Policy background Digital Government Data Protection
The Digital Government measures in the Act operate within the framework of the Data Protection Act 1998 and the Human Rights Act 1998, and all processing of information under these powers must be carried out in compliance with that legislation. The Part 5 powers of the present Act explicitly state that information cannot be disclosed if to do so would contravene the Data Protection Act 1998, which provides a framework of principle-based safeguards on processing personal data, including requirements for fair and lawful processing and for data minimisation.
	In particular, the provisions in and the codes of practice produced under the Act will be subject to the "Data Protection Principles" set out in Schedule 1 to the Data Protection Act 1998 which require that use of personal data must be proportionate (i.e. that only the minimum amount of data required to fulfil a given objective is to be shared). The powers are limited to ensure that information can only be shared for the specific purposes set out in the Act.
	The General Data Protection Regulation or "GDPR" (Regulation (EU) 2016/679) was adopted on 27 April 2016 and must take effect by 25 May 2018. In the government’s view the measures in Part 5 of the Act are also consistent with the GDPR.
	Information cannot be disclosed under Part 5 if to do so would be prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016 (or, until those provisions are fully in force, is prohibited by Part 1 of the Regulation of Investigatory Powers Act 2000).
	The information-sharing powers in Part 5 are supplemented by statutory codes of practice or statements of principles, each of which is required to be consistent with the Information Commissioner’s Data sharing code of practice. Persons who disclose information under Part 5 are also explicitly required to have regard, in so far as they apply to the information in question, to certain codes of practice issued by the Information Commissioner under section 51(3) of the Data Protection Act 1998.