- Y Diweddaraf sydd Ar Gael (Diwygiedig)
- Pwynt Penodol mewn Amser (23/05/2018)
- Gwreiddiol (Fel y'i Deddfwyd)
Version Superseded: 25/05/2018
Point in time view as at 23/05/2018. This version of this part contains provisions that are not valid for this point in time.
Data Protection Act 2018,
PART 1
is up to date with all changes known to be in force on or before 01 September 2024. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
Yn ddilys o 25/05/2018
1(1)Section 19AC of the Registration Service Act 1953 (codes of practice) is amended as follows.U.K.
(2)In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.
(3)In subsection (11), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.
Yn ddilys o 25/05/2018
2(1)Section 1A of the Veterinary Surgeons Act 1966 (functions of the Royal College of Veterinary Surgeons as competent authority) is amended as follows.U.K.
(2)In subsection (8)—
(a)omit “personal data protection legislation in the United Kingdom that implements”,
(b)for paragraph (a) substitute—
“(a)the GDPR; and”, and
(c)in paragraph (b), at the beginning insert “ legislation in the United Kingdom that implements ”.
(3)In subsection (9), after “section” insert “—
“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.
Yn ddilys o 25/05/2018
3U.K.In section 11AA(1) of the Parliamentary Commissioner Act 1967 (disclosure of information by Parliamentary Commissioner to Information Commissioner)—
(a)in paragraph (a), for sub-paragraph (i) substitute—
“(i)sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and
(b)for paragraph (b) substitute—
“(b)the commission of an offence under—
(i)a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or
(ii)section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”
Yn ddilys o 25/05/2018
4U.K.The Local Government Act 1974 is amended as follows.
5U.K.In section 33A(1) (disclosure of information by Local Commissioner to Information Commissioner)—
(a)in paragraph (a), for sub-paragraph (i) substitute—
“(i)sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and
(b)for paragraph (b) substitute—
“(b)the commission of an offence under—
(i)a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or
(ii)section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”
6U.K.In section 34O(1) (disclosure of information by Local Commissioner to Information Commissioner)—
(a)in paragraph (a), for sub-paragraph (i) substitute—
“(i)sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and
(b)for paragraph (b) substitute—
“(b)the commission of an offence under—
(i)a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or
(ii)section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”
Yn ddilys o 25/05/2018
7U.K.The Consumer Credit Act 1974 is amended as follows.
8U.K.In section 157(2A) (duty to disclose name etc of agency)—
(a)in paragraph (a), for “the Data Protection Act 1998” substitute “ the GDPR ”, and
(b)in paragraph (b), after “any” insert “ other ”.
9U.K.In section 159(1)(a) (correction of wrong information) for “section 7 of the Data Protection Act 1998” substitute “ Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) ”.
10U.K.In section 189(1) (definitions), at the appropriate place insert—
““the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);”.
Yn ddilys o 25/05/2018
11U.K.The Pharmacy (Northern Ireland) Order 1976 is amended as follows.
12U.K.In article 2(2) (interpretation), omit the definition of “Directive 95/46/EC”.
13U.K.In article 8D (European professional card), after paragraph (3) insert—
“(4)In Schedule 2C, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”
14U.K.In article 22A(6) (Directive 2005/36/EC: functions of competent authority etc.), before sub-paragraph (a) insert—
“(za)“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.
15(1)Schedule 2C (Directive 2005/36/EC: European professional card) is amended as follows.U.K.
(2)In paragraph 8(1) (access to data), for “Directive 95/46/EC” substitute “ the GDPR ”.
(3)In paragraph 9 (processing data), omit sub-paragraph (2) (deeming the Society to be the controller for the purposes of Directive 95/46/EC).
16(1)The table in Schedule 2D (functions of the Society under Directive 2005/36/EC) is amended as follows.U.K.
(2)In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
(3)In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
17(1)Paragraph 2 of Schedule 3 (fitness to practice: disclosure of information) is amended as follows.U.K.
(2)In sub-paragraph (2)(a), after “provision” insert “ or the GDPR ”.
(3)For sub-paragraph (3) substitute—
“(3)In determining for the purposes of sub-paragraph (2)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this paragraph.”
(4)After sub-paragraph (4) insert—
“(5)In this paragraph, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”
Yn ddilys o 25/05/2018
18(1)Schedule 2 to the Representation of the People Act 1983 (provisions which may be contained in regulations as to registration etc) is amended as follows.U.K.
(2)In paragraph 1A(5), for “the Data Protection Act 1998” substitute “ Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.
(3)In paragraph 8C(2), for “the Data Protection Act 1998” substitute “ Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.
(4)In paragraph 11A—
(a)in sub-paragraph (1) for “who are data users to supply data, or documents containing information extracted from data and” substitute “ to supply information ”, and
(b)omit sub-paragraph (2).
Yn ddilys o 25/05/2018
19U.K.The Medical Act 1983 is amended as follows.
20(1)Section 29E (evidence) is amended as follows.U.K.
(2)In subsection (5), after “enactment” insert “ or the GDPR ”.
(3)For subsection (7) substitute—
“(7)In determining for the purposes of subsection (5) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.”
(4)In subsection (9), at the end insert—
““the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”
21(1)Section 35A (General Medical Council's power to require disclosure of information) is amended as follows.U.K.
(2)In subsection (4), after “enactment” insert “ or the GDPR ”.
(3)For subsection (5A) substitute—
“(5A)In determining for the purposes of subsection (4) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.”
(4)In subsection (7), at the end insert—
““the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”
22U.K.In section 49B(7) (Directive 2005/36: designation of competent authority etc.), after “Schedule 4A” insert “—
“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.
23U.K.In section 55(1) (interpretation), omit the definition of “Directive 95/46/EC”.
24(1)Paragraph 9B of Schedule 1 (incidental powers of the General Medical Council) is amended as follows.U.K.
(2)In sub-paragraph (2)(a), after “enactment” insert “ or the GPDR ”.
(3)After sub-paragraph (3) insert—
“(4)In this paragraph, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”
25(1)Paragraph 5A of Schedule 4 (professional performance assessments and health assessments) is amended as follows.U.K.
(2)In sub-paragraph (8), after “enactment” insert “ or the GDPR ”.
(3)For sub-paragraph (8A) substitute—
“(8A)In determining for the purposes of sub-paragraph (8) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this paragraph.”
(4)After sub-paragraph (13) insert—
“(14)In this paragraph, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”
26(1)The table in Schedule 4A (functions of the General Medical Council as competent authority under Directive 2005/36) is amended as follows.U.K.
