(3) In section 45 (law enforcement processing: right of access by the data subject), after subsection (2) insert—
“ (2A) Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection. ”
(4) In section 94 (intelligence services processing: right of access by the data subject), after subsection (2) insert—
(5) The amendments made by this section are to be treated as having come into force on 1 January 2024.
I141 S. 78 in force at Royal Assent, see s. 142(2)(b)
79 Data subjects’ rights to information: legal professional privilege exemption U.K.
(2) In section 43 (overview and scope of Chapter 3 of Part 3: rights of the data subject in connection with law enforcement processing)—
(a) in subsection (1)(a), for “section 44” substitute “sections 44 and 45A” , and
(b) in subsection (1)(b), for “section 45” substitute “sections 45 and 45A” .
(3) For the italic heading before section 44 substitute—
“ Data subject’s rights to information ” .
(4) In the heading of section 44, omit “Information:”.
(5) Omit the italic heading before section 45.
(6) After that section insert—
“ 45A Exemption from sections 44 and 45: legal professional privilege
(1) Sections 44(2) and 45(1) do not require the controller to give the data subject—
(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications could be maintained in legal proceedings, or
(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.
(2) A controller relying on the exemption in subsection (1) must inform the data subject in writing without undue delay of—
(a) the decision to rely on the exemption,
(b) the reason for the decision,
(c) the data subject’s right to make a request to the Commissioner under section 51,
(d) the data subject’s right to lodge a complaint with the Commissioner under section 165, and
(e) the data subject’s right to apply to a court under section 167.
(3) Subsection (2)(a) and (b) do not apply to the extent that complying with them would—
(a) undermine a claim described in subsection (1)(a), or