportionality and use for a policing purpose.

On 4^th December the Government launched a consultation on a new legal framework for law enforcement use of biometrics, facial recognition and similar technologies. During the consultation we want to hear views on when and how biometrics, facial recognition and similar technologies should be used, and what safeguards and oversight are needed.

Question to the Home Office:

To ask His Majesty's Government what steps they are taking to ensure that any use of live facial recognition cameras by law enforcement bodies is subject to clear safeguards to protect privacy and human rights.

Answered by Lord Hanson of Flint - Minister of State (Home Office)

When deploying facial recognition technology, police forces must comply with existing legislation including the Human Rights Act 1998, Equality Act 2010, Data Protection Act 2018, Police and Criminal Evidence Act 1984, as well as their own published policies. For live facial recognition, police forces must also follow the College of Policing’s Authorised Professional Practice (APP) on Live Facial Recognition. Forces must also give due regard to the Surveillance Camera Code of Practice, which is supplemented by published policing policies.

On 4 December the Government launched a 10 week public consultation on law enforcement use of biometrics, facial recognition and similar technologies. We are consulting on a new legal framework to create consistent, durable rules and appropriate safeguards for biometrics and facial recognition. This framework will aim to strike the right balance between public protection and privacy. The consultation will close week commencing 9 Feb 2026.

Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, what assessment his Department has made of making patient records owned by the patient.

Answered by Zubir Ahmed - Parliamentary Under-Secretary (Department of Health and Social Care)

Health records are not owned by patients, as the providers of care who create and maintain the records are the data controllers, although all patients have the right to access their records under the Data Protection Act 2018. Patients also have the legal right to ask for factual inaccuracies to be amended.

The general practice (GP) record can be viewed online on the NHS App, or by logging onto the National Health Service website. Individuals can alternatively contact their practice to view their record. To view a hospital record, individuals can ask the trust where they are a patient.

As part of the 10-Year Health Plan, we are developing a single patient record which will give patients greater control over their records, and act as a patient passport to seamless care. It will provide a single, secure, and authoritative account of their data by bringing together all of a patient’s medical information from different records in one place, for example GP and hospital data, and patients will be able to view the record securely on the NHS App and add their own data, for example from a wearable device.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, how many disciplinary cases were concluded against civil servants in (a) her Department and (b) its agencies by (i) outcome and (ii) whether the primary allegation related to (A) performance and (B) conduct in the last twelve months.

Answered by Ian Murray - Minister of State (Department for Science, Innovation and Technology)

In the last 12 months, there have been 6 disciplinary cases that have concluded within DCMS. All related to an allegation of misconduct.

We cannot provide the outcome of closed disciplinary cases. Doing so would breach the Data Protection Act and risk identifying individual cases where the case count is five or less, as the information relates to someone other than the data subjects.

DCMS does not hold information regarding its agencies, including its arms-length and public bodies. This is because they are independent employers from the department.

Poor performance is addressed under a separate management procedure.

Question to the Home Office:

To ask the Secretary of State for the Home Department, with reference to the Written Statement entitled Consultation on a new legal framework for law enforcement use of biometrics, facial recognition and similar technologies, published on 4 December 2025, HCWS1129, what assessment her Department has made of current police practice regarding the deployment of facial recognition and related technologies; how operational consistency across police forces will be ensured under the proposed new framework; and what plans she has to strengthen oversight mechanisms, including independent scrutiny, to guarantee that law enforcement agencies use these technologies only within clearly defined legal parameters and with transparent accountability.

Answered by Sarah Jones - Minister of State (Home Office)

The Government recognises the importance of ensuring the use of facial recognition and similar biometric technologies by law enforcement remains proportionate to the seriousness of the harm being addressed. The consultation launched on 4 December seeks views on whether seriousness of harm should be a factor to decide how and when law enforcement organisations can acquire, retain, and use biometrics, facial recognition, and similar technology. The consultation also asks for views on what factors are relevant to consider when assessing ‘seriousness’ of harm and for which purposes should law enforcement organisations be allowed to use these technologies.

