(1) The first data protection principle is that the processing of personal data must be -
(a) lawful, and
(b) fair and transparent.
(2) The processing of personal data is lawful only if and to the extent that -
(a) at least one of the conditions in Schedule 9 is met, and
(b) in the case of sensitive processing, at least one of the conditions in Schedule 10 is also met.
(3) The Secretary of State may by regulations amend Schedule 10 -
(a) by adding conditions;
(b) by omitting conditions added by regulations under paragraph (a).
(4) Regulations under subsection (3) are subject to the affirmative resolution procedure.
(5) In determining whether the processing of personal data is fair and transparent, regard is to be had to the method by which it is obtained.
(6) For the purposes of subsection (5), data is to be treated as obtained fairly and transparently if it consists of information obtained from a person who -
(a) is authorised by an enactment to supply it, or
(b) is required to supply
…