(1) In relation to the processing of personal data to which the UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects) -
(a) enables a data subject to authorise a body or other organisation which meets the conditions set out in subsections (3) and (4) to exercise the data subject's rights under Articles 77, 78 and 79 of the UK GDPR (rights to lodge complaints and to an effective judicial remedy) on the data subject's behalf, and
(b) also authorises such a body or organisation to exercise the data subject's rights under Article 82 of the UK GDPR (right to compensation).
(2) In relation to the processing of personal data to which the UK GDPR does not apply, a body or other organisation which meets the conditions in subsections (3) and (4), if authorised to do so by a data subject, may exercise some or all of the following rights of a data subject on the data subject's behalf -
(a) rights under section 165(2) and (4)(d) (complaints to the Commissioner);
(b) rights
…