Criminal law enforcement processing
under Part 3 of the DPA2018

Part 3 of the Data Protection Act 2018 (DPA2018) governs the processing of personal data when conducting criminal investigations, issuing criminal penalties, and protecting against threats to public security.

Part 3 is divided into six chapters and implements the EU Law Enforcement Directive (LED) into UK law. Its scope applies to competent authorities, including law enforcement agencies, local authorities, government departments, courts, prisons and any other bodies with statutory functions to exercise powers for law enforcement purposes.

This 1-day course provides detailed instruction to individuals with data protection responsibilities working for competent authorities processing information for criminal law enforcement purposes.

Scope and Definitions:

• Competent Authorities authorities (Section 30)
• Law enforcement purposes (Section 31)
• Controllers and Processors (Section 32)

Law enforcement data protection principles:

• The six principles (Sections 35-40)
• Safeguards for archiving (Section 41)
• Conditions for sensitive processing (Section 42 and Schedule 8)

Data Subject Rights:

• Rights of the data subject (Section 43)
• Controllers' general duties (Section 44)
• Right of Access (Section 45)
• Right to rectification (Section 46)
• Right to erasure or restriction of processing (Section 47)
• Supplementary to the rights under section 46 or 47 (Section 48)
• Right not to be subject to automated decision-making (Section 49)
• Automated decision-making authorised by law: safeguards (Section 50)

Governance:

• General obligations of the controller
• Data protection by design and default
• Joint Controllers
• Processors
• Processing under the authority of the controller or processor
• Logging (Section 62)
• Data Protection Impact Assessment
• Security and notifying breaches
• Notifying a breach to the ICO
• Notifying a breach to the data subject
• Data Protection Officers

Transfers to third countries:

• Transfer of personal data to third countries
• General Principles for transfers
• Transfers based on an adequacy decision
• Transfer subject to appropriate safeguards
• Transfers on the basis of special circumstances
• Transfers of personal data to persons other than relevant authorities
• National security: certificates by the Minister - DPA2018

Data Sharing:

• Data Sharing under Part 2
• Disclosure Considerations
• Sharing between competent authorities
• Sharing with a competent authority