Judgment Approved by the court for handing down. R (Bridges) -v- CC South Wales & ors 102. In addition, where the processing is “sensitive processing”, it is permitted only in the two cases set out in subsections (4) and (5). Of particular relevance in the present context is subsection (5), which deals with the situation where (a) the processing is “strictly necessary” for the law enforcement purpose, (b) the processing meets at least one of the conditions in Schedule 8, and (c) at the time when the processing is carried out, the controller has an appropriate policy document in place in accordance with section 42. 103. Schedule 8, which sets out conditions for sensitive processing under Part 3, provides that the condition in paragraph 1 is met if the processing “(a) is necessary for the exercise of a function conferred on a person by an enactment or rule of law, and (b) is necessary for reasons of substantial public interest.” 104. We accept, as did the Divisional Court, that the legal protections in the DPA 2018 form an important part of the framework in determining whether the interference with the Appellant’s Article 8 rights was in accordance with the law. That Act is not, however, sufficient by itself, nor was it suggested that it is. 105. Before leaving the DPA 2018 we should mention one further matter. In the skeleton argument on behalf of the Information Commissioner it was submitted that the Divisional Court had fallen into error by putting the cart before the horse in that it had addressed the question of the requirement of law in Article 8(2) of the Convention before considering whether there had been compliance with section 35 of the DPA 2018. In particular, it was submitted that the processing of the data in the present case was not “based on law” within the meaning of section 35(2) of the DPA 2018, interpreted in accordance with the EU’s Law Enforcement Directive and the Convention, because there was no legal basis for the processing that was clear, precise and foreseeable in its application. It was also submitted that the processing was not “strictly necessary” for the law enforcement purposes as required by section 35(5)(a) of the DPA 2018. 106. Since, it was submitted, there was a breach of section 35(2), there could not be “accordance with the law” for the purpose of Article 8(2). Detailed submissions were made as to the requirements of strict necessity, citing authority from both the Court of Justice of the European Union and the Supreme Court of the UK. 107. At the hearing before us we made it clear that we did not regard these submissions as properly falling within the scope of the present appeal. The submissions were made by an intervener in the context of Ground 1 in the appeal. Ground 1 was formulated as follows on behalf of the Appellant: “The Divisional Court erred in concluding that the interference with the Appellant’s rights under Article 8(1) … occasioned by the Respondent’s use of live automated facial recognition technology … on 21 December 2017 and 27 March 2018 and on an ongoing basis was/is in accordance with the law for the purposes of Article 8(2) ECHR.” 108. It is clear therefore that the submissions advanced on behalf of the Information Commissioner, at least in writing, went beyond the scope of Ground 1 since they