Data Protection Act 2018

Section 211

SCHEDULE 19 U.K. Minor and consequential amendments

PART 1 U.K. Amendments of primary legislation

Registration Service Act 1953 (c. 37) U.K.

1 (1) Section 19AC of the Registration Service Act 1953 (codes of practice) is amended as follows. U.K.

(2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (11), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

Commencement Information

I1 Sch. 19 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Veterinary Surgeons Act 1966 (c. 36) U.K.

2 (1) Section 1A of the Veterinary Surgeons Act 1966 (functions of the Royal College of Veterinary Surgeons as competent authority) is amended as follows. U.K.

(2) In subsection (8)—

(a) omit “personal data protection legislation in the United Kingdom that implements”,

(b) for paragraph (a) substitute—

“(a) the GDPR; and”, and

(c) in paragraph (b), at the beginning insert “ legislation in the United Kingdom that implements ”.

(3) In subsection (9), after “section” insert “—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

Commencement Information

I2 Sch. 19 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Parliamentary Commissioner Act 1967 (c. 13) U.K.

3 U.K. In section 11AA(1) of the Parliamentary Commissioner Act 1967 (disclosure of information by Parliamentary Commissioner to Information Commissioner)—

(a) in paragraph (a), for sub-paragraph (i) substitute—

“(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and

(b) for paragraph (b) substitute—

“(b) the commission of an offence under—

(i) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or

(ii) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

Commencement Information

I3 Sch. 19 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Local Government Act 1974 (c. 7) U.K.

4 U.K. The Local Government Act 1974 is amended as follows.

Commencement Information

I4 Sch. 19 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

5 U.K. In section 33A(1) (disclosure of information by Local Commissioner to Information Commissioner)—

(a) in paragraph (a), for sub-paragraph (i) substitute—

“(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and

(b) for paragraph (b) substitute—

“(b) the commission of an offence under—

(i) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or

(ii) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

Commencement Information

I5 Sch. 19 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

6 U.K. In section 34O(1) (disclosure of information by Local Commissioner to Information Commissioner)—

(a) in paragraph (a), for sub-paragraph (i) substitute—

“(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and

(b) for paragraph (b) substitute—

“(b) the commission of an offence under—

(i) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or

(ii) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

Commencement Information

I6 Sch. 19 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Consumer Credit Act 1974 (c. 39) U.K.

7 U.K. The Consumer Credit Act 1974 is amended as follows.

Commencement Information

I7 Sch. 19 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

8 U.K. In section 157(2A) (duty to disclose name etc of agency)—

(a) in paragraph (a), for “the Data Protection Act 1998” substitute “ the GDPR ”, and

(b) in paragraph (b), after “any” insert “ other ”.

Commencement Information

I8 Sch. 19 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

9 U.K. In section 159(1)(a) (correction of wrong information) for “section 7 of the Data Protection Act 1998” substitute “ Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) ”.

Commencement Information

I9 Sch. 19 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

10 U.K. In section 189(1) (definitions), at the appropriate place insert—

““the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);”.

Commencement Information

I10 Sch. 19 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22)) U.K.

11 U.K. The Pharmacy (Northern Ireland) Order 1976 is amended as follows.

Commencement Information

I11 Sch. 19 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

12 U.K. In article 2(2) (interpretation), omit the definition of “Directive 95/46/EC”.

Commencement Information

I12 Sch. 19 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

13 U.K. In article 8D (European professional card), after paragraph (3) insert—

“(4) In Schedule 2C, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”

Commencement Information

I13 Sch. 19 para. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

14 U.K. In article 22A(6) (Directive 2005/36/EC: functions of competent authority etc.), before sub-paragraph (a) insert—

“(za) “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

Commencement Information

I14 Sch. 19 para. 14 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

15 (1) Schedule 2C (Directive 2005/36/EC: European professional card) is amended as follows. U.K.

(2) In paragraph 8(1) (access to data), for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In paragraph 9 (processing data), omit sub-paragraph (2) (deeming the Society to be the controller for the purposes of Directive 95/46/EC).

Commencement Information

I15 Sch. 19 para. 15 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

16 (1) The table in Schedule 2D (functions of the Society under Directive 2005/36/EC) is amended as follows. U.K.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Commencement Information

I16 Sch. 19 para. 16 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

17 (1) Paragraph 2 of Schedule 3 (fitness to practice: disclosure of information) is amended as follows. U.K.

(2) In sub-paragraph (2)(a), after “provision” insert “ or the GDPR ”.

(3) For sub-paragraph (3) substitute—

“(3) In determining for the purposes of sub-paragraph (2)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this paragraph.”

(4) After sub-paragraph (4) insert—

“(5) In this paragraph, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I17 Sch. 19 para. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Representation of the People Act 1983 (c. 2) U.K.

18 (1) Schedule 2 to the Representation of the People Act 1983 (provisions which may be contained in regulations as to registration etc) is amended as follows. U.K.

(2) In paragraph 1A(5), for “the Data Protection Act 1998” substitute “ Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.

(3) In paragraph 8C(2), for “the Data Protection Act 1998” substitute “ Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.

(4) In paragraph 11A—

(a) in sub-paragraph (1) for “who are data users to supply data, or documents containing information extracted from data and” substitute “ to supply information ”, and

(b) omit sub-paragraph (2).

Commencement Information

I18 Sch. 19 para. 18 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Medical Act 1983 (c. 54) U.K.

19 U.K. The Medical Act 1983 is amended as follows.

Commencement Information

I19 Sch. 19 para. 19 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

20 (1) Section 29E (evidence) is amended as follows. U.K.

(2) In subsection (5), after “enactment” insert “ or the GDPR ”.

(3) For subsection (7) substitute—

“(7) In determining for the purposes of subsection (5) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.”

(4) In subsection (9), at the end insert—

““the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I20 Sch. 19 para. 20 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

21 (1) Section 35A (General Medical Council's power to require disclosure of information) is amended as follows. U.K.

(2) In subsection (4), after “enactment” insert “ or the GDPR ”.

(3) For subsection (5A) substitute—

“(5A) In determining for the purposes of subsection (4) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.”

(4) In subsection (7), at the end insert—

““the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I21 Sch. 19 para. 21 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

22 U.K. In section 49B(7) (Directive 2005/36: designation of competent authority etc.), after “Schedule 4A” insert “—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

Commencement Information

I22 Sch. 19 para. 22 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

23 U.K. In section 55(1) (interpretation), omit the definition of “Directive 95/46/EC”.

Commencement Information

I23 Sch. 19 para. 23 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

24 (1) Paragraph 9B of Schedule 1 (incidental powers of the General Medical Council) is amended as follows. U.K.

(2) In sub-paragraph (2)(a), after “enactment” insert “ or the GPDR ”.

(3) After sub-paragraph (3) insert—

“(4) In this paragraph, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I24 Sch. 19 para. 24 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

25 (1) Paragraph 5A of Schedule 4 (professional performance assessments and health assessments) is amended as follows. U.K.

(2) In sub-paragraph (8), after “enactment” insert “ or the GDPR ”.

(3) For sub-paragraph (8A) substitute—

“(8A) In determining for the purposes of sub-paragraph (8) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this paragraph.”

(4) After sub-paragraph (13) insert—

“(14) In this paragraph, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I25 Sch. 19 para. 25 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

26 (1) The table in Schedule 4A (functions of the General Medical Council as competent authority under Directive 2005/36) is amended as follows. U.K.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Commencement Information

I26 Sch. 19 para. 26 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Dentists Act 1984 (c. 24) U.K.

27 U.K. The Dentists Act 1984 is amended as follows.

Commencement Information

I27 Sch. 19 para. 27 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

28 (1) Section 33B (the General Dental Council's power to require disclosure of information: the dental profession) is amended as follows. U.K.

(2) In subsection (3), after “enactment” insert “ or relevant provision of the GDPR ”.

(3) For subsection (4) substitute—

“(4) For the purposes of subsection (3)—

• “relevant enactment” means any enactment other than—

  (a)

  this Act, or

  (b)

  the listed provisions in paragraph 1 of Schedule 11 to the Data Protection Act 2018 (exemptions to Part 4 : disclosures required by law);

• “relevant provision of the GDPR” means any provision of the GDPR apart from the listed GDPR provisions in paragraph 1 of Schedule 2 to the Data Protection Act 2018 (GDPR provisions to be adapted or restricted: disclosures required by law).”

(4) After subsection (10) insert—

“(11) In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I28 Sch. 19 para. 28 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

29 U.K. In section 36ZA(6) (Directive 2005/36: designation of competent authority etc), after “Schedule 4ZA—” insert—

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

Commencement Information

I29 Sch. 19 para. 29 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

30 (1) Section 36Y (the General Dental Council's power to require disclosure of information: professions complementary to dentistry) is amended as follows. U.K.

(2) In subsection (3), after “enactment” insert “ or relevant provision of the GDPR ”.

(3) For subsection (4) substitute—

“(4) For the purposes of subsection (3)—

• “relevant enactment” means any enactment other than—

  (a)

  this Act, or

  (b)

  the listed provisions in paragraph 1 of Schedule 11 to the Data Protection Act 2018 (exemptions to Part 4 : disclosures required by law);

• “relevant provision of the GDPR” means any provision of the GDPR apart from the listed GDPR provisions in paragraph 1 of Schedule 2 to the Data Protection Act 2018 (GDPR provisions to be adapted or restricted: disclosures required by law).”

(4) After subsection (10) insert—

“(11) In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I30 Sch. 19 para. 30 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

31 U.K. In section 53(1) (interpretation), omit the definition of “Directive 95/46/EC”.

Commencement Information

I31 Sch. 19 para. 31 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

32 (1) The table in Schedule 4ZA (Directive 2005/36: functions of the General Dental Council under section 36ZA(3)) is amended as follows. U.K.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Commencement Information

I32 Sch. 19 para. 32 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Companies Act 1985 (c. 6) U.K.

33 U.K. In section 449(11) of the Companies Act 1985 (provision for security of information obtained), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I33 Sch. 19 para. 33 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Access to Medical Reports Act 1988 (c. 28) U.K.

34 U.K. In section 2(1) of the Access to Medical Reports Act 1988 (interpretation), for the definition of “health professional” substitute—

““health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act);”.

Commencement Information

I34 Sch. 19 para. 34 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Opticians Act 1989 (c. 44) U.K.

35 (1) Section 13B of the Opticians Act 1989 (the Council's power to require disclosure of information) is amended as follows. U.K.

(2) In subsection (3), after “enactment” insert “ or the GDPR ”.

(3) For subsection (4) substitute—

“(4) In determining for the purposes of subsection (3) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.”

(4) After subsection (9) insert—

“(10) In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I35 Sch. 19 para. 35 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Access to Health Records Act 1990 (c. 23) U.K.

36 U.K. The Access to Health Records Act 1990 is amended as follows.

Commencement Information

I36 Sch. 19 para. 36 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

37 U.K. For section 2 substitute—

“2 Health professionals

In this Act, “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act).”

Commencement Information

I37 Sch. 19 para. 37 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

38 (1) Section 3 (right of access to health records) is amended as follows. U.K.

(2) In subsection (2), omit “Subject to subsection (4) below,”.

(3) In subsection (4), omit from “other than the following” to the end.

Commencement Information

I38 Sch. 19 para. 38 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Human Fertilisation and Embryology Act 1990 (c. 37) U.K.

39 (1) Section 33D of the Human Fertilisation and Embryology Act 1990 (disclosure for the purposes of medical or other research) is amended as follows. U.K.

(2) In subsection (6), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (9), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I39 Sch. 19 para. 39 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Trade Union and Labour Relations (Consolidation) Act 1992 (c. 52) U.K.

40 (1) Section 251B of the Trade Union and Labour Relations (Consolidation) Act 1992 (prohibition on disclosure of information) is amended as follows. U.K.

(2) In subsection (3), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (6) insert—

“(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I40 Sch. 19 para. 40 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Tribunals and Inquiries Act 1992 (c. 53) U.K.

41 U.K. In the table in Part 1 of Schedule 1 to the Tribunals and Inquiries Act 1992 (tribunals to which the Act applies), in the second column, in paragraph 14(a), for “section 6 of the Data Protection Act 1998” substitute “ section 114 of the Data Protection Act 2018 ”.

Commencement Information

I41 Sch. 19 para. 41 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Industrial Relations (Northern Ireland) Order 1992 (S.I. 1992/807 (N.I. 5)) U.K.

42 (1) Article 90B of the Industrial Relations (Northern Ireland) Order 1992 (prohibition on disclosure of information held by the Labour Relations Agency) is amended as follows. U.K.

(2) In paragraph (3), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After paragraph (6) insert—

“(7) In this Article, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I42 Sch. 19 para. 42 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Health Service Commissioners Act 1993 (c. 46) U.K.

43 U.K. In section 18A(1) of the Health Service Commissioners Act 1993 (power to disclose information)—

(a) in paragraph (a), for sub-paragraph (i) substitute—

“(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and

(b) for paragraph (b) substitute—

“(b) the commission of an offence under—

(i) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or

(ii) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

Commencement Information

I43 Sch. 19 para. 43 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection Act 1998 (c. 29) U.K.

44 U.K. The Data Protection Act 1998 is repealed, with the exception of section 62 and paragraphs 13, 15, 16, 18 and 19 of Schedule 15 (which amend other enactments).

Commencement Information

I44 Sch. 19 para. 44 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Crime and Disorder Act 1998 (c. 37) U.K.

45 U.K. In section 17A(4) of the Crime and Disorder Act 1998 (sharing of information), for “(within the meaning of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”.

Commencement Information

I45 Sch. 19 para. 45 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Food Standards Act 1999 (c. 28) U.K.

46 (1) Section 19 of the Food Standards Act 1999 (publication etc by the Food Standards Agency of advice and information) is amended as follows. U.K.

(2) In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (8), after “section” insert “—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I46 Sch. 19 para. 46 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Immigration and Asylum Act 1999 (c. 33) U.K.

47 (1) Section 13 of the Immigration and Asylum Act 1999 (proof of identity of persons to be removed or deported) is amended as follows. U.K.

(2) For subsection (4) substitute—

“(4) For the purposes of Article 49(1)(d) of the GDPR, the provision under this section of identification data is a transfer of personal data which is necessary for important reasons of public interest.”

(3) After subsection (4) insert—

“(4A) “The GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I47 Sch. 19 para. 47 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Financial Services and Markets Act 2000 (c. 8) U.K.

48 U.K. The Financial Services and Markets Act 2000 is amended as follows.

Commencement Information

I48 Sch. 19 para. 48 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

49 U.K. In section 86(9) (exempt offers to the public), for “the Data Protection Act 1998 or any directly applicable EU legislation relating to data protection” substitute “—

(a) the data protection legislation, or

(b) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection”.

Commencement Information

I49 Sch. 19 para. 49 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

50 U.K. In section 391A(6)(b) (publication: special provisions relating to the capital requirements directive), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I50 Sch. 19 para. 50 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

51 U.K. In section 391C(7)(a) (publication: special provisions relating to the UCITS directive), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I51 Sch. 19 para. 51 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

52 U.K. In section 391D(9)(a) (publication: special provisions relating to the markets in financial instruments directive), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I52 Sch. 19 para. 52 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

53 U.K. In section 417 (definitions), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I53 Sch. 19 para. 53 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Terrorism Act 2000 (c. 11) U.K.

54 U.K. In section 21F(2)(d) of the Terrorism Act 2000 (other permitted disclosures between institutions etc) for “(within the meaning of section 1 of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”.

Commencement Information

I54 Sch. 19 para. 54 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Freedom of Information Act 2000 (c. 36) U.K.

55 U.K. The Freedom of Information Act 2000 is amended as follows.

Commencement Information

I55 Sch. 19 para. 55 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

56 U.K. In section 2(3) (absolute exemptions), for paragraph (f) substitute—

“(f) section 40(1),

(fa) section 40(2) so far as relating to cases where the first condition referred to in that subsection is satisfied,”.

Commencement Information

I56 Sch. 19 para. 56 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

57 U.K. In section 18 (the Information Commissioner), omit subsection (1).

Commencement Information

I57 Sch. 19 para. 57 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

58 (1) Section 40 (personal information) is amended as follows. U.K.

(2) In subsection (2)—

(a) in paragraph (a), for “do” substitute “ does ”, and

(b) in paragraph (b), for “either the first or the second” substitute “ the first, second or third ”.

(3) For subsection (3) substitute—

“(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).”

(4) For subsection (4) substitute—

“(4A) The third condition is that—

(a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or

(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.”

(5) For subsection (5) substitute—

“(5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).

(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies—

(a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—

(i) would (apart from this Act) contravene any of the data protection principles, or

(ii) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded;

(b) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) would (apart from this Act) contravene Article 21 of the GDPR (general processing: right to object to processing);

(c) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in subsection (4A)(a);

(d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.”

(6) Omit subsection (6).

(7) For subsection (7) substitute—

“(7) In this section—

• “the data protection principles” means the principles set out in—

  (a)

  Article 5(1) of the GDPR, and

  (b)

  section 34(1) of the Data Protection Act 2018;

• “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

• “the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act).

(8) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”

Commencement Information

I58 Sch. 19 para. 58 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

59 U.K. Omit section 49 (reports to be laid before Parliament).

Commencement Information

I59 Sch. 19 para. 59 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

60 U.K. For section 61 (appeal proceedings) substitute—

“61 Appeal proceedings

(1) Tribunal Procedure Rules may make provision for regulating the exercise of rights of appeal conferred by sections 57(1) and (2) and 60(1) and (4).

(2) In relation to appeals under those provisions, Tribunal Procedure Rules may make provision about—

(a) securing the production of material used for the processing of personal data, and

(b) the inspection, examination, operation and testing of equipment or material used in connection with the processing of personal data.

(3) Subsection (4) applies where—

(a) a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal on an appeal under those provisions, and

(b) if those proceedings were proceedings before a court having power to commit for contempt, the act or omission would constitute contempt of court.

(4) The First-tier Tribunal may certify the offence to the Upper Tribunal.

(5) Where an offence is certified under subsection (4), the Upper Tribunal may—

(a) inquire into the matter, and

(b) deal with the person charged with the offence in any manner in which it could deal with the person if the offence had been committed in relation to the Upper Tribunal.

(6) Before exercising the power under subsection (5)(b), the Upper Tribunal must—

(a) hear any witness who may be produced against or on behalf of the person charged with the offence, and

(b) hear any statement that may be offered in defence.

(7) In this section, “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act).”

