- Latest available (Revised)
- Point in Time (25/05/2018)
- Original (As enacted)
Point in time view as at 25/05/2018.
Data Protection Act 2018,
PART 2
is up to date with all changes known to be in force on or before 04 September 2024. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
228U.K.In the table in the Schedule to the Estate Agents (Specified Offences) (No. 2) Order 1991 (specified offences), at the end insert—
“Data Protection Act 2018 | Section 144 | False statements made in response to an information notice |
Section 148 | Destroying or falsifying information and documents etc” |
Commencement Information
I1Sch. 19 para. 228 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
229(1)Article 4 of the Channel Tunnel (International Arrangements) Order 1993 (application of enactments) is amended as follows.U.K.
(2)In paragraph (2)—
(a)for “section 5 of the Data Protection Act 1998 (“the 1998 Act”), data which are” substitute “ section 207 of the Data Protection Act 2018 (“the 2018 Act”), data which is ”,
(b)for “data controller” substitute “ controller ”,
(c)after “in the context of” insert “ the activities of ”, and
(d)for “and the 1998 Act” substitute “ and the 2018 Act ”.
(3)In paragraph (3)—
(a)for “section 5 of the 1998 Act, data which are” substitute “ section 207 of the 2018 Act, data which is ”,
(b)for “data controller” substitute “ controller ”,
(c)after “in the context of” insert “ the activities of ”, and
(d)for “and the 1998 Act” substitute “ and the 2018 Act ”.
Commencement Information
I2Sch. 19 para. 229 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
230U.K.The Access to Health Records (Northern Ireland) Order 1993 is amended as follows.
Commencement Information
I3Sch. 19 para. 230 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
231U.K.In Article 4 (health professionals), for paragraph (1) substitute—
“(1)In this Order, “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act).”
Commencement Information
I4Sch. 19 para. 231 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
232U.K.In Article 5(4)(a) (fees for access to health records), for “under section 7 of the Data Protection Act 1998” substitute “ made by the Department ”.
Commencement Information
I5Sch. 19 para. 232 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
233U.K.In article 4 of the Channel Tunnel (Miscellaneous Provisions) Order 1994 (application of enactments), for paragraphs (2) and (3) substitute—
“(2)For the purposes of section 207 of the Data Protection Act 2018 (“the 2018 Act”), data which is processed in a control zone in Belgium, in connection with the carrying out of frontier controls, by an officer belonging to the United Kingdom is to be treated as processed by a controller established in the United Kingdom in the context of the activities of that establishment (and accordingly the 2018 Act applies in respect of such data).
(3)For the purposes of section 207 of the 2018 Act, data which is processed in a control zone in Belgium, in connection with the carrying out of frontier controls, by an officer belonging to the Kingdom of Belgium is to be treated as processed by a controller established in the Kingdom of Belgium in the context of the activities of that establishment (and accordingly the 2018 Act does not apply in respect of such data).”
Commencement Information
I6Sch. 19 para. 233 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
234U.K.The European Primary and Specialist Dental Qualifications Regulations 1998 are amended as follows.
Commencement Information
I7Sch. 19 para. 234 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
235(1)Regulation 2(1) (interpretation) is amended as follows.U.K.
(2)Omit the definition of “Directive 95/46/EC”.
(3)At the appropriate place insert—
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.
Commencement Information
I8Sch. 19 para. 235 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
236(1)The table in Schedule A1 (functions of the GDC under Directive 2005/36) is amended as follows.U.K.
(2)In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
(3)In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
Commencement Information
I9Sch. 19 para. 236 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
237U.K.For article 7 of the Scottish Parliamentary Corporate Body (Crown Status) Order 1999 substitute—
7(1)The Parliamentary corporation is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article.
(2)The Parliamentary corporation is to be treated as a government department for the purposes of the following provisions—
(a)section 8(d) (lawfulness of processing under the GDPR: public interest etc),
(b)section 209 (application to the Crown),
(c)paragraph 6 of Schedule 1 (statutory etc and government purposes),
(d)paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and
(e)paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data).
(3)In the provisions mentioned in paragraph (4)—
(a)references to employment by or under the Crown are to be treated as including employment as a member of staff of the Parliamentary corporation, and
(b)references to a person in the service of the Crown are to be treated as including a person so employed.