(2)In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
(3)In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
Yn ddilys o 25/05/2018
27U.K.The Dentists Act 1984 is amended as follows.
28(1)Section 33B (the General Dental Council's power to require disclosure of information: the dental profession) is amended as follows.U.K.
(2)In subsection (3), after “enactment” insert “ or relevant provision of the GDPR ”.
(3)For subsection (4) substitute—
“(4)For the purposes of subsection (3)—
“relevant enactment” means any enactment other than—
this Act, or
the listed provisions in paragraph 1 of Schedule 11 to the Data Protection Act 2018 (exemptions to Part 4 : disclosures required by law);
“relevant provision of the GDPR” means any provision of the GDPR apart from the listed GDPR provisions in paragraph 1 of Schedule 2 to the Data Protection Act 2018 (GDPR provisions to be adapted or restricted: disclosures required by law).”
(4)After subsection (10) insert—
“(11)In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”
29U.K.In section 36ZA(6) (Directive 2005/36: designation of competent authority etc), after “Schedule 4ZA—” insert—
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.
30(1)Section 36Y (the General Dental Council's power to require disclosure of information: professions complementary to dentistry) is amended as follows.U.K.
(2)In subsection (3), after “enactment” insert “ or relevant provision of the GDPR ”.
(3)For subsection (4) substitute—
“(4)For the purposes of subsection (3)—
“relevant enactment” means any enactment other than—
this Act, or
the listed provisions in paragraph 1 of Schedule 11 to the Data Protection Act 2018 (exemptions to Part 4 : disclosures required by law);
“relevant provision of the GDPR” means any provision of the GDPR apart from the listed GDPR provisions in paragraph 1 of Schedule 2 to the Data Protection Act 2018 (GDPR provisions to be adapted or restricted: disclosures required by law).”
(4)After subsection (10) insert—
“(11)In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”
31U.K.In section 53(1) (interpretation), omit the definition of “Directive 95/46/EC”.
32(1)The table in Schedule 4ZA (Directive 2005/36: functions of the General Dental Council under section 36ZA(3)) is amended as follows.U.K.
(2)In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
(3)In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
Yn ddilys o 25/05/2018
33U.K.In section 449(11) of the Companies Act 1985 (provision for security of information obtained), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
Yn ddilys o 25/05/2018
34U.K.In section 2(1) of the Access to Medical Reports Act 1988 (interpretation), for the definition of “health professional” substitute—
““health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act);”.
Yn ddilys o 25/05/2018
35(1)Section 13B of the Opticians Act 1989 (the Council's power to require disclosure of information) is amended as follows.U.K.
(2)In subsection (3), after “enactment” insert “ or the GDPR ”.
(3)For subsection (4) substitute—
“(4)In determining for the purposes of subsection (3) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.”
(4)After subsection (9) insert—
“(10)In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”
Yn ddilys o 25/05/2018
36U.K.The Access to Health Records Act 1990 is amended as follows.
37U.K.For section 2 substitute—
In this Act, “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act).”
38(1)Section 3 (right of access to health records) is amended as follows.U.K.
(2)In subsection (2), omit “Subject to subsection (4) below,”.
(3)In subsection (4), omit from “other than the following” to the end.
Yn ddilys o 25/05/2018
39(1)Section 33D of the Human Fertilisation and Embryology Act 1990 (disclosure for the purposes of medical or other research) is amended as follows.U.K.
(2)In subsection (6), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In subsection (9), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
40(1)Section 251B of the Trade Union and Labour Relations (Consolidation) Act 1992 (prohibition on disclosure of information) is amended as follows.U.K.
(2)In subsection (3), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (6) insert—
“(7)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
41U.K.In the table in Part 1 of Schedule 1 to the Tribunals and Inquiries Act 1992 (tribunals to which the Act applies), in the second column, in paragraph 14(a), for “section 6 of the Data Protection Act 1998” substitute “ section 114 of the Data Protection Act 2018 ”.
Yn ddilys o 25/05/2018
42(1)Article 90B of the Industrial Relations (Northern Ireland) Order 1992 (prohibition on disclosure of information held by the Labour Relations Agency) is amended as follows.U.K.
(2)In paragraph (3), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After paragraph (6) insert—
“(7)In this Article, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
43U.K.In section 18A(1) of the Health Service Commissioners Act 1993 (power to disclose information)—
(a)in paragraph (a), for sub-paragraph (i) substitute—
“(i)sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and
(b)for paragraph (b) substitute—
“(b)the commission of an offence under—
(i)a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or
(ii)section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”
Yn ddilys o 25/05/2018
44U.K.The Data Protection Act 1998 is repealed, with the exception of section 62 and paragraphs 13, 15, 16, 18 and 19 of Schedule 15 (which amend other enactments).
Yn ddilys o 25/05/2018
45U.K.In section 17A(4) of the Crime and Disorder Act 1998 (sharing of information), for “(within the meaning of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”.
Yn ddilys o 25/05/2018
46(1)Section 19 of the Food Standards Act 1999 (publication etc by the Food Standards Agency of advice and information) is amended as follows.U.K.
(2)In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In subsection (8), after “section” insert “—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
47(1)Section 13 of the Immigration and Asylum Act 1999 (proof of identity of persons to be removed or deported) is amended as follows.U.K.
(2)For subsection (4) substitute—
“(4)For the purposes of Article 49(1)(d) of the GDPR, the provision under this section of identification data is a transfer of personal data which is necessary for important reasons of public interest.”
(3)After subsection (4) insert—
“(4A)“The GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”
Yn ddilys o 25/05/2018
48U.K.The Financial Services and Markets Act 2000 is amended as follows.
49U.K.In section 86(9) (exempt offers to the public), for “the Data Protection Act 1998 or any directly applicable EU legislation relating to data protection” substitute “—
(a)the data protection legislation, or
(b)any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection”.
50U.K.In section 391A(6)(b) (publication: special provisions relating to the capital requirements directive), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
51U.K.In section 391C(7)(a) (publication: special provisions relating to the UCITS directive), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
52U.K.In section 391D(9)(a) (publication: special provisions relating to the markets in financial instruments directive), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
53U.K.In section 417 (definitions), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
54U.K.In section 21F(2)(d) of the Terrorism Act 2000 (other permitted disclosures between institutions etc) for “(within the meaning of section 1 of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”.
Yn ddilys o 25/05/2018
55U.K.The Freedom of Information Act 2000 is amended as follows.