Commencement Information

I60 Sch. 19 para. 60 in force at Royal Assent for specified purposes, see s. 212(2)(f)

I61 Sch. 19 para. 60 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(g)

61 U.K. In section 76(1) (disclosure of information between Commissioner and ombudsmen), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I62 Sch. 19 para. 61 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

62 U.K. After section 76A insert—

“76B Disclosure of information to Tribunal

(1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the Upper Tribunal with information necessary for the discharge of their functions in connection with appeals under section 60 of this Act.

(2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

(3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.”

Commencement Information

I63 Sch. 19 para. 62 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

63 U.K. In section 77(1)(b) (offence of altering etc records with intent to prevent disclosure), omit “or section 7 of the Data Protection Act 1998,”.

Commencement Information

I64 Sch. 19 para. 63 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

64 U.K. In section 84 (interpretation), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I65 Sch. 19 para. 64 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Political Parties, Elections and Referendums Act 2000 (c. 41) U.K.

65 (1) Paragraph 28 of Schedule 19C to the Political Parties, Elections and Referendums Act 2000 (civil sanctions: disclosure of information) is amended as follows. U.K.

(2) In sub-paragraph (4)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After sub-paragraph (5) insert—

“(6) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I66 Sch. 19 para. 65 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Public Finance and Accountability (Scotland) Act 2000 (asp 1) U.K.

66 U.K. The Public Finance and Accountability (Scotland) Act 2000 is amended as follows.

Commencement Information

I67 Sch. 19 para. 66 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

67 U.K. In section 26B(3)(a) (voluntary disclosure of data to Audit Scotland), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

Commencement Information

I68 Sch. 19 para. 67 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

68 U.K. In section 26C(3)(a) (power to require disclosure of data), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

Commencement Information

I69 Sch. 19 para. 68 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

69 U.K. In section 29(1) (interpretation), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I70 Sch. 19 para. 69 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Criminal Justice and Police Act 2001 (c. 16) U.K.

70 U.K. The Criminal Justice and Police Act 2001 is amended as follows.

Commencement Information

I71 Sch. 19 para. 70 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

71 U.K. In section 57(1) (retention of seized items)—

(a) omit paragraph (m), and

(b) after paragraph (s) insert—

“(t) paragraph 10 of Schedule 15 to the Data Protection Act 2018;”.

Commencement Information

I72 Sch. 19 para. 71 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

72 U.K. In section 65(7) (meaning of “legal privilege”)—

(a) for “paragraph 1 of Schedule 9 to the Data Protection Act 1998 (c. 29)” substitute “ paragraphs 1 and 2 of Schedule 15 to the Data Protection Act 2018 ”, and

(b) for “paragraph 9” substitute “ paragraph 11 (matters exempt from inspection and seizure: privileged communications) ”.

Commencement Information

I73 Sch. 19 para. 72 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

73 U.K. In Schedule 1 (powers of seizure)—

(a) omit paragraph 65, and

(b) after paragraph 73R insert—

“Data Protection Act 2018 U.K.

73S The power of seizure conferred by paragraphs 1 and 2 of Schedule 15 to the Data Protection Act 2018 (powers of entry and inspection).”

Commencement Information

I74 Sch. 19 para. 73 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Anti-terrorism, Crime and Security Act 2001 (c.24) U.K.

74 U.K. The Anti-terrorism, Crime and Security Act 2001 is amended as follows.

Commencement Information

I75 Sch. 19 para. 74 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

75 (1) Section 19 (disclosure of information held by revenue departments) is amended as follows. U.K.

(2) In subsection (7), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (9), after “section” insert “—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I76 Sch. 19 para. 75 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Prospective

F1 76 U.K. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F1 Sch. 19 para. 76 omitted (29.3.2019) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(3), Sch. 4 para. 3

Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.)) U.K.

77 (1) Section 7A of the Health and Personal Social Services Act (Northern Ireland) 2001 (power to obtain information etc) is amended as follows. U.K.

(2) In subsection (3), after “provision” insert “ or the GDPR ”.

(3) For subsection (5) substitute—

“(5) In determining for the purposes of subsection (3) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.”

(4) After subsection (7) insert—

“(8) In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I77 Sch. 19 para. 77 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Justice (Northern Ireland) Act 2002 (c. 26) U.K.

78 (1) Section 5A of the Justice (Northern Ireland) Act 2002 (disclosure of information to the Commission) is amended as follows. U.K.

(2) In subsection (3)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (9) insert—

“(10) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I78 Sch. 19 para. 78 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Proceeds of Crime Act 2002 (c. 29) U.K.

79 U.K. The Proceeds of Crime Act 2002 is amended as follows.

Commencement Information

I79 Sch. 19 para. 79 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

80 U.K. In section 333C(2)(d) (other permitted disclosures between institutions etc), for “(within the meaning of section 1 of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”.

Commencement Information

I80 Sch. 19 para. 80 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

81 U.K. In section 436(3)(a) (disclosure of information to certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

Commencement Information

I81 Sch. 19 para. 81 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

82 U.K. In section 438(8)(a) (disclosure of information by certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

Commencement Information

I82 Sch. 19 para. 82 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

83 U.K. In section 439(3)(a) (disclosure of information to Lord Advocate and to Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

Commencement Information

I83 Sch. 19 para. 83 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

84 U.K. In section 441(7)(a) (disclosure of information by Lord Advocate and Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

Commencement Information

I84 Sch. 19 para. 84 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

85 U.K. After section 442 insert—

“442A Data protection legislation

In this Part, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I85 Sch. 19 para. 85 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Enterprise Act 2002 (c. 40) U.K.

86 (1) Section 237 of the Enterprise Act 2002 (general restriction on disclosure) is amended as follows. U.K.

(2) In subsection (4), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (6) insert—

“(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I86 Sch. 19 para. 86 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Scottish Public Services Ombudsman Act 2002 (asp 11) U.K.

87 (1) In Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (disclosure of information by the Ombudsman), the entry for the Information Commissioner is amended as follows. U.K.

(2) In paragraph 1, for sub-paragraph (a) substitute—

“(a) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”.

(3) For paragraph 2 substitute—

“2 The commission of an offence under—

(a) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or

(b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

Commencement Information

I87 Sch. 19 para. 87 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Freedom of Information (Scotland) Act 2002 (asp 13) U.K.

88 U.K. The Freedom of Information (Scotland) Act 2002 is amended as follows.

Commencement Information

I88 Sch. 19 para. 88 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

89 U.K. In section 2(2)(e)(ii) (absolute exemptions), omit “by virtue of subsection (2)(a)(i) or (b) of that section”.

Commencement Information

I89 Sch. 19 para. 89 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

90 (1) Section 38 (personal information) is amended as follows. U.K.

(2) In subsection (1), for paragraph (b) substitute—

“(b) personal data and the first, second or third condition is satisfied (see subsections (2A) to (3A));”.

(3) For subsection (2) substitute—

“(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(2B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).”

(4) For subsection (3) substitute—

“(3A) The third condition is that—

(a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or

(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.”

(5) Omit subsection (4).

(6) In subsection (5), for the definitions of “the data protection principles” and of “data subject” and “personal data” substitute—

““the data protection principles” means the principles set out in—

(a) Article 5(1) of the GDPR, and

(b) section 34(1) of the Data Protection Act 2018;

“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

“the GDPR”, “personal data”, “processing” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4), (10), (11) and (14) of that Act);”.

(7) After that subsection insert—

“(5A) In determining for the purposes of this section whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”

Commencement Information

I90 Sch. 19 para. 90 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Courts Act 2003 (c. 39) U.K.

91 U.K. Schedule 5 to the Courts Act 2003 (collection of fines) is amended as follows.

Commencement Information

I91 Sch. 19 para. 91 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

92 (1) Paragraph 9C (disclosure of information in connection with making of attachment of earnings orders or applications for benefit deductions: supplementary) is amended as follows. U.K.

(2) In sub-paragraph (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After sub-paragraph (5) insert—

“(6) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I92 Sch. 19 para. 92 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

93 (1) Paragraph 10A (attachment of earnings orders (Justice Act (Northern Ireland) 2016): disclosure of information) is amended as follows. U.K.

(2) In sub-paragraph (7), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In sub-paragraph (8), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I93 Sch. 19 para. 93 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Sexual Offences Act 2003 (c. 42) U.K.

94 (1) Section 94 of the Sexual Offences Act 2003 (Part 2: supply of information to the Secretary of State etc for verification) is amended as follows. U.K.

(2) In subsection (6), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (8), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I94 Sch. 19 para. 94 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Criminal Justice Act 2003 (c. 44) U.K.

95 U.K. The Criminal Justice Act 2003 is amended as follows.

Commencement Information

I95 Sch. 19 para. 95 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

96 U.K. In section 327A(9) (disclosure of information about convictions etc of child sex offenders to members of the public), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I96 Sch. 19 para. 96 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

97 U.K. In section 327B (disclosure of information about convictions etc of child sex offenders to members of the public: interpretation), after subsection (4) insert—

“(4A) “The data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I97 Sch. 19 para. 97 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13) U.K.

98 (1) Section 279 of the Mental Health (Care and Treatment) (Scotland) Act 2003 (information for research) is amended as follows. U.K.

(2) In subsection (2), for “research purposes within the meaning given by section 33 of the Data Protection Act 1998 (c. 29) (research, history and statistics)” substitute “ purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics) ”.

(3) After subsection (9) insert—

“(10) In this section, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”

Commencement Information

I98 Sch. 19 para. 98 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Public Audit (Wales) Act 2004 (c. 23) U.K.

99 (1) Section 64C of the Public Audit (Wales) Act 2004 (voluntary provision of data) is amended as follows. U.K.

(2) In subsection (3)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (5), at the beginning insert “In this section—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I99 Sch. 19 para. 99 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Companies (Audit, Investigations and Community Enterprise) Act 2004 (c. 27) U.K.

100 U.K. The Companies (Audit, Investigations and Community Enterprise) Act 2004 is amended as follows.

Commencement Information

I100 Sch. 19 para. 100 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

101 (1) Section 15A (disclosure of information by tax authorities) is amended as follows. U.K.

(2) In subsection (2)—

(a) omit “within the meaning of the Data Protection Act 1998”, and

(b) for “that Act” substitute “ the data protection legislation ”.

(3) After subsection (7) insert—

“(8) In this section—

• “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

• “personal data” has the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).”

Commencement Information

I101 Sch. 19 para. 101 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

102 (1) Section 15D (permitted disclosure of information obtained under compulsory powers) is amended as follows. U.K.

(2) In subsection (7), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (7) insert—

“(8) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I102 Sch. 19 para. 102 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Domestic Violence, Crime and Victims Act 2004 (c. 28) U.K.

103 (1) Section 54 of the Domestic Violence, Crime and Victims Act 2004 (disclosure of information) is amended as follows. U.K.

(2) In subsection (7), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (8) insert—

“(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I103 Sch. 19 para. 103 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Children Act 2004 (c. 31) U.K.

104 U.K. The Children Act 2004 is amended as follows.

Commencement Information

I104 Sch. 19 para. 104 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

105 (1) Section 12 (information databases) is amended as follows. U.K.

(2) In subsection (13)(e) for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (13) insert—

“(14) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I105 Sch. 19 para. 105 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

106 (1) Section 29 (information databases: Wales) is amended as follows. U.K.

(2) In subsection (14)(e) for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (14) insert—

“(15) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I106 Sch. 19 para. 106 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Constitutional Reform Act 2005 (c. 4) U.K.

107 (1) Section 107 of the Constitutional Reform Act 2005 (disclosure of information to the Commission) is amended as follows. U.K.

(2) In subsection (3)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (9) insert—

“(10) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I107 Sch. 19 para. 107 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Mental Capacity Act 2005 (c. 9) U.K.

108 U.K. In section 64 of the Mental Capacity Act 2005 (interpretation), for the definition of “health record” substitute—

““health record” has the same meaning as in the Data Protection Act 2018 (see section 205 of that Act);”.

Commencement Information

I108 Sch. 19 para. 108 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Public Services Ombudsman (Wales) Act 2005 (c. 10) U.K.

109 (1) Section 34X of the Public Services Ombudsman (Wales) Act 2005 (disclosure of information) is amended as follows. U.K.

(2) In subsection (4), for paragraph (a) substitute—

“(a) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement);”.

(3) For subsection (5) substitute—

“(5) The offences are those under—

(a) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc);

(b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

Commencement Information

I109 Sch. 19 para. 109 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Commissioners for Revenue and Customs Act 2005 (c. 11) U.K.

110 (1) Section 22 of the Commissioners for Revenue and Customs Act 2005 (data protection, etc) is amended as follows. U.K.

(2) The existing text becomes subsection (1).

(3) In that subsection, in paragraph (a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(4) After that subsection insert—

“(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I110 Sch. 19 para. 110 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Gambling Act 2005 (c. 19) U.K.

111 (1) Section 352 of the Gambling Act 2005 (data protection) is amended as follows. U.K.

(2) The existing text becomes subsection (1).

(3) In that subsection, for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(4) After that subsection insert—

“(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I111 Sch. 19 para. 111 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Commissioner for Older People (Wales) Act 2006 (c. 30) U.K.

112 (1) Section 18 of the Commissioner for Older People (Wales) Act 2006 (power to disclose information) is amended as follows. U.K.

(2) In subsection (7), for paragraph (a) substitute—

“(a) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement);”.

(3) For subsection (8) substitute—

“(8) The offences are those under—

(a) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc); or

(b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

Commencement Information

I112 Sch. 19 para. 112 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

National Health Service Act 2006 (c. 41) U.K.

113 U.K. The National Health Service Act 2006 is amended as follows.

Commencement Information

I113 Sch. 19 para. 113 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

114 (1) Section 251 (control of patient information) is amended as follows. U.K.

(2) In subsection (7), for “made by or under the Data Protection Act 1998 (c 29)” substitute “ of the data protection legislation ”.

(3) In subsection (13), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I114 Sch. 19 para. 114 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

115 (1) Section 264C (provision and disclosure of information about health service products: supplementary) is amended as follows. U.K.

(2) In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (3) insert—

“(4) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I115 Sch. 19 para. 115 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

116 U.K. In paragraph 7B(3) of Schedule 1 (further provision about the Secretary of State and services under the Act), for “has the same meaning as in the Data Protection Act 1998” substitute “ has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.

Commencement Information

I116 Sch. 19 para. 116 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

National Health Service (Wales) Act 2006 (c. 42) U.K.

117 U.K. The National Health Service (Wales) Act 2006 is amended as follows.

Commencement Information

I117 Sch. 19 para. 117 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

118 (1) Section 201C (provision of information about medical supplies: supplementary) is amended as follows. U.K.

(2) In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (3) insert—

“(4) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I118 Sch. 19 para. 118 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

119 U.K. In paragraph 7B(3) of Schedule 1 (further provision about the Welsh Ministers and services under the Act), for “has the same meaning as in the Data Protection Act 1998” substitute “ has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act) ”.

Commencement Information

I119 Sch. 19 para. 119 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Companies Act 2006 (c. 46) U.K.

120 U.K. The Companies Act 2006 is amended as follows.

Commencement Information

I120 Sch. 19 para. 120 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

121 U.K. In section 458(2) (disclosure of information by tax authorities)—

(a) for “within the meaning of the Data Protection Act 1998 (c. 29)” substitute “ within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act) ”, and

(b) for “that Act” substitute “ the data protection legislation ”.

Commencement Information

I121 Sch. 19 para. 121 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

122 U.K. In section 461(7) (permitted disclosure of information obtained under compulsory powers), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

Commencement Information

I122 Sch. 19 para. 122 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

123 U.K. In section 948(9) (restrictions on disclosure) for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

Commencement Information

I123 Sch. 19 para. 123 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

124 U.K. In section 1173(1) (minor definitions: general), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I124 Sch. 19 para. 124 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

125 U.K. In section 1224A(7) (restrictions on disclosure), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I125 Sch. 19 para. 125 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

126 U.K. In section 1253D(3) (restriction on transfer of audit working papers to third countries), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I126 Sch. 19 para. 126 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

127 U.K. In section 1261(1) (minor definitions: Part 42), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I127 Sch. 19 para. 127 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

128 U.K. In section 1262 (index of defined expressions: Part 42), at the appropriate place insert—

“the data protection legislation

section 1261(1)”.

Commencement Information

I128 Sch. 19 para. 128 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

129 U.K. In Schedule 8 (index of defined expressions: general), at the appropriate place insert—

“the data protection legislation

section 1173(1)”.

Commencement Information

I129 Sch. 19 para. 129 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Tribunals, Courts and Enforcement Act 2007 (c. 15) U.K.

130 U.K. The Tribunals, Courts and Enforcement Act 2007 is amended as follows.

Commencement Information

I130 Sch. 19 para. 130 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

131 U.K. In section 11(5)(b) (right to appeal to Upper Tribunal), for “section 28(4) or (6) of the Data Protection Act 1998 (c. 29)” substitute “ section 27(3) or (5), 79(5) or (7) or 111(3) or (5) of the Data Protection Act 2018 ”.

Commencement Information

I131 Sch. 19 para. 131 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

132 U.K. In section 13(8)(a) (right to appeal to the Court of Appeal), for “section 28(4) or (6) of the Data Protection Act 1998 (c. 29)” substitute “ section 27(3) or (5), 79(5) or (7) or 111(3) or (5) of the Data Protection Act 2018 ”.

Commencement Information

I132 Sch. 19 para. 132 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Statistics and Registration Service Act 2007 (c. 18) U.K.

133 U.K. The Statistics and Registration Service Act 2007 is amended as follows.

Commencement Information

I133 Sch. 19 para. 133 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

134 (1) Section 45 (information held by HMRC) is amended as follows. U.K.

(2) In subsection (4A), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

(3) In subsection (4B), for “the Data Protection Act 1998” substitute “ the Data Protection Act 2018 ”.

Commencement Information

I134 Sch. 19 para. 134 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

135 (1) Section 45A (information held by other public authorities) is amended as follows. U.K.

(2) In subsection (8), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

(3) In subsection (9), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) In subsection (12)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(5) In subsection 12(c), after the first “legislation” insert “ (which is not part of the data protection legislation) ”.

Commencement Information

I135 Sch. 19 para. 135 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

136 (1) Section 45B(3) (access to information held by Crown bodies etc) is amended as follows. U.K.

(2) In paragraph (a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In paragraph (c), after the first “legislation” insert “ (which is not part of the data protection legislation) ”.

Commencement Information

I136 Sch. 19 para. 136 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

137 (1) Section 45C(13) (power to require disclosures by other public authorities) is amended as follows. U.K.