(4)The provisions are—
(a)section 24(3) (exemption for certain data relating to employment under the Crown), and
(b)section 209(6) (application of certain provisions to a person in the service of the Crown).
(5)In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).”
Commencement Information
I10Sch. 19 para. 237 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
238U.K.For article 9 of the Northern Ireland Assembly Commission (Crown Status) Order 1999 substitute—
9(1)The Commission is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article.
(2)The Commission is to be treated as a government department for the purposes of the following provisions—
(a)section 8(d) (lawfulness of processing under the GDPR: public interest etc),
(b)section 209 (application to the Crown),
(c)paragraph 6 of Schedule 1 (statutory etc and government purposes),
(d)paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and
(e)paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data).
(3)In the provisions mentioned in paragraph (4)—
(a)references to employment by or under the Crown are to be treated as including employment as a member of staff of the Commission, and
(b)references to a person in the service of the Crown are to be treated as including a person so employed.
(4)The provisions are—
(a)section 24(3) (exemption for certain data relating to employment under the Crown), and
(b)section 209(6) (application of certain provisions to a person in the service of the Crown).
(5)In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).”
Commencement Information
I11Sch. 19 para. 238 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
239U.K.The Data Protection (Corporate Finance Exemption) Order 2000 is revoked.
Commencement Information
I12Sch. 19 para. 239 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
240U.K.The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 is revoked.
Commencement Information
I13Sch. 19 para. 240 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
241U.K.The Data Protection (Functions of Designated Authority) Order 2000 is revoked.
Commencement Information
I14Sch. 19 para. 241 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
242U.K.The Data Protection (International Co-operation) Order 2000 is revoked.
Commencement Information
I15Sch. 19 para. 242 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
243U.K.The Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 are revoked.
Commencement Information
I16Sch. 19 para. 243 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
244U.K.In the Consumer Credit (Credit Reference Agency) Regulations 2000, regulation 4(1) and Schedule 1 (statement of rights under section 9(3) of the Data Protection Act 1998) are revoked.
Commencement Information
I17Sch. 19 para. 244 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
245U.K.The Data Protection (Subject Access Modification) (Health) Order 2000 is revoked.
Commencement Information
I18Sch. 19 para. 245 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
246U.K.The Data Protection (Subject Access Modification) (Education) Order 2000 is revoked.
Commencement Information
I19Sch. 19 para. 246 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
247U.K.The Data Protection (Subject Access Modification) (Social Work) Order 2000 is revoked.
Commencement Information
I20Sch. 19 para. 247 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
248U.K.The Data Protection (Crown Appointments) Order 2000 is revoked.
Commencement Information
I21Sch. 19 para. 248 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
249U.K.The Data Protection (Processing of Sensitive Personal Data) Order 2000 is revoked.
Commencement Information
I22Sch. 19 para. 249 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
250U.K.The Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 is revoked.
Commencement Information
I23Sch. 19 para. 250 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
251U.K.The Data Protection (Designated Codes of Practice) (No. 2) Order 2000 is revoked.
Commencement Information
I24Sch. 19 para. 251 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
252U.K.The Representation of the People (England and Wales) Regulations 2001 are amended as follows.
Commencement Information
I25Sch. 19 para. 252 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
253U.K.In regulation 3(1) (interpretation), at the appropriate places insert—
““Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”;
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”;
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.
Commencement Information
I26Sch. 19 para. 253 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
254U.K.In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
Commencement Information
I27Sch. 19 para. 254 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
255U.K.In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
Commencement Information
I28Sch. 19 para. 255 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
256U.K.In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
Commencement Information
I29Sch. 19 para. 256 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
257U.K.In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute—
“(a)Article 89 GDPR purposes;”.
Commencement Information
I30Sch. 19 para. 257 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
258(1)Regulation 92(2) (interpretation and application of Part VI etc) is amended as follows.U.K.
(2)After sub-paragraph (b) insert—
“(ba)“relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards.”
(3)Omit sub-paragraphs (c) and (d).
Commencement Information
I31Sch. 19 para. 258 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
259U.K.In regulation 96(2A)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.
Commencement Information
I32Sch. 19 para. 259 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
260U.K.In regulation 97(5) and (6) (supply of free copy of full register to the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.
Commencement Information
I33Sch. 19 para. 260 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
261U.K.In regulation 97A(7) and (8) (supply of free copy of full register to the National Library of Wales and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.
