Part 3: Law enforcement processing Chapter 1: Scope and definitions Sections 30 to 33: Definitions
These sections define terms used in Part 3. There are also additional definitions in sections 3 and 205 which are relevant to the Act as a whole. The definition of "personal data" in section 3(2) is such that anonymised data falls outside the provisions of this Part as does data in relation to an individual who has died.
	Schedule 7 lists the principal competent authorities. The list includes UK government departments and ministers, chief officers of police, non-policing law enforcement agencies, prosecutorial agencies, other criminal justice agencies and other office holders or organisations who carry out law enforcement activities in connection with law enforcement. A number of public organisations responsible for the investigation or prosecution of criminal offences or the execution of criminal penalties, are not legal entities in their own right. For example, HM Courts and Tribunals Service and HM Prison Service are executive agencies of the Ministry of Justice and, as such, would be caught by the entry at paragraph 1 of Schedule 7 in respect of ministerial Government departments. The entry in respect of UK government departments only covers those departments which have law enforcement functions, for example the Department for Work and Pensions in relation to benefit fraud or the Home Office in relation to immigration crime. Where a UK government department, the Scottish Ministers, the Welsh Ministers or a Northern Ireland department do not have responsibilities which involve the processing of personal data for law enforcement purposes, these entries in paragraphs 1 to 4 of Schedule 7 will not impose obligations on those departments or Ministers under this Part.
	The list of competent authorities in Schedule 7 only covers the principal police and other criminal justice agencies in the UK which will, as part of their functions, process personal data for law enforcement purposes and are therefore subject to the provisions of this Part. Section 30(1)(b) provides for a catch-all provision to capture other persons (that is, office holders or organisations) exercising statutory functions for any of law enforcement purposes, for example local authorities when prosecuting trading standards offences or the Environment Agency when prosecuting environmental offences. It does not, however, apply to an individual or organisation (such as the Royal Society for the Prevention of Cruelty to Animals) undertaking a private prosecution. The intelligence agencies are expressly excluded from the definition of a competent authority as there is a potential overlap between their functions and the catch-all provision (for example, under section 1(4) of the Security Service Act 1989, the Security Service has a function of supporting police forces and other law enforcement agencies in the prevention and detection of serious crime). The processing of personal data by the intelligence services is governed by the provisions in Part 4 of the Act. This reflects Recital 14 of the LED, which acknowledges that the activities of agencies dealing with national security issues fall outside the scope of the Directive.
	Section 30(3) enables the list of competent authorities in Schedule 7 to be amended by regulations. This regulation-making power will enable the Schedule to be updated to take account of changes in the name of a listed office or organisation (in such a case the negative procedure applies), the abolition of an existing office or organisation (or a change in its functions such that it no longer processes personal data for law enforcement purposes) or the creation of a new office or organisation which engages in the processing of personal data for law enforcement purposes (in the latter two cases the affirmative procedure applies).
	The definition of "law enforcement purposes" in section 31 sets the boundaries to which the data protection regime in Part 3 of the Act applies. Not all processing of personal data by a competent authority will be for law enforcement purposes. This is because where a controller determines that the processing will take place for another purpose, for example, for HR purposes, this will be general processing and governed by either the GDPR or the applied GDPR regime (see Chapter 3 of Part 2).
	Section 32 defines the terms "controller" and "processor" for the purposes of Part 3. The controller (which includes employees of the controller) determines the purpose and means of processing; or alternatively their responsibility may be set out in law. The definition of an "employee" in section 33(2) ensures that, in this context, police officers and special constables (who are office holders rather than employees) are treated as an extension of their chief officer.
	Where two or more controllers act together as controllers to decide the purpose and means of any data processing they are known as "joint controllers". For example, the Police National Computer is managed on behalf of all police forces in the UK with individual chief constables jointly determining the purposes and means of the processing of the personal data held on the database. In this situation, the chief constables will be acting as joint controllers.
	Processors act on behalf of the controller. Similar to the 1998 Act, section 32(3) makes clear a processor does not include an employee of the controller.