Part 4: Intelligence services processing Chapter 6: Exemptions Sections 110 and 111: National security
Section 110 creates an exemption from certain provisions in the Act if that exemption is required for the purpose of safeguarding national security. The provisions from which there is an exemption are in Parts 4 to 6 of the Act and include most of the data protection principles, the rights of data subjects, certain obligations on controllers and processors, and various enforcement provisions. This exemption mirrors the position previously provided for in section 28 of the 1998 Act.
	Section 111 provides that, as before under the provisions of the 1998 Act, a Minister of the Crown (as defined in subsection (10)) may certify that an exemption for the purposes of safeguarding national security is required in respect of specified personal data or processing. Subsection (1) provides that such a certificate is to be taken as conclusive evidence of the exemption being required. Section 130 below makes provision for the publication of such ministerial certificates.
	These provisions allow departure from certain requirements of the Act where this is necessary to safeguard national security. For instance, they will exempt an intelligence service controller from having to reveal to a terrorist suspect subject to covert surveillance, that personal data relating to him or her is being processed.
	A certificate issued by a Minister of the Crown is a means to give an intelligence service legal certainty that an exemption applies to the specified data processing. Any person directly affected by the issuing of any certificate may appeal to the tribunal to judicially review the decision to issue the certificate or, where the certificate identifies data by means of a general description, challenge the application of the certificate to specific data. Such an appeal would be heard by the Upper Tribunal which would apply judicial review principles when determining the appeal. In applying such principles the Upper Tribunal would be able to consider a wide range of issues, including necessity, proportionality and lawfulness. This would enable, for example, the Upper Tribunal to consider whether the decision to issue the certificate was reasonable, having regard to the impact on the rights of data subjects and balancing the need to safeguard national security.