Commencement Information
I34Sch. 19 para. 261 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
262U.K.In regulation 99(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.
Commencement Information
I35Sch. 19 para. 262 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
263U.K.In regulation 109A(9) and (10) (supply of free copy of full register to public libraries and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.
Commencement Information
I36Sch. 19 para. 263 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
264U.K.In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”) substitute—
“(i)Article 89 GDPR purposes;”.
Commencement Information
I37Sch. 19 para. 264 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
265U.K.The Representation of the People (Scotland) Regulations 2001 are amended as follows.
Commencement Information
I38Sch. 19 para. 265 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
266U.K.In regulation 3(1) (interpretation), at the appropriate places, insert—
““Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”;
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”;
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.
Commencement Information
I39Sch. 19 para. 266 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
267U.K.In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
Commencement Information
I40Sch. 19 para. 267 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
268U.K.In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
Commencement Information
I41Sch. 19 para. 268 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
269U.K.In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
Commencement Information
I42Sch. 19 para. 269 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
270U.K.In regulation 61(3) (records and lists kept under Schedule 4), for paragraph (a) (but not the final “or”) substitute—
“(a)Article 89 GDPR purposes;”.
Commencement Information
I43Sch. 19 para. 270 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
271U.K.In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute—
“(a)Article 89 GDPR purposes;”.
Commencement Information
I44Sch. 19 para. 271 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
272(1)Regulation 92(2) (interpretation of Part VI etc) is amended as follows.U.K.
(2)After sub-paragraph (b) insert—
“(ba)“relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards.”
(3)Omit sub-paragraphs (c) and (d).
Commencement Information
I45Sch. 19 para. 272 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
273U.K.In regulation 95(3)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.
Commencement Information
I46Sch. 19 para. 273 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
274U.K.In regulation 96(5) and (6) (supply of free copy of full register to the National Library of Scotland and the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.
Commencement Information
I47Sch. 19 para. 274 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
275U.K.In regulation 98(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.
Commencement Information
I48Sch. 19 para. 275 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
276U.K.In regulation 108A(9) and (10) (supply of full register to statutory library authorities and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.
Commencement Information
I49Sch. 19 para. 276 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
277U.K.In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”) substitute—
“(i)Article 89 GDPR purposes;”.
Commencement Information
I50Sch. 19 para. 277 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
278(1)Article 9 of the Financial Services and Markets 2000 (Disclosure of Confidential Information) Regulations 2001 (disclosure by regulators or regulator workers to certain other persons) is amended as follows.U.K.
(2)In paragraph (2B), for sub-paragraph (a) substitute—
“(a)the disclosure is made in accordance with Chapter V of the GDPR;”.
(3)After paragraph (5) insert—
“(6)In this article, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”
Commencement Information
I51Sch. 19 para. 278 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
279U.K.The Nursing and Midwifery Order 2001 is amended as follows.
Commencement Information
I52Sch. 19 para. 279 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
280(1)Article 3 (the Nursing and Midwifery Council and its Committees) is amended as follows.U.K.
(2)In paragraph (18), after “enactment” insert “ or the GDPR ”.
(3)After paragraph (18) insert—
“(19)In this paragraph, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”
Commencement Information
I53Sch. 19 para. 280 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
281(1)Article 25 (the Council's power to require disclosure of information) is amended as follows.U.K.
(2)In paragraph (3), after “enactment” insert “ or the GDPR ”.
(3)In paragraph (6)—
(a)for “paragraph (5),” substitute “ paragraph (3)— ”, and
(b)at the appropriate place insert—
““the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”
Commencement Information
I54Sch. 19 para. 281 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
282U.K.In article 39B (European professional card), after paragraph (2) insert—
“(3)For the purposes of Schedule 2B, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”
Commencement Information
I55Sch. 19 para. 282 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
283U.K.In article 40(6) (Directive 2005/36/EC: designation of competent authority etc), at the appropriate place insert—
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.
Commencement Information
I56Sch. 19 para. 283 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
284(1)Schedule 2B (Directive 2005/36/EC: European professional card) is amended as follows.U.K.
(2)In paragraph 8(1) (access to data) for “Directive 95/46/EC” substitute “ the GDPR ”.
(3)In paragraph 9 (processing data), omit sub-paragraph (2) (deeming the Society to be the controller for the purposes of Directive 95/46/EC).
