Part 4: Intelligence services processing Chapter 2: Principles Sections 85 to 91: Data protection principles
These sections set out the six data protection principles governing the processing of personal data by intelligence services, and make further provision about the application of those principles.
	The first principle (section 86) is that processing must be lawful, fair and transparent. The conditions under which processing is lawful are set out in Schedule 9, and include where the data subject has given their consent, where the processing is necessary for compliance with a legal obligation, where the processing is necessary for the statutory function of an intelligence service or where the processing is necessary for the administration of justice. The criteria for sensitive processing (defined in section 86(7)) are stricter and are set out in Schedule 10. Section 86(3) confers a regulation-making power (subject to the affirmative procedure) on the Secretary of State to add to conditions in Schedule 10. It also establishes a power to omit conditions added by regulations made under this section.
	The requirement to process data fairly does not in itself prevent intelligence services from carrying out activities such as covert surveillance. Such activities would be regarded as fair and lawful if they comply with the requirements of the Human Rights Act 1998 (for example, where interference with privacy is permissible because it is both necessary and proportionate), the purposes and functions and disclosure gateways specified in the Security Service Act 1989 and Intelligence Services Act 1994 (as appropriate) or any other relevant legislation (for example, the Regulation of Investigatory Powers Act 2000 or the Investigatory Powers Act 2016).
	The principle of transparency requires controllers to be clear and open with data subjects about how information about them will be used. This could be achieved, for example, by providing generic information on a website about the identity of the controller, the purposes of the processing undertaken by the controller, rights available to data subjects and other information as specified.
	The second principle (section 87) requires personal data to be collected for specific, explicit and legitimate purposes. The statutory functions of the intelligence services are set out in the Security Service Act 1989 (for MI5) and the Intelligence Services Act 1994 (for MI6 and GCHQ). Personal data collected for one purpose may be processed for another. The use for that other purpose, however, must also be lawful, proportionate and necessary. So, for example, personal data collected by the Security Service for the purpose of safeguarding national security could be processed further for the purpose of the prevention or detection of serious criminal offences, for instance by alerting the relevant law enforcement agency to intelligence suggesting a subject of interest is in possession of a firearm.
	The third principle (section 88) requires that personal data undergoing processing by controllers be adequate and relevant and not excessive for the purposes for which it is processed. That means that a controller:
	holds personal data about an individual that is sufficient for the purpose in question; and
	does not hold more information than is needed for that purpose.
	The fourth principle (section 89) requires personal data undergoing processing to be accurate and, where necessary, kept up to date. The accuracy of personal data held by a controller under Part 4 might not always be a straightforward question of fact in cases where it amounts to an intelligence officer’s assessment which is based on underlying information which is partial or incomplete.
	The fifth principle (section 90) requires that personal data undergoing processing be kept for no longer than is necessary. To comply with this principle, controllers should establish time limits for erasure, or for periodic review. Similarly to the previous position under the 1998 Act, this section does not specify minimum or maximum periods for the retention of data. In practice, to comply with the fifth principle, controllers should review the length of time they retain personal data; consider the purpose or purposes for which they hold information in deciding whether, and if so for how long, to retain it; updating or archiving information and securely deleting information that is no longer needed for those purposes.
	The retention of certain information by intelligence services is governed by statutory rules. For example, the Investigatory Powers Act 2016 requires the retention and examination of a bulk personal dataset by an intelligence service to be authorised by a warrant issued by a Secretary of State and approved by a Judicial Commissioner.
	The sixth principle (section 91) requires personal data to be processed in a secure manner. The current Commissioner guidance stipulates that, in practice, this means that controllers must have appropriate security to prevent the personal data they hold being accidentally or deliberately compromised. In particular, controllers will need to:
	design and organise their security to fit the nature of the personal data they hold and the harm that may result from a security breach;
	be clear about who in their organisation is responsible for ensuring information security;
	make sure they have the right physical and technical security, backed up by robust policies and procedures and reliable, well-trained staff; and
	be ready to respond to any breach of security swiftly and effectively.