Some of the differences between Part 3 of the Data Protection Act 2018 (DPA 2018), which covers law enforcement processing, and the UK GDPR cause difficulties for competent authorities who process under both regimes depending on whether the processing is for a law enforcement or general purpose respectively.
	This Act makes changes to Part 3 DPA 2018 in order to reduce differences across the regimes by introducing a definition of consent that has the same meaning as in the other regimes; by conferring the ability to create codes of conduct and introducing similar exemptions for legal professional privilege and national security. All of these provisions currently exist under the UK GDPR.
	The Act also amends Part 3 DPA 2018 to remove the requirement for competent authorities 1 to inform the data subject that they have been subject to automated decision-making if certain conditions are met, including reconsideration, with meaningful human involvement, as soon as reasonably practicable. This change reflects the fact that, under certain circumstances, the current requirement could risk prejudicing an active investigation by tipping off an individual that they are of interest to the police.
	The Act also removes the requirement to record a justification in the logs of consultation and disclosure, which is resource intensive and holds limited value in maintaining accountability since it is unlikely that someone accessing the log for an improper purpose would enter an honest justification. The other safeguards, such as the requirement to record the time and date of consultation or disclosure, remain in the legislation.
	The current situation where competent authorities and the intelligence services are governed by different data protection regimes presents challenges to joint operational working. In response to the Manchester and Fishmongers’ Hall terrorist incidents and the increasing expectation that law enforcement and the intelligence services will work jointly in operational partnerships, the Act introduces a power that will allow the Secretary of State to issue a notice designating some specified competent authorities to process data jointly with the intelligence services under Part 4 DPA 2018 for national security purposes. This intends to enable these operational partnerships to respond to national security threats and protect the public, particularly where the processing of data requires complex decisions at pace.
Changes to Part 3 and Part 4 of the Data Protection Act 2018