(2) In paragraph (b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In paragraph (d), after the first “legislation” insert “ (which is not part of the data protection legislation) ”.

Commencement Information

I137 Sch. 19 para. 137 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

138 U.K. In section 45D(9)(b) (power to require disclosure by undertakings), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I138 Sch. 19 para. 138 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

139 (1) Section 45E (further provision about powers in sections 45B, 45C and 45D) is amended as follows. U.K.

(2) In subsection (6), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (16), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

(4) In subsection (17), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I139 Sch. 19 para. 139 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

140 (1) Section 53A (disclosure by the Statistics Board to devolved administrations) is amended as follows. U.K.

(2) In subsection (9), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

(3) In subsection (10), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) In subsection (12)(b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I140 Sch. 19 para. 140 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

141 (1) Section 54 (Data Protection Act 1998 and Human Rights Act 1998) is amended as follows. U.K.

(2) In the heading, omit “Data Protection Act 1998 and”.

(3) Omit paragraph (a) (together with the final “or”).

Commencement Information

I141 Sch. 19 para. 141 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

142 U.K. In section 67 (general interpretation: Part 1), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I142 Sch. 19 para. 142 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Serious Crime Act 2007 (c. 27) U.K.

143 U.K. The Serious Crime Act 2007 is amended as follows.

Commencement Information

I143 Sch. 19 para. 143 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

144 (1) Section 5A (verification and disclosure of information) is amended as follows. U.K.

(2) In subsection (6)—

(a) for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) for “are” substitute “ is ”.

(3) After subsection (6) insert—

“(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I144 Sch. 19 para. 144 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

145 (1) Section 68 (disclosure of information to prevent fraud) is amended as follows. U.K.

(2) In subsection (4)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (8), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I145 Sch. 19 para. 145 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

146 (1) Section 85 (disclosure of information by Revenue and Customs) is amended as follows. U.K.

(2) In subsection (8)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (9), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I146 Sch. 19 para. 146 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Legal Services Act 2007 (c. 29) U.K.

147 (1) Section 169 of the Legal Services Act 2007 (disclosure of information to the Legal Services Board) is amended as follows. U.K.

(2) In subsection (3)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (8) insert—

“(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I147 Sch. 19 para. 147 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Adoption and Children (Scotland) Act 2007 (asp 4) U.K.

148 U.K. In section 74 of the Adoption and Children (Scotland) Act 2007 (disclosure of medical information about parents), for subsection (5) substitute—

“(5) In subsection (4)(e), “processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act).”

Commencement Information

I148 Sch. 19 para. 148 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Criminal Justice and Immigration Act 2008 (c. 4) U.K.

149 U.K. The Criminal Justice and Immigration Act 2008 is amended as follows.

Commencement Information

I149 Sch. 19 para. 149 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

150 U.K. Omit—

(a) section 77 (power to alter penalty for unlawfully obtaining etc personal data), and

(b) section 78 (new defence for obtaining etc for journalism and other special purposes).

Commencement Information

I150 Sch. 19 para. 150 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

151 (1) Section 114 (supply of information to Secretary of State etc) is amended as follows. U.K.

(2) In subsection (5), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (6) insert—

“(6A) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I151 Sch. 19 para. 151 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Regulatory Enforcement and Sanctions Act 2008 (c. 13) U.K.

152 (1) Section 70 of the Regulatory Enforcement and Sanctions Act 2008 (disclosure of information) is amended as follows. U.K.

(2) In subsection (4)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (5) insert—

“(6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I152 Sch. 19 para. 152 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Health and Social Care Act 2008 (c. 14) U.K.

153 U.K. In section 20A(5) of the Health and Social Care Act 2008 (functions relating to processing of information by registered persons), in the definition of “processing”, for “the Data Protection Act 1998” substitute “ Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act); ”.

Commencement Information

I153 Sch. 19 para. 153 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Counter-Terrorism Act 2008 (c. 28) U.K.

154 (1) Section 20 of the Counter-Terrorism Act 2008 (disclosure and the intelligence services: supplementary provisions) is amended as follows. U.K.

(2) In subsection (2)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (4) insert—

“(5) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I154 Sch. 19 para. 154 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Public Health etc. (Scotland) Act 2008 (asp 5) U.K.

155 (1) Section 117 of the Public Health etc. (Scotland) Act 2008 (disclosure of information) is amended as follows. U.K.

(2) In subsection (6), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (7) insert—

“(7A) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I155 Sch. 19 para. 155 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Banking Act 2009 (c. 1) U.K.

156 (1) Section 83ZY of the Banking Act 2009 (special resolution regime: publication of notices etc) is amended as follows. U.K.

(2) In subsection (10), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (11), after “section” insert “—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I156 Sch. 19 para. 156 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Borders, Citizenship and Immigration Act 2009 (c. 11) U.K.

157 (1) Section 19 of the Borders, Citizenship and Immigration Act 2009 (use and disclosure of customs information: application of statutory provisions) is amended as follows. U.K.

(2) In subsection (1)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (4) insert—

“(5) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I157 Sch. 19 para. 157 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Marine and Coastal Access Act 2009 (c. 23) U.K.

158 U.K. The Marine and Coastal Access Act 2009 is amended as follows.

Commencement Information

I158 Sch. 19 para. 158 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

159 (1) Paragraph 13 of Schedule 7 (further provision about civil sanctions under Part 4: disclosure of information) is amended as follows. U.K.

(2) In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After sub-paragraph (6) insert—

“(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I159 Sch. 19 para. 159 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

160 (1) Paragraph 9 of Schedule 10 (further provision about fixed monetary penalties: disclosure of information) is amended as follows. U.K.

(2) In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After sub-paragraph (6) insert—

“(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I160 Sch. 19 para. 160 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Coroners and Justice Act 2009 (c. 25) U.K.

161 U.K. In Schedule 21 to the Coroners and Justice Act 2009 (minor and consequential amendments), omit paragraph 29(3).

Commencement Information

I161 Sch. 19 para. 161 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Broads Authority Act 2009 (c. i) U.K.

162 (1) Section 38 of the Broads Authority Act 2009 (provision of information) is amended as follows. U.K.

(2) In subsection (3), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) In subsection (6), after “section” insert “—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I162 Sch. 19 para. 162 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)) U.K.

163 (1) Section 13 of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (functions of the Regional Agency) is amended as follows. U.K.

(2) In subsection (8), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (8) insert—

“(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I163 Sch. 19 para. 163 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Terrorist Asset-Freezing etc. Act 2010 (c. 38) U.K.

164 (1) Section 25 of the Terrorist Asset-Freezing etc. Act 2010 (application of provisions) is amended as follows. U.K.

(2) In subsection (2)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (6), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I164 Sch. 19 para. 164 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Marine (Scotland) Act 2010 (asp 5) U.K.

165 (1) Paragraph 12 of Schedule 2 to the Marine (Scotland) Act 2010 (further provision about civil sanctions under Part 4: disclosure of information) is amended as follows. U.K.

(2) In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After sub-paragraph (6) insert—

“(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I165 Sch. 19 para. 165 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Charities Act 2011 (c. 25) U.K.

166 (1) Section 59 of the Charities Act 2011 (disclosure: supplementary) is amended as follows. U.K.

(2) The existing text becomes subsection (1).

(3) In that subsection, in paragraph (a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) After that subsection insert—

“(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I166 Sch. 19 para. 166 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Welsh Language (Wales) Measure 2011 (nawm 1) U.K.

167 U.K. The Welsh Language (Wales) Measure 2011 is amended as follows.

Commencement Information

I167 Sch. 19 para. 167 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

168 (1) Section 22 (power to disclose information) is amended as follows. U.K.

(2) In subsection (4)—

(a) in the English language text, for paragraph (a) substitute—

“(a) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement);”, and

(b) in the Welsh language text, for paragraph (a) substitute—

“(a) adrannau 142 i 154, 160 i 164, neu 174 i 176 o Ddeddf Diogelu Data 2018 neu Atodlen 15 i'r Ddeddf honno (darpariaethau penodol yn ymwneud â gorfodi);”.

(3) For subsection (5)—

(a) in the English language text substitute—

“(5) The offences referred to under subsection (3)(b) are those under—

(a) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of exercise of warrant etc); or

(b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”, and

(b) in the Welsh language text substitute—

“(5) Y tramgwyddau y cyfeirir atynt yn is-adran (3)(b) yw'r rhai—

(a) o dan ddarpariaeth yn Neddf Diogelu Data 2018 ac eithrio paragraff 15 o Atodlen 15 (rhwystro gweithredu gwarant etc); neu

(b) o dan adran 77 o Ddeddf Rhyddid Gwybodaeth 2000 (trosedd o altro etc cofnodion gyda'r bwriad o atal datgelu).”

(4) In subsection (8)—

(a) in the English language text, for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) in the Welsh language text, for “gymhwyso Deddf Diogelu Data 1998” substitute “gymhwyso'r ddeddfwriaeth diogelu data”.

(5) In subsection (9)—

(a) at the appropriate place in the English language text insert—

““the data protection legislation” (“y ddeddfwriaeth diogelu data”) has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”, and

(b) at the appropriate place in the Welsh language text insert—

““mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno);”.

Commencement Information

I168 Sch. 19 para. 168 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

169 (1) Paragraph 8 of Schedule 2 (inquiries by the Commissioner: reports) is amended as follows. U.K.

(2) In sub-paragraph (7)—

(a) in the English language text, for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) in the Welsh language text, for “gymhwyso Deddf Diogelu Data 1998” substitute “gymhwyso'r ddeddfwriaeth diogelu data”.

(3) In sub-paragraph (8)—

(a) in the English language text, after “this paragraph” insert “—

“the data protection legislation” (“y ddeddfwriaeth diogelu data”) has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”, and

(b) in the Welsh language text, after “hwn” insert—

““mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno);”.

Commencement Information

I169 Sch. 19 para. 169 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Safeguarding Board Act (Northern Ireland) 2011 (c. 7 (N.I)) U.K.

170 (1) Section 10 of the Safeguarding Board Act (Northern Ireland) 2011 (duty to co-operate) is amended as follows. U.K.

(2) In subsection (3), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

(3) After subsection (3) insert—

“(4) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I170 Sch. 19 para. 170 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Health and Social Care Act 2012 (c. 7) U.K.

171 U.K. The Health and Social Care Act 2012 is amended as follows.

Commencement Information

I171 Sch. 19 para. 171 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

172 U.K. In section 250(7) (power to publish information standards), for the definition of “processing” substitute—

““processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);”.

Commencement Information

I172 Sch. 19 para. 172 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

173 (1) Section 251A (consistent identifiers) is amended as follows. U.K.

(2) In subsection (7)(a), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.

(3) After subsection (8) insert—

“(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I173 Sch. 19 para. 173 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

174 (1) Section 251B (duty to share information) is amended as follows. U.K.

(2) In subsection (5)(a), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.

(3) After subsection (6) insert—

“(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I174 Sch. 19 para. 174 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Protection of Freedoms Act 2012 (c. 9) U.K.

175 U.K. The Protection of Freedoms Act 2012 is amended as follows.

Commencement Information

I175 Sch. 19 para. 175 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

176 (1) Section 27 (exceptions and further provision about consent and notification) is amended as follows. U.K.

(2) In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (5) insert—

“(6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I176 Sch. 19 para. 176 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

177 U.K. In section 28(1) (interpretation: Chapter 2), for the definition of “processing” substitute—

““processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);”.

Commencement Information

I177 Sch. 19 para. 177 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

178 U.K. In section 29(7) (code of practice for surveillance camera systems), for the definition of “processing” substitute—

““processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);”.

Commencement Information

I178 Sch. 19 para. 178 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

HGV Road User Levy Act 2013 (c. 7) U.K.

179 (1) Section 14A of the HGV Road User Levy Act 2013 (disclosure of information by Revenue and Customs) is amended as follows. U.K.

(2) In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (5) insert—

“(6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I179 Sch. 19 para. 179 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Crime and Courts Act 2013 (c. 22) U.K.

180 U.K. The Crime and Courts Act 2013 is amended as follows.

Commencement Information

I180 Sch. 19 para. 180 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

181 (1) Section 42 (other interpretive provisions) is amended as follows. U.K.

(2) In subsection (5)(a), for “section 13 of the Data Protection Act 1998 (damage or distress suffered as a result of a contravention of a requirement of that Act)” substitute “ Article 82 of the GDPR or section 168 or 169 of the Data Protection Act 2018 (compensation for contravention of the data protection legislation) ”.

(3) After subsection (5) insert—

“(5A) In subsection (5)(a), “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I181 Sch. 19 para. 181 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

182 (1) Paragraph 1 of Schedule 7 (statutory restrictions on disclosure) is amended as follows. U.K.

(2) The existing text becomes sub-paragraph (1).

(3) In that sub-paragraph, in paragraph (a)—

(a) for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) for “are” substitute “ is ”.

(4) After that sub-paragraph, insert—

“(2) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I182 Sch. 19 para. 182 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Marine Act (Northern Ireland) 2013 (c. 10 (N.I.)) U.K.

183 (1) Paragraph 8 of Schedule 2 to the Marine Act (Northern Ireland) 2013 (further provision about fixed monetary penalties under section 35: disclosure of information) is amended as follows. U.K.

(2) In sub-paragraph (5)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After sub-paragraph (6) insert—

“(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I183 Sch. 19 para. 183 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Local Audit and Accountability Act 2014 (c. 2) U.K.

184 (1) Paragraph 3 of Schedule 9 to the Local Audit and Accountability Act 2014 (data matching: voluntary provision of data) is amended as follows. U.K.

(2) In sub-paragraph (3)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After sub-paragraph (3) insert—

“(3A) “The data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

(4) In sub-paragraph (4), for “comprise or include” substitute “ comprises or includes ”.

Commencement Information

I184 Sch. 19 para. 184 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Anti-social Behaviour, Crime and Policing Act 2014 (c. 12) U.K.

185 (1) Paragraph 7 of Schedule 4 to the Anti-social Behaviour, Crime and Policing Act 2014 (anti-social behaviour case reviews: information) is amended as follows. U.K.

(2) In sub-paragraph (4)—

(a) for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) for “are” substitute “ is ”.

(3) After sub-paragraph (5) insert—

“(6) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I185 Sch. 19 para. 185 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Immigration Act 2014 (c. 22) U.K.

186 (1) Paragraph 6 of Schedule 6 to the Immigration Act 2014 (information: limitation on powers) is amended as follows. U.K.

(2) The existing text becomes sub-paragraph (1).

(3) In that sub-paragraph, in paragraph (a)—

(a) for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

(b) for “are” substitute “ is ”.

(4) After that sub-paragraph insert—

“(2) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I186 Sch. 19 para. 186 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Care Act 2014 (c. 23) U.K.

187 U.K. In section 67(9) of the Care Act 2014 (involvement in assessment, plans etc), for paragraph (a) substitute—

“(a) a health record (within the meaning given in section 205 of the Data Protection Act 2018),”.

Commencement Information

I187 Sch. 19 para. 187 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Social Services and Well-being (Wales) Act 2014 (anaw 4) U.K.

188 U.K. In section 18(10)(b) of the Social Services and Well-being (Wales) Act 2014 (registers of sight-impaired, hearing-impaired and other disabled people)—

(a) in the English language text, for “(within the meaning of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”, and

(b) in the Welsh language text, for “(o fewn ystyr “personal data” yn Neddf Diogelu Data 1998)” substitute “(o fewn ystyr “ personal data ” yn Rhan 5 i 7 o Ddeddf Diogelu Data 2018 (gweler adran 3(2) a (14) o'r Ddeddf honno))”.

Commencement Information

I188 Sch. 19 para. 188 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Counter-Terrorism and Security Act 2015 (c. 6) U.K.

189 (1) Section 38 of the Counter-Terrorism and Security Act 2015 (support etc for people vulnerable to being drawn into terrorism: co-operation) is amended as follows. U.K.

(2) In subsection (4)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (4) insert—

“(4A) “The data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I189 Sch. 19 para. 189 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Small Business, Enterprise and Employment Act 2015 (c. 26) U.K.

190 (1) Section 6 of the Small Business, Enterprise and Employment Act 2015 (application of listed provisions to designated credit reference agencies) is amended as follows. U.K.

(2) In subsection (7)—

(a) for paragraph (b) substitute—

“(b) Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers);”, and

(b) omit paragraph (c).

(3) After subsection (7) insert—

“(7A) In subsection (7) “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I190 Sch. 19 para. 190 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Modern Slavery Act 2015 (c. 30) U.K.

191 (1) Section 54A of the Modern Slavery Act 2015 (Gangmasters and Labour Abuse Authority: information gateways) is amended as follows. U.K.

(2) In subsection (5)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (9), after “section” insert “—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I191 Sch. 19 para. 191 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.)) U.K.

192 U.K. The Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 is amended as follows.

Commencement Information

I192 Sch. 19 para. 192 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

193 U.K. In section 13(5) (duty to notify National Crime Agency about suspected victims of certain offences) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I193 Sch. 19 para. 193 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

194 U.K. In section 25(1) (interpretation of this Act), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I194 Sch. 19 para. 194 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

195 U.K. In paragraph 18(5) of Schedule 3 (supply of information to relevant Northern Ireland departments, Secretary of State, etc) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I195 Sch. 19 para. 195 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Justice Act (Northern Ireland) 2015 (c. 9 (N.I.)) U.K.

196 (1) Section 72 of the Justice Act (Northern Ireland) 2015 (supply of information to relevant Northern Ireland departments or Secretary of State) is amended as follows. U.K.

(2) In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (7), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I196 Sch. 19 para. 196 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Immigration Act 2016 (c. 19) U.K.

197 (1) Section 7 of the Immigration Act 2016 (information gateways: supplementary) is amended as follows. U.K.

(2) In subsection (2)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (11), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I197 Sch. 19 para. 197 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Investigatory Powers Act 2016 (c. 25) U.K.

198 U.K. The Investigatory Powers Act 2016 is amended as follows.

Commencement Information

I198 Sch. 19 para. 198 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

199 U.K. In section 1(5)(b), for sub-paragraph (ii) substitute—

“(ii) in section 170 of the Data Protection Act 2018 (unlawful obtaining etc of personal data),”.

Commencement Information

I199 Sch. 19 para. 199 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

200 U.K. In section 199 (bulk personal datasets: interpretation), for subsection (2) substitute—

“(2) In this Part, “personal data” means—

(a) personal data within the meaning of section 3(2) of the Data Protection Act 2018 which is subject to processing described in section 82(1) of that Act, and

(b) data relating to a deceased individual where the data would fall within paragraph (a) if it related to a living individual.”

