Intelligence services processing
National security is outside the scope of EU law by virtue of Article 4(2) of the Treaty on European Union, which states that national security is the sole responsibility of each Member State. Therefore the processing of personal data in connection with national security activities and processing by agencies or units dealing with national security issues is not within scope of the GDPR or LED.
	Domestic processing of personal data by the intelligence services, comprising the Security Service, the Secret Intelligence Service and the Government Communications Headquarters, is currently governed by the 1998 Act. Part 4 of the new Act builds on the existing regime by seeking to adopt the standards of the modernised Convention 108 (which does apply to national security data processing) to ensure processing of personal data carried out by the intelligence services will be in-line with future international standards. It provides for rules on processing personal data in the national security context whilst ensuring that the UK intelligence community can tackle existing, new and emerging national security threats.
	As was the case previously under the 1998 Act, the regime in Part 4 of the Act provides for exemptions from certain provisions in the Act where necessary to safeguard national security. Also consistent with the approach in the 1998 Act, there is provision for a certificate signed by a Minister of the Crown certifying that exemption from a specified requirement is necessary for the purpose of safeguarding national security to be conclusive evidence of that fact.
	The intelligence services already comply with data handling obligations. These are supported by physical, technical and procedural controls which are overseen by the Investigatory Powers Commissioner and which are also aligned to the Cabinet Office Transforming Government Security Review. They include vetting of personnel, handling restrictions based on classification of data, firewalling and air gapping of internal IT and access restrictions.
	The regulatory structure applying to the intelligence services is found in other legislation and already imposes restrictions on their activities, including relating to their data handling practices. This includes the Security Services Act 1989, the Intelligence Services Act 1994, the Regulation of Investigatory Powers Act 2000 and the Investigatory Powers Act 2016 ("the 2016 Act"). For example, Part 7 of the 2016 Act provides for agency specific warrants which are relevant to how the agencies hold and use bulk personal datasets. The 2016 Act also creates a number of offences which are applicable if an individual in an agency wrongly uses or discloses data obtained using the powers in that Act.