Privacy and Data Protection Act 2014

An organisation may discharge its duty to comply with an Information Privacy Principle in respect of personal information collected, held, managed, used, disclosed or transferred by it by complying with a code of practice approved under this Division and binding on the organisation.

A code of practice may—

modify the application of any one or more of the Information Privacy Principles by prescribing standards, whether or not in substitution for any Information Privacy Principle, that are at least as stringent as the standards prescribed by the Information Privacy Principle; or

prescribe how any one or more of the Information Privacy Principles are to be applied or complied with.

A code of practice may apply in relation to any one or more of the following—

any specified information or class of information;

any specified organisation or class of organisation;

any specified activity or class of activity;

any specified industry, profession or calling or class of industry, profession or calling.

A code of practice may also—

impose controls on an organisation that matches data for the purpose of producing or verifying information about an identifiable individual; or

in relation to charging—

set guidelines to be followed in determining charges; or

prescribe circumstances in which no charge may be imposed; or

prescribe—

procedures for dealing with complaints alleging a contravention of the code, including the appointment of an independent code administrator to whom complaints may be made; or

remedies available where a complaint is substantiated; or

provide for the review of the code by the Information Commissioner; or

provide for the expiry of the code.

Subsection (1) applies also to a public sector agency or a Council in seeking to discharge its duty to comply, so far as is reasonably practicable, with an Information Privacy Principle in relation to a public register as imposed by section 20(2) and this Part has effect accordingly.