Commencement Information

I200 Sch. 19 para. 200 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Prospective

F2 201 U.K. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F2 Sch. 19 para. 201 omitted (29.3.2019) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(3), Sch. 4 para. 3

202 U.K. In section 206 (additional safeguards for health records), for subsection (7) substitute—

“(7) In subsection (6)—

• “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204(1) of that Act);

• “health service body” has meaning given by section 204(4) of that Act.”

Commencement Information

I201 Sch. 19 para. 202 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

203 (1) Section 237 (information gateway) is amended as follows. U.K.

(2) In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (2) insert—

“(3) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I202 Sch. 19 para. 203 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.)) U.K.

204 (1) Section 49 of the Police Services Ombudsman Act (Northern Ireland) 2016 (disclosure of information) is amended as follows. U.K.

(2) In subsection (4), for paragraph (a) substitute—

“(a) sections 142 to 154, 160 to 164 and 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”.

(3) For subsection (5) substitute—

“(5) The offences are those under—

(a) any provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (powers of entry and inspection: offences),

(b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

(4) After subsection (6) insert—

“(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I203 Sch. 19 para. 204 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12 (N.I.)) U.K.

205 (1) Section 1 of the Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (control of information of a relevant person) is amended as follows. U.K.

(2) In subsection (8), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.

(3) After subsection (12) insert—

“(12A) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I204 Sch. 19 para. 205 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Mental Capacity Act (Northern Ireland) 2016 (c. 18 (N.I.)) U.K.

206 U.K. In section 306(1) of the Mental Capacity Act (Northern Ireland) 2016 (definitions for purposes of Act), for the definition of “health record” substitute—

““health record” has the meaning given by section 205 of the Data Protection Act 2018;”.

Commencement Information

I205 Sch. 19 para. 206 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Justice Act (Northern Ireland) 2016 (c. 21 (N.I.)) U.K.

207 U.K. The Justice Act (Northern Ireland) 2016 is amended as follows.

Commencement Information

I206 Sch. 19 para. 207 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

208 (1) Section 17 (disclosure of information) is amended as follows. U.K.

(2) In subsection (7), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (8), after “section” insert “—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I207 Sch. 19 para. 208 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

209 U.K. In section 44(3) (disclosure of information)—

(a) in paragraph (a), for “Part 5 of the Data Protection Act 1998” substitute “ sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 ”, and

(b) for paragraph (b) substitute—

“(b) the commission of an offence under—

(i) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc); or

(ii) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

Commencement Information

I208 Sch. 19 para. 209 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Policing and Crime Act 2017 (c. 3) U.K.

210 (1) Section 50 of the Policing and Crime Act 2017 (Freedom of Information Act etc: Police Federation for England and Wales) is amended as follows. U.K.

(2) The existing text becomes subsection (1).

(3) In that subsection, in paragraph (b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) After that subsection, insert—

“(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I209 Sch. 19 para. 210 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Valid from 02/12/2019

Children and Social Work Act 2017 (c. 12) U.K.

211 U.K. In Schedule 5 to the Children and Social Work Act 2017—

(a) in Part 1 (general amendments to do with social workers etc in England), omit paragraph 6, and

(b) in Part 2 (renaming of Health and Social Work Professions Order 2001), omit paragraph 47(g).

Higher Education and Research Act 2017 (c. 29) U.K.

212 U.K. The Higher Education and Research Act 2017 is amended as follows.

Commencement Information

I210 Sch. 19 para. 212 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

213 (1) Section 63 (cooperation and information sharing by the Office for Students) is amended as follows. U.K.

(2) In subsection (6), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) In subsection (7), at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Commencement Information

I211 Sch. 19 para. 213 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

214 (1) Section 112 (cooperation and information sharing between the Office for Students and UKRI) is amended as follows. U.K.

(2) In subsection (6), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (6) insert —

“(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I212 Sch. 19 para. 214 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Digital Economy Act 2017 (c. 30) U.K.

215 U.K. The Digital Economy Act 2017 is amended as follows.

Commencement Information

I213 Sch. 19 para. 215 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

216 (1) Section 40 (further provisions about disclosures under sections 35 to 39) is amended as follows. U.K.

(2) In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (10) insert—

“(11) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I214 Sch. 19 para. 216 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

217 (1) Section 43 (codes of practice) is amended as follows. U.K.

(2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

Commencement Information

I215 Sch. 19 para. 217 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

218 (1) Section 49 (further provision about disclosures under section 48) is amended as follows. U.K.

(2) In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (10) insert—

“(11) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I216 Sch. 19 para. 218 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

219 (1) Section 52 (code of practice) is amended as follows. U.K.

(2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.

Commencement Information

I217 Sch. 19 para. 219 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

220 (1) Section 57 (further provision about disclosures under section 56) is amended as follows. U.K.

(2) In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (10) insert—

“(11) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I218 Sch. 19 para. 220 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

221 (1) Section 60 (code of practice) is amended as follows. U.K.

(2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.

Commencement Information

I219 Sch. 19 para. 221 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

222 (1) Section 65 (supplementary provision about disclosures under section 64) is amended as follows. U.K.

(2) In subsection (2)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After subsection (8) insert—

“(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I220 Sch. 19 para. 222 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

223 (1) Section 70 (code of practice) is amended as follows. U.K.

(2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

(3) In subsection (15), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.

Commencement Information

I221 Sch. 19 para. 223 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

224 U.K. Omit sections 108 to 110 (charges payable to the Information Commissioner).

Commencement Information

I222 Sch. 19 para. 224 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Landfill Disposals Tax (Wales) Act 2017 (anaw 3) U.K.

225 (1) Section 60 of the Landfill Disposals Tax (Wales) Act 2017 (disclosure of information to the Welsh Revenue Authority) is amended as follows. U.K.

(2) In subsection (4)(a)—

(a) in the English language text, for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”, and

(b) in the Welsh language text, for “torri Deddf Diogelu Data 1998 (p. 29)” substitute “torri'r ddeddfwriaeth diogelu data”.

(3) After subsection (7)—

(a) in the English language text insert—

“(8) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”, and

(b) in the Welsh language text insert—

“(8) Yn yr adran hon, mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno).”

Commencement Information

I223 Sch. 19 para. 225 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (anaw 2) U.K.

226 (1) Section 4 of the Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (additional learning needs code) is amended as follows. U.K.

(2) In the English language text—

(a) in subsection (9), omit from “and in this subsection” to the end, and

(b) after subsection (9) insert—

“(9A) In subsection (9)—

• “data subject” (“testun y data”) has the meaning given by section 3(5) of the Data Protection Act 2018;

• “personal data” (“data personol”) has the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).”

(3) In the Welsh language text—

(a) in subsection (9), omit from “ac yn yr is-adran hon” to the end, and

(b) after subsection (9) insert—

“(9A) Yn is-adran (9)—

• mae i “data personol” yr un ystyr ag a roddir i “personal data” yn Rhannau 5 i 7 o Ddeddf Diogelu Data 2018 (gweler adran 3(2) a (14) o'r Ddeddf honno);

• mae i “testun y data” yr ystyr a roddir i “data subject” gan adran 3(5) o'r Ddeddf honno.”

Commencement Information

I224 Sch. 19 para. 226 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Valid from 02/12/2019

This Act U.K.

227 (1) Section 204 of this Act (meaning of “health professional” and “social work professional”) is amended as follows (to reflect the arrangements for the registration of social workers in England under Part 2 of the Children and Social Work Act 2017). U.K.

(2) In subsection (1)(g)—

(a) omit “and Social Work”, and

(b) omit “, other than the social work profession in England”.

(3) In subsection (2), for paragraph (a) substitute—

“(a) a person registered as a social worker in the register maintained by Social Work England under section 39(1) of the Children and Social Work Act 2017;”.

PART 2 U.K. Amendments of other legislation

Estate Agents (Specified Offences) (No. 2) Order 1991 (S.I. 1991/1091) U.K.

228 U.K. In the table in the Schedule to the Estate Agents (Specified Offences) (No. 2) Order 1991 (specified offences), at the end insert—

“Data Protection Act 2018	Section 144	False statements made in response to an information notice
	Section 148	Destroying or falsifying information and documents etc”

Commencement Information

I225 Sch. 19 para. 228 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Channel Tunnel (International Arrangements) Order 1993 (S.I. 1993/1813) U.K.

229 (1) Article 4 of the Channel Tunnel (International Arrangements) Order 1993 (application of enactments) is amended as follows. U.K.

(2) In paragraph (2)—

(a) for “section 5 of the Data Protection Act 1998 (“the 1998 Act”), data which are” substitute “ section 207 of the Data Protection Act 2018 (“the 2018 Act”), data which is ”,

(b) for “data controller” substitute “ controller ”,

(c) after “in the context of” insert “ the activities of ”, and

(d) for “and the 1998 Act” substitute “ and the 2018 Act ”.

(3) In paragraph (3)—

(a) for “section 5 of the 1998 Act, data which are” substitute “ section 207 of the 2018 Act, data which is ”,

(b) for “data controller” substitute “ controller ”,

(c) after “in the context of” insert “ the activities of ”, and

(d) for “and the 1998 Act” substitute “ and the 2018 Act ”.

Commencement Information

I226 Sch. 19 para. 229 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4)) U.K.

230 U.K. The Access to Health Records (Northern Ireland) Order 1993 is amended as follows.

Commencement Information

I227 Sch. 19 para. 230 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

231 U.K. In Article 4 (health professionals), for paragraph (1) substitute—

“(1) In this Order, “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act).”

Commencement Information

I228 Sch. 19 para. 231 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

232 U.K. In Article 5(4)(a) (fees for access to health records), for “under section 7 of the Data Protection Act 1998” substitute “ made by the Department ”.

Commencement Information

I229 Sch. 19 para. 232 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Channel Tunnel (Miscellaneous Provisions) Order 1994 (S.I. 1994/1405) U.K.

233 U.K. In article 4 of the Channel Tunnel (Miscellaneous Provisions) Order 1994 (application of enactments), for paragraphs (2) and (3) substitute—

“(2) For the purposes of section 207 of the Data Protection Act 2018 (“the 2018 Act”), data which is processed in a control zone in Belgium, in connection with the carrying out of frontier controls, by an officer belonging to the United Kingdom is to be treated as processed by a controller established in the United Kingdom in the context of the activities of that establishment (and accordingly the 2018 Act applies in respect of such data).

(3) For the purposes of section 207 of the 2018 Act, data which is processed in a control zone in Belgium, in connection with the carrying out of frontier controls, by an officer belonging to the Kingdom of Belgium is to be treated as processed by a controller established in the Kingdom of Belgium in the context of the activities of that establishment (and accordingly the 2018 Act does not apply in respect of such data).”

Commencement Information

I230 Sch. 19 para. 233 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

European Primary and Specialist Dental Qualifications Regulations 1998 (S.I. 1998/811) U.K.

234 U.K. The European Primary and Specialist Dental Qualifications Regulations 1998 are amended as follows.

Commencement Information

I231 Sch. 19 para. 234 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

235 (1) Regulation 2(1) (interpretation) is amended as follows. U.K.

(2) Omit the definition of “Directive 95/46/EC”.

(3) At the appropriate place insert—

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

Commencement Information

I232 Sch. 19 para. 235 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

236 (1) The table in Schedule A1 (functions of the GDC under Directive 2005/36) is amended as follows. U.K.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Commencement Information

I233 Sch. 19 para. 236 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (S.I. 1999/677) U.K.

237 U.K. For article 7 of the Scottish Parliamentary Corporate Body (Crown Status) Order 1999 substitute—

“Data Protection Act 2018 U.K.

7 (1) The Parliamentary corporation is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article.

(2) The Parliamentary corporation is to be treated as a government department for the purposes of the following provisions—

(a) section 8(d) (lawfulness of processing under the GDPR: public interest etc),

(b) section 209 (application to the Crown),

(c) paragraph 6 of Schedule 1 (statutory etc and government purposes),

(d) paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and

(e) paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data).

(3) In the provisions mentioned in paragraph (4)—

(a) references to employment by or under the Crown are to be treated as including employment as a member of staff of the Parliamentary corporation, and

(b) references to a person in the service of the Crown are to be treated as including a person so employed.

(4) The provisions are—

(a) section 24(3) (exemption for certain data relating to employment under the Crown), and

(b) section 209(6) (application of certain provisions to a person in the service of the Crown).

(5) In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).”

Commencement Information

I234 Sch. 19 para. 237 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Northern Ireland Assembly Commission (Crown Status) Order 1999 (S.I. 1999/3145) U.K.

238 U.K. For article 9 of the Northern Ireland Assembly Commission (Crown Status) Order 1999 substitute—

“Data Protection Act 2018 U.K.

9 (1) The Commission is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article.

(2) The Commission is to be treated as a government department for the purposes of the following provisions—

(a) section 8(d) (lawfulness of processing under the GDPR: public interest etc),

(b) section 209 (application to the Crown),

(c) paragraph 6 of Schedule 1 (statutory etc and government purposes),

(d) paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and

(e) paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data).

(3) In the provisions mentioned in paragraph (4)—

(a) references to employment by or under the Crown are to be treated as including employment as a member of staff of the Commission, and

(b) references to a person in the service of the Crown are to be treated as including a person so employed.

(4) The provisions are—

(a) section 24(3) (exemption for certain data relating to employment under the Crown), and

(b) section 209(6) (application of certain provisions to a person in the service of the Crown).

(5) In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).”

Commencement Information

I235 Sch. 19 para. 238 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184) U.K.

239 U.K. The Data Protection (Corporate Finance Exemption) Order 2000 is revoked.

Commencement Information

I236 Sch. 19 para. 239 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 (S.I. 2000/185) U.K.

240 U.K. The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 is revoked.

Commencement Information

I237 Sch. 19 para. 240 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186) U.K.

241 U.K. The Data Protection (Functions of Designated Authority) Order 2000 is revoked.

Commencement Information

I238 Sch. 19 para. 241 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (International Co-operation) Order 2000 (S.I. 2000/190) U.K.

242 U.K. The Data Protection (International Co-operation) Order 2000 is revoked.

Commencement Information

I239 Sch. 19 para. 242 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191) U.K.

243 U.K. The Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 are revoked.

Commencement Information

I240 Sch. 19 para. 243 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290) U.K.

244 U.K. In the Consumer Credit (Credit Reference Agency) Regulations 2000, regulation 4(1) and Schedule 1 (statement of rights under section 9(3) of the Data Protection Act 1998) are revoked.

Commencement Information

I241 Sch. 19 para. 244 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413) U.K.

245 U.K. The Data Protection (Subject Access Modification) (Health) Order 2000 is revoked.

Commencement Information

I242 Sch. 19 para. 245 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414) U.K.

246 U.K. The Data Protection (Subject Access Modification) (Education) Order 2000 is revoked.

Commencement Information

I243 Sch. 19 para. 246 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415) U.K.

247 U.K. The Data Protection (Subject Access Modification) (Social Work) Order 2000 is revoked.

Commencement Information

I244 Sch. 19 para. 247 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416) U.K.

248 U.K. The Data Protection (Crown Appointments) Order 2000 is revoked.

Commencement Information

I245 Sch. 19 para. 248 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417) U.K.

249 U.K. The Data Protection (Processing of Sensitive Personal Data) Order 2000 is revoked.

Commencement Information

I246 Sch. 19 para. 249 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419) U.K.

250 U.K. The Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 is revoked.

Commencement Information

I247 Sch. 19 para. 250 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864) U.K.

251 U.K. The Data Protection (Designated Codes of Practice) (No. 2) Order 2000 is revoked.

Commencement Information

I248 Sch. 19 para. 251 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Representation of the People (England and Wales) Regulations 2001 (S.I. 2001/341) U.K.

252 U.K. The Representation of the People (England and Wales) Regulations 2001 are amended as follows.

Commencement Information

I249 Sch. 19 para. 252 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

253 U.K. In regulation 3(1) (interpretation), at the appropriate places insert—

““Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”;

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”;

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.

Commencement Information

I250 Sch. 19 para. 253 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

254 U.K. In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I251 Sch. 19 para. 254 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

255 U.K. In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I252 Sch. 19 para. 255 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

256 U.K. In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I253 Sch. 19 para. 256 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

257 U.K. In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute—

“(a) Article 89 GDPR purposes;”.

Commencement Information

I254 Sch. 19 para. 257 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

258 (1) Regulation 92(2) (interpretation and application of Part VI etc) is amended as follows. U.K.

(2) After sub-paragraph (b) insert—

“(ba) “relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards.”

(3) Omit sub-paragraphs (c) and (d).

Commencement Information

I255 Sch. 19 para. 258 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

259 U.K. In regulation 96(2A)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.

Commencement Information

I256 Sch. 19 para. 259 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

260 U.K. In regulation 97(5) and (6) (supply of free copy of full register to the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

Commencement Information

I257 Sch. 19 para. 260 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

261 U.K. In regulation 97A(7) and (8) (supply of free copy of full register to the National Library of Wales and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

Commencement Information

I258 Sch. 19 para. 261 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

262 U.K. In regulation 99(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

Commencement Information

I259 Sch. 19 para. 262 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

263 U.K. In regulation 109A(9) and (10) (supply of free copy of full register to public libraries and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

Commencement Information

I260 Sch. 19 para. 263 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

264 U.K. In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”) substitute—

“(i) Article 89 GDPR purposes;”.

Commencement Information

I261 Sch. 19 para. 264 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Representation of the People (Scotland) Regulations 2001 (S.I. 2001/497) U.K.

265 U.K. The Representation of the People (Scotland) Regulations 2001 are amended as follows.

Commencement Information

I262 Sch. 19 para. 265 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

266 U.K. In regulation 3(1) (interpretation), at the appropriate places, insert—

““Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”;

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”;

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.

Commencement Information

I263 Sch. 19 para. 266 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

267 U.K. In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I264 Sch. 19 para. 267 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

268 U.K. In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I265 Sch. 19 para. 268 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

269 U.K. In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I266 Sch. 19 para. 269 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

270 U.K. In regulation 61(3) (records and lists kept under Schedule 4), for paragraph (a) (but not the final “or”) substitute—

“(a) Article 89 GDPR purposes;”.

Commencement Information

I267 Sch. 19 para. 270 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

271 U.K. In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute—

“(a) Article 89 GDPR purposes;”.

Commencement Information

I268 Sch. 19 para. 271 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

272 (1) Regulation 92(2) (interpretation of Part VI etc) is amended as follows. U.K.

(2) After sub-paragraph (b) insert—

“(ba) “relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards.”

