Part 7: Supplementary and final provision Section 187: Representation of data subjects with their authority
This section concerns the ability of representative bodies to exercise certain rights on behalf of data subjects, provided they are authorized to do so by the data subjects. The relevant rights are the right to complain to the Commissioner, the rights to bring judicial review proceedings against the Commissioner and to apply for a tribunal order against the Commissioner under section 166, the right to apply for a court order against a controller or processor, and (in relation to the GDPR only) the right to receive compensation from a controller or processor. This section reflects the rights in 80(1) of the GDPR and Article 55 of the LED.
	Subsection (1) signposts to the right to authorise a representative body set out in Article 80(1) of the GDPR and allows a data subject to authorise a representative body to exercise his or her right to compensation under the GDPR.
	Subsection (2) sets out, in relation to the data protection legislation other than the GDPR, the right for a data subject to authorise a representative body to exercise his or her rights. It lists the rights a representative organisation can exercise on behalf of the data subject.
	Subsections (3) and (4) sets out the requirements that a representative body must meet in order to exercise a data subject’s rights on their behalf. The representative body must be a not-for-profit organisation with objectives in the public interest, and must be active in protecting the rights and freedoms of data subjects in relation to their personal data.
	Subsection (5) explains that references to a "representative body" in this Act are to a body or organisation which is authorised to exercise a right on behalf of a data subject.
	This is a new provision with no direct equivalent in the 1998 Act.