We do not intend to publish an impact assessment specifically on the potential implications for civil liberties as part of the consultation process. However, alongside the consultation we have published an equalities impact assessment which makes clear the Government’s commitment to building public trust by highlighting the specific legal frameworks that will be put in place and the statutory bodies for oversight, which will apply to everyone in England and Wales.

We recognise that to maintain public confidence we must ensure individual rights, privacy and data security are protected. We believe that the use of biometric and inferential technology should always be demonstrably ‘necessary’ and ‘proportionate’ to the objective being sought. Furthermore, a clear and consistent justification for interference with people’s rights is required. Threshold setting and decision making needs to be attributed to, and shared appropriately between, Parliament, Ministers, independent oversight bodies, and law enforcement organisations. The consultation seeks views on what factors are relevant to consider when assessing interference with privacy so as to ensure the legal framework reflects the views of the public.

When using facial recognition technology, police forces must comply with existing legislation including the Human Rights Act 1998, Equality Act 2010, Data Protection Act 2018, Police and Criminal Evidence Act 1984, as well as their own published policies. For live facial recognition, police forces must also follow the College of Policing’s Authorised Professional Practice (APP) on Live Facial Recognition.

Oversight of police practice regarding deployment of facial recognition and related technologies is currently provided by regulators and public bodies, including the Biometrics and Surveillance Camera Commissioner, the Information Commissioner, HMICFRS, Equality and Human Rights Commission, and the Independent Office for Police Conduct. The courts system also plays a vital role in ensuring the law is upheld.

The Government recognises the importance of independent scrutiny to ensure operational consistency across forces under new framework. That is why the consultation explained the government’s proposal to create a single regulatory and oversight body to oversee law enforcement use of biometrics, facial recognition and similar technologies.

The Government envisage giving this body the necessary powers to provide assurance that law enforcement use of biometric technologies is legal, responsible, and necessary. These powers could include setting standards to assure scientific validity, issuing codes of practice and investigating instances where a technology has been misused, hacked or accessed without authorisation.

Question to the Home Office:

To ask the Secretary of State for the Home Department, with reference to the Written Statement entitled Consultation on a new legal framework for law enforcement use of biometrics, facial recognition and similar technologies, published on 4 December 2025, HCWS1129, what assessment she has made of the safeguards required to ensure that the use of facial recognition and similar biometric technologies by law enforcement remains proportionate to the seriousness of the harm being addressed; what steps she plans to take to ensure that the legal framework maintains public confidence in the protection of individual rights, privacy and data security; and whether she intends to publish an impact assessment on the potential implications for civil liberties as part of the consultation process.

Answered by Sarah Jones - Minister of State (Home Office)

The Government recognises the importance of ensuring the use of facial recognition and similar biometric technologies by law enforcement remains proportionate to the seriousness of the harm being addressed. The consultation launched on 4 December seeks views on whether seriousness of harm should be a factor to decide how and when law enforcement organisations can acquire, retain, and use biometrics, facial recognition, and similar technology. The consultation also asks for views on what factors are relevant to consider when assessing ‘seriousness’ of harm and for which purposes should law enforcement organisations be allowed to use these technologies.

We do not intend to publish an impact assessment specifically on the potential implications for civil liberties as part of the consultation process. However, alongside the consultation we have published an equalities impact assessment which makes clear the Government’s commitment to building public trust by highlighting the specific legal frameworks that will be put in place and the statutory bodies for oversight, which will apply to everyone in England and Wales.

We recognise that to maintain public confidence we must ensure individual rights, privacy and data security are protected. We believe that the use of biometric and inferential technology should always be demonstrably ‘necessary’ and ‘proportionate’ to the objective being sought. Furthermore, a clear and consistent justification for interference with people’s rights is required. Threshold setting and decision making needs to be attributed to, and shared appropriately between, Parliament, Ministers, independent oversight bodies, and law enforcement organisations. The consultation seeks views on what factors are relevant to consider when assessing interference with privacy so as to ensure the legal framework reflects the views of the public.