(3) Omit sub-paragraphs (c) and (d).

Commencement Information

I269 Sch. 19 para. 272 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

273 U.K. In regulation 95(3)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.

Commencement Information

I270 Sch. 19 para. 273 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

274 U.K. In regulation 96(5) and (6) (supply of free copy of full register to the National Library of Scotland and the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

Commencement Information

I271 Sch. 19 para. 274 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

275 U.K. In regulation 98(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

Commencement Information

I272 Sch. 19 para. 275 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

276 U.K. In regulation 108A(9) and (10) (supply of full register to statutory library authorities and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

Commencement Information

I273 Sch. 19 para. 276 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

277 U.K. In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”) substitute—

“(i) Article 89 GDPR purposes;”.

Commencement Information

I274 Sch. 19 para. 277 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (S.I. 2001/2188) U.K.

278 (1) Article 9 of the Financial Services and Markets 2000 (Disclosure of Confidential Information) Regulations 2001 (disclosure by regulators or regulator workers to certain other persons) is amended as follows. U.K.

(2) In paragraph (2B), for sub-paragraph (a) substitute—

“(a) the disclosure is made in accordance with Chapter V of the GDPR;”.

(3) After paragraph (5) insert—

“(6) In this article, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I275 Sch. 19 para. 278 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Nursing and Midwifery Order 2001 (S.I. 2002/253) U.K.

279 U.K. The Nursing and Midwifery Order 2001 is amended as follows.

Commencement Information

I276 Sch. 19 para. 279 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

280 (1) Article 3 (the Nursing and Midwifery Council and its Committees) is amended as follows. U.K.

(2) In paragraph (18), after “enactment” insert “ or the GDPR ”.

(3) After paragraph (18) insert—

“(19) In this paragraph, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I277 Sch. 19 para. 280 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

281 (1) Article 25 (the Council's power to require disclosure of information) is amended as follows. U.K.

(2) In paragraph (3), after “enactment” insert “ or the GDPR ”.

(3) In paragraph (6)—

(a) for “paragraph (5),” substitute “ paragraph (3)— ”, and

(b) at the appropriate place insert—

““the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I278 Sch. 19 para. 281 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

282 U.K. In article 39B (European professional card), after paragraph (2) insert—

“(3) For the purposes of Schedule 2B, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”

Commencement Information

I279 Sch. 19 para. 282 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

283 U.K. In article 40(6) (Directive 2005/36/EC: designation of competent authority etc), at the appropriate place insert—

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

Commencement Information

I280 Sch. 19 para. 283 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

284 (1) Schedule 2B (Directive 2005/36/EC: European professional card) is amended as follows. U.K.

(2) In paragraph 8(1) (access to data) for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In paragraph 9 (processing data), omit sub-paragraph (2) (deeming the Society to be the controller for the purposes of Directive 95/46/EC).

Commencement Information

I281 Sch. 19 para. 284 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

285 (1) The table in Schedule 3 (functions of the Council under Directive 2005/36) is amended as follows. U.K.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Commencement Information

I282 Sch. 19 para. 285 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

286 U.K. In Schedule 4 (interpretation), omit the definition of “Directive 95/46/EC”.

Commencement Information

I283 Sch. 19 para. 286 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Electronic Commerce (EC Directive) Regulations 2002 (S.I. 2002/2013) U.K.

287 U.K. Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002 (exclusions) is amended as follows.

Commencement Information

I284 Sch. 19 para. 287 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

288 U.K. In paragraph (1)(b) for “the Data Protection Directive and the Telecommunications Data Protection Directive” substitute “ the GDPR ”.

Commencement Information

I285 Sch. 19 para. 288 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

289 U.K. In paragraph (3)—

(a) omit the definitions of “Data Protection Directive” and “Telecommunications Data Protection Directive”, and

(b) at the appropriate place insert—

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.

Commencement Information

I286 Sch. 19 para. 289 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 (S.I. 2002/2905) U.K.

290 U.K. The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 is revoked.

Commencement Information

I287 Sch. 19 para. 290 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426) U.K.

291 U.K. The Privacy and Electronic Communications (EC Directive) Regulations 2003 are amended as follows.

Commencement Information

I288 Sch. 19 para. 291 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

292 U.K. In regulation 2(1) (interpretation), in the definition of “the Information Commissioner” and “the Commissioner”, for “section 6 of the Data Protection Act 1998” substitute “ the Data Protection Act 2018 ”.

Commencement Information

I289 Sch. 19 para. 292 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

293 (1) Regulation 4 (relationship between these Regulations and the Data Protection Act 1998) is amended as follows. U.K.

(2) The existing text becomes sub-paragraph (1).

(3) In that sub-paragraph, for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) After that sub-paragraph insert—

“(2) In this regulation—

• “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

• “personal data” and “processing” have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4) and (14) of that Act).

(3) Regulation 2(2) and (3) (meaning of certain expressions) do not apply for the purposes of this regulation.”

(5) In the heading of that regulation, for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Commencement Information

I290 Sch. 19 para. 293 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818) U.K.

294 U.K. The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 is amended as follows.

Commencement Information

I291 Sch. 19 para. 294 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

295 U.K. In article 8(2) (exercise of powers by French officers in a control zone in the United Kingdom: disapplication of law of England and Wales)—

(a) for “The Data Protection Act 1998” substitute “ The Data Protection Act 2018 ”, and

(b) for “are” substitute “ is ”.

Commencement Information

I292 Sch. 19 para. 295 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

296 U.K. In article 11(4) (exercise of powers by UK immigration officers and constables in a control zone in France: enactments having effect)—

(a) for “The Data Protection Act 1998” substitute “ The Data Protection Act 2018 ”,

(b) for “are” substitute “ is ”,

(c) for “section 5” substitute “ section 207 ”,

(d) for “data controller” substitute “ controller ”, and

(e) after “in the context of” insert “ the activities of ”.

Commencement Information

I293 Sch. 19 para. 296 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Pupils' Educational Records (Scotland) Regulations 2003 (S.S.I. 2003/581) U.K.

297 U.K. The Pupils' Educational Records (Scotland) Regulations 2003 are amended as follows.

Commencement Information

I294 Sch. 19 para. 297 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

298 (1) Regulation 2 (interpretation) is amended as follows. U.K.

(2) Omit the definition of “the 1998 Act”.

(3) At the appropriate place insert—

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

Commencement Information

I295 Sch. 19 para. 298 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

299 (1) Regulation 6 (circumstances where information should not be disclosed) is amended as follows. U.K.

(2) After “any information” insert “ to the extent that any of the following conditions are satisfied ”.

(3) For paragraphs (a) to (c) substitute—

“(aa) the pupil to whom the information relates would have no right of access to the information under the GDPR;

(ab) the information is personal data described in Article 9(1) or 10 of the GDPR (special categories of personal data and personal data relating to criminal convictions and offences);”.

(4) In paragraph (d), for “to the extent that its disclosure” substitute “ the disclosure of the information ”.

(5) In paragraph (e), for “that” substitute “ the information ”.

Commencement Information

I296 Sch. 19 para. 299 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

300 U.K. In regulation 9 (fees), for paragraph (1) substitute—

“(1A) In complying with a request made under regulation 5(2), the responsible body may only charge a fee where Article 12(5) or Article 15(3) of the GDPR would permit the charging of a fee if the request had been made by the pupil to whom the information relates under Article 15 of the GDPR.

(1B) Where paragraph (1A) permits the charging of a fee, the responsible body may not charge a fee that—

(a) exceeds the cost of supply, or

(b) exceeds any limit in regulations made under section 12 of the Data Protection Act 2018 that would apply if the request had been made by the pupil to whom the information relates under Article 15 of the GDPR.”

Commencement Information

I297 Sch. 19 para. 300 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

European Parliamentary Elections (Northern Ireland) Regulations 2004 (S.I. 2004/1267) U.K.

301 U.K. Schedule 1 to the European Parliamentary Elections (Northern Ireland) Regulations 2004 (European Parliamentary elections rules) is amended as follows.

Commencement Information

I298 Sch. 19 para. 301 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

302 (1) Paragraph 74(1) (interpretation) is amended as follows. U.K.

(2) Omit the definitions of “relevant conditions” and “research purposes”.

(3) At the appropriate places insert—

““Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”;

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.

Commencement Information

I299 Sch. 19 para. 302 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

303 U.K. In paragraph 77(2)(b) (conditions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “ Article 89 GDPR purposes ”.

Commencement Information

I300 Sch. 19 para. 303 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244) U.K.

304 U.K. In regulation 3(1) of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, omit “the appropriate limit referred to in section 9A(3) and (4) of the 1998 Act and”.

Commencement Information

I301 Sch. 19 para. 304 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Environmental Information Regulations 2004 (S.I. 2004/3391) U.K.

305 U.K. The Environmental Information Regulations 2004 are amended as follows.

Commencement Information

I302 Sch. 19 para. 305 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

306 (1) Regulation 2 (interpretation) is amended as follows. U.K.

(2) In paragraph (1), at the appropriate places, insert—

““the data protection principles” means the principles set out in—

(a) Article 5(1) of the GDPR,

(b) section 34(1) of the Data Protection Act 2018, and

(c) section 85(1) of that Act;”;

““data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”;

““the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);”;

““personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);”.

(3) For paragraph (4) substitute—

“(4A) In these Regulations, references to the Data Protection Act 2018 have effect as if in Chapter 3 of Part 2 of that Act (other general processing)—

(a) the references to an FOI public authority were references to a public authority as defined in these Regulations, and

(b) the references to personal data held by such an authority were to be interpreted in accordance with regulation 3(2).”

Commencement Information

I303 Sch. 19 para. 306 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

307 (1) Regulation 13 (personal data) is amended as follows. U.K.

(2) For paragraph (1) substitute—

“(1) To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if—

(a) the first condition is satisfied, or

(b) the second or third condition is satisfied and, in all the circumstances of the case, the public interest in not disclosing the information outweighs the public interest in disclosing it.”

(3) For paragraph (2) substitute—

“(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations—

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(2B) The second condition is that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene—

(a) Article 21 of the GDPR (general processing: right to object to processing), or

(b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).”

(4) For paragraph (3) substitute—

“(3A) The third condition is that—

(a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018,

(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or

(c) on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.”

(5) Omit paragraph (4).

(6) For paragraph (5) substitute—

“(5A) For the purposes of this regulation a public authority may respond to a request by neither confirming nor denying whether such information exists and is held by the public authority, whether or not it holds such information, to the extent that—

(a) the condition in paragraph (5B)(a) is satisfied, or

(b) a condition in paragraph (5B)(b) to (e) is satisfied and in all the circumstances of the case, the public interest in not confirming or denying whether the information exists outweighs the public interest in doing so.

(5B) The conditions mentioned in paragraph (5A) are—

(a) giving a member of the public the confirmation or denial—

(i) would (apart from these Regulations) contravene any of the data protection principles, or

(ii) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded;

(b) giving a member of the public the confirmation or denial would (apart from these Regulations) contravene Article 21 of the GDPR or section 99 of the Data Protection Act 2018 (right to object to processing);

(c) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in paragraph (3A)(a);

(d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section;

(e) on a request under section 94(1)(a) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.”

(7) After that paragraph insert—

“(6) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”

Commencement Information

I304 Sch. 19 para. 307 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

308 U.K. In regulation 14 (refusal to disclose information), in paragraph (3)(b), for “regulations 13(2)(a)(ii) or 13(3)” substitute “ regulation 13(1)(b) or (5A) ”.

Commencement Information

I305 Sch. 19 para. 308 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

309 U.K. In regulation 18 (enforcement and appeal provisions), in paragraph (5), for “regulation 13(5)” substitute “ regulation 13(5A) ”.

Commencement Information

I306 Sch. 19 para. 309 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520) U.K.

310 U.K. The Environmental Information (Scotland) Regulations 2004 are amended as follows.

Commencement Information

I307 Sch. 19 para. 310 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

311 (1) Regulation 2 (interpretation) is amended as follows. U.K.

(2) In paragraph (1), at the appropriate places, insert—

““the data protection principles” means the principles set out in—

(a) Article 5(1) of the GDPR, and

(b) section 34(1) of the Data Protection Act 2018;”;”;

““data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”;

““the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);”;

““personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);”.

(3) For paragraph (3) substitute—

“(3A) In these Regulations, references to the Data Protection Act 2018 have effect as if in Chapter 3 of Part 2 of that Act (other general processing)—

(a) the references to an FOI public authority were references to a Scottish public authority as defined in these Regulations, and

(b) the references to personal data held by such an authority were to be interpreted in accordance with paragraph (2) of this regulation.”

Commencement Information

I308 Sch. 19 para. 311 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

312 (1) Regulation 11 (personal data) is amended as follows. U.K.

(2) For paragraph (2) substitute—

“(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if—

(a) the first condition set out in paragraph (3A) is satisfied, or

(b) the second or third condition set out in paragraph (3B) or (4A) is satisfied and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.”

(3) For paragraph (3) substitute—

“(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations—

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene Article 21 of the GDPR (general processing: right to object to processing).”

(4) For paragraph (4) substitute—

“(4A) The third condition is that any of the following applies to the information—

(a) it is exempt from the obligation under Article 15(1) of the GDPR (general processing: right of access by the data subject) to provide access to, and information about, personal data by virtue of provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or

(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.”

(5) Omit paragraph (5).

(6) After paragraph (6) insert—

“(7) In determining, for the purposes of this regulation, whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”

Commencement Information

I309 Sch. 19 para. 312 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Licensing Act 2003 (Personal Licences) Regulations 2005 (S.I. 2005/41) U.K.

313 (1) Regulation 7 of the Licensing Act 2003 (Personal Licences) Regulations 2005 (application for grant of a personal licence) is amended as follows. U.K.

(2) In paragraph (1)(b)—

(a) for paragraph (iii) (but not the final “, and”) substitute—

“(iii) the results of a request made under Article 15 of the GDPR or section 45 of the Data Protection Act 2018 (rights of access by the data subject) to the National Identification Service for information contained in the Police National Computer”, and

(b) in the words following paragraph (iii), omit “search”.

(3) After paragraph (2) insert—

“(3) In this regulation, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I310 Sch. 19 para. 313 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Education (Pupil Information) (England) Regulations 2005 (S.I. 2005/1437) U.K.

314 U.K. The Education (Pupil Information) (England) Regulations 2005 are amended as follows.

Commencement Information

I311 Sch. 19 para. 314 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

315 U.K. In regulation 3(5) (meaning of educational record) for “section 1(1) of the Data Protection Act 1998” substitute “ section 3(4) of the Data Protection Act 2018 ”.

Commencement Information

I312 Sch. 19 para. 315 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

316 (1) Regulation 5 (disclosure of curricular and educational records) is amended as follows. U.K.

(2) In paragraph (4)—

(a) in sub-paragraph (a), for “the Data Protection Act 1998” substitute “ the GDPR ”, and

(b) in sub-paragraph (b), for “that Act or by virtue of any order made under section 30(2) or section 38(1) of the Act” substitute “ the GDPR ”.

(3) After paragraph (6) insert—

“(7) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”

Commencement Information

I313 Sch. 19 para. 316 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042) U.K.

317 (1) Regulation 45 of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (sensitive information) is amended as follows. U.K.

(2) In paragraph (1)(d)—

(a) omit “, within the meaning of section 1(1) of the Data Protection Act 1998”, and

(b) for “(2) or (3)” substitute “ (1A), (1B) or (1C) ”.

(3) After paragraph (1) insert—

“(1A) The condition in this paragraph is that the disclosure of the information to a member of the public—

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(1B) The condition in this paragraph is that the disclosure of the information to a member of the public would contravene—

(a) Article 21 of the GDPR (general processing: right to object to processing), or

(b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).

(1C) The condition in this paragraph is that—

(a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018,

(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or

(c) on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.

(1D) In this regulation—

• “the data protection principles” means the principles set out in—

  (a)

  Article 5(1) of the GDPR,

  (b)

  section 34(1) of the Data Protection Act 2018, and

  (c)

  section 85(1) of that Act;

• “the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

• “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

(1E) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”

(4) Omit paragraphs (2) to (4).

Commencement Information

I314 Sch. 19 para. 317 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Register of Judgments, Orders and Fines Regulations 2005 (S.I. 2005/3595) U.K.

318 U.K. In regulation 3 of the Register of Judgments, Orders and Fines Regulations 2005 (interpretation)—

(a) for the definition of “data protection principles” substitute—

““data protection principles” means the principles set out in Article 5(1) of the GDPR;”, and

(b) at the appropriate place insert—

““the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);”.

Commencement Information

I315 Sch. 19 para. 318 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494) U.K.

319 U.K. The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 are amended as follows.

Commencement Information

I316 Sch. 19 para. 319 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

320 (1) Regulation 39 (sensitive information) is amended as follows. U.K.

(2) In paragraph (1)(d)—

(a) omit “, within the meaning of section 1(1) of the Data Protection Act 1998”, and

(b) for “(2) or (3)” substitute “ (1A), (1B) or (1C) ”.

(3) After paragraph (1) insert—

“(1A) The condition in this paragraph is that the disclosure of the information to a member of the public—

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(1B) The condition in this paragraph is that the disclosure of the information to a member of the public would contravene—

(a) Article 21 of the GDPR (general processing: right to object to processing), or

(b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).

(1C) The condition in this paragraph is that—

(a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018,

(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or

(c) on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.

(1D) In this regulation—

• “the data protection principles” means the principles set out in—

  (a)

  Article 5(1) of the GDPR,

  (b)

  section 34(1) of the Data Protection Act 2018, and

  (c)

  section 85(1) of that Act;

• “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

• “the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

• “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

(1E) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”

(4) Omit paragraphs (2) to (4).

Commencement Information

I317 Sch. 19 para. 320 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Processing of Sensitive Personal Data) Order 2006 (S.I. 2006/2068) U.K.

321 U.K. The Data Protection (Processing of Sensitive Personal Data) Order 2006 is revoked.

Commencement Information

I318 Sch. 19 para. 321 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

National Assembly for Wales (Representation of the People) Order 2007 (S.I. 2007/236) U.K.

322 (1) Paragraph 14 of Schedule 1 to the National Assembly for Wales (Representation of the People) Order 2007 (absent voting at Assembly elections: conditions on the use, supply and inspection of absent vote records or lists) is amended as follows. U.K.

(2) The existing text becomes sub-paragraph (1).

(3) For paragraph (a) of that sub-paragraph (but not the final “or”) substitute—

“(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”.