Commencement Information
I57Sch. 19 para. 284 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
285(1)The table in Schedule 3 (functions of the Council under Directive 2005/36) is amended as follows.U.K.
(2)In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
(3)In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
Commencement Information
I58Sch. 19 para. 285 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
286U.K.In Schedule 4 (interpretation), omit the definition of “Directive 95/46/EC”.
Commencement Information
I59Sch. 19 para. 286 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
287U.K.Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002 (exclusions) is amended as follows.
Commencement Information
I60Sch. 19 para. 287 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
288U.K.In paragraph (1)(b) for “the Data Protection Directive and the Telecommunications Data Protection Directive” substitute “ the GDPR ”.
Commencement Information
I61Sch. 19 para. 288 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
289U.K.In paragraph (3)—
(a)omit the definitions of “Data Protection Directive” and “Telecommunications Data Protection Directive”, and
(b)at the appropriate place insert—
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.
Commencement Information
I62Sch. 19 para. 289 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
290U.K.The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 is revoked.
Commencement Information
I63Sch. 19 para. 290 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
291U.K.The Privacy and Electronic Communications (EC Directive) Regulations 2003 are amended as follows.
Commencement Information
I64Sch. 19 para. 291 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
292U.K.In regulation 2(1) (interpretation), in the definition of “the Information Commissioner” and “the Commissioner”, for “section 6 of the Data Protection Act 1998” substitute “ the Data Protection Act 2018 ”.
Commencement Information
I65Sch. 19 para. 292 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
293(1)Regulation 4 (relationship between these Regulations and the Data Protection Act 1998) is amended as follows.U.K.
(2)The existing text becomes sub-paragraph (1).
(3)In that sub-paragraph, for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(4)After that sub-paragraph insert—
“(2)In this regulation—
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4) and (14) of that Act).
(3)Regulation 2(2) and (3) (meaning of certain expressions) do not apply for the purposes of this regulation.”
(5)In the heading of that regulation, for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
Commencement Information
I66Sch. 19 para. 293 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
294U.K.The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 is amended as follows.
Commencement Information
I67Sch. 19 para. 294 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
295U.K.In article 8(2) (exercise of powers by French officers in a control zone in the United Kingdom: disapplication of law of England and Wales)—
(a)for “The Data Protection Act 1998” substitute “ The Data Protection Act 2018 ”, and
(b)for “are” substitute “ is ”.
Commencement Information
I68Sch. 19 para. 295 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
296U.K.In article 11(4) (exercise of powers by UK immigration officers and constables in a control zone in France: enactments having effect)—
(a)for “The Data Protection Act 1998” substitute “ The Data Protection Act 2018 ”,
(b)for “are” substitute “ is ”,
(c)for “section 5” substitute “ section 207 ”,
(d)for “data controller” substitute “ controller ”, and
(e)after “in the context of” insert “ the activities of ”.
Commencement Information
I69Sch. 19 para. 296 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
297U.K.The Pupils' Educational Records (Scotland) Regulations 2003 are amended as follows.
Commencement Information
I70Sch. 19 para. 297 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
298(1)Regulation 2 (interpretation) is amended as follows.U.K.
(2)Omit the definition of “the 1998 Act”.
(3)At the appropriate place insert—
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.
Commencement Information
I71Sch. 19 para. 298 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
299(1)Regulation 6 (circumstances where information should not be disclosed) is amended as follows.U.K.
(2)After “any information” insert “ to the extent that any of the following conditions are satisfied ”.
(3)For paragraphs (a) to (c) substitute—
“(aa)the pupil to whom the information relates would have no right of access to the information under the GDPR;
(ab)the information is personal data described in Article 9(1) or 10 of the GDPR (special categories of personal data and personal data relating to criminal convictions and offences);”.
(4)In paragraph (d), for “to the extent that its disclosure” substitute “ the disclosure of the information ”.
(5)In paragraph (e), for “that” substitute “ the information ”.
Commencement Information
I72Sch. 19 para. 299 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
300U.K.In regulation 9 (fees), for paragraph (1) substitute—
“(1A)In complying with a request made under regulation 5(2), the responsible body may only charge a fee where Article 12(5) or Article 15(3) of the GDPR would permit the charging of a fee if the request had been made by the pupil to whom the information relates under Article 15 of the GDPR.