When using facial recognition technology, police forces must comply with existing legislation including the Human Rights Act 1998, Equality Act 2010, Data Protection Act 2018, Police and Criminal Evidence Act 1984, as well as their own published policies. For live facial recognition, police forces must also follow the College of Policing’s Authorised Professional Practice (APP) on Live Facial Recognition.

Oversight of police practice regarding deployment of facial recognition and related technologies is currently provided by regulators and public bodies, including the Biometrics and Surveillance Camera Commissioner, the Information Commissioner, HMICFRS, Equality and Human Rights Commission, and the Independent Office for Police Conduct. The courts system also plays a vital role in ensuring the law is upheld.

The Government recognises the importance of independent scrutiny to ensure operational consistency across forces under new framework. That is why the consultation explained the government’s proposal to create a single regulatory and oversight body to oversee law enforcement use of biometrics, facial recognition and similar technologies.

The Government envisage giving this body the necessary powers to provide assurance that law enforcement use of biometric technologies is legal, responsible, and necessary. These powers could include setting standards to assure scientific validity, issuing codes of practice and investigating instances where a technology has been misused, hacked or accessed without authorisation.

Question to the Home Office:

To ask the Secretary of State for the Home Department, with reference to the Written Statement entitled Consultation on a new legal framework for law enforcement use of biometrics, facial recognition and similar technologies, published on 4 December 2025, HCWS1129, what assessment her Department has made of the effectiveness of police practice in the deployment of facial recognition and other biometric technologies; and whether she plans to enhance oversight and independent scrutiny of that deployment.

Answered by Sarah Jones - Minister of State (Home Office)

The Government recognises the importance of ensuring the use of facial recognition and similar biometric technologies by law enforcement remains proportionate to the seriousness of the harm being addressed. The consultation launched on 4 December seeks views on whether seriousness of harm should be a factor to decide how and when law enforcement organisations can acquire, retain, and use biometrics, facial recognition, and similar technology. The consultation also asks for views on what factors are relevant to consider when assessing ‘seriousness’ of harm and for which purposes should law enforcement organisations be allowed to use these technologies.

We do not intend to publish an impact assessment specifically on the potential implications for civil liberties as part of the consultation process. However, alongside the consultation we have published an equalities impact assessment which makes clear the Government’s commitment to building public trust by highlighting the specific legal frameworks that will be put in place and the statutory bodies for oversight, which will apply to everyone in England and Wales.

We recognise that to maintain public confidence we must ensure individual rights, privacy and data security are protected. We believe that the use of biometric and inferential technology should always be demonstrably ‘necessary’ and ‘proportionate’ to the objective being sought. Furthermore, a clear and consistent justification for interference with people’s rights is required. Threshold setting and decision making needs to be attributed to, and shared appropriately between, Parliament, Ministers, independent oversight bodies, and law enforcement organisations. The consultation seeks views on what factors are relevant to consider when assessing interference with privacy so as to ensure the legal framework reflects the views of the public.

When using facial recognition technology, police forces must comply with existing legislation including the Human Rights Act 1998, Equality Act 2010, Data Protection Act 2018, Police and Criminal Evidence Act 1984, as well as their own published policies. For live facial recognition, police forces must also follow the College of Policing’s Authorised Professional Practice (APP) on Live Facial Recognition.

Oversight of police practice regarding deployment of facial recognition and related technologies is currently provided by regulators and public bodies, including the Biometrics and Surveillance Camera Commissioner, the Information Commissioner, HMICFRS, Equality and Human Rights Commission, and the Independent Office for Police Conduct. The courts system also plays a vital role in ensuring the law is upheld.

The Government recognises the importance of independent scrutiny to ensure operational consistency across forces under new framework. That is why the consultation explained the government’s proposal to create a single regulatory and oversight body to oversee law enforcement use of biometrics, facial recognition and similar technologies.