Yn ddilys o 25/05/2018
56U.K.In section 2(3) (absolute exemptions), for paragraph (f) substitute—
“(f)section 40(1),
(fa)section 40(2) so far as relating to cases where the first condition referred to in that subsection is satisfied,”.
Yn ddilys o 25/05/2018
57U.K.In section 18 (the Information Commissioner), omit subsection (1).
Yn ddilys o 25/05/2018
58(1)Section 40 (personal information) is amended as follows.U.K.
(2)In subsection (2)—
(a)in paragraph (a), for “do” substitute “ does ”, and
(b)in paragraph (b), for “either the first or the second” substitute “ the first, second or third ”.
(3)For subsection (3) substitute—
“(3A)The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
(a)would contravene any of the data protection principles, or
(b)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(3B)The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).”
(4)For subsection (4) substitute—
“(4A)The third condition is that—
(a)on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or
(b)on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.”
(5)For subsection (5) substitute—
“(5A)The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).
(5B)The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies—
(a)giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—
(i)would (apart from this Act) contravene any of the data protection principles, or
(ii)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded;
(b)giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the GDPR (general processing: right to object to processing);
(c)on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a);
(d)on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.”
(6)Omit subsection (6).
(7)For subsection (7) substitute—
“(7)In this section—
“the data protection principles” means the principles set out in—
Article 5(1) of the GDPR, and
section 34(1) of the Data Protection Act 2018;
“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
“the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act).
(8)In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”
Yn ddilys o 25/05/2018
59U.K.Omit section 49 (reports to be laid before Parliament).
60U.K.For section 61 (appeal proceedings) substitute—
(1)Tribunal Procedure Rules may make provision for regulating the exercise of rights of appeal conferred by sections 57(1) and (2) and 60(1) and (4).
(2)In relation to appeals under those provisions, Tribunal Procedure Rules may make provision about—
(a)securing the production of material used for the processing of personal data, and
(b)the inspection, examination, operation and testing of equipment or material used in connection with the processing of personal data.
(3)Subsection (4) applies where—
(a)a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal on an appeal under those provisions, and
(b)if those proceedings were proceedings before a court having power to commit for contempt, the act or omission would constitute contempt of court.
(4)The First-tier Tribunal may certify the offence to the Upper Tribunal.
(5)Where an offence is certified under subsection (4), the Upper Tribunal may—
(a)inquire into the matter, and
(b)deal with the person charged with the offence in any manner in which it could deal with the person if the offence had been committed in relation to the Upper Tribunal.
(6)Before exercising the power under subsection (5)(b), the Upper Tribunal must—
(a)hear any witness who may be produced against or on behalf of the person charged with the offence, and
(b)hear any statement that may be offered in defence.
(7)In this section, “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act).”
Commencement Information
I1Sch. 19 para. 60 in force at Royal Assent for specified purposes, see s. 212(2)(f)
Yn ddilys o 25/05/2018
61U.K.In section 76(1) (disclosure of information between Commissioner and ombudsmen), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
Yn ddilys o 25/05/2018
62U.K.After section 76A insert—
(1)No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the Upper Tribunal with information necessary for the discharge of their functions in connection with appeals under section 60 of this Act.
(2)But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
(3)Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.”
Yn ddilys o 25/05/2018
63U.K.In section 77(1)(b) (offence of altering etc records with intent to prevent disclosure), omit “or section 7 of the Data Protection Act 1998,”.
Yn ddilys o 25/05/2018
64U.K.In section 84 (interpretation), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
65(1)Paragraph 28 of Schedule 19C to the Political Parties, Elections and Referendums Act 2000 (civil sanctions: disclosure of information) is amended as follows.U.K.
(2)In sub-paragraph (4)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After sub-paragraph (5) insert—
“(6)In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
66U.K.The Public Finance and Accountability (Scotland) Act 2000 is amended as follows.
67U.K.In section 26B(3)(a) (voluntary disclosure of data to Audit Scotland), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
68U.K.In section 26C(3)(a) (power to require disclosure of data), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
69U.K.In section 29(1) (interpretation), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
70U.K.The Criminal Justice and Police Act 2001 is amended as follows.
71U.K.In section 57(1) (retention of seized items)—
(a)omit paragraph (m), and
(b)after paragraph (s) insert—
“(t)paragraph 10 of Schedule 15 to the Data Protection Act 2018;”.
72U.K.In section 65(7) (meaning of “legal privilege”)—
(a)for “paragraph 1 of Schedule 9 to the Data Protection Act 1998 (c. 29)” substitute “ paragraphs 1 and 2 of Schedule 15 to the Data Protection Act 2018 ”, and
(b)for “paragraph 9” substitute “ paragraph 11 (matters exempt from inspection and seizure: privileged communications) ”.
73U.K.In Schedule 1 (powers of seizure)—
(a)omit paragraph 65, and
(b)after paragraph 73R insert—
73SThe power of seizure conferred by paragraphs 1 and 2 of Schedule 15 to the Data Protection Act 2018 (powers of entry and inspection).”
Yn ddilys o 25/05/2018
74U.K.The Anti-terrorism, Crime and Security Act 2001 is amended as follows.
75(1)Section 19 (disclosure of information held by revenue departments) is amended as follows.U.K.
(2)In subsection (7), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)In subsection (9), after “section” insert “—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Prospective
F176U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Textual Amendments
Yn ddilys o 25/05/2018
77(1)Section 7A of the Health and Personal Social Services Act (Northern Ireland) 2001 (power to obtain information etc) is amended as follows.U.K.
(2)In subsection (3), after “provision” insert “ or the GDPR ”.
(3)For subsection (5) substitute—
“(5)In determining for the purposes of subsection (3) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.”
(4)After subsection (7) insert—
“(8)In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”
Yn ddilys o 25/05/2018
78(1)Section 5A of the Justice (Northern Ireland) Act 2002 (disclosure of information to the Commission) is amended as follows.U.K.
(2)In subsection (3)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (9) insert—
“(10)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
79U.K.The Proceeds of Crime Act 2002 is amended as follows.
80U.K.In section 333C(2)(d) (other permitted disclosures between institutions etc), for “(within the meaning of section 1 of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”.
81U.K.In section 436(3)(a) (disclosure of information to certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
82U.K.In section 438(8)(a) (disclosure of information by certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
83U.K.In section 439(3)(a) (disclosure of information to Lord Advocate and to Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
84U.K.In section 441(7)(a) (disclosure of information by Lord Advocate and Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
85U.K.After section 442 insert—
In this Part, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
86(1)Section 237 of the Enterprise Act 2002 (general restriction on disclosure) is amended as follows.U.K.