(1B)Where paragraph (1A) permits the charging of a fee, the responsible body may not charge a fee that—
(a)exceeds the cost of supply, or
(b)exceeds any limit in regulations made under section 12 of the Data Protection Act 2018 that would apply if the request had been made by the pupil to whom the information relates under Article 15 of the GDPR.”
Commencement Information
I73Sch. 19 para. 300 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
301U.K.Schedule 1 to the European Parliamentary Elections (Northern Ireland) Regulations 2004 (European Parliamentary elections rules) is amended as follows.
Commencement Information
I74Sch. 19 para. 301 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
302(1)Paragraph 74(1) (interpretation) is amended as follows.U.K.
(2)Omit the definitions of “relevant conditions” and “research purposes”.
(3)At the appropriate places insert—
““Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”;
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.
Commencement Information
I75Sch. 19 para. 302 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
303U.K.In paragraph 77(2)(b) (conditions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “ Article 89 GDPR purposes ”.
Commencement Information
I76Sch. 19 para. 303 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
304U.K.In regulation 3(1) of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, omit “the appropriate limit referred to in section 9A(3) and (4) of the 1998 Act and”.
Commencement Information
I77Sch. 19 para. 304 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
305U.K.The Environmental Information Regulations 2004 are amended as follows.
Commencement Information
I78Sch. 19 para. 305 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
306(1)Regulation 2 (interpretation) is amended as follows.U.K.
(2)In paragraph (1), at the appropriate places, insert—
““the data protection principles” means the principles set out in—
(a)Article 5(1) of the GDPR,
(b)section 34(1) of the Data Protection Act 2018, and
(c)section 85(1) of that Act;”;
““data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”;
““the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);”;
““personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);”.
(3)For paragraph (4) substitute—
“(4A)In these Regulations, references to the Data Protection Act 2018 have effect as if in Chapter 3 of Part 2 of that Act (other general processing)—
(a)the references to an FOI public authority were references to a public authority as defined in these Regulations, and
(b)the references to personal data held by such an authority were to be interpreted in accordance with regulation 3(2).”
Commencement Information
I79Sch. 19 para. 306 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
307(1)Regulation 13 (personal data) is amended as follows.U.K.
(2)For paragraph (1) substitute—
“(1)To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if—
(a)the first condition is satisfied, or
(b)the second or third condition is satisfied and, in all the circumstances of the case, the public interest in not disclosing the information outweighs the public interest in disclosing it.”
(3)For paragraph (2) substitute—
“(2A)The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations—
(a)would contravene any of the data protection principles, or
(b)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(2B)The second condition is that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene—
(a)Article 21 of the GDPR (general processing: right to object to processing), or
(b)section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).”
(4)For paragraph (3) substitute—
“(3A)The third condition is that—
(a)on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018,
(b)on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or
(c)on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.”
(5)Omit paragraph (4).
(6)For paragraph (5) substitute—
“(5A)For the purposes of this regulation a public authority may respond to a request by neither confirming nor denying whether such information exists and is held by the public authority, whether or not it holds such information, to the extent that—
(a)the condition in paragraph (5B)(a) is satisfied, or
(b)a condition in paragraph (5B)(b) to (e) is satisfied and in all the circumstances of the case, the public interest in not confirming or denying whether the information exists outweighs the public interest in doing so.
(5B)The conditions mentioned in paragraph (5A) are—
(a)giving a member of the public the confirmation or denial—
(i)would (apart from these Regulations) contravene any of the data protection principles, or
(ii)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded;
(b)giving a member of the public the confirmation or denial would (apart from these Regulations) contravene Article 21 of the GDPR or section 99 of the Data Protection Act 2018 (right to object to processing);
(c)on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in paragraph (3A)(a);
(d)on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section;
(e)on a request under section 94(1)(a) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.”
(7)After that paragraph insert—
“(6)In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”
Commencement Information
I80Sch. 19 para. 307 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
308U.K.In regulation 14 (refusal to disclose information), in paragraph (3)(b), for “regulations 13(2)(a)(ii) or 13(3)” substitute “ regulation 13(1)(b) or (5A) ”.
Commencement Information
I81Sch. 19 para. 308 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
309U.K.In regulation 18 (enforcement and appeal provisions), in paragraph (5), for “regulation 13(5)” substitute “ regulation 13(5A) ”.
