General processing Lawfulness of processing
The Act is drafted to ensure that existing data processing can continue, subject to the enhanced rights provided by the GDPR.
	Persons giving consent to the processing of personal data need to have a certain level of understanding of what they are being asked which is why the GDPR specifies that parents or guardians must give consent to personal data processing on behalf of young children using information society services. The GDPR allows the UK to set the threshold for the minimum age at which a child can consent to such data processing to any age between 13 years and 16 years. The 1998 Act was silent on this matter but the Commissioner’s guidance suggested that some form of parental consent would normally be required before collecting personal data from children under 12. The new Act allows a child aged 13 years or older to consent to his or her personal data being processed by providers of information society services.
	Processing of special categories of personal data (data concerning race, political opinions, health, etc. as described above) is generally prohibited unless explicit consent is obtained. However, the GDPR allows processing to take place in certain circumstances without explicit consent and enables domestic law to stipulate the conditions and safeguards around this processing in certain cases. The processing of special categories of data and criminal conviction and offences data must be undertaken with adequate and appropriate safeguards to ensure the absolute protection of individuals’ most sensitive personal data. There are many circumstances where this sort of data is legitimately used including the pricing of risk in financial services and the operation of anti-doping programmes in sport. The Act replicates the former provisions in the 1998 Act that allowed the processing of this sort of data. The new Act provides equivalent provision as far as possible to allow for continued processing for ‘substantial public interest’ purposes, to ensure that organisations are able to continue lawfully processing data whilst also achieving a balance between individuals’ rights, while also making some new provision. The Act aims to largely preserve the effect of paragraph 5 of Schedule 2 and of Schedule 3 to the 1998 Act as well as the Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417).
	It is not possible to predict what future circumstances may arise which justify the processing of these particularly sensitive categories of data without explicit consent of the individual. For example, in 2009 the then Home Secretary established the Hillsborough Independent Panel to investigate the disaster which occurred on 15 April 1989. Some of the information held by public bodies within the scope of the Hillsborough disclosure exercise included sensitive personal data so the Secretary of State made the Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978) to ensure that there was no room for doubt that it may be possible in an appropriate case for an individual or body to disclose such data. The Act provides the Secretary of State with the necessary power to manage unforeseeable situations of this sort.
	The GDPR gives individuals the right to not be subject to a decision based solely on automated processing, including profiling, which have legal or other significant effects for him or her, unless that decision is necessary for contractual purposes, authorised by law and appropriate safeguards are in place, or based on consent. Automated processing is processing where there is no human intervention, for example, when data is collected about an individual’s personal finances, which is then processed according to an algorithm to decide creditworthiness. In those cases in which automated decision making is allowed, the GDPR requires additional safeguards to be put in place to protect individuals from inaccurate processing. The Act substantively replicates the additional safeguards provided within section 12(2) of the 1998 Act and ensures they are consistent with relevant provisions of the GDPR itself.