(2)In subsection (4), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (6) insert—
“(7)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
87(1)In Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (disclosure of information by the Ombudsman), the entry for the Information Commissioner is amended as follows.U.K.
(2)In paragraph 1, for sub-paragraph (a) substitute—
“(a)sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”.
(3)For paragraph 2 substitute—
“2The commission of an offence under—
(a)a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or
(b)section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”
Yn ddilys o 25/05/2018
88U.K.The Freedom of Information (Scotland) Act 2002 is amended as follows.
89U.K.In section 2(2)(e)(ii) (absolute exemptions), omit “by virtue of subsection (2)(a)(i) or (b) of that section”.
90(1)Section 38 (personal information) is amended as follows.U.K.
(2)In subsection (1), for paragraph (b) substitute—
“(b)personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A));”.
(3)For subsection (2) substitute—
“(2A)The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—
(a)would contravene any of the data protection principles, or
(b)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(2B)The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).”
(4)For subsection (3) substitute—
“(3A)The third condition is that—
(a)on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or
(b)on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.”
(5)Omit subsection (4).
(6)In subsection (5), for the definitions of “the data protection principles” and of “data subject” and “personal data” substitute—
““the data protection principles” means the principles set out in—
(a)Article 5(1) of the GDPR, and
(b)section 34(1) of the Data Protection Act 2018;
“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
“the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act);”.
(7)After that subsection insert—
“(5A)In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”
Yn ddilys o 25/05/2018
91U.K.Schedule 5 to the Courts Act 2003 (collection of fines) is amended as follows.
92(1)Paragraph 9C (disclosure of information in connection with making of attachment of earnings orders or applications for benefit deductions: supplementary) is amended as follows.U.K.
(2)In sub-paragraph (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After sub-paragraph (5) insert—
“(6)In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
93(1)Paragraph 10A (attachment of earnings orders (Justice Act (Northern Ireland) 2016): disclosure of information) is amended as follows.U.K.
(2)In sub-paragraph (7), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In sub-paragraph (8), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
94(1)Section 94 of the Sexual Offences Act 2003 (Part 2: supply of information to the Secretary of State etc for verification) is amended as follows.U.K.
(2)In subsection (6), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)In subsection (8), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
95U.K.The Criminal Justice Act 2003 is amended as follows.
96U.K.In section 327A(9) (disclosure of information about convictions etc of child sex offenders to members of the public), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
97U.K.In section 327B (disclosure of information about convictions etc of child sex offenders to members of the public: interpretation), after subsection (4) insert—
“(4A)“The data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
98(1)Section 279 of the Mental Health (Care and Treatment) (Scotland) Act 2003 (information for research) is amended as follows.U.K.
(2)In subsection (2), for “research purposes within the meaning given by section 33 of the Data Protection Act 1998 (c. 29) (research, history and statistics)” substitute “ purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics) ”.
(3)After subsection (9) insert—
“(10)In this section, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”
Yn ddilys o 25/05/2018
99(1)Section 64C of the Public Audit (Wales) Act 2004 (voluntary provision of data) is amended as follows.U.K.
(2)In subsection (3)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)In subsection (5), at the beginning insert “In this section—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
100U.K.The Companies (Audit, Investigations and Community Enterprise) Act 2004 is amended as follows.
101(1)Section 15A (disclosure of information by tax authorities) is amended as follows.U.K.
(2)In subsection (2)—
(a)omit “within the meaning of the Data Protection Act 1998”, and
(b)for “that Act” substitute “ the data protection legislation ”.
(3)After subsection (7) insert—
“(8)In this section—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
“personal data” has the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).”
102(1)Section 15D (permitted disclosure of information obtained under compulsory powers) is amended as follows.U.K.
(2)In subsection (7), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (7) insert—
“(8)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
103(1)Section 54 of the Domestic Violence, Crime and Victims Act 2004 (disclosure of information) is amended as follows.U.K.
(2)In subsection (7), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (8) insert—
“(9)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
104U.K.The Children Act 2004 is amended as follows.
105(1)Section 12 (information databases) is amended as follows.U.K.
(2)In subsection (13)(e) for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (13) insert—
“(14)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
106(1)Section 29 (information databases: Wales) is amended as follows.U.K.
(2)In subsection (14)(e) for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (14) insert—
“(15)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
107(1)Section 107 of the Constitutional Reform Act 2005 (disclosure of information to the Commission) is amended as follows.U.K.
(2)In subsection (3)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (9) insert—
“(10)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
108U.K.In section 64 of the Mental Capacity Act 2005 (interpretation), for the definition of “health record” substitute—
““health record” has the same meaning as in the Data Protection Act 2018 (see section 205 of that Act);”.
Yn ddilys o 25/05/2018
109(1)Section 34X of the Public Services Ombudsman (Wales) Act 2005 (disclosure of information) is amended as follows.U.K.
(2)In subsection (4), for paragraph (a) substitute—
“(a)sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement);”.
(3)For subsection (5) substitute—
“(5)The offences are those under—
(a)a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc);
(b)section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”
Yn ddilys o 25/05/2018
110(1)Section 22 of the Commissioners for Revenue and Customs Act 2005 (data protection, etc) is amended as follows.U.K.
(2)The existing text becomes subsection (1).
(3)In that subsection, in paragraph (a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(4)After that subsection insert—
“(2)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
111(1)Section 352 of the Gambling Act 2005 (data protection) is amended as follows.U.K.
(2)The existing text becomes subsection (1).
(3)In that subsection, for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(4)After that subsection insert—
“(2)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
112(1)Section 18 of the Commissioner for Older People (Wales) Act 2006 (power to disclose information) is amended as follows.U.K.
(2)In subsection (7), for paragraph (a) substitute—
“(a)sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement);”.
(3)For subsection (8) substitute—
“(8)The offences are those under—
(a)a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc); or
(b)section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”
Yn ddilys o 25/05/2018
113U.K.The National Health Service Act 2006 is amended as follows.
114(1)Section 251 (control of patient information) is amended as follows.U.K.
(2)In subsection (7), for “made by or under the Data Protection Act 1998 (c 29)” substitute “ of the data protection legislation ”.
(3)In subsection (13), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
115(1)Section 264C (provision and disclosure of information about health service products: supplementary) is amended as follows.U.K.
(2)In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (3) insert—
“(4)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
116U.K.In paragraph 7B(3) of Schedule 1 (further provision about the Secretary of State and services under the Act), for “has the same meaning as in the Data Protection Act 1998” substitute “ has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.