Commencement Information
I82Sch. 19 para. 309 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
310U.K.The Environmental Information (Scotland) Regulations 2004 are amended as follows.
Commencement Information
I83Sch. 19 para. 310 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
311(1)Regulation 2 (interpretation) is amended as follows.U.K.
(2)In paragraph (1), at the appropriate places, insert—
““the data protection principles” means the principles set out in—
(a)Article 5(1) of the GDPR, and
(b)section 34(1) of the Data Protection Act 2018;”;”;
““data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”;
““the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);”;
““personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);”.
(3)For paragraph (3) substitute—
“(3A)In these Regulations, references to the Data Protection Act 2018 have effect as if in Chapter 3 of Part 2 of that Act (other general processing)—
(a)the references to an FOI public authority were references to a Scottish public authority as defined in these Regulations, and
(b)the references to personal data held by such an authority were to be interpreted in accordance with paragraph (2) of this regulation.”
Commencement Information
I84Sch. 19 para. 311 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
312(1)Regulation 11 (personal data) is amended as follows.U.K.
(2)For paragraph (2) substitute—
“(2)To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if—
(a)the first condition set out in paragraph (3A) is satisfied, or
(b)the second or third condition set out in paragraph (3B) or (4A) is satisfied and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.”
(3)For paragraph (3) substitute—
“(3A)The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations—
(a)would contravene any of the data protection principles, or
(b)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(3B)The second condition is that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene Article 21 of the GDPR (general processing: right to object to processing).”
(4)For paragraph (4) substitute—
“(4A)The third condition is that any of the following applies to the information—
(a)it is exempt from the obligation under Article 15(1) of the GDPR (general processing: right of access by the data subject) to provide access to, and information about, personal data by virtue of provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or
(b)on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.”
(5)Omit paragraph (5).
(6)After paragraph (6) insert—
“(7)In determining, for the purposes of this regulation, whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”
Commencement Information
I85Sch. 19 para. 312 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
313(1)Regulation 7 of the Licensing Act 2003 (Personal Licences) Regulations 2005 (application for grant of a personal licence) is amended as follows.U.K.
(2)In paragraph (1)(b)—
(a)for paragraph (iii) (but not the final “, and”) substitute—
“(iii)the results of a request made under Article 15 of the GDPR or section 45 of the Data Protection Act 2018 (rights of access by the data subject) to the National Identification Service for information contained in the Police National Computer”, and
(b)in the words following paragraph (iii), omit “search”.
(3)After paragraph (2) insert—
“(3)In this regulation, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”
Commencement Information
I86Sch. 19 para. 313 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
314U.K.The Education (Pupil Information) (England) Regulations 2005 are amended as follows.
Commencement Information
I87Sch. 19 para. 314 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
315U.K.In regulation 3(5) (meaning of educational record) for “section 1(1) of the Data Protection Act 1998” substitute “ section 3(4) of the Data Protection Act 2018 ”.
Commencement Information
I88Sch. 19 para. 315 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
316(1)Regulation 5 (disclosure of curricular and educational records) is amended as follows.U.K.
(2)In paragraph (4)—
(a)in sub-paragraph (a), for “the Data Protection Act 1998” substitute “ the GDPR ”, and
(b)in sub-paragraph (b), for “that Act or by virtue of any order made under section 30(2) or section 38(1) of the Act” substitute “ the GDPR ”.
(3)After paragraph (6) insert—
“(7)In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”
Commencement Information
I89Sch. 19 para. 316 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
317(1)Regulation 45 of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (sensitive information) is amended as follows.U.K.
(2)In paragraph (1)(d)—
(a)omit “, within the meaning of section 1(1) of the Data Protection Act 1998”, and
(b)for “(2) or (3)” substitute “ (1A), (1B) or (1C) ”.
(3)After paragraph (1) insert—
“(1A)The condition in this paragraph is that the disclosure of the information to a member of the public—
(a)would contravene any of the data protection principles, or
(b)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(1B)The condition in this paragraph is that the disclosure of the information to a member of the public would contravene—
(a)Article 21 of the GDPR (general processing: right to object to processing), or
(b)section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).
(1C)The condition in this paragraph is that—
(a)on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018,
(b)on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or
(c)on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.