(4) After that sub-paragraph insert—

“(2) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”

Commencement Information

I319 Sch. 19 para. 322 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (S.I. 2007/679) U.K.

323 U.K. In regulation 3 of the Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (research which may be carried out despite a participant's loss of capacity), for paragraph (b) substitute—

“(b) any material used consists of or includes human cells or human DNA,”.

Commencement Information

I320 Sch. 19 para. 323 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118) U.K.

324 U.K. For article 5 of the National Assembly for Wales Commission (Crown Status) Order 2007 substitute—

“Data Protection Act 2018 U.K.

5 (1) The Assembly Commission is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article.

(2) The Assembly Commission is to be treated as a government department for the purposes of the following provisions—

(a) section 8(d) (lawfulness of processing under the GDPR: public interest etc),

(b) section 209 (application to the Crown),

(c) paragraph 6 of Schedule 1 (statutory etc and government purposes),

(d) paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and

(e) paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data).

(3) In the provisions mentioned in paragraph (4)—

(a) references to employment by or under the Crown are to be treated as including employment as a member of staff of the Assembly Commission, and

(b) references to a person in the service of the Crown are to be treated as including a person so employed.

(4) The provisions are—

(a) section 24(3) (exemption for certain data relating to employment under the Crown), and

(b) section 209(6) (application of certain provisions to a person in the service of the Crown).

(5) In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).”

Commencement Information

I321 Sch. 19 para. 324 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (S.I. 2007/837 (W.72)) U.K.

325 U.K. In regulation 3 of the Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (research which may be carried out despite a participant's loss of capacity) —

(a) in the English language text, for paragraph (c) substitute—

“(c) any material used consists of or includes human cells or human DNA; and”, and

(b) in the Welsh language text, for paragraph (c) substitute—

“(c) os yw unrhyw ddeunydd a ddefnyddir yn gelloedd dynol neu'n DNA dynol neu yn eu cynnwys; ac”.

Commencement Information

I322 Sch. 19 para. 325 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (S.S.I. 2007/170) U.K.

326 (1) Regulation 18 of the Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (conditions on the supply and inspection of absent voter records or lists) is amended as follows. U.K.

(2) In paragraph (1), for sub-paragraph (a) (but not the final “or”) substitute—

“(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”.

(3) After paragraph (1) insert—

“(2) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”

Commencement Information

I323 Sch. 19 para. 326 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (S.S.I. 2007/264) U.K.

327 U.K. In regulation 5 of the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (conditions on the use, supply and disclosure of documents open to public inspection)—

(a) in paragraph (2), for sub-paragraph (i) (but not the final “or”) substitute—

“(i) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”, and

(b) after paragraph (3) insert—

“(4) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”

Commencement Information

I324 Sch. 19 para. 327 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 (S.R. (N.I.) 2007 No. 43) U.K.

328 U.K. The Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 are amended as follows.

Commencement Information

I325 Sch. 19 para. 328 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

329 U.K. In regulation 2 (interpretation), at the appropriate place insert—

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

Commencement Information

I326 Sch. 19 para. 329 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

330 U.K. In regulation 10(2) (duties of Boards of Governors), for “documents which are the subject of an order under section 30(2) of the Data Protection Act 1998” substitute “ information to which the pupil to whom the information relates would have no right of access under the GDPR ”.

Commencement Information

I327 Sch. 19 para. 330 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Representation of the People (Northern Ireland) Regulations 2008 (S.I. 2008/1741) U.K.

331 U.K. In regulation 118 of the Representation of the People (Northern Ireland) Regulations 2008 (conditions on the use, supply and disclosure of documents open to public inspection)—

(a) in paragraph (2), for “research purposes within the meaning of that term in section 33 of the Data Protection Act 1998” substitute “ purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics) ”, and

(b) after paragraph (3) insert—

“(4) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”

Commencement Information

I328 Sch. 19 para. 331 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (S.I. 2008/3122) U.K.

332 U.K. In paragraph 1(c) of the Schedule to the Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (modifications with which Chapter 1 of Part 28 of the Companies Act 2006 extends to the Isle of Man), for “the Data Protection Act 1998 (c 29)” substitute “ the data protection legislation ”.

Commencement Information

I329 Sch. 19 para. 332 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 (S.I. 2008/3239 (W.286)) U.K.

333 U.K. The Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 are amended as follows.

Commencement Information

I330 Sch. 19 para. 333 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

334 U.K. In regulation 2(1) (interpretation)—

(a) at the appropriate place in the English language text insert—

““the GDPR” (“y GDPR”) and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);”, and

(b) at the appropriate place in the Welsh language text insert—

““mae i “y GDPR” a chyfeiriadau at Atodlen 2 i Ddeddf Diogelu Data 2018 yr un ystyr ag a roddir i “the GDPR” a chyfeiriadau at yr Atodlen honno yn Rhannau 5 i 7 o'r Ddeddf honno (gweler adran 3(10), (11) a (14) o'r Ddeddf honno);”.”

Commencement Information

I331 Sch. 19 para. 334 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

335 (1) Regulation 25 (duty to co-operate by disclosing information as regards relevant persons) is amended as follows. U.K.

(2) In paragraph (7)—

(a) in the English language text, at the end insert “ or the GDPR ”, and

(b) in the Welsh language text, at the end insert “neu'r GDPR”.

(3) For paragraph (8)—

(a) in the English language text substitute—

“(8) In determining for the purposes of paragraph (7) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”, and

(b) in the Welsh language text substitute—

“(8) Wrth benderfynu at ddibenion paragraff (7) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.”

Commencement Information

I332 Sch. 19 para. 335 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

336 (1) Regulation 26 (responsible bodies requesting additional information be disclosed about relevant persons) is amended as follows. U.K.

(2) In paragraph (6)—

(a) in the English language text, at the end insert “ or the GDPR ”, and

(b) in the Welsh language text, at the end insert “neu'r GDPR”.

(3) For paragraph (7)—

(a) in the English language text substitute—

“(7) In determining for the purposes of paragraph (6) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”, and

(b) in the Welsh language text substitute—

“(7) Wrth benderfynu at ddibenion paragraff (6) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.”

Commencement Information

I333 Sch. 19 para. 336 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

337 (1) Regulation 29 (occurrence reports) is amended as follows. U.K.

(2) In paragraph (3)—

(a) in the English language text, at the end insert “ or the GDPR ”, and

(b) in the Welsh language text, at the end insert “neu'r GDPR”.

(3) For paragraph (4)—

(a) in the English language text substitute—

“(4) In determining for the purposes of paragraph (3) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”, and

(b) in the Welsh language text substitute—

“(4) Wrth benderfynu at ddibenion paragraff (3) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.”

Commencement Information

I334 Sch. 19 para. 337 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (S.R. (N.I.) 2008 No. 3) U.K.

338 (1) Regulation 5 of the Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (information whose disclosure would be affected by the application of other legislation) is amended as follows. U.K.

(2) In paragraph (3)—

(a) omit “within the meaning of section 1(1) of the Data Protection Act 1998”, and

(b) for the words from “where” to the end substitute “ if the condition in paragraph (3A) or (3B) is satisfied ”.

(3) After paragraph (3) insert—

“(3A) The condition in this paragraph is that the disclosure of the information to a member of the public—

(a) would contravene any of the data protection principles, or

(b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

(3B) The condition in this paragraph is that the disclosure of the information to a member of the public would contravene—

(a) Article 21 of the GDPR (general processing: right to object to processing), or

(b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).”

(4) After paragraph (4) insert—

“(5) In this regulation—

• “the data protection principles” means the principles set out in—

  (a)

  Article 5(1) of the GDPR,

  (b)

  section 34(1) of the Data Protection Act 2018, and

  (c)

  section 85(1) of that Act;

• “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);

• “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).”

Commencement Information

I335 Sch. 19 para. 338 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Companies (Disclosure of Address) Regulations 2009 (S.I. 2009/214) U.K.

339 (1) Paragraph 6 of Schedule 2 to the Companies (Disclosure of Address) Regulations 2009 (conditions for permitted disclosure to a credit reference agency) is amended as follows. U.K.

(2) The existing text becomes sub-paragraph (1).

(3) In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—

“(ii) for the purposes of ensuring that it complies with its data protection obligations;”.

(4) In paragraph (c) of that sub-paragraph—

(a) omit “or” at the end of sub-paragraph (i), and

(b) at the end insert “; or

(iii) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);”.

(5) After paragraph (c) of that sub-paragraph insert—

“(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.”

(6) After sub-paragraph (1) insert—

“(2) In this paragraph, “data protection obligations”, in relation to a credit reference agency, means—

(a) where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);

(b) where the agency carries on business in a EEA State other than the United Kingdom, obligations under—

(i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018),

(ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and

(iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).”

Commencement Information

I336 Sch. 19 para. 339 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Overseas Companies Regulations 2009 (S.I. 2009/1801) U.K.

340 (1) Paragraph 6 of Schedule 2 to the Overseas Companies Regulations 2009 (conditions for permitted disclosure to a credit reference agency) is amended as follows. U.K.

(2) The existing text becomes sub-paragraph (1).

(3) In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—

“(ii) for the purposes of ensuring that it complies with its data protection obligations;”.

(4) In paragraph (c) of that sub-paragraph—

(a) omit “or” at the end of sub-paragraph (i), and

(b) at the end insert “; or

(iii) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);”.

(5) After paragraph (c) of that sub-paragraph insert—

“(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.”

(6) After sub-paragraph (1) insert—

“(2) In this paragraph, “data protection obligations”, in relation to a credit reference agency, means—

(a) where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);

(b) where the agency carries on business in a EEA State other than the United Kingdom, obligations under—

(i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018),

(ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and

(iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).”

Commencement Information

I337 Sch. 19 para. 340 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Processing of Sensitive Personal Data) Order 2009 (S.I. 2009/1811) U.K.

341 U.K. The Data Protection (Processing of Sensitive Personal Data) Order 2009 is revoked.

Commencement Information

I338 Sch. 19 para. 341 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Provision of Services Regulations 2009 (S.I. 2009/2999) U.K.

342 U.K. In regulation 25 of the Provision of Services Regulations 2009 (derogations from the freedom to provide services), for paragraph (d) substitute—

“(d) matters covered by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.

Commencement Information

I339 Sch. 19 para. 342 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

INSPIRE Regulations 2009 (S.I. 2009/3157) U.K.

343 (1) Regulation 9 of the INSPIRE Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows. U.K.

(2) In paragraph (2)—

(a) omit “or” at the end of sub-paragraph (a),

(b) for sub-paragraph (b) substitute—

“(b) Article 21 of the GDPR (general processing: right to object to processing), or

(c) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).”, and

(c) omit the words following sub-paragraph (b).

(3) After paragraph (7) insert—

“(8) In this regulation—

• “the data protection principles” means the principles set out in—

  (a)

  Article 5(1) of the GDPR,

  (b)

  section 34(1) of the Data Protection Act 2018, and

  (c)

  section 85(1) of that Act;

• “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);

• “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

(9) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”

Commencement Information

I340 Sch. 19 para. 343 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440) U.K.

344 (1) Regulation 10 of the INSPIRE (Scotland) Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows. U.K.

(2) In paragraph (2)—

(a) omit “or” at the end of sub-paragraph (a),

(b) for sub-paragraph (b) substitute—

“(b) Article 21 of the GDPR (general processing: right to object to processing), or

(c) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).”, and

(c) omit the words following sub-paragraph (b).

(3) After paragraph (6) insert—

“(7) In this regulation—

• “the data protection principles” means the principles set out in—

  (a)

  Article 5(1) of the GDPR,

  (b)

  section 34(1) of the Data Protection Act 2018, and

  (c)

  section 85(1) of that Act;

• “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);

• “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

(8) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”

Commencement Information

I341 Sch. 19 para. 344 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 (S.R (N.I.) 2009 No. 225) U.K.

345 U.K. The Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 are amended as follows.

Commencement Information

I342 Sch. 19 para. 345 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

346 U.K. In regulation 2(2) (interpretation), at the appropriate place insert—

““the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);”.”

Commencement Information

I343 Sch. 19 para. 346 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

347 (1) Regulation 25 (duty to co-operate by disclosing information as regards relevant persons) is amended as follows. U.K.

(2) In paragraph (7), at the end insert “ or the GDPR ”.

(3) For paragraph (8) substitute—

“(8) In determining for the purposes of paragraph (7) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”

Commencement Information

I344 Sch. 19 para. 347 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

348 (1) Regulation 26 (responsible bodies requesting additional information be disclosed about relevant persons) is amended as follows. U.K.

(2) In paragraph (6), at the end insert “ or the GDPR ”.

(3) For paragraph (7) substitute—

“(7) In determining for the purposes of paragraph (6) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”

Commencement Information

I345 Sch. 19 para. 348 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

349 (1) Regulation 29 (occurrence reports) is amended as follows. U.K.

(2) In paragraph (3), at the end insert “ or the GDPR ”.

(3) For paragraph (4) substitute—

“(4) In determining for the purposes of paragraph (3) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”

Commencement Information

I346 Sch. 19 para. 349 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31) U.K.

350 U.K. The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 are revoked.

Commencement Information

I347 Sch. 19 para. 350 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Pharmacy Order 2010 (S.I. 2010/231) U.K.

351 U.K. The Pharmacy Order 2010 is amended as follows.

Commencement Information

I348 Sch. 19 para. 351 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

352 U.K. In article 3(1) (interpretation), omit the definition of “Directive 95/46/EC”.

Commencement Information

I349 Sch. 19 para. 352 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

353 (1) Article 9 (inspection and enforcement) is amended as follows. U.K.

(2) For paragraph (4) substitute—

“(4) If a report that the Council proposes to publish pursuant to paragraph (3) includes personal data, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure of the personal data is required by paragraph (3) of this article.”

(3) After paragraph (4) insert—

“(5) In this article, “personal data” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).”

Commencement Information

I350 Sch. 19 para. 353 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

354 U.K. In article 33A (European professional card), after paragraph (2) insert—

“(3) In Schedule 2A, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”

Commencement Information

I351 Sch. 19 para. 354 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

355 (1) Article 49 (disclosure of information: general) is amended as follows. U.K.

(2) In paragraph (2)(a), after “enactment” insert “ or the GDPR ”.

(3) For paragraph (3) substitute—

“(3) In determining for the purposes of paragraph (2)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by paragraph (1) of this article.”

(4) After paragraph (5) insert—

“(6) In this article, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I352 Sch. 19 para. 355 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

356 (1) Article 55 (professional performance assessments) is amended as follows. U.K.

(2) In paragraph (5)(a), after “enactment” insert “ or the GDPR ”.

(3) For paragraph (6) substitute—

“(6) In determining for the purposes of paragraph (5)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by paragraph (4) of this article.”

(4) After paragraph (8) insert—

“(9) In this article, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Commencement Information

I353 Sch. 19 para. 356 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

357 U.K. In article 67(6) (Directive 2005/36/EC: designation of competent authority etc.), after sub-paragraph (a) insert—

“(aa) “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

Commencement Information

I354 Sch. 19 para. 357 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

358 (1) Schedule 2A (Directive 2005/36/EC: European professional card) is amended as follows. U.K.

(2) In paragraph 8(1) (access to data), for “Directive 95/46/EC)” substitute “ the GDPR ”.

(3) In paragraph 9 (processing data)—

(a) omit sub-paragraph (2) (deeming the Council to be the controller for the purposes of Directive 95/46/EC), and

(b) after sub-paragraph (2) insert—

“(3) In this paragraph, “personal data” has the same meaning as in the Data Protection Act 2018 (see section 3(2) of that Act).”

Commencement Information

I355 Sch. 19 para. 358 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

359 (1) The table in Schedule 3 (Directive 2005/36/EC: designation of competent authority etc.) is amended as follows. U.K.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Commencement Information

I356 Sch. 19 para. 359 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910) U.K.

360 U.K. The Data Protection (Monetary Penalties) Order 2010 is revoked.

Commencement Information

I357 Sch. 19 para. 360 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

National Employment Savings Trust Order 2010 (S.I. 2010/917) U.K.

361 U.K. The National Employment Savings Trust Order 2010 is amended as follows.

Commencement Information

I358 Sch. 19 para. 361 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

362 U.K. In article 2 (interpretation)—

(a) omit the definition of “data” and “personal data”, and

(b) at the appropriate place insert—

““personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).”

Commencement Information

I359 Sch. 19 para. 362 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

363 (1) Article 10 (disclosure of requested data to the Secretary of State) is amended as follows. U.K.

(2) In paragraph (1)—

(a) for “disclosure of data” substitute “ disclosure of information ”, and

(b) for “requested data” substitute “ requested information ”.

(3) In paragraph (2)—

(a) for “requested data” substitute “ requested information ”,

(b) for “those data are” substitute “ the information is ”, and

(c) for “receive those data” substitute “ receive that information ”.

(4) In paragraph (3), for “requested data” substitute “ requested information ”.

(5) In paragraph (4), for “requested data” substitute “ requested information ”.

Commencement Information

I360 Sch. 19 para. 363 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Local Elections (Northern Ireland) Order 2010 (S.I. 2010/2977) U.K.

364 (1) Schedule 3 to the Local Elections (Northern Ireland) Order 2010 (access to marked registers and other documents open to public inspection after an election) is amended as follows. U.K.

(2) In paragraph 1(1) (interpretation and general)—

(a) omit the definition of “research purposes”, and

(b) at the appropriate places insert—

““Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”;

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.

(3) In paragraph 5(3) (restrictions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “ Article 89 GDPR purposes ”.

Commencement Information

I361 Sch. 19 para. 364 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Pupil Information (Wales) Regulations 2011 (S.I. 2011/1942 (W.209)) U.K.

365 (1) Regulation 5 of the Pupil Information (Wales) Regulations 2011 (duties of head teacher - educational records) is amended as follows. U.K.

(2) In paragraph (5)—

(a) in the English language text, for “documents which are subject to any order under section 30(2) of the Data Protection Act 1998” substitute “information—

(a) which the head teacher could not lawfully disclose to the pupil under the GDPR, or

(b) to which the pupil would have no right of access under the GDPR.”, and

(b) in the Welsh language text, for “ddogfennau sy'n ddarostyngedig i unrhyw orchymyn o dan adran 30(2) o Ddeddf Diogelu Data 1998” substitute “wybodaeth—

(a) na allai'r pennaeth ei datgelu'n gyfreithlon i'r disgybl o dan y GDPR, neu

(b) na fyddai gan y disgybl hawl mynediad ati o dan y GDPR.”