Yn ddilys o 25/05/2018
117U.K.The National Health Service (Wales) Act 2006 is amended as follows.
118(1)Section 201C (provision of information about medical supplies: supplementary) is amended as follows.U.K.
(2)In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (3) insert—
“(4)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
119U.K.In paragraph 7B(3) of Schedule 1 (further provision about the Welsh Ministers and services under the Act), for “has the same meaning as in the Data Protection Act 1998” substitute “ has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.
Yn ddilys o 25/05/2018
120U.K.The Companies Act 2006 is amended as follows.
121U.K.In section 458(2) (disclosure of information by tax authorities)—
(a)for “within the meaning of the Data Protection Act 1998 (c. 29)” substitute “ within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act) ”, and
(b)for “that Act” substitute “ the data protection legislation ”.
122U.K.In section 461(7) (permitted disclosure of information obtained under compulsory powers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
123U.K.In section 948(9) (restrictions on disclosure) for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
124U.K.In section 1173(1) (minor definitions: general), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
125U.K.In section 1224A(7) (restrictions on disclosure), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
126U.K.In section 1253D(3) (restriction on transfer of audit working papers to third countries), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
127U.K.In section 1261(1) (minor definitions: Part 42), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
128U.K.In section 1262 (index of defined expressions: Part 42), at the appropriate place insert—
“the data protection legislation | section 1261(1)”. |
129U.K.In Schedule 8 (index of defined expressions: general), at the appropriate place insert—
“the data protection legislation | section 1173(1)”. |
Yn ddilys o 25/05/2018
130U.K.The Tribunals, Courts and Enforcement Act 2007 is amended as follows.
131U.K.In section 11(5)(b) (right to appeal to Upper Tribunal), for “section 28(4) or (6) of the Data Protection Act 1998 (c. 29)” substitute “ section 27(3) or (5), 79(5) or (7) or 111(3) or (5) of the Data Protection Act 2018 ”.
132U.K.In section 13(8)(a) (right to appeal to the Court of Appeal), for “section 28(4) or (6) of the Data Protection Act 1998 (c. 29)” substitute “ section 27(3) or (5), 79(5) or (7) or 111(3) or (5) of the Data Protection Act 2018 ”.
Yn ddilys o 25/05/2018
133U.K.The Statistics and Registration Service Act 2007 is amended as follows.
134(1)Section 45 (information held by HMRC) is amended as follows.U.K.
(2)In subsection (4A), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.
(3)In subsection (4B), for “the Data Protection Act 1998” substitute “ the Data Protection Act 2018 ”.
135(1)Section 45A (information held by other public authorities) is amended as follows.U.K.
(2)In subsection (8), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.
(3)In subsection (9), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(4)In subsection (12)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(5)In subsection 12(c), after the first “legislation” insert “ (which is not part of the data protection legislation) ”.
136(1)Section 45B(3) (access to information held by Crown bodies etc) is amended as follows.U.K.
(2)In paragraph (a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In paragraph (c), after the first “legislation” insert “ (which is not part of the data protection legislation) ”.
137(1)Section 45C(13) (power to require disclosures by other public authorities) is amended as follows.U.K.
(2)In paragraph (b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In paragraph (d), after the first “legislation” insert “ (which is not part of the data protection legislation) ”.
138U.K.In section 45D(9)(b) (power to require disclosure by undertakings), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
139(1)Section 45E (further provision about powers in sections 45B, 45C and 45D) is amended as follows.U.K.
(2)In subsection (6), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.
(3)In subsection (16), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.
(4)In subsection (17), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
140(1)Section 53A (disclosure by the Statistics Board to devolved administrations) is amended as follows.U.K.
(2)In subsection (9), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.
(3)In subsection (10), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(4)In subsection (12)(b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
141(1)Section 54 (Data Protection Act 1998 and Human Rights Act 1998) is amended as follows.U.K.
(2)In the heading, omit “Data Protection Act 1998 and”.
(3)Omit paragraph (a) (together with the final “or”).
142U.K.In section 67 (general interpretation: Part 1), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
143U.K.The Serious Crime Act 2007 is amended as follows.
144(1)Section 5A (verification and disclosure of information) is amended as follows.U.K.
(2)In subsection (6)—
(a)for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and
(b)for “are” substitute “ is ”.
(3)After subsection (6) insert—
“(7)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
145(1)Section 68 (disclosure of information to prevent fraud) is amended as follows.U.K.
(2)In subsection (4)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)In subsection (8), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
146(1)Section 85 (disclosure of information by Revenue and Customs) is amended as follows.U.K.
(2)In subsection (8)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)In subsection (9), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
147(1)Section 169 of the Legal Services Act 2007 (disclosure of information to the Legal Services Board) is amended as follows.U.K.
(2)In subsection (3)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (8) insert—
“(9)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
148U.K.In section 74 of the Adoption and Children (Scotland) Act 2007 (disclosure of medical information about parents), for subsection (5) substitute—
“(5)In subsection (4)(e), “processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act).”
Yn ddilys o 25/05/2018
149U.K.The Criminal Justice and Immigration Act 2008 is amended as follows.
150U.K.Omit—
(a)section 77 (power to alter penalty for unlawfully obtaining etc personal data), and
(b)section 78 (new defence for obtaining etc for journalism and other special purposes).
151(1)Section 114 (supply of information to Secretary of State etc) is amended as follows.U.K.
(2)In subsection (5), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (6) insert—
“(6A)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
152(1)Section 70 of the Regulatory Enforcement and Sanctions Act 2008 (disclosure of information) is amended as follows.U.K.
(2)In subsection (4)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (5) insert—
“(6)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
153U.K.In section 20A(5) of the Health and Social Care Act 2008 (functions relating to processing of information by registered persons), in the definition of “processing”, for “the Data Protection Act 1998” substitute “ Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act); ”.
Yn ddilys o 25/05/2018
154(1)Section 20 of the Counter-Terrorism Act 2008 (disclosure and the intelligence services: supplementary provisions) is amended as follows.U.K.
(2)In subsection (2)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (4) insert—
“(5)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
155(1)Section 117 of the Public Health etc. (Scotland) Act 2008 (disclosure of information) is amended as follows.U.K.
(2)In subsection (6), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (7) insert—
“(7A)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
156(1)Section 83ZY of the Banking Act 2009 (special resolution regime: publication of notices etc) is amended as follows.U.K.
(2)In subsection (10), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In subsection (11), after “section” insert “—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
157(1)Section 19 of the Borders, Citizenship and Immigration Act 2009 (use and disclosure of customs information: application of statutory provisions) is amended as follows.U.K.