The Government envisage giving this body the necessary powers to provide assurance that law enforcement use of biometric technologies is legal, responsible, and necessary. These powers could include setting standards to assure scientific validity, issuing codes of practice and investigating instances where a technology has been misused, hacked or accessed without authorisation.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, pursuant to the answer of 9 December to Question 96093, what steps the Government is taking to safeguard individuals from non-sexually explicit deepfakes, digital impersonation, and the misuse of personal identity.

Answered by Kanishka Narayan - Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)

Solutions that help to determine what media is real and what is AI-generated are key to tackling a range of AI risks. The government is undertaking work to explore the potential methods for detecting AI-generated content.

The UK’s Online Safety Act has introduced duties on in scope services to tackle digital impersonation where it amounts to an existing offence, including false statements about a candidate's character or conduct ahead of or during an election.

The UK also has strong data protection laws to help tackle the misuse of personal identity, through the UK GDPR and the Data Protection Act 2018. These laws require that any personal data processing is lawful, fair and transparent.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what mechanisms are in place to ensure that UK institutions and companies comply with the GDPR, the Data Protection Act 2018, and other relevant national security requirements when sharing genomic data internationally.

Answered by Ian Murray - Minister of State (Department for Science, Innovation and Technology)

The UK has one of the most robust data protection regimes in the world, with all organisations required to comply with our legislation to safeguard UK personal data when transferring it overseas. Failure to do so can result in enforcement action.

Our data regulator, the Information Commissioner’s Office, has powers to take enforcement action and issue hefty fines. Individuals who consider that their data has been misused can also take legal action.

Found: Orders) (England) Regulations 2001(27), as a relevant authority; (e)for the purposes of the Data Protection Act

Found: , the Police and Justice Act 2006 (c. 48) and amended by paragraph 45 of Schedule 19 to the Data Protection Act

Found: , the Police and Justice Act 2006 (c. 48) and amended by paragraph 45 of Schedule 19 to the Data Protection Act

Found: In accordance with section 182(2) of the Data Protection Act 2018, the Secretary of State has consulted

Found: for information is received by either party under the Freedom of Information Act 2000, the Data Protection Act

Found: National Cyber Security Centre (NCSC) guidance, General Data Protection Regulations (GDPR), the Data Protection Act

Found: biometric information is sensitive personal information and is handled in accordance with the Data Protection Act

Found: individual recorded as a consequence of this framework will be processed in accordance with the Data Protection Act

Found: software or system that the Supplier is required to develop under this Contract; "DPA 2018" the Data Protection Act

Found: h) ‘Data Protection Legislation’ means • the UK GDPR • the Data Protection Act 2018 • all applicable

Found: protection and data sharing 8 Legal duties under the UK General Data Protection Regulation and Data Protection Act

Found: “DPA 2018” means the Data Protection Act 2018“Default” means any breach of the obligations of the Supplier

Found: statutory obligations relating to the management of personal data in LEDS arising from the Data Protection Act

Found: statutory obligations relating to the management of personal data in LEDS arising from the Data Protection Act

Found: “DPA 2018” means the Data Protection Act 2018“Default” means any breach of the obligations of the Supplier

Found: “DPA 2018” means the Data Protection Act 2018“Default” means any breach of the obligations of the Supplier

Found: statutory obligations relating to the management of personal data in LEDS arising from the Data Protection Act

Found: statutory obligations relating to the management of personal data in LEDS arising from the Data Protection Act

Found: following is to explain your rights and give you the information you are be entitled to under the Data Protection Act

Found: may be disclosed in accordance with UK legislation (the Freedom of Information Act 2000, the Data Protection Act

Found: “DPA 2018” means the Data Protection Act 2018“Default” means any breach of the obligations of the Supplier

Found: will be processed in accordance with the MRS Code of Conduct, and in compliance with the Data Protection Act

Found: “DPA 2018” means the Data Protection Act 2018“Default” means any breach of the obligations of the Supplier

