Part 3: Law enforcement processing Chapter 2: Principles Section 35: The first data protection principle
The first principle (section 35) is that processing must be lawful and fair. In contrast to the first data protection principle under the GDPR (see Article 5(1)(a)) there is no requirement for data to be processed in a transparent manner. This omission recognises the inherent sensitivities of processing for the law enforcement purposes by competent authorities, particularly where transparency would undermine or compromise covert techniques and capabilities, and/or sensitive or covert operations including, for example, where investigatory powers under the Regulation of Investigatory Powers Act 2000 or Investigatory Powers Act 2016 are engaged.
	"Lawful" processing means authorised by either statute, common law or royal prerogative. For example, Part 5 of the Police and Criminal Evidence Act 1984 (which applies to England and Wales) confers statutory authority for the taking and retention of DNA and fingerprints, while the Domestic Violence Disclosure Scheme relies on the police’s common law powers to disclose information where it is necessary to do so to prevent crime.
	The requirement to process data fairly does not in itself prevent law-enforcement authorities from carrying out activities, such as covert investigations or video surveillance. Such activities can be done for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, as long as they are in accordance with the law (for example, covert surveillance carried out under Part 2 of the Regulation of Investigatory Powers Act 2000) and constitute a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the natural person concerned. The data protection principle of fair processing is a distinct notion from the right to a fair trial as defined in Article 6 of the ECHR.
	Article 10 of the LED generally prohibits the processing of "special categories of personal data" unless specific circumstances apply.
	Section 35 uses the term "sensitive processing" (as defined in subsection (8)) to refer to such "special categories of personal data". Subsections (4) and (5) specify the two circumstances when sensitive processing may take place for law enforcement purposes, namely when the data subject has consented or where the processing is "strictly necessary" for one or more of the purposes specified in Schedule 8. As an additional safeguard, in each case, the controller must have an appropriate policy in place. The Article 29 Working Party has opined "that the term "strictly necessary" in Article 10 [of the LED] has to be understood as a call to pay particular attention to the necessity principle in the context of processing special categories of data, as well as to foresee precise and particularly solid justifications for the processing of such data". Section 42 makes further provision in respect of such appropriate policies in respect of sensitive processing.