(2)In subsection (1)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (4) insert—
“(5)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
158U.K.The Marine and Coastal Access Act 2009 is amended as follows.
159(1)Paragraph 13 of Schedule 7 (further provision about civil sanctions under Part 4: disclosure of information) is amended as follows.U.K.
(2)In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After sub-paragraph (6) insert—
“(7)In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
160(1)Paragraph 9 of Schedule 10 (further provision about fixed monetary penalties: disclosure of information) is amended as follows.U.K.
(2)In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After sub-paragraph (6) insert—
“(7)In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
161U.K.In Schedule 21 to the Coroners and Justice Act 2009 (minor and consequential amendments), omit paragraph 29(3).
Yn ddilys o 25/05/2018
162(1)Section 38 of the Broads Authority Act 2009 (provision of information) is amended as follows.U.K.
(2)In subsection (3), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)In subsection (6), after “section” insert “—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
163(1)Section 13 of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (functions of the Regional Agency) is amended as follows.U.K.
(2)In subsection (8), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (8) insert—
“(9)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
164(1)Section 25 of the Terrorist Asset-Freezing etc. Act 2010 (application of provisions) is amended as follows.U.K.
(2)In subsection (2)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In subsection (6), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
165(1)Paragraph 12 of Schedule 2 to the Marine (Scotland) Act 2010 (further provision about civil sanctions under Part 4: disclosure of information) is amended as follows.U.K.
(2)In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After sub-paragraph (6) insert—
“(7)In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
166(1)Section 59 of the Charities Act 2011 (disclosure: supplementary) is amended as follows.U.K.
(2)The existing text becomes subsection (1).
(3)In that subsection, in paragraph (a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(4)After that subsection insert—
“(2)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
167U.K.The Welsh Language (Wales) Measure 2011 is amended as follows.
168(1)Section 22 (power to disclose information) is amended as follows.U.K.
(2)In subsection (4)—
(a)in the English language text, for paragraph (a) substitute—
“(a)sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement);”, and
(b)in the Welsh language text, for paragraph (a) substitute—
“(a)adrannau 142 i 154, 160 i 164, neu 174 i 176 o Ddeddf Diogelu Data 2018 neu Atodlen 15 i'r Ddeddf honno (darpariaethau penodol yn ymwneud â gorfodi);”.
(3)For subsection (5)—
(a)in the English language text substitute—
“(5)The offences referred to under subsection (3)(b) are those under—
(a)a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of exercise of warrant etc); or
(b)section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”, and
(b)in the Welsh language text substitute—
“(5)Y tramgwyddau y cyfeirir atynt yn is-adran (3)(b) yw'r rhai—
(a)o dan ddarpariaeth yn Neddf Diogelu Data 2018 ac eithrio paragraff 15 o Atodlen 15 (rhwystro gweithredu gwarant etc); neu
(b)o dan adran 77 o Ddeddf Rhyddid Gwybodaeth 2000 (trosedd o altro etc cofnodion gyda'r bwriad o atal datgelu).”
(4)In subsection (8)—
(a)in the English language text, for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and
(b)in the Welsh language text, for “gymhwyso Deddf Diogelu Data 1998” substitute “gymhwyso'r ddeddfwriaeth diogelu data”.
(5)In subsection (9)—
(a)at the appropriate place in the English language text insert—
““the data protection legislation” (“y ddeddfwriaeth diogelu data”) has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”, and
(b)at the appropriate place in the Welsh language text insert—
““mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno);”.
169(1)Paragraph 8 of Schedule 2 (inquiries by the Commissioner: reports) is amended as follows.U.K.
(2)In sub-paragraph (7)—
(a)in the English language text, for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and
(b)in the Welsh language text, for “gymhwyso Deddf Diogelu Data 1998” substitute “gymhwyso'r ddeddfwriaeth diogelu data”.
(3)In sub-paragraph (8)—
(a)in the English language text, after “this paragraph” insert “—
“the data protection legislation” (“y ddeddfwriaeth diogelu data”) has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”, and
(b)in the Welsh language text, after “hwn” insert—
““mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno);”.
Yn ddilys o 25/05/2018
170(1)Section 10 of the Safeguarding Board Act (Northern Ireland) 2011 (duty to co-operate) is amended as follows.U.K.
(2)In subsection (3), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.
(3)After subsection (3) insert—
“(4)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
171U.K.The Health and Social Care Act 2012 is amended as follows.
172U.K.In section 250(7) (power to publish information standards), for the definition of “processing” substitute—
““processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);”.
173(1)Section 251A (consistent identifiers) is amended as follows.U.K.
(2)In subsection (7)(a), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.
(3)After subsection (8) insert—
“(9)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
174(1)Section 251B (duty to share information) is amended as follows.U.K.
(2)In subsection (5)(a), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.
(3)After subsection (6) insert—
“(7)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
175U.K.The Protection of Freedoms Act 2012 is amended as follows.
176(1)Section 27 (exceptions and further provision about consent and notification) is amended as follows.U.K.
(2)In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (5) insert—
“(6)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
177U.K.In section 28(1) (interpretation: Chapter 2), for the definition of “processing” substitute—
““processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);”.
178U.K.In section 29(7) (code of practice for surveillance camera systems), for the definition of “processing” substitute—
““processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);”.
Yn ddilys o 25/05/2018
179(1)Section 14A of the HGV Road User Levy Act 2013 (disclosure of information by Revenue and Customs) is amended as follows.U.K.
(2)In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (5) insert—
“(6)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
180U.K.The Crime and Courts Act 2013 is amended as follows.
181(1)Section 42 (other interpretive provisions) is amended as follows.U.K.
(2)In subsection (5)(a), for “section 13 of the Data Protection Act 1998 (damage or distress suffered as a result of a contravention of a requirement of that Act)” substitute “ Article 82 of the GDPR or section 168 or 169 of the Data Protection Act 2018 (compensation for contravention of the data protection legislation) ”.
(3)After subsection (5) insert—
“(5A)In subsection (5)(a), “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”
182(1)Paragraph 1 of Schedule 7 (statutory restrictions on disclosure) is amended as follows.U.K.
(2)The existing text becomes sub-paragraph (1).
(3)In that sub-paragraph, in paragraph (a)—
(a)for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and
(b)for “are” substitute “ is ”.
(4)After that sub-paragraph, insert—
“(2)In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
183(1)Paragraph 8 of Schedule 2 to the Marine Act (Northern Ireland) 2013 (further provision about fixed monetary penalties under section 35: disclosure of information) is amended as follows.U.K.
(2)In sub-paragraph (5)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After sub-paragraph (6) insert—
“(7)In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
184(1)Paragraph 3 of Schedule 9 to the Local Audit and Accountability Act 2014 (data matching: voluntary provision of data) is amended as follows.U.K.
(2)In sub-paragraph (3)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After sub-paragraph (3) insert—
“(3A)“The data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
(4)In sub-paragraph (4), for “comprise or include” substitute “ comprises or includes ”.
Yn ddilys o 25/05/2018
185(1)Paragraph 7 of Schedule 4 to the Anti-social Behaviour, Crime and Policing Act 2014 (anti-social behaviour case reviews: information) is amended as follows.U.K.
(2)In sub-paragraph (4)—
(a)for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and
(b)for “are” substitute “ is ”.
(3)After sub-paragraph (5) insert—
“(6)In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
186(1)Paragraph 6 of Schedule 6 to the Immigration Act 2014 (information: limitation on powers) is amended as follows.U.K.
(2)The existing text becomes sub-paragraph (1).
(3)In that sub-paragraph, in paragraph (a)—
(a)for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and
(b)for “are” substitute “ is ”.
(4)After that sub-paragraph insert—
“(2)In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
187U.K.In section 67(9) of the Care Act 2014 (involvement in assessment, plans etc), for paragraph (a) substitute—
“(a)a health record (within the meaning given in section 205 of the Data Protection Act 2018),”.
Yn ddilys o 25/05/2018
188U.K.In section 18(10)(b) of the Social Services and Well-being (Wales) Act 2014 (registers of sight-impaired, hearing-impaired and other disabled people)—
(a)in the English language text, for “(within the meaning of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”, and
(b)in the Welsh language text, for “(o fewn ystyr “personal data” yn Neddf Diogelu Data 1998)” substitute “(o fewn ystyr “ personal data ” yn Rhan 5 i 7 o Ddeddf Diogelu Data 2018 (gweler adran 3(2) a (14) o'r Ddeddf honno))”.
Yn ddilys o 25/05/2018
189(1)Section 38 of the Counter-Terrorism and Security Act 2015 (support etc for people vulnerable to being drawn into terrorism: co-operation) is amended as follows.U.K.
(2)In subsection (4)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (4) insert—
“(4A)“The data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
190(1)Section 6 of the Small Business, Enterprise and Employment Act 2015 (application of listed provisions to designated credit reference agencies) is amended as follows.U.K.
(2)In subsection (7)—
(a)for paragraph (b) substitute—
“(b)Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers);”, and
(b)omit paragraph (c).
(3)After subsection (7) insert—
“(7A)In subsection (7) “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”
Yn ddilys o 25/05/2018
191(1)Section 54A of the Modern Slavery Act 2015 (Gangmasters and Labour Abuse Authority: information gateways) is amended as follows.U.K.
(2)In subsection (5)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In subsection (9), after “section” insert “—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
192U.K.The Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 is amended as follows.
193U.K.In section 13(5) (duty to notify National Crime Agency about suspected victims of certain offences) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
194U.K.In section 25(1) (interpretation of this Act), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
195U.K.In paragraph 18(5) of Schedule 3 (supply of information to relevant Northern Ireland departments, Secretary of State, etc) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
Yn ddilys o 25/05/2018
196(1)Section 72 of the Justice Act (Northern Ireland) 2015 (supply of information to relevant Northern Ireland departments or Secretary of State) is amended as follows.U.K.
(2)In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In subsection (7), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
197(1)Section 7 of the Immigration Act 2016 (information gateways: supplementary) is amended as follows.U.K.
(2)In subsection (2)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In subsection (11), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
Yn ddilys o 25/05/2018
198U.K.The Investigatory Powers Act 2016 is amended as follows.
199U.K.In section 1(5)(b), for sub-paragraph (ii) substitute—
“(ii)in section 170 of the Data Protection Act 2018 (unlawful obtaining etc of personal data),”.
200U.K.In section 199 (bulk personal datasets: interpretation), for subsection (2) substitute—
“(2)In this Part, “personal data” means—
(a)personal data within the meaning of section 3(2) of the Data Protection Act 2018 which is subject to processing described in section 82(1) of that Act, and
(b)data relating to a deceased individual where the data would fall within paragraph (a) if it related to a living individual.”
Prospective
F2201U.K.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Textual Amendments
202U.K.In section 206 (additional safeguards for health records), for subsection (7) substitute—
“(7)In subsection (6)—
“health professional” has the same meaning as in the Data Protection Act 2018 (see section 204(1) of that Act);
“health service body” has meaning given by section 204(4) of that Act.”
203(1)Section 237 (information gateway) is amended as follows.U.K.
(2)In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (2) insert—
“(3)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
204(1)Section 49 of the Police Services Ombudsman Act (Northern Ireland) 2016 (disclosure of information) is amended as follows.U.K.
(2)In subsection (4), for paragraph (a) substitute—
“(a)sections 142 to 154, 160 to 164 and 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”.
(3)For subsection (5) substitute—
“(5)The offences are those under—
(a)any provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (powers of entry and inspection: offences),
(b)section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”
(4)After subsection (6) insert—
“(7)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
205(1)Section 1 of the Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (control of information of a relevant person) is amended as follows.U.K.
(2)In subsection (8), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.
(3)After subsection (12) insert—
“(12A)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
206U.K.In section 306(1) of the Mental Capacity Act (Northern Ireland) 2016 (definitions for purposes of Act), for the definition of “health record” substitute—
““health record” has the meaning given by section 205 of the Data Protection Act 2018;”.
Yn ddilys o 25/05/2018
207U.K.The Justice Act (Northern Ireland) 2016 is amended as follows.
208(1)Section 17 (disclosure of information) is amended as follows.U.K.
(2)In subsection (7), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In subsection (8), after “section” insert “—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
209U.K.In section 44(3) (disclosure of information)—
(a)in paragraph (a), for “Part 5 of the Data Protection Act 1998” substitute “ sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 ”, and
(b)for paragraph (b) substitute—
“(b)the commission of an offence under—
(i)a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc); or
(ii)section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”
Yn ddilys o 25/05/2018
210(1)Section 50 of the Policing and Crime Act 2017 (Freedom of Information Act etc: Police Federation for England and Wales) is amended as follows.U.K.
(2)The existing text becomes subsection (1).
(3)In that subsection, in paragraph (b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(4)After that subsection, insert—
“(2)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 02/12/2019
211U.K.In Schedule 5 to the Children and Social Work Act 2017—
(a)in Part 1 (general amendments to do with social workers etc in England), omit paragraph 6, and
(b)in Part 2 (renaming of Health and Social Work Professions Order 2001), omit paragraph 47(g).
Yn ddilys o 25/05/2018
212U.K.The Higher Education and Research Act 2017 is amended as follows.
213(1)Section 63 (cooperation and information sharing by the Office for Students) is amended as follows.U.K.
(2)In subsection (6), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)In subsection (7), at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.
214(1)Section 112 (cooperation and information sharing between the Office for Students and UKRI) is amended as follows.U.K.
(2)In subsection (6), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (6) insert —
“(7)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Yn ddilys o 25/05/2018
215U.K.The Digital Economy Act 2017 is amended as follows.
216(1)Section 40 (further provisions about disclosures under sections 35 to 39) is amended as follows.U.K.
(2)In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (10) insert—
“(11)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
217(1)Section 43 (codes of practice) is amended as follows.U.K.
(2)In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.
(3)In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.
218(1)Section 49 (further provision about disclosures under section 48) is amended as follows.U.K.
(2)In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (10) insert—
“(11)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
219(1)Section 52 (code of practice) is amended as follows.U.K.
(2)In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.
(3)In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.
220(1)Section 57 (further provision about disclosures under section 56) is amended as follows.U.K.
(2)In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (10) insert—
“(11)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
221(1)Section 60 (code of practice) is amended as follows.U.K.
(2)In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.
(3)In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.
222(1)Section 65 (supplementary provision about disclosures under section 64) is amended as follows.U.K.
(2)In subsection (2)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After subsection (8) insert—
“(9)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
223(1)Section 70 (code of practice) is amended as follows.U.K.
(2)In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.
(3)In subsection (15), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.
224U.K.Omit sections 108 to 110 (charges payable to the Information Commissioner).
Yn ddilys o 25/05/2018
225(1)Section 60 of the Landfill Disposals Tax (Wales) Act 2017 (disclosure of information to the Welsh Revenue Authority) is amended as follows.U.K.
(2)In subsection (4)(a)—
(a)in the English language text, for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”, and
(b)in the Welsh language text, for “torri Deddf Diogelu Data 1998 (p. 29)” substitute “torri'r ddeddfwriaeth diogelu data”.
(3)After subsection (7)—
(a)in the English language text insert—
“(8)In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”, and
(b)in the Welsh language text insert—
“(8)Yn yr adran hon, mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno).”
Yn ddilys o 25/05/2018
226(1)Section 4 of the Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (additional learning needs code) is amended as follows.U.K.
(2)In the English language text—
(a)in subsection (9), omit from “and in this subsection” to the end, and
(b)after subsection (9) insert—
“(9A)In subsection (9)—
“data subject” (“testun y data”) has the meaning given by section 3(5) of the Data Protection Act 2018;
“personal data” (“data personol”) has the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).”
(3)In the Welsh language text—
(a)in subsection (9), omit from “ac yn yr is-adran hon” to the end, and
(b)after subsection (9) insert—
“(9A)Yn is-adran (9)—
mae i “data personol” yr un ystyr ag a roddir i “personal data” yn Rhannau 5 i 7 o Ddeddf Diogelu Data 2018 (gweler adran 3(2) a (14) o'r Ddeddf honno);
mae i “testun y data” yr ystyr a roddir i “data subject” gan adran 3(5) o'r Ddeddf honno.”
Yn ddilys o 02/12/2019
227(1)Section 204 of this Act (meaning of “health professional” and “social work professional”) is amended as follows (to reflect the arrangements for the registration of social workers in England under Part 2 of the Children and Social Work Act 2017).U.K.
(2)In subsection (1)(g)—
(a)omit “and Social Work”, and
(b)omit “, other than the social work profession in England”.
(3)In subsection (2), for paragraph (a) substitute—
“(a)a person registered as a social worker in the register maintained by Social Work England under section 39(1) of the Children and Social Work Act 2017;”.
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
The Whole Schedule you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Schedule you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
This Part only you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
This Part only you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
Y Ddeddf Gyfan you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
Y Ddeddf Gyfan heb Atodlenni you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
Y Rhestrau you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
Y Diweddaraf sydd Ar Gael (diwygiedig):Y fersiwn ddiweddaraf sydd ar gael o’r ddeddfwriaeth yn cynnwys newidiadau a wnaed gan ddeddfwriaeth ddilynol ac wedi eu gweithredu gan ein tîm golygyddol. Gellir gweld y newidiadau nad ydym wedi eu gweithredu i’r testun eto yn yr ardal ‘Newidiadau i Ddeddfwriaeth’.
Gwreiddiol (Fel y’i Deddfwyd neu y’i Gwnaed): Mae'r wreiddiol fersiwn y ddeddfwriaeth fel ag yr oedd pan gafodd ei deddfu neu eu gwneud. Ni wnaed unrhyw newidiadau i’r testun.
Pwynt Penodol mewn Amser: This becomes available after navigating to view revised legislation as it stood at a certain point in time via Advanced Features > Show Timeline of Changes or via a point in time advanced search.
Rhychwant ddaearyddol: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.
Dangos Llinell Amser Newidiadau: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.
Testun a grëwyd gan yr adran o’r llywodraeth oedd yn gyfrifol am destun y Ddeddf i esbonio beth mae’r Ddeddf yn ceisio ei wneud ac i wneud y Ddeddf yn hygyrch i ddarllenwyr nad oes ganddynt gymhwyster cyfreithiol. Cyflwynwyd Nodiadau Esboniadol ym 1999 ac maent yn cyd-fynd â phob Deddf Gyhoeddus ac eithrio Deddfau Adfeddiannu, Cronfa Gyfunol, Cyllid a Chyfnerthiad.
Gallwch wneud defnydd o ddogfennau atodol hanfodol a gwybodaeth ar gyfer yr eitem ddeddfwriaeth o’r tab hwn. Yn ddibynnol ar yr eitem ddeddfwriaeth sydd i’w gweld, gallai hyn gynnwys:
This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.
Defnyddiwch y ddewislen hon i agor dogfennau hanfodol sy’n cyd-fynd â’r ddeddfwriaeth a gwybodaeth am yr eitem hon o ddeddfwriaeth. Gan ddibynnu ar yr eitem o ddeddfwriaeth sy’n cael ei gweld gall hyn gynnwys:
liciwch ‘Gweld Mwy’ neu ddewis ‘Rhagor o Adnoddau’ am wybodaeth ychwanegol gan gynnwys