Found: process data only within the limits of UK data protection laws, including the UK GDPR and the Data Protection Act

Found: to information regimes (these are primarily the Freedom of Information Act 2000 (FOIA), the Data Protection Act

Found: The department will process your personal data in accordance with the Data Protection Act 2018 (DPA)

Found: to information regimes (these are primarily the Freedom of Information Act 2000 (FOIA), the Data Protection Act

Found: Section 8(d) of the Data Protection Act 2018 states that this will include processing of personal data

Found: Section 8(d) of the Data Protection Act 2018 states that this will include processing of personal data

Found: The Home Office will process your personal data in accordance with the Data Protection Act and, in the

Found: be disclosed in accordance with UK legislation (the Freedom of Information Act 2000, the Data Protection Act

Found: be disclosed in accordance with UK legislation (the Freedom of Information Act 2000, the Data Protection Act

Found: be disclosed in accordance with UK legislation (the Freedom of Information Act 2000, the Data Protection Act

Found: be disclosed in accordance with UK legislation (the Freedom of Information Act 2000, the Data Protection Act

Found: be disclosed in accordance with UK legislation (the Freedom of Information Act 2000, the Data Protection Act

Found: be disclosed in accordance with UK legislation (the Freedom of Information Act 2000, the Data Protection Act

Found: be processed under the general processing regime set out in the UK GDPR and Part 2 of the Data Protection Act

Found: (2) For the purposes of section 8(c) of the Data Protection Act 2018 (lawfulness of processing: public

Found: General measures The Data Protection Act 2018 (DPA), which came into force in May 2018, requires periodic

Found: General measures The Data Protection Act 2018 (DPA), which came into force in May 2018, requires periodic

Found: Data Protection All information will be processed in compliance with the Data Protection Act 2018 and

Found: confidentiality under an agreement; and (f) ‘personal data’ has the same meaning given to it in the Data Protection Act

Found: the data in the IDSR, you must recognise the privacy of that data and always comply with the Data Protection Act

Found: residents (2011 Bristol Core Strategy), let alone any references to the core principles of the Data Protection Act

Found: individual recorded as a consequence of this framework will be processed in accordance with the Data Protection Act

Found: 7The Advisory Committee handles personal information provided to it in accordance with the Data Protection Act

Found: to third parties only in compliance with the UK General Data Protection Regulation and the Data Protection Act

Found: to third parties only in compliance with the UK General Data Protection Regulation and the Data Protection Act

Found: We particularly draw to your attention the Bribery Act 2010, the Data Protection Act 2018, the Fraud

Found: ascribed to it in the Data Protection Legislation; Data Protection Legislation means: (a) Data Protection Act

Found: ascribed to it in the Data Protection Legislation; Data Protection Legislation means: (a) Data Protection Act

Found: to third parties only in compliance with the UK General Data Protection Regulation and the Data Protection Act

Found: information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act

Found: which relates to our obligations in employment law, paired with Schedule 1 part 1(1) of the Data Protection Act

Found: We particularly draw to your attention the Bribery Act 2010, the Data Protection Act 2018, the Fraud

Found: consistent with the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act

Found: , including but not limited to Charities Act 2011, Equality Act 2010, Bribery Act 2010 and Data Protection Act

Found: accountable to the public, it is important we respond to formal requests for information (Data Protection Act

Found: • Non-Compliance with Data Protection Act and General Data Protection Regulation – GLAA is still

Found: • Non-Compliance with Data Protection Act and General Data Protection Regulation – GLAA is still

Found: protection requirements contained within the UK General Data Protection Regulation and the Data Protection Act

Found: This will ensure compliance with the law in terms of its duties under the Data Protection Act 1998,

Found: can request this information through the Subject Access Request (SAR) process set out in the Data Protection Act

Found: special category data, we rely on substantial public interest, and our condition under the Data Protection Act

Found: (2) For the purposes of section 8(c) of the Data Protection Act 2018 (lawfulness of processing: public

