Section 91 amends Part 5 of the DPA 2018 by inserting new sections 120A-D. These provisions provide for a principal objective and general duties for the Commissioner when carrying out functions under the data protection legislation. They also require the Commissioner to prepare and publish a strategy and introduce new reporting requirements.
	Subsection (2) omits section 2(2) (duty of Commissioner when carrying out functions) of the DPA 2018. This now forms part of the new principal objective at new section 120A of the DPA 2018.
	New section 120A introduces a new principal objective for the Commissioner. To meet this objective when carrying out functions under the data protection legislation, the Commissioner should aim to secure an appropriate level of protection for personal data, having regard to the interests of data subjects, controllers and others and matters of general public interest; and to promote public trust and confidence in the processing of personal data.
	New section 120B sets out new duties for the Commissioner when carrying out data protection functions. This includes duties to have regard to the desirability of promoting innovation and competition; a new duty to have regard to the importance of preventing, investigating and detecting criminal offences; and a new duty to have regard to the need to safeguard public and national security. There is also a new duty to have regard to the fact that children merit specific protection, as they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing.
	New section 120C requires the Commissioner to prepare and publish a strategy. This should detail how the Commissioner will discharge functions under the data protection legislation in relation to duties under new sections 120A and 120B. It should also detail how the Commissioner will discharge data protection functions in relation to duties under section 108 of the Deregulation Act 2015 which requires the Commissioner to have regard to the desirability of promoting economic growth when exercising a regulatory function. In addition, there is a requirement for the strategy to set out how data protection functions will be carried out in accordance with the duty under section 21 of the Legislative and Regulatory Reform Act 2006 to have regard to the principles that regulatory activities should be carried out in a way which is transparent, accountable, proportionate and consistent and should be targeted only at cases in which action is needed.
	New section 120C does not require the strategy to take a particular form and it is envisaged that this obligation can be met by a standalone report. The Commissioner must review and revise the strategy as needed as outlined in 120C(2) and must publish the strategy and any revised strategy, as outlined in 120C(3).
	New section 120D outlines the duty for the Commissioner to consult, when considering how the manner in which the Commissioner exercises functions under the data protection legislation may affect economic growth, innovation and competition. An example of such instances could be issues relating to emerging technology. This consultation should be conducted at such times as the Commissioner considers appropriate.
	New section 120D(2) defines the scope of this consultation requirement, outlining that it requires the Commissioner to consult other regulators and other such persons as the Commissioner considers appropriate in relation to economic growth, innovation and competition.
	Subsection (4) of section 91 inserts a new requirement into section 139 DPA 2018 for the Commissioner to report on what has been done to comply with its duties under new sections 120A and 120B, as well as certain other statutory duties, during a reporting period. This also includes a review of the strategy published under new section 120C and a summary of what the Commissioner has done to comply with the consultation duty under new section 120D. This reporting requirement is an additional part of the Commissioner’s annual reporting requirements to Parliament under the DPA 2018.
	Subsection (5) inserts the requirement for the Commissioner to prepare the first strategy as set out in 120C within 18 months of this requirement coming into force.
Part 5: Data Protection and Privacy Information Commissioner's role Section 91: Duties of the Commissioner in carrying out functions