Data Protection Act 2018

Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22)) U.K.

11 U.K. The Pharmacy (Northern Ireland) Order 1976 is amended as follows.

12 U.K. In article 2(2) (interpretation), omit the definition of “Directive 95/46/EC”.

13 U.K. In article 8D (European professional card), after paragraph (3) insert—

“(4) In Schedule 2C, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”

14 U.K. In article 22A(6) (Directive 2005/36/EC: functions of competent authority etc.), before sub-paragraph (a) insert—

“(za) “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

15 (1) Schedule 2C (Directive 2005/36/EC: European professional card) is amended as follows. U.K.

(2) In paragraph 8(1) (access to data), for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In paragraph 9 (processing data), omit sub-paragraph (2) (deeming the Society to be the controller for the purposes of Directive 95/46/EC).

16 (1) The table in Schedule 2D (functions of the Society under Directive 2005/36/EC) is amended as follows. U.K.

(2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

(3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

17 (1) Paragraph 2 of Schedule 3 (fitness to practice: disclosure of information) is amended as follows. U.K.

(2) In sub-paragraph (2)(a), after “provision” insert “ or the GDPR ”.

(3) For sub-paragraph (3) substitute—

“(3) In determining for the purposes of sub-paragraph (2)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this paragraph.”

(4) After sub-paragraph (4) insert—

“(5) In this paragraph, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”