(1D)In this regulation—
“the data protection principles” means the principles set out in—
Article 5(1) of the GDPR,
section 34(1) of the Data Protection Act 2018, and
section 85(1) of that Act;
“the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);
“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).
(1E)In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”
(4)Omit paragraphs (2) to (4).
Commencement Information
I90Sch. 19 para. 317 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
318U.K.In regulation 3 of the Register of Judgments, Orders and Fines Regulations 2005 (interpretation)—
(a)for the definition of “data protection principles” substitute—
““data protection principles” means the principles set out in Article 5(1) of the GDPR;”, and
(b)at the appropriate place insert—
““the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);”.
Commencement Information
I91Sch. 19 para. 318 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
319U.K.The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 are amended as follows.
Commencement Information
I92Sch. 19 para. 319 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
320(1)Regulation 39 (sensitive information) is amended as follows.U.K.
(2)In paragraph (1)(d)—
(a)omit “, within the meaning of section 1(1) of the Data Protection Act 1998”, and
(b)for “(2) or (3)” substitute “ (1A), (1B) or (1C) ”.
(3)After paragraph (1) insert—
“(1A)The condition in this paragraph is that the disclosure of the information to a member of the public—
(a)would contravene any of the data protection principles, or
(b)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(1B)The condition in this paragraph is that the disclosure of the information to a member of the public would contravene—
(a)Article 21 of the GDPR (general processing: right to object to processing), or
(b)section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).
(1C)The condition in this paragraph is that—
(a)on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018,
(b)on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or
(c)on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.
(1D)In this regulation—
“the data protection principles” means the principles set out in—
Article 5(1) of the GDPR,
section 34(1) of the Data Protection Act 2018, and
section 85(1) of that Act;
“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
“the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);
“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).
(1E)In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”
(4)Omit paragraphs (2) to (4).
Commencement Information
I93Sch. 19 para. 320 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
321U.K.The Data Protection (Processing of Sensitive Personal Data) Order 2006 is revoked.
Commencement Information
I94Sch. 19 para. 321 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
322(1)Paragraph 14 of Schedule 1 to the National Assembly for Wales (Representation of the People) Order 2007 (absent voting at Assembly elections: conditions on the use, supply and inspection of absent vote records or lists) is amended as follows.U.K.
(2)The existing text becomes sub-paragraph (1).
(3)For paragraph (a) of that sub-paragraph (but not the final “or”) substitute—
“(a)purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”.
(4)After that sub-paragraph insert—
“(2)In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”
Commencement Information
I95Sch. 19 para. 322 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
323U.K.In regulation 3 of the Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (research which may be carried out despite a participant's loss of capacity), for paragraph (b) substitute—
“(b)any material used consists of or includes human cells or human DNA,”.
Commencement Information
I96Sch. 19 para. 323 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
324U.K.For article 5 of the National Assembly for Wales Commission (Crown Status) Order 2007 substitute—
5(1)The Assembly Commission is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article.
(2)The Assembly Commission is to be treated as a government department for the purposes of the following provisions—
(a)section 8(d) (lawfulness of processing under the GDPR: public interest etc),
(b)section 209 (application to the Crown),
(c)paragraph 6 of Schedule 1 (statutory etc and government purposes),
(d)paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and
(e)paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data).
(3)In the provisions mentioned in paragraph (4)—
(a)references to employment by or under the Crown are to be treated as including employment as a member of staff of the Assembly Commission, and
(b)references to a person in the service of the Crown are to be treated as including a person so employed.
(4)The provisions are—
(a)section 24(3) (exemption for certain data relating to employment under the Crown), and
(b)section 209(6) (application of certain provisions to a person in the service of the Crown).
(5)In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).”
Commencement Information
I97Sch. 19 para. 324 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
325U.K.In regulation 3 of the Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (research which may be carried out despite a participant's loss of capacity) —
(a)in the English language text, for paragraph (c) substitute—
“(c)any material used consists of or includes human cells or human DNA; and”, and
(b)in the Welsh language text, for paragraph (c) substitute—
“(c)os yw unrhyw ddeunydd a ddefnyddir yn gelloedd dynol neu'n DNA dynol neu yn eu cynnwys; ac”.
Commencement Information
I98Sch. 19 para. 325 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
326(1)Regulation 18 of the Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (conditions on the supply and inspection of absent voter records or lists) is amended as follows.U.K.