(3) After paragraph (5)—

(a) in the English language text insert—

“(6) In this regulation, “the GDPR” (“y GDPR”) means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”, and

(b) in the Welsh language text insert—

“(6) Yn y rheoliad hwn, ystyr “y GDPR” (“the GDPR”) yw Rheoliad (EU) 2016/679 Senedd Ewrop a'r Cyngor dyddiedig 27 Ebrill 2016 ar ddiogelu personau naturiol o ran prosesu data personol a rhyddid symud data o'r fath (y Rheoliad Diogelu Data Cyffredinol), fel y'i darllenir ynghyd â Phennod 2 o Ran 2 o Ddeddf Diogelu Data 2018.”

Commencement Information

I362 Sch. 19 para. 365 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Debt Arrangement Scheme (Scotland) Regulations 2011 (S.S.I. 2011/141) U.K.

366 U.K. In Schedule 4 to the Debt Arrangement Scheme (Scotland) Regulations 2011 (payments distributors), omit paragraph 2.

Commencement Information

I363 Sch. 19 para. 366 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Police and Crime Commissioner Elections Order 2012 (S.I. 2012/1917) U.K.

367 U.K. The Police and Crime Commissioner Elections Order 2012 is amended as follows.

Commencement Information

I364 Sch. 19 para. 367 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

368 (1) Schedule 2 (absent voting in Police and Crime Commissioner elections) is amended as follows. U.K.

(2) In paragraph 20 (absent voter lists: supply of copies etc)—

(a) in sub-paragraph (8), for paragraph (a) (but not the final “or”) substitute—

“(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”, and

(b) after sub-paragraph (10) insert—

“(11) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”

(3) In paragraph 24 (restriction on use of absent voter records or lists or the information contained in them)—

(a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

“(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics),”, and

(b) after that sub-paragraph insert—

“(4) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”

Commencement Information

I365 Sch. 19 para. 368 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

369 (1) Schedule 10 (access to marked registers and other documents open to public inspection after an election) is amended as follows. U.K.

(2) In paragraph 1(2) (interpretation), omit paragraphs (c) and (d) (but not the final “and”).

(3) In paragraph 5 (restriction on use of documents or of information contained in them)—

(a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

“(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics),”, and

(b) after sub-paragraph (4) insert—

“(5) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”

Commencement Information

I366 Sch. 19 para. 369 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978) U.K.

370 U.K. The Data Protection (Processing of Sensitive Personal Data) Order 2012 is revoked.

Commencement Information

I367 Sch. 19 para. 370 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Neighbourhood Planning (Referendums) Regulations 2012 (S.I. 2012/2031) U.K.

371 U.K. Schedule 6 to the Neighbourhood Planning (Referendums) Regulations 2012 (registering to vote in a business referendum) is amended as follows.

Commencement Information

I368 Sch. 19 para. 371 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

372 (1) Paragraph 29(1) (interpretation of Part 8) is amended as follows. U.K.

(2) At the appropriate places insert—

““Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”;

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.

(3) For the definition of “relevant conditions” substitute—

““relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards;”.

(4) Omit the definition of “research purposes”.

Commencement Information

I369 Sch. 19 para. 372 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

373 U.K. In paragraph 32(3)(b)(i), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.

Commencement Information

I370 Sch. 19 para. 373 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

374 U.K. In paragraph 33(6) and (7) (supply of copy of business voting register to the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

Commencement Information

I371 Sch. 19 para. 374 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

375 U.K. In paragraph 34(6) and (7) (supply of copy of business voting register to the Office of National Statistics and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

Commencement Information

I372 Sch. 19 para. 375 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

376 U.K. In paragraph 39(8) and (97) (supply of copy of business voting register to public libraries and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

Commencement Information

I373 Sch. 19 para. 376 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

377 U.K. In paragraph 45(2) (conditions on the use, supply and disclosure of documents open to public inspection), for paragraph (a) (but not the final “or”) substitute—

“(a) Article 89 GDPR purposes (as defined in paragraph 29),”.

Commencement Information

I374 Sch. 19 para. 377 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Controlled Drugs (Supervision of Management and Use) Regulations 2013 (S.I. 2013/373) U.K.

378 (1) Regulation 20 of the Controlled Drugs (Supervision of Management and Use) Regulations 2013 (information management) is amended as follows. U.K.

(2) For paragraph (4) substitute—

“(4) Where a CDAO, a responsible body or someone acting on their behalf is permitted to share information which includes personal data by virtue of a function under these Regulations, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”

(3) In paragraph (5), after “enactment” insert “ or the GDPR ”.

(4) After paragraph (6) insert—

“(7) In this regulation, “the GDPR”, “personal data” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (10), (11) and (14) of that Act).”

Commencement Information

I375 Sch. 19 para. 378 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Communications Act 2003 (Disclosure of Information) Order 2014 (S.I. 2014/1825) U.K.

379 (1) Article 3 of the Communications Act 2003 (Disclosure of Information) Order 2014 (specification of relevant functions) is amended as follows. U.K.

(2) The existing text becomes paragraph (1).

(3) In that paragraph, in sub-paragraph (a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(4) After that paragraph insert—

“(2) In this article, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I376 Sch. 19 para. 379 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141) U.K.

380 U.K. In the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014, omit Part 4 (data protection in relation to police and judicial co-operation in criminal matters).

Commencement Information

I377 Sch. 19 para. 380 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282) U.K.

381 U.K. The Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 is revoked.

Commencement Information

I378 Sch. 19 para. 381 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

The Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (S.R. (N.I.) 2014 No. 224) U.K.

382 U.K. In regulation 6 of the Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (applications)—

(a) in paragraph (9), omit sub-paragraph (b) and the word “and” before it, and

(b) in paragraph (11), omit the definition of “processing” and “sensitive personal data” and the word “and” before it.

Commencement Information

I379 Sch. 19 para. 382 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Control of Poisons and Explosives Precursors Regulations 2015 (S.I. 2015/966) U.K.

383 U.K. In regulation 3 of the Control of Poisons and Explosives Precursors Regulations 2015 (applications in relation to licences under section 4A of the Poisons Act 1972)—

(a) in paragraph (7), omit sub-paragraph (b) and the word “and” before it, and

(b) omit paragraph (8).

Commencement Information

I380 Sch. 19 para. 383 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Companies (Disclosure of Date of Birth Information) Regulations 2015 (S.I. 2015/1694) U.K.

384 (1) Paragraph 6 of Schedule 2 to the Companies (Disclosure of Date of Birth Information) Regulations 2015 (conditions for permitted disclosure to a credit reference agency) is amended as follows. U.K.

(2) The existing text becomes sub-paragraph (1).

(3) In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—

“(ii) for the purposes of ensuring that it complies with its data protection obligations;”.

(4) In paragraph (c) of that sub-paragraph—

(a) omit “or” at the end of sub-paragraph (i), and

(b) at the end insert “; or

(iii) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);”.

(5) After paragraph (c) of that sub-paragraph insert—

“(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.”

(6) After sub-paragraph (1) insert—

“(2) In this paragraph, “data protection obligations”, in relation to a credit reference agency, means—

(a) where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);

(b) where the agency carries on business in a EEA State other than the United Kingdom, obligations under—

(i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018),

(ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and

(iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).”

Commencement Information

I381 Sch. 19 para. 384 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Small and Medium Sized Business (Credit Information) Regulations 2015 (S.I. 2015/1945) U.K.

385 U.K. The Small and Medium Sized Business (Credit Information) Regulations 2015 are amended as follows.

Commencement Information

I382 Sch. 19 para. 385 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

386 (1) Regulation 12 (criteria for the designation of a credit reference agency) is amended as follows. U.K.

(2) In paragraph (1)(b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) After paragraph (2) insert—

“(3) In this regulation, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Commencement Information

I383 Sch. 19 para. 386 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

387 (1) Regulation 15 (access to and correction of information for individuals and small firms) is amended as follows. U.K.

(2) For paragraph (1) substitute—

“(1) Section 13 of the Data Protection Act 2018 (rights of the data subject under the GDPR: obligations of credit reference agencies) applies in respect of a designated credit reference agency which is not a credit reference agency within the meaning of section 145(8) of the Consumer Credit Act 1974 as if it were such an agency.”

(3) After paragraph (3) insert—

“(4) In this regulation, the reference to section 13 of the Data Protection Act 2018 has the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).”

Commencement Information

I384 Sch. 19 para. 387 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

European Union (Recognition of Professional Qualifications) Regulations 2015 (S.I. 2015/2059) U.K.

388 U.K. The European Union (Recognition of Professional Qualifications) Regulations 2015 are amended as follows.

Commencement Information

I385 Sch. 19 para. 388 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

389 (1) Regulation 2(1) (interpretation) is amended as follows. U.K.

(2) Omit the definition of “Directive 95/46/EC”.

(3) At the appropriate place insert—

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

Commencement Information

I386 Sch. 19 para. 389 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

390 U.K. In regulation 5(5) (functions of competent authorities in the United Kingdom) for “Directives 95/46/EC” substitute “ the GDPR and Directive ”.

Commencement Information

I387 Sch. 19 para. 390 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

391 U.K. In regulation 45(3) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “ the GDPR ”.

Commencement Information

I388 Sch. 19 para. 391 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

392 U.K. In regulation 46(1) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “ the GDPR ”.

Commencement Information

I389 Sch. 19 para. 392 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

393 U.K. In regulation 48(2) (processing and access to data regarding the European Professional Card), omit paragraph (2) (deeming the relevant designated competent authorities to be controllers for the purposes of Directive 95/46/EC).

Commencement Information

I390 Sch. 19 para. 393 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

394 U.K. In regulation 66(3) (exchange of information), for “Directives 95/46/EC” substitute “ the GDPR and Directive ”.

Commencement Information

I391 Sch. 19 para. 394 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Scottish Parliament (Elections etc) Order 2015 (S.S.I. 2015/425) U.K.

395 U.K. The Scottish Parliament (Elections etc) Order 2015 is amended as follows.

Commencement Information

I392 Sch. 19 para. 395 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

396 (1) Schedule 3 (absent voting) is amended as follows. U.K.

(2) In paragraph 16 (absent voting lists: supply of copies etc)—

(a) in sub-paragraph (4), for paragraph (a) (but not the final “or”) substitute—

“(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”, and

(b) after sub-paragraph (10) insert—

“(11) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”

(3) In paragraph 20 (restriction on use of absent voting lists)—

(a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

“(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”, and

(b) after that sub-paragraph insert—

“(4) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”

Commencement Information

I393 Sch. 19 para. 396 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

397 (1) Schedule 8 (access to marked registers and other documents open to public inspection after an election) is amended as follows. U.K.

(2) In paragraph 1(2) (interpretation), omit paragraphs (c) and (d) (but not the final “and”).

(3) In paragraph 5 (restriction on use of documents or of information contained in them)—

(a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

“(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”, and

(b) after sub-paragraph (4) insert—

“(5) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”

Commencement Information

I394 Sch. 19 para. 397 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (S.I. 2016/295) U.K.

398 U.K. In paragraph 1(3) of Schedule 3 to the Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (access to marked registers after a petition), omit the definition of “relevant conditions”.

Commencement Information

I395 Sch. 19 para. 398 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Register of People with Significant Control Regulations 2016 (S.I. 2016/339) U.K.

399 U.K. Schedule 4 to the Register of People with Significant Control Regulations 2016 (conditions for permitted disclosure) is amended as follows.

Commencement Information

I396 Sch. 19 para. 399 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

400 (1) Paragraph 6 (disclosure to a credit reference agency) is amended as follows. U.K.

(2) In sub-paragraph (b), for paragraph (ii) (together with the final “; and”) substitute—

“(ii) for the purposes of ensuring that it complies with its data protection obligations;”.

(3) In sub-paragraph (c)—

(a) omit “or” at the end of paragraph (ii), and

(b) at the end insert—

“(iv) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice); or

(v) section 148 of that Act (destroying or falsifying information and documents etc);”

(4) After sub-paragraph (c) insert—

“(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in sub-paragraph (c)(iii), other than a penalty notice that has been cancelled.”

Commencement Information

I397 Sch. 19 para. 400 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

401 U.K. In paragraph 12A (disclosure to a credit institution or a financial institution), for sub-paragraph (b) substitute—

“(b) for the purposes of ensuring that it complies with its data protection obligations.”

Commencement Information

I398 Sch. 19 para. 401 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

402 U.K. In Part 3 (interpretation), after paragraph 13 insert—

“14 In this Schedule, “data protection obligations”, in relation to a credit reference agency, a credit institution or a financial institution, means—

(a) where the agency or institution carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);

(b) where the agency or institution carries on business in a EEA State other than the United Kingdom, obligations under—

(i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018),

(ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and

(iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).”

Commencement Information

I399 Sch. 19 para. 402 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) U.K.

403 U.K. The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 are amended as follows.

Commencement Information

I400 Sch. 19 para. 403 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

404 U.K. In regulation 2(1) (interpretation), omit the definition of “the 1998 Act”.

Commencement Information

I401 Sch. 19 para. 404 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

405 U.K. In regulation 3(3) (supervision), omit “under the 1998 Act”.

Commencement Information

I402 Sch. 19 para. 405 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

406 U.K. For Schedule 2 substitute—

“SCHEDULE 2 U.K. Information Commissioner's enforcement powers

Provisions applied for enforcement purposes U.K.

1 For the purposes of enforcing these Regulations and the eIDAS Regulation, the following provisions of Parts 5 to 7 of the Data Protection Act 2018 apply with the modifications set out in paragraphs 2 to 26—

(a) section 140 (publication by the Commissioner);

(b) section 141 (notices from the Commissioner);

(c) section 142 (information notices);

(d) section 143 (information notices: restrictions);

(e) section 144 (false statements made in response to an information notice);

(f) section 145 (information orders);

(g) section 146 (assessment notices);

(h) section 147 (assessment notices: restrictions);

(i) section 148 (destroying or falsifying information and documents etc);

(j) section 149 (enforcement notices);

(k) section 150 (enforcement notices: supplementary);

(l) section 152 (enforcement notices: restrictions);

(m) section 153 (enforcement notices: cancellation and variation);

(n) section 154 and Schedule 15 (powers of entry and inspection);

(o) section 155 and Schedule 16 (penalty notices);

(p) section 156(4)(a) (penalty notices: restrictions);

(q) section 157 (maximum amount of penalty);

(r) section 159 (amount of penalties: supplementary);

(s) section 160 (guidance about regulatory action);

(t) section 161 (approval of first guidance about regulatory action);

(u) section 162 (rights of appeal);

(v) section 163 (determination of appeals);

(w) section 164 (applications in respect of urgent notices);

(x) section 180 (jurisdiction);

(y) section 182(1), (2), (5), (7) and (13) (regulations and consultation);

(z) section 196 (penalties for offences);

(z1) section 197 (prosecution);

(z2) section 202 (proceedings in the First-tier Tribunal: contempt);

(z3) section 203 (Tribunal Procedure Rules).

General modification of references to the Data Protection Act 2018 U.K.

2 The provisions listed in paragraph 1 have effect as if—

(a) references to the Data Protection Act 2018 were references to the provisions of that Act as applied by these Regulations;

(b) references to a particular provision of that Act were references to that provision as applied by these Regulations.

Modification of section 142 (information notices) U.K.

3 (1) Section 142 has effect as if subsections (9) and (10) were omitted.

(2) In that section, subsection (1) has effect as if—

(a) in paragraph (a)—

(i) for “controller or processor” there were substituted “ trust service provider ”;

(ii) for “the data protection legislation” there were substituted “ the eIDAS Regulation and the EITSET Regulations ”;

(b) paragraph (b) were omitted.

(3) In that section, subsection (2) has effect as if paragraph (a) were omitted.

Modification of section 143 (information notices: restrictions) U.K.

4 (1) Section 143 has effect as if subsections (1) and (9) were omitted.

(2) In that section—

(a) subsections (3)(b) and (4)(b) have effect as if for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”;

(b) subsection (7)(a) has effect as if for “this Act” there were substituted “ section 144 or 148 or paragraph 15 of Schedule 15 ”;

(c) subsection (8) has effect as if for “this Act (other than an offence under section 144)” there were substituted “ section 148 or paragraph 15 of Schedule 15 ”.

Modification of section 145 (information orders) U.K.

5 Section 145(2)(b) has effect as if for “section 142(2)(b)” there were substituted “ section 142(2) ”.

Modification of section 146 (assessment notices) U.K.

6 (1) Section 146 has effect as if subsection (11) were omitted.

(2) In that section—

(a) subsection (1) has effect as if—

(i) for “controller or processor” (in both places) there were substituted “ trust service provider ”;

(ii) for “the data protection legislation” there were substituted “ the eIDAS requirements ”;

(b) subsection (2) has effect as if paragraphs (h) and (i) were omitted;

(c) subsections (7), (8), (9) and (10) have effect as if for “controller or processor” (in each place) there were substituted “trust service provider.

(d) subsection (9)(a) has effect as if for “as described in section 149(2) or that an offence under this Act” there were substituted “ to comply with the eIDAS requirements or that an offence under section 144 or 148 or paragraph 15 of Schedule 15 ”.

Modification of section 147 (assessment notices: restrictions) U.K.

7 (1) Section 147 has effect as if subsections (5) and (6) were omitted.

(2) In that section, subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”.

Modification of section 149 (enforcement notices) U.K.

8 (1) Section 149 has effect as if subsections (2) to (5) and (7) to (9) were omitted.

(2) In that section—

(a) subsection (1) has effect as if—

(i) for “as described in subsection (2), (3), (4) or (5)” there were substituted “ to comply with the eIDAS requirements ”;

(ii) for “sections 150 and 151” there were substituted “ section 150 ”;

(b) subsection (6) has effect as if the words “given in reliance on subsection (2), (3) or (5)” were omitted.

Modification of section 150 (enforcement notices: supplementary) U.K.

9 (1) Section 150 has effect as if subsection (3) were omitted.

(2) In that section, subsection (2) has effect as if the words “in reliance on section 149(2)” and “or distress” were omitted.

Modification of section 152 (enforcement notices: restrictions) U.K.

10 Section 152 has effect as if subsections (1), (2) and (4) were omitted.

Withdrawal notices U.K.

11 The provisions listed in paragraph 1 have effect as if after section 153 there were inserted—

“Withdrawal notices U.K.

153A Withdrawal notices

(1) The Commissioner may, by written notice (a “withdrawal notice”), withdraw the qualified status from a trust service provider, or the qualified status of a service provided by a trust service provider, if—

(a) the Commissioner is satisfied that the trust service provider has failed to comply with an information notice or an enforcement notice, and

(b) the condition in subsection (2) or (3) is met.