Found: to information regimes (these are primarily the Freedom of Information Act 2000 (FOIA), the Data Protection Act

Found: Regulations 2004 (EIR), however any disclosure will be in line with the requirements of the Data Protection Act

Found: to how those classes of information are defined) in the Freedom of Information Act 2000 and Data Protection Act

Found: to how those classes of information are defined) in the Freedom of Information Act 2000 and Data Protection Act

Found: accordance with UK information access legislation (the Freedom of Information Act 2000, the Data Protection Act

Found: accordance with UK information access legislation (the Freedom of Information Act 2000, the Data Protection Act

Found: Management 18.1 How data will be processed ● The PSFA complies with the Data Protection Act

Found: “DPA 2018” the Data Protection Act 2018.

Found: “DPA 2018” the Data Protection Act 2018.

Found: “DPA 2018” the Data Protection Act 2018.

Found: GDPR, and any applicable national implementing Laws as amended from time to time; (ii) the Data Protection Act

Found: “DPA 2018” the Data Protection Act 2018.

Found: “DPA 2018” the Data Protection Act 2018.

Found: “DPA 2018” the Data Protection Act 2018.

Found: “DPA 2018” the Data Protection Act 2018.

Found: the purpose of ‘Equality of Opportunity or Treatment’ [UK GDPR Article 9(2)(a and g); and Data Protection Act

Found: Data is obscured where the annual headcount for a staff group is 500 or less, in line with The Data Protection Act

Found: Data is obscured where the annual headcount for a staff group is 500 or less, in line with The Data Protection Act

Found: vaccinations and immunisations, where “processing” has the same meaning as in section 3(4) of the Data Protection Act

Found: Orders) (England) Regulations 2001(27), as a relevant authority; (e)for the purposes of the Data Protection Act

Found: , the Police and Justice Act 2006 (c. 48) and amended by paragraph 45 of Schedule 19 to the Data Protection Act

Found: , the Police and Justice Act 2006 (c. 48) and amended by paragraph 45 of Schedule 19 to the Data Protection Act

Found: process your personal data in accordance DVSA Policy team consultations@dvsa.gov.ukwith the Data Protection Act

Found: The department will process your personal data in accordance with the Data Protection Act 2018 (DPA)

Found: information is received by either party under the Freedom of Information Act 2000, or the Data Protection Act

Found: to information regimes (these are primarily the Freedom of Information Act 2000 (FOIA), the Data Protection Act

Found: information is received by either party under the Freedom of Information Act 2000, or the Data Protection Act

Found: information is received by either party under the Freedom of Information Act 2000, or the Data Protection Act

Found: The Home Office will process your personal data in accordance with the Data Protection Act and, in the

Found: to information regimes (these are primarily the Freedom of Information Act 2000 (FOIA), the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: Information (Scotland) Act 2002 (FOISA), the UK General Data Protection Regulation and the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: Article 5(1) of the General Data Protection Regulations (GDPR) and in Section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: out in Article 5(1) of the UK General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: regulate the relationship between FOISA, the UK General Data Protection Regulation and the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: contravene the data-protection principles in Article 5(1) of the UK GDPR and section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: protection principles outlined in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act

Found: individuals with regard to the processing of Personal Data to which a Party is subject including the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the UK General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: protection principles in Article 5(1)of the General Data Protection Regulation and in S.34(1) of the Data Protection Act

Found: out in Article 5(1) of the UK General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: Article 5(1) of the General Data Protection Regulations (GDPR) and in Section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: (Previous response did advise that any ad hoc requests would be conducted under the Data Protection Act

Found: Article 5(1) of the General Data Protection Regulations (GDPR) and in Section 34(1) of the Data Protection Act

Found: Article 5(1) of the General Data Protection Regulations (GDPR) and in Section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: party and disclosing it would contravene the data protection principles in Schedule 1 to the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: out in Article 5(1) of the UK General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Articl e 5(1) of the General Data Protection Regulation and in Section 34(1) of the Data Protection Act

