Part 2: General processing Chapter 3: Other general processing Sections 26 to 28: National security and defence exemption
These sections create an exemption from certain provisions in the applied GDPR scheme and in Parts 5, 6 and 7 of the Act if that exemption is required for the purpose of safeguarding national security or for defence purposes. The provisions that may be disapplied in such circumstances are listed in subsection (2) of section 26 and include most of the data protection principles, the rights of data subjects, certain obligations on data controllers and processors, and various enforcement provisions.
	Section 26 provides for an exemption similar to that in section 28 of the 1998 Act where this is required for the purpose of safeguarding national security. Schedule 7 to the 1998 Act provided further exemptions to the subject information provisions, including at paragraph 2, when they would be likely to prejudice the "combat effectiveness" of the armed forces.
	The "defence purposes" element of section 26 is intended to ensure the continued protection, security and capability of the armed forces, and the civilian staff that support them, not just their combat effectiveness. The following are examples of processing activities which might be considered defence purposes requiring the protection of the exemption:
	collection, consideration and utilisation of military or other defence related intelligence in support of current and future military operations;
	collation of personal data to assist in assessing the capability and effectiveness of armed forces personnel, including performance of troops;
	collection and storage of information, including biometric details, necessary to maintain the security of defence sites, supplies and services;
	management of data relating to former armed forces personnel who hold a reserve liability;
	sharing of data with coalition partners to support them in maintaining their security, capability and effectiveness of their armed forces.
	This is not an exhaustive list, and the application of the exemption should only be considered in specific cases where the fulfilment of a specific data protection right or obligation is found to place the security, capability or effectiveness of UK defence activities at risk.
	As was the case under the 1998 Act, a Minister of the Crown (as defined in section 27(10)) may certify that an exemption is required in respect of specified personal data or processing for the purpose of safeguarding national security. Section 27(1) provides that such a certificate is to be taken as conclusive evidence of the exemption being required. A certificate issued by a Minister of the Crown is a means to give a data controller legal certainty that the national security exemption applies to the specified data processing. Section 130 below makes provision for the publication of such ministerial certificates.
	Any person directly affected by the issuing of any certificate may appeal the decision to issue the certificate or, where the certificate identifies data by means of a general description, challenge the application of the certificate to specific data (section 27(3)). Such an appeal would be heard by the Upper Tribunal which would apply judicial review principles when determining the appeal. In applying such principles the Upper Tribunal would be able to consider a wide range of issues, including necessity, proportionality and lawfulness. This would enable, for example, the Upper Tribunal to consider whether the decision to issue the certificate was reasonable, having regard to the impact on the rights of data subjects and balancing the need to safeguard national security.
	Section 28 modifies the application of Articles 9 (prohibition on processing of special categories of personal data) and 32 (security of processing) of the applied GDPR scheme where processing takes place for national security and defence purposes. In each instance, alternative security measures appropriate to the risk must be implemented.