(2) The condition in this subsection is met if the period for the trust service provider to appeal against the information notice or enforcement notice has ended without an appeal having been brought.

(3) The condition in this subsection is met if an appeal against the information notice or enforcement notice has been brought and—

(a) the appeal and any further appeal in relation to the notice has been decided or has otherwise ended, and

(b) the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought.

(4) A withdrawal notice must—

(a) state when the withdrawal takes effect, and

(b) provide information about the rights of appeal under section 162.”

Modification of Schedule 15 (powers of entry and inspection) U.K.

12 (1) Schedule 15 has effect as if paragraph 3 were omitted.

(2) Paragraph 1(1) of that Schedule (issue of warrants in connection with non-compliance and offences) has effect as if for paragraph (a) (but not the final “and”) there were substituted—

“(a) there are reasonable grounds for suspecting that—

(i) a trust service provider has failed or is failing to comply with the eIDAS requirements, or

(ii) an offence under section 144 or 148 or paragraph 15 of Schedule 15 has been or is being committed,”.

(3) Paragraph 2 of that Schedule (issue of warrants in connection with assessment notices) has effect as if—

(a) in sub-paragraphs (1) and (2), for “controller or processor” there were substituted “ trust service provider ”;

(b) in sub-paragraph (2), for “the data protection legislation” there were substituted “ the eIDAS requirements ”.

(4) Paragraph 5 of that Schedule (content of warrants) has effect as if—

(a) in sub-paragraph (1)(c), for “the processing of personal data” there were substituted “ the provision of trust services ”;

(b) in sub-paragraph (2)(d)—

(i) for “controller or processor” there were substituted “ trust service provider ”;

(ii) for “as described in section 149(2)” there were substituted “ to comply with the eIDAS requirements ”;

(c) in sub-paragraph (3)(a) and (d)—

(i) for “controller or processor” there were substituted “ trust service provider ”;

(ii) for “the data protection legislation” there were substituted “ the eIDAS requirements ”.

(5) Paragraph 11 of that Schedule (privileged communications) has effect as if, in sub-paragraphs (1)(b) and (2)(b), for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”.

Modification of section 155 (penalty notices) U.K.

13 (1) Section 155 has effect as if subsections (1)(a), (2)(a), (3)(g), (4) and (6) to (8) were omitted.

(2) Subsection (2) of that section has effect as if—

(a) the words “Subject to subsection (4),” were omitted;

(b) in paragraph (b), the words “to the extent that the notice concerns another matter,” were omitted.

(3) Subsection (3) of that section has effect as if—

(a) for “controller or processor”, in each place, there were substituted “ trust services provider ”;

(b) in paragraph (c), the words “or distress” were omitted;

(c) in paragraph (c), for “data subjects” there were substituted “ relying parties ”;

(d) in paragraph (d), for “section 57, 66, 103 or 107” there were substituted “ Article 19(1) of the eIDAS Regulation ”.

Modification of Schedule 16 (penalties) U.K.

14 Schedule 16 has effect as if paragraphs 3(2)(b) and 5(2)(b) were omitted.

Modification of section 157 (maximum amount of penalty) U.K.

15 Section 157 has effect as if subsections (1) to (3) and (6) were omitted.

Modification of section 159 (amount of penalties: supplementary) U.K.

16 Section 159 has effect as if—

(a) in subsection (1), the words “Article 83 of the GDPR and” were omitted;

(b) in subsection (2), the words “Article 83 of the GDPR” and “and section 158” were omitted.

Modification of section 160 (guidance about regulatory action) U.K.

17 (1) Section 160 has effect as if subsections (5) and (12) were omitted.

(2) In that section, subsection (4)(f) has effect as if for “controllers and processors” there were substituted “ trust service providers ”.

Modification of section 162 (rights of appeal) U.K.

18 (1) Section 162 has effect as if subsection (4) were omitted.

(2) In that section, subsection (1) has effect as if, after paragraph (c), there were inserted—

“(ca) a withdrawal notice;”.

Modification of section 163 (determination of appeals) U.K.

19 Section 163 has effect as if subsection (6) were omitted.

Modification of section 180 (jurisdiction) U.K.

20 (1) Section 180 has effect as if subsections (2)(d) and (e) and (3) were omitted.

(2) Subsection (1) of that section has effect as if for “subsections (3) and (4)” there were substituted “ subsection (4) ”.

Modification of section 182 (regulations and consultation) U.K.

21 Section 182 has effect as if subsections (3), (4), (6), (8) to (11) and (14) were omitted.

Modification of section 196 (penalties for offences) U.K.

22 (1) Section 196 has effect as if subsections (3) to (5) were omitted.

(2) In that section—

(a) subsection (1) has effect as if the words “section 119 or 173 or” were omitted;

(b) subsection (2) has effect as if for “section 132, 144, 148, 170, 171 or 184” there were substituted “ section 144 or 148 ”.

Modification of section 197 (prosecution) U.K.

23 Section 197 has effect as if subsections (3) to (6) were omitted.

Modification of section 202 (proceedings in the First-tier Tribunal: contempt) U.K.

24 Section 202 has effect as if in subsection (1)(a), for sub-paragraphs (i) and (ii) there were substituted “ on an appeal under section 162 ”.

Modification of section 203 (Tribunal Procedure Rules) U.K.

25 Section 203 has effect as if—

(a) in subsection (1), for paragraphs (a) and (b) there were substituted “ the exercise of the rights of appeal conferred by section 162 ”;

(b) in subsection (2)(a) and (b), for “the processing of personal data” there were substituted “ the provision of trust services ”.

Approval of first guidance about regulatory action U.K.

26 (1) This paragraph applies if the first guidance produced under section 160(1) of the Data Protection Act 2018 and the first guidance produced under that provision as applied by this Schedule are laid before Parliament as a single document (“the combined guidance”).

(2) Section 161 of that Act (including that section as applied by this Schedule) has effect as if the references to “the guidance” were references to the combined guidance, except in subsections (2)(b) and (4).

(3) Nothing in subsection (2)(a) of that section (including as applied by this Schedule) prevents another version of the combined guidance being laid before Parliament.

(4) Any duty under subsection (2)(b) of that section (including as applied by this Schedule) may be satisfied by producing another version of the combined guidance.

Interpretation U.K.

27 In this Schedule—

• “the eIDAS requirements” means the requirements of Chapter III of the eIDAS Regulation;

• “the EITSET Regulations” means these Regulations;

• “withdrawal notice” has the meaning given in section 153A of the Data Protection Act 2018 (as inserted in that Act by this Schedule).”

Commencement Information

I403 Sch. 19 para. 406 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g) (with reg. 4)

Court Files Privileged Access Rules (Northern Ireland) 2016 (S.R. (N.I.) 2016 No. 123) U.K.

407 U.K. The Court Files Privileged Access Rules (Northern Ireland) 2016 are amended as follows.

Commencement Information

I404 Sch. 19 para. 407 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

408 U.K. In rule 5 (information that may released) for “Schedule 1 of the Data Protection Act 1998” substitute “—

(a) Article 5(1) of the GDPR, and

(b) section 34(1) of the Data Protection Act 2018.”

Commencement Information

I405 Sch. 19 para. 408 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

409 U.K. In rule 7(2) (provision of information) for “Schedule 1 of the Data Protection Act 1998” substitute “—

(a) Article 5(1) of the GDPR, and

(b) section 34(1) of the Data Protection Act 2018.”

Commencement Information

I406 Sch. 19 para. 409 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (S.I. 2017/692) U.K.

410 U.K. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 are amended as follows.

Commencement Information

I407 Sch. 19 para. 410 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

411 U.K. In regulation 3(1) (interpretation), at the appropriate places insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”;

““the GDPR” and references to provisions of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);”.

Commencement Information

I408 Sch. 19 para. 411 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

412 U.K. In regulation 16(8) (risk assessment by the Treasury and Home Office), for “the Data Protection Act 1998 or any other enactment” substitute “—

(a) the Data Protection Act 2018 or any other enactment, or

(b) the GDPR.”

Commencement Information

I409 Sch. 19 para. 412 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

413 U.K. In regulation 17(9) (risk assessment by supervisory authorities), for “the Data Protection Act 1998 or any other enactment” substitute “—

(a) the Data Protection Act 2018 or any other enactment, or

(b) the GDPR.”

Commencement Information

I410 Sch. 19 para. 413 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

414 U.K. For regulation 40(9)(c) (record keeping) substitute—

“(c) “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

(d) “personal data” has the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).”

Commencement Information

I411 Sch. 19 para. 414 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

415 (1) Regulation 41 (data protection) is amended as follows. U.K.

(2) Omit paragraph (2).

(3) In paragraph (3)(a), after “Regulations” insert “ or the GDPR ”.

(4) Omit paragraphs (4) and (5).

(5) After those paragraphs insert—

“(6) Before establishing a business relationship or entering into an occasional transaction with a new customer, as well as providing the customer with the information required under Article 13 of the GDPR (information to be provided where personal data are collected from the data subject), relevant persons must provide the customer with a statement that any personal data received from the customer will be processed only—

(a) for the purposes of preventing money laundering or terrorist financing, or

(b) as permitted under paragraph (3).

(7) In Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest includes processing of personal data in accordance with these Regulations that is necessary for the prevention of money laundering or terrorist financing.

(8) In the case of sensitive processing of personal data for the purposes of the prevention of money laundering or terrorist financing, section 10 of, and Schedule 1 to, the Data Protection Act 2018 make provision about when the processing meets a requirement in Article 9(2) or 10 of the GDPR for authorisation under the law of the United Kingdom (see, for example, paragraphs 10, 11 and 12 of that Schedule).

(9) In this regulation—

• “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

• “personal data” and “processing” have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4) and (14) of that Act);

• “sensitive processing” means the processing of personal data described in Article 9(1) or 10 of the GDPR (special categories of personal data and personal data relating to criminal convictions and offences etc).”

Commencement Information

I412 Sch. 19 para. 415 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

416 (1) Regulation 84 (publication: the Financial Conduct Authority) is amended as follows. U.K.

(2) In paragraph (10), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) For paragraph (11) substitute—

“(11) For the purposes of this regulation, “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).”

Commencement Information

I413 Sch. 19 para. 416 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

417 (1) Regulation 85 (publication: the Commissioners) is amended as follows. U.K.

(2) In paragraph (9), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

(3) For paragraph (10) substitute—

“(10) For the purposes of this regulation, “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).”

Commencement Information

I414 Sch. 19 para. 417 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

418 U.K. For regulation 106(a) (general restrictions) substitute—

“(a) a disclosure in contravention of the data protection legislation; or”.

Commencement Information

I415 Sch. 19 para. 418 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

419 U.K. After paragraph 27 of Schedule 3 (relevant offences) insert—

“27A An offence under the Data Protection Act 2018, apart from an offence under section 173 of that Act.”

Commencement Information

I416 Sch. 19 para. 419 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (S.I. 2017/694) U.K.

420 (1) Paragraph 6 of Schedule 5 to the Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (conditions for permitted disclosure to a credit institution or a financial institution) is amended as follows. U.K.

(2) The existing text becomes sub-paragraph (1).

(3) For paragraph (b) of that sub-paragraph substitute—

“(b) for the purposes of ensuring that it complies with its data protection obligations.”

(4) After sub-paragraph (1) insert—

“(2) In this paragraph, “data protection obligations”, in relation to a relevant institution, means—

(a) where the institution carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);

(b) where the institution carries on business in a EEA State other than the United Kingdom, obligations under—

(i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018),

(ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and

(iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).”

Commencement Information

I417 Sch. 19 para. 420 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480) U.K.

421 U.K. In regulation 1(2) of the Data Protection (Charges and Information) Regulations 2018 (interpretation), at the appropriate places insert—

““data controller” means a person who is a controller for the purposes of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act);”;

““personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);”.

Commencement Information

I418 Sch. 19 para. 421 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66) U.K.

422 U.K. The National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 are amended as follows.

Commencement Information

I419 Sch. 19 para. 422 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

423 (1) Regulation 1 (citation and commencement) is amended as follows. U.K.

(2) In paragraph (2), omit “Subject to paragraph (3),”.

(3) Omit paragraph (3).

Commencement Information

I420 Sch. 19 para. 423 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

424 U.K. In regulation 3(1) (interpretation)—

(a) omit the definition of “the 1998 Act”,

(b) at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”, and

(c) omit the definition of “GDPR”.

Commencement Information

I421 Sch. 19 para. 424 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

425 (1) Schedule 6 (other contractual terms) is amended as follows. U.K.

(2) In paragraph 63(2) (interpretation: general), for “the 1998 Act or any directly applicable EU instrument relating to data protection” substitute “—

(a) the data protection legislation, or

(b) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection.”

(3) For paragraph 64 (meaning of data controller etc.) substitute—

“Meaning of controller etc. U.K.

64A For the purposes of this Part—

• “controller” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act);

• “data protection officer” means a person designated as a data protection officer under the data protection legislation;

• “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act).”

(4) In paragraph 65(2)(b) (roles, responsibilities and obligations: general), for “data controllers” substitute “ controllers ”.

(5) In paragraph 69(2)(a) (processing and access of data), for “the 1998 Act, and any directly applicable EU instrument relating to data protection;” substitute “—

(i) the data protection legislation, and

(ii) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;”.

(6) In paragraph 94(4) (variation of a contract: general)—

(a) omit paragraph (b), and

(b) after paragraph (d) (but before the final “and”) insert—

“(da) the data protection legislation;

(db) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;”.

Commencement Information

I422 Sch. 19 para. 425 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 (S.S.I. 2018/67) U.K.

426 U.K. The National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 are amended as follows.

Commencement Information

I423 Sch. 19 para. 426 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

427 (1) Regulation 1 (citation and commencement) is amended as follows. U.K.

(2) In paragraph (2), omit “Subject to paragraph (3),”.

(3) Omit paragraph (3).

Commencement Information

I424 Sch. 19 para. 427 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

428 U.K. In regulation 3(1) (interpretation)—

(a) omit the definition of “the 1998 Act”, and

(b) at the appropriate place insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”, and

(c) omit the definition of “GDPR”.

Commencement Information

I425 Sch. 19 para. 428 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

429 (1) Schedule 1 (content of agreements) is amended as follows. U.K.

(2) In paragraph 34 (interpretation)—

(a) in sub-paragraph (1)—

(i) omit “Subject to sub-paragraph (3),”,

(ii) before paragraph (a) insert—

“(za) “controller” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act);

(zb) “data protection officer” means a person designated as a data protection officer under the data protection legislation;”, and

(iii) for paragraph (d) substitute—

“(e) “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act).”,

(b) omit sub-paragraphs (2) and (3),

(c) in sub-paragraph (4), for “the 1998 Act and any directly applicable EU instrument relating to data protection” substitute “—

(a) the data protection legislation, or

(b) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection.”, and

(d) in sub-paragraph (6)(b), for “data controllers” substitute “ controllers ”.

(3) In paragraph 37(2)(a) (processing and access of data), for “the 1998 Act, and any directly applicable EU instrument relating to data protection;” substitute “—

(i) the data protection legislation, and

(ii) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;”.

(4) In paragraph 61(3) (variation of agreement: general)—

(a) omit paragraph (b), and

(b) after paragraph (d) (but before the final “and”) insert—

“(da) the data protection legislation;

(db) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;”.

Commencement Information

I426 Sch. 19 para. 429 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

PART 3 U.K. Modifications

Introduction U.K.

430 (1) Unless the context otherwise requires, legislation described in sub-paragraph (2) has effect on and after the day on which this Part of this Schedule comes into force as if it were modified in accordance with this Part of this Schedule. U.K.

(2) That legislation is—

(a) subordinate legislation made before the day on which this Part of this Schedule comes into force;

(b) primary legislation that is passed or made before the end of the Session in which this Act is passed.

(3) In this Part of this Schedule—

• “primary legislation” has the meaning given in section 211(7);

• “references” includes any references, however expressed.

Commencement Information

I427 Sch. 19 para. 430 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

General modifications U.K.

431 (1) References to a particular provision of, or made under, the Data Protection Act 1998 have effect as references to the equivalent provision or provisions of, or made under, the data protection legislation. U.K.

(2) Other references to the Data Protection Act 1998 have effect as references to the data protection legislation.

(3) References to disclosure, use or other processing of information that is prohibited or restricted by an enactment which include disclosure, use or other processing of information that is prohibited or restricted by the Data Protection Act 1998 have effect as if they included disclosure, use or other processing of information that is prohibited or restricted by the GDPR or the applied GDPR.

Commencement Information

I428 Sch. 19 para. 431 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Specific modification of references to terms used in the Data Protection Act 1998 U.K.

432 (1) References to personal data, and to the processing of such data, as defined in the Data Protection Act 1998, have effect as references to personal data, and to the processing of such data, as defined for the purposes of Parts 5 to 7 of this Act (see section 3(2), (4) and (14)). U.K.

(2) References to processing as defined in the Data Protection Act 1998, in relation to information, have effect as references to processing as defined in section 3(4).

(3) References to a data subject as defined in the Data Protection Act 1998 have effect as references to a data subject as defined in section 3(5).

(4) References to a data controller as defined in the Data Protection Act 1998 have effect as references to a controller as defined for the purposes of Parts 5 to 7 of this Act (see section 3(6) and (14)).

(5) References to the data protection principles set out in the Data Protection Act 1998 have effect as references to the principles set out in—

(a) Article 5(1) of the GDPR and the applied GDPR, and

(b) sections 34(1) and 85(1) of this Act.

(6) References to direct marketing as defined in section 11 of the Data Protection Act 1998 have effect as references to direct marketing as defined in section 122 of this Act.

(7) References to a health professional within the meaning of section 69(1) of the Data Protection Act 1998 have effect as references to a health professional within the meaning of section 204 of this Act.

(8) References to a health record within the meaning of section 68(2) of the Data Protection Act 1998 have effect as references to a health record within the meaning of section 205 of this Act.

Commencement Information

I429 Sch. 19 para. 432 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

PART 4 U.K. Supplementary

Definitions U.K.

433 U.K. Section 3(14) does not apply to this Schedule.

Commencement Information

I430 Sch. 19 para. 433 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

Provision inserted in subordinate legislation by this Schedule U.K.

434 U.K. Provision inserted into subordinate legislation by this Schedule may be amended or revoked as if it had been inserted using the power under which the subordinate legislation was originally made.

Commencement Information

I431 Sch. 19 para. 434 in force at Royal Assent for specified purposes, see s. 212(2)(f)

I432 Sch. 19 para. 434 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(g)