Found: regulate the relationship between FOISA, the UK General Data Protection Regulation and the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: data and disclosing it would breach data protection principles, as outlined by GDPR and the Data Protection Act

Found: individuals with regard to the processing of Personal Data to which a Party is subject including the Data Protection Act

Found: individuals with regard to the processing of Personal Data to which a Party is subject including the Data Protection Act

Found: with regard to the processing of Personal Data to which a Party is subject including the Data Protection Act

Found: with regard to the processing of Personal Data to which a Party is subject including the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: regulate the relationship between FOISA, the UK General Data Protection Regulation and the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: compliance was integrated with existing data protection obligations under UK GDPR and the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: Article 5(1) of the General Data Protection Regulations (GDPR) and in Section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: out in Article 5(1) of the UK General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: the performance of the Verifier Verifier must ensure that the requirements of UK GDPR and Data Protection Act

Found: legal data gateway has therefore been created to support compliance with the UK GDPR and the Data Protection Act

Found: also register with Information Commissioners Office and ensure that it complies with the Data Protection Act

Found: must also register with Information Commissioners Office and ensure that it complies with the Data Protection Act

Found: individuals with regard to the processing of Personal Data to which a Party is subject including the Data Protection Act

Found: principles in Article 5(1) o f the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: Article 5(1) of the General Data Protection Regulations (GDPR) and in Section 34(1) of the Data Protection Act

Found: individuals) and disclosing it would contravene the data protection principles in Schedule 1 to the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Articl e 5(1) of the General Data Protection Regulation and in Section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: relevant court of law, or directives or requirements of any regulatory body including the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: are the data subject, and so it is subject to the General Data Protection Regulation and the Data Protection Act

Found: They are also required by the Data Protection Act 2018/GDPR to appoint a Data Protection Officer (though

Found: principes in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: There are potential exemptions under the Data Protection Act 2018 which can allow data controllers to

Found: principles in Article 5(1) of the General Data Protection Regulation and in section 34(1) of the Data Protection Act

Found: Article 5(1) of the General Data Protection Regulations (GDPR) and in Section 34(1) of the Data Protection Act

Found: reasons of substantial public interest and identify a condition from Schedule 1, Part 2 of the Data Protection Act

Found: European Union (Withdrawal) Act 2018 (and see section 205(4)) (the "UK GDPR"); (iii) the Data Protection Act

Found: (4) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act

Found: The amendment replaces subsection (8) to refer to new section 183A of the Data Protection Act 2018 (

Found: purpose for which it is disclosed, and (b) handled and stored in accordance with— (i) the Data Protection Act

Found: Section 61, page 49, leave out lines 24 to 27 and insert— ‘(8) But see also section 183A of the Data Protection Act

Found: purpose for which it is disclosed, and (b) handled and stored in accordance with— (i) the Data Protection Act

Found: Irranca-Davies 16 Section 24, page 12, after line 21, insert— ‘( ) But see also section 183A of the Data Protection Act

Found: purpose for which it is disclosed, and (b) handled and stored in accordance with— (i) the Data Protection Act

Found: protection of prohibitions and restrictions etc on processing: relevant enactments) of the Data Protection Act

Found: Irranca-Davies 16 Section 24, page 12, after line 21, insert— ‘( ) But see also section 183A of the Data Protection Act

Found: Irranca-Davies 16 Section 24, page 12, after line 21, insert— ‘( ) But see also section 183A of the Data Protection Act

Found: However, the provisions under section 39 need to be read alongside section 183A of the Data Protection Act

Found: Housing Registers as they are no longer required as a consequence of section 183A of the Data Protection Act

Found: no longer needed as a result of the general data protection override in section 183A of the Data Protection Act

Found: longer needed as a result of the general data protection override in section 183A of the Data Protection Act

Found: no longer necessary because of the general data protection override in section 183A of the Data Protection Act

Found: (5) But see also section 183A of the Data Protection Act 2018 (c. 12) (protection of requirements

