(b) applies to processing of personal data by a qualifying competent authority where the processing is the subject of a designation notice that is for the time being in force (see sections 82A to 82E). ” ,
(b) in subsection (1)—
(i) after “applies” insert “only” ,
(ii) in paragraph (a), for “the processing by an intelligence service” substitute “processing” , and
(iii) in paragraph (b), for “the processing by an intelligence service” substitute “processing” ,
(c) after subsection (2) insert—
“ (2A) In this Part—
“ competent authority ” has the same meaning as in Part 3;
“ qualifying competent authority ” means a competent authority specified or described in regulations made by the Secretary of State. ” , and
(d) after subsection (3) insert—
“ (4) Regulations under this section are subject to the affirmative resolution procedure. ”
(3) After section 82 insert—
“ 82A Designation of processing by a qualifying competent authority
(1) For the purposes of this Part, the Secretary of State may give a notice designating processing of personal data by a qualifying competent authority (a “designation notice”) where—
(a) an application for designation of the processing is made in accordance with this section, and
(b) the Secretary of State considers that designation of the processing is required for the purposes of safeguarding national security.
(2) The Secretary of State may only designate processing by a qualifying competent authority that is carried out by the authority as a joint controller with at least one intelligence service.
(3) The Secretary of State may not designate processing by a qualifying competent authority that consists of the transfer of personal data to—
(a) a country or territory outside the United Kingdom, or
(b) an international organisation.
(4) A designation notice must—
(a) specify or describe the processing and qualifying competent authority that are designated, and
(b) be given to the applicants for the designation (and see also section 82D).
(5) An application for designation of processing of personal data by a qualifying competent authority must be made jointly by—
(a) the qualifying competent authority, and
(b) the intelligence service with which the processing is to be carried out.