Section 60 Issuing of codes of conduct

  1. The Regulator may from time to time issue codes of conduct.
  2. A code of conduct must—
    1. incorporate all the conditions for the lawful processing of personal information or set out obligations that provide a functional equivalent of all the obligations set out in those conditions; and
    2. prescribe how the conditions for the lawful processing of personal information are to be applied, or are to be complied with, given the particular features of the sector or sectors of society in which the relevant responsible parties are operating.
  3. A code of conduct may apply in relation to any one or more of the following:
    1. Any specified information or class of information;
    2. any specified body or class of bodies;
    3. any specified activity or class of activities; or
    4. any specified industry, profession, or vocation or class of industries, professions, or vocations.
  4. A code of conduct must also—
    1. specify appropriate measures—
      1. for information matching programmes if such programmes are used within a specific sector; or
      2. for protecting the legitimate interests of data subjects insofar as automated decision making, as referred to in section 71, is concerned;
    2. provide for the review of the code by the Regulator; and
    3. provide for the expiry of the code.