Part 2: General processing Chapter 2: The GDPR Section 7: Meaning of "public authority" and "public body"
Article 6(1)(a) to (f) of the GDPR sets out a list of conditions which allow for the lawful processing of personal data. Schedule 2 to the 1998 Act contained an equivalent provision to Article 6(1).
	Article 6(1)(e) makes reference to processing carried out by "public authorities in the performance of their tasks". However, the GDPR does not provide a definition of "public authority" or "public body" for the purposes of Article 6(1)(e) and Article 37.
	This section defines public authority and public body for the purpose of the GDPR and is largely consistent with the definition which existed in section 1(1) of the 1998 Act.
	Subsection (1) provides a definition of "public authority" and "public body", which applies to all references to these terms in the GDPR. The definition is based on that of a "public authority" in the 2000 Act, and it applies to those bodies listed in Schedule 1 to the 2000 Act and to Scottish public authorities as defined by the Freedom of Information (Scotland) Act 2002. Subsection 1(c) provides a power for the Secretary of States to designate additional bodies as "public authorities" for the purposes of the GDPR by regulations.
	Subsection (2) makes clear that a public authority or public body will only be regarded as such for the purposes of the GDPR when it is carrying out a task in the public interest or in the exercise of official authority vested in it. Conversely, where such a body is carrying out a non-public function, it is not treated as a public authority for the purposes of the GDPR As a result it may, in some circumstances, be able to rely on Article 6(1)(f) of the GDPR as a lawful basis for processing.
	Subsection (3) provides that the authorities listed are not "public authorities" for the purposes of the GDPR, even though they are (or may in future be) public authorities for the purposes of the 2000 Act or the Freedom of Information (Scotland) Act 2002.
	Subsection (4) contains a power for the Secretary of State to specify that a body is not a public authority for the purposes of the GDPR, even if they are otherwise included by virtue of subsection (1)(a) or (b).
	Subsection (5) provides that regulations under this section are subject to the affirmative resolution procedure.