Law enforcement processing
The GDPR does not apply to the processing of personal data by competent authorities (broadly the police and other criminal justice agencies) "for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and the prevention of threats to public security" (see Article 2(2)(d)). Instead, alongside the GDPR, the European Parliament and Council adopted the Law Enforcement Directive (EU) 2016/6801 "on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA" ("LED").
	Unlike the GDPR, the LED is not directly applicable EU law; accordingly Part 3 of the Act (together with provisions in Parts 5 to 7 which apply across the GDPR, LED and intelligence services regimes) transposes the provisions of the LED into UK law.
	The scope of the LED is provided for in Article 1 and concerns the processing of personal data by competent authorities for law enforcement purposes. A competent authority is any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. Further, a competent authority may also be any other body or entity entrusted by Member State law to exercise public authority and public powers for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. This definition covers not only all police forces, prosecutors and other criminal justice agencies in the UK, but also other organisations with incidental law enforcement functions, such as Her Majesty’s Revenue and Customs, the Health and Safety Executive and the Office of the Information Commissioner.
	While the LED only applies in relation to the cross-border processing of personal data for law enforcement purposes (see below), Part 3 of the Act also applies to the domestic law enforcement processing. This will ensure that there is a single domestic and trans-national regime for all law enforcement processing. The provisions of the GDPR, together with the derogations in Chapter 2 of Part 2 of the Act, will apply to the processing of personal data by law enforcement agencies for purposes other than law enforcement purposes, for example where the controller determines that the processing is for internal personnel management/ human resources purposes.