(2)In paragraph (1), for sub-paragraph (a) (but not the final “or”) substitute—
“(a)purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”.
(3)After paragraph (1) insert—
“(2)In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”
Commencement Information
I99Sch. 19 para. 326 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
327U.K.In regulation 5 of the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (conditions on the use, supply and disclosure of documents open to public inspection)—
(a)in paragraph (2), for sub-paragraph (i) (but not the final “or”) substitute—
“(i)purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”, and
(b)after paragraph (3) insert—
“(4)In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”
Commencement Information
I100Sch. 19 para. 327 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
328U.K.The Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 are amended as follows.
Commencement Information
I101Sch. 19 para. 328 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
329U.K.In regulation 2 (interpretation), at the appropriate place insert—
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.
Commencement Information
I102Sch. 19 para. 329 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
330U.K.In regulation 10(2) (duties of Boards of Governors), for “documents which are the subject of an order under section 30(2) of the Data Protection Act 1998” substitute “ information to which the pupil to whom the information relates would have no right of access under the GDPR ”.
Commencement Information
I103Sch. 19 para. 330 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
331U.K.In regulation 118 of the Representation of the People (Northern Ireland) Regulations 2008 (conditions on the use, supply and disclosure of documents open to public inspection)—
(a)in paragraph (2), for “research purposes within the meaning of that term in section 33 of the Data Protection Act 1998” substitute “ purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics) ”, and
(b)after paragraph (3) insert—
“(4)In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”
Commencement Information
I104Sch. 19 para. 331 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
332U.K.In paragraph 1(c) of the Schedule to the Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (modifications with which Chapter 1 of Part 28 of the Companies Act 2006 extends to the Isle of Man), for “the Data Protection Act 1998 (c 29)” substitute “ the data protection legislation ”.
Commencement Information
I105Sch. 19 para. 332 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
333U.K.The Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 are amended as follows.
Commencement Information
I106Sch. 19 para. 333 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
334U.K.In regulation 2(1) (interpretation)—
(a)at the appropriate place in the English language text insert—
““the GDPR” (“y GDPR”) and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);”, and
(b)at the appropriate place in the Welsh language text insert—
““mae i “y GDPR” a chyfeiriadau at Atodlen 2 i Ddeddf Diogelu Data 2018 yr un ystyr ag a roddir i “the GDPR” a chyfeiriadau at yr Atodlen honno yn Rhannau 5 i 7 o'r Ddeddf honno (gweler adran 3(10), (11) a (14) o'r Ddeddf honno);”.”
Commencement Information
I107Sch. 19 para. 334 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
335(1)Regulation 25 (duty to co-operate by disclosing information as regards relevant persons) is amended as follows.U.K.
(2)In paragraph (7)—
(a)in the English language text, at the end insert “ or the GDPR ”, and
(b)in the Welsh language text, at the end insert “neu'r GDPR”.
(3)For paragraph (8)—
(a)in the English language text substitute—
“(8)In determining for the purposes of paragraph (7) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”, and
(b)in the Welsh language text substitute—
“(8)Wrth benderfynu at ddibenion paragraff (7) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.”
Commencement Information
I108Sch. 19 para. 335 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
336(1)Regulation 26 (responsible bodies requesting additional information be disclosed about relevant persons) is amended as follows.U.K.
(2)In paragraph (6)—
(a)in the English language text, at the end insert “ or the GDPR ”, and
(b)in the Welsh language text, at the end insert “neu'r GDPR”.
(3)For paragraph (7)—
(a)in the English language text substitute—
“(7)In determining for the purposes of paragraph (6) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”, and
(b)in the Welsh language text substitute—
“(7)Wrth benderfynu at ddibenion paragraff (6) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.”
Commencement Information
I109Sch. 19 para. 336 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
337(1)Regulation 29 (occurrence reports) is amended as follows.U.K.
(2)In paragraph (3)—
(a)in the English language text, at the end insert “ or the GDPR ”, and
(b)in the Welsh language text, at the end insert “neu'r GDPR”.
(3)For paragraph (4)—
(a)in the English language text substitute—
“(4)In determining for the purposes of paragraph (3) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”, and
(b)in the Welsh language text substitute—
“(4)Wrth benderfynu at ddibenion paragraff (3) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.”
Commencement Information
I110Sch. 19 para. 337 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
338(1)Regulation 