Part 3: Law enforcement processing Chapter 4: Controller and processor Sections 56 to 65: General obligations
This Chapter provides for obligations on controllers and processors. Sections 56 and 57 impose general obligations on controllers to take appropriate technical and organisational measures to ensure that the requirements of Part 3 are complied with. In order to demonstrate compliance with Part 3, controllers should adopt internal policies and implement measures which adhere to the principle of data protection by design and data protection by default. Overall the measures implemented need to be proportionate to the processing activities, but this is not just an economic consideration; measures should adhere to the data principles and the outcome of any completed data protection impact assessment (see section 64).
	The intention is to ensure that data protection is mainstreamed in processing operations, particularly in the planning of new proposals or projects, although equally relevant for existing processing operations. Instead of data protection considerations emerging once plans are in place or the processing has begun, this places an obligation on the controller to put in place appropriate technical and organisational measures to implement the data protection principles from the outset. This aims to ensure controllers only process personal data which is necessary for the specific purposes of the processing and the processing reflects and complies with the principles. Methods of processing such as pseudonymisation may assist in meeting these obligations. The purpose is not to place undue burdens on the controller, however an assessment of available technology, cost, type of data and any risks (such as consequences of a data breach, potential for fraud or misuse of the data, damage to the data subject’s reputation) linked to processing must be considered when applying appropriate technical and organisational safeguards.
	Section 58 establishes the responsibilities for joint controllers. Where two or more competent authorities jointly determine the purposes and means of the processing of personal data they will be "joint controllers" for the purposes of Part 3. This provision further requires that any arrangements in relation to joint controllers must ensure there is unambiguous apportionment of the responsibilities as set out in Part 3. Controllers should determine their obligations by means of a transparent arrangement between them, for example, under the terms of a collaboration agreement between police forces in England and Wales made under section 22A of the Police Act 1996. The definition of joint controllers used here extends the concept of "controllers in common" used in the 1998 Act; this is because any agreement between joint controllers must have an unambiguous apportionment of responsibilities under the Act, and set-out which controller will be responsible for each function.
	Sections 59 and 60 provide for the use by a controller of a processor to carry out processing of personal data on behalf of the controller. In particular, a controller may only use a processor where the processor is able to guarantee to implement the technical and organisational measures necessary to ensure it is compliant with the law. It is vital that the controller is satisfied that the processor can and does implement these measures. A processor must not engage with another processor without authorisation from the controller. This means that specific permission from the controller must be sought before engaging any sub-processors or contractors.
	There is also a requirement that the processing by the processor is governed by a contract or other legal act, which is binding on the processor with regard to the controller. Section 58(5) and (6) specify a number of provisions that will ensure the lawfulness of the processing that must be included in such a contract including a duty of confidentiality.
	Overall the controller will need, if requested, to demonstrate its own processing or that done on its behalf by a processor is compliant with the requirements of this Part. Any arrangement between the controller and processor will need to reflect these requirements.
	To that end, section 61 specifies what records should be kept by controllers and processors, these records need to be made available to the Commissioner on request, and are a means of demonstrating compliance with the law. The processing of personal data in non-automated processing systems (that is, paper based filing) also needs to be appropriately monitored by controllers and processors, and there should be in place methods of demonstrating lawfulness of processing, and data security and integrity. This may be through logs or other forms of records.
	Section 62 imposes logging requirements. Such requirements were not imposed by the 1998 Act. The purpose of the requirement is to enable a controller to monitor and audit data processing internally. The purposes for which logs may be used, including self-monitoring, are set out in subsection (4). Self-monitoring includes internal disciplinary proceedings with a competent authority. The Independent Office for Police Conduct (formally the Independent Police Complaints Commission) has published guidance on the recording of police complaints and an example of a category of complaint that this may be relevant to is: category Z – Improper access and/or disclosure of information. If, for example, an officer or member of police staff was suspected of inappropriately accessing the Police National Computer to check on neighbours, family or friends, the logging should show details of when the record was accessed and, where possible, by whom, which would assist the investigation possibly leading to criminal or disciplinary action and possible dismissal.
	Many automated systems have existing logging capabilities; however, there is a requirement within the section to log erasure of personal data, as well as collection, alteration, consultation, etc. Logs of erasure should not reference the data itself – there is no need to retain a record of what was erased as that too would also be a record. Rather, the log should be able to specify that an item of data was erased on a specific date by a specific person. Article 63(2) of the LED provides for a transitional period in respect of the logging requirements for automated processing systems set up before 6 May 2016; in such cases the requirements of Article 25(1), as transposed by section 62, must apply by 6 May 2023. This is provided for in paragraph 14 of Schedule 20 to the Act.
	Section 64 places data protection impact assessments ("DPIA") on a statutory footing. The Commissioner has issued a code of practice in respect of the existing, non-statutory, Privacy Impact Assessments. The assessments should highlight and address privacy issues where a controller intends to process personal data in a way which could result in a high risk to data subject rights and freedoms. Impact assessments should cover relevant systems and processes (not individual cases) and should consider the human rights issues of processing the data. In policing, the use of Privacy Impact Assessments has increased in recent years with examples such as in the introduction of Body Worn Video and development of the Child Abuse Image Database. This provision requires DPIAs at the outset and for them to be mainstreamed into the project planning lifecycle. The content of the DPIA must include the matters specified in subsection (3).
	Where an impact assessment has indicated there is a high risk associated with the processing, section 65 requires a controller, or where appropriate a processor, to consult with the Commissioner prior to conducting that processing operation. The Commissioner may provide written advice as to how to conduct the processing or implement mitigating measures.