Found: Housing Registers as they are no longer required as a consequence of section 183A of the Data Protection Act

Found: Housing Registers as they are no longer required as a consequence of section 183A of the Data Protection Act

Found: Irranca-Davies 16 Section 24, page 12, after line 21, insert— ‘( ) But see also section 183A of the Data Protection Act

Found: Irranca-Davies 16 Section 24, page 12, after line 21, insert— ‘( ) But see also section 183A of the Data Protection Act

Found: protection of prohibitions and restrictions etc on processing: relevant enactments) of the Data Protection Act

Found: However, the provisions under section 39 need to be read alongside section 183A of the Data Protection Act

Found: However, the provisions under section 39 need to be read alongside section 183A of the Data Protection Act

Found: Irranca-Davies 16 Section 24, page 12, after line 21, insert— ‘( ) But see also section 183A of the Data Protection Act

Found: purpose for which it is disclosed, and (b) handled and stored in accordance with— (i) the Data Protection Act

Found: purpose for which it is disclosed, and (b) handled and stored in accordance with— (i) the Data Protection Act

Found: Section 61, page 49, leave out lines 24 to 27 and insert— ‘(8) But see also section 183A of the Data Protection Act

Found: (2) But see also section 183A of the Data Protection Act 2018 (c. 12) (protection of requirements

Found: (2) But see also section 183A of the Data Protection Act 2018 (c. 12) (protection of requirements

Found: The amendment replaces subsection (8) to refer to new section 183A of the Data Protection Act 2018 (

Found: (2) But see also section 183A of the Data Protection Act 2018 (c. 12) (protection of requirements

Found: (2) But see also section 183A of the Data Protection Act 2018 (c. 12) (protection of requirements

Found: (2) But see also section 183A of the Data Protection Act 2018 (c. 12) (protection of requirements

Found: (4) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act

Found: letter adds that the provisions under section 39 need to be read alongside section 183A of the Data Protection Act

Found: Education Act 2002 3 • The Academies Act 2010 • School Standards and Framework Act 1998 • Data Protection Act

Found: Commissioner's Data Sharing Code of Practice of May 2011 1.1.5 Data Protection Legislation : (i) the Data Protection Act

Found: ‘Personal data’ is defined in sections 3(2) and (3) of the Data Protection Act 2018 (‘the DPA 2018’)

Found: personal data underlying these statistics are processed in accordance with the requirements of the Data Protection Act

Found: Freedom of Information Act 2000, the 28 Environmental Information Regulations 2004 and the Data Protection Act

Found: ‘Personal data’ is defined in sections 3(2) and (3) of the Data Protection Act 1998 (‘the DPA 2018’)

Found: ‘Personal data’ is defined in sections 3(2) and (3) of the Data Protection Act 2018 (‘the DPA 2018’)

Found: ‘Personal data’ is defined in sections 3(2) and (3) of the Data Protection Act 2018 (‘the DPA 2018’)

Found: ‘Personal data’ is defined in sections 3(2) and (3) of the Data Protection Act 2018 (‘the DPA 2018’)

Found: in accordance with the obligations and duties under the Freedom of Information Act 2000, the Data Protection Act

Found: obligations under the Freedom of Information Act 2000, the Environmental information Act 2004 or the Data Protection Act

Found: The Data Protection Act 2018, Freedom of Information Act 2000 and the Environmental Information Regulations

Found: ‘Personal data’ is defined in sections 3(2) and (3) of the Data Protection Act 2018 (‘the DPA 2018’)

Found: used by the Welsh Government in accordance with its obligations and duties under the: • The Data Protection Act

Found: ‘Personal data’ is defined in sections 3(2) and (3) of the Data Protection Act 2018 (‘the DPA 2018’)

Found: supplied by you in this form, is in accordance with the terms of our registration under the Data Protection Act

Found: personal data underlying these statistics are processed in accordance with the requirements of the Data Protection Act

Found: personal data underlying these statistics is processed in accordance with the requirements of the Data Protection Act