Data Protection Act 2018

24 Manual unstructured data held by FOI public authorities U.K.

(1) The provisions of [F1 the UK GDPR] and this Act listed in subsection (2) do not apply to personal data to which [F2 the UK GDPR] applies by virtue of [F3 Article 2(1A)] (manual unstructured personal data held by FOI public authorities).

(2) Those provisions are—

(a) in Chapter II of [F4 the UK GDPR] (principles)—

(i) Article 5(1)(a) to (c), (e) and (f) (principles relating to processing, other than the accuracy principle),

(ii) Article 6 (lawfulness),

(iii) Article 7 (conditions for consent),

(iv) Article 8(1) and (2) (child's consent),

(v) Article 9 (processing of special categories of personal data),

(vi) Article 10 (data relating to criminal convictions etc), and

(vii) Article 11(2) (processing not requiring identification);

(b) in Chapter III of [F5 the UK GDPR] (rights of the data subject)—

(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided),

(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),

(iii) Article 20 (right to data portability), and

(iv) Article 21(1) (objections to processing);

(c) in Chapter V of [F6 the UK GDPR], Articles 44 to 49 (transfers of personal data to third countries or international organisations);

[F7 (ca) in Part 2 of this Act, sections 17A, 17B and 17C (transfers to third countries);

(cb) in Part 5 of this Act, section 119A (standard clauses for transfers to third countries);]

[F8 (d) in Part 7 of this Act, sections 170 and 171 (offences relating to personal data).]

(see also paragraph 1(2) of Schedule 18).

(3) In addition, the provisions of [F9 the UK GDPR] listed in subsection (4) do not apply to personal data to which [F10 the UK GDPR] applies by virtue of [F11 Article 2(1A)] where the personal data relates to appointments, removals, pay, discipline, superannuation or other personnel matters in relation to—

(a) service in any of the armed forces of the Crown;

(b) service in any office or employment under the Crown or under any public authority;

(c) service in any office or employment, or under any contract for services, in respect of which power to take action, or to determine or approve the action taken, in such matters is vested in—

(i) Her Majesty,

(ii) a Minister of the Crown,

(iii) the National Assembly for Wales,

(iv) the Welsh Ministers,

(v) a Northern Ireland Minister (within the meaning of the Freedom of Information Act 2000), or

(vi) an FOI public authority.

(4) Those provisions are—

(a) the remaining provisions of Chapters II and III (principles and rights of the data subject);

(b) Chapter IV (controller and processor);

(c) Chapter IX (specific processing situations).

(5) A controller is not obliged to comply with Article 15(1) to (3) of [F12 the UK GDPR] (right of access by the data subject) in relation to personal data to which [F13 the UK GDPR] applies by virtue of [F14 Article 2(1A)] if—

(a) the request under [F15 Article 15] does not contain a description of the personal data, or

(b) the controller estimates that the cost of complying with the request so far as relating to the personal data would exceed the appropriate maximum.

(6) Subsection (5)(b) does not remove the controller's obligation to confirm whether or not personal data concerning the data subject is being processed unless the estimated cost of complying with that obligation alone in relation to the personal data would exceed the appropriate maximum.

(7) An estimate for the purposes of this section must be made in accordance with regulations under section 12(5) of the Freedom of Information Act 2000.

(8) In subsections (5) and (6), “the appropriate maximum” means the maximum amount specified by the Secretary of State by regulations.

(9) Regulations under subsection (8) are subject to the negative resolution procedure.

Textual Amendments

F1 Words in s. 24(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F2 Words in s. 24(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F3 Words in s. 24(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(2)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F4 Words in s. 24(2)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F5 Words in s. 24(2)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F6 Words in s. 24(2)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F7 S. 24(2)(ca)(cb) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F8 S. 24(2)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(3)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F9 Words in s. 24(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(4)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F10 Words in s. 24(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(4)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F11 Words in s. 24(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(4)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F12 Words in s. 24(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(5)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F13 Words in s. 24(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(5)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F14 Words in s. 24(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(5)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F15 Words in s. 24(5)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 32(5)(d) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Modifications etc. (not altering text)

C1 Pt. 2 Ch. 3 applied (31.12.2020) by Regulation (EU) No. 625/2017, Art. 143 (as substituted by The Official Controls (Animals, Feed and Food, Plant Health etc.) (Amendment) (EU Exit) Regulations 2020 (S.I. 2020/1481), regs. 1, 27(3) (with reg. 46))

Commencement Information

I1 S. 24 in force at Royal Assent for specified purposes, see s. 212(2)(f)