Part 5: Data Protection and Privacy Intelligence Services Section 89: Joint processing by intelligence services and competent authorities
Section 89 amends Part 4 of the DPA 2018 to enable joint processing between a qualifying competent authority (or authorities) and an intelligence service (or intelligence services), under Part 4 of the DPA 2018. This enables the controllers to process the data within a single, common regime. The controls and safeguards under Part 4 will apply to all such joint processing.
	Subsection (2) amends section 82 of the DPA 2018, which currently applies Part 4 only to processing by or on behalf of the Intelligence Services. This amendment makes clear that Part 4 also applies to the processing of personal data by a qualifying competent authority where the processing is the subject of a designation notice. New subsection (2A) provides a power to the Secretary of State to make regulations to specify competent authorities (as defined in Section 30(1) of the DPA 2018) who can be regarded as "qualifying competent authorities", so able to apply for or be issued with a designation notice. New subsection (4) provides that any such regulations are subject to the affirmative procedure.
	Subsection (3) of section 89 inserts new sections, 82A – 82E, that impose the conditions for designation notices.
	82A enables qualifying competent authorities (as specified in Regulations) to jointly apply for a notice from the Secretary of State permitting them to have a joint controller relationship under Part 4 of the DPA 2018. The Secretary of State must be satisfied that the intended processing is required for the purposes of safeguarding national security. Before giving a designation notice, the Secretary of State must consult with the Commissioner, and they may also consult with other relevant public or regulatory bodies as appropriate.
	82B provides for rules governing the duration of a designation notice. Notices cease to be in force after a period of 5 years or a shorter period if specified in the notice issued by the Secretary of State.
	82C imposes conditions on the review and withdrawal of a designation notice. It requires a designation notice to be reviewed at least annually by the Secretary of State.
	A designation notice may be withdrawn by the Secretary of State at any time, following a review and when some or all of the processing to which the notice applies is no longer required for the purposes of safeguarding national security.
	When considering when a withdrawal notice should come into force, the Secretary of State must take into account the time needed for controllers to effect an orderly transition to new arrangements for the processing of that data. During the transition period and prior to the withdrawal notice coming into effect, the processing of data falling within the terms of the notice by a joint controller would continue to be subject to Part 4 DPA 2018. For example, joint processing activities such as transiting data in readiness for the notice being withdrawn would continue to be subject to Part 4 DPA 2018. When a notice is not in force or when processing is outside the scope of a notice, Part 3 of the DPA 2018 or the UK GDPR will apply to any processing by the competent authority, depending on its purpose.
	82D requires the Secretary of State to provide a copy of the designation notice to the Commissioner and the Commissioner must make available to the public a record of that designation notice whilst it is in force, with the assumption of transparency.
	82E allows a designation notice to be appealed to the tribunal if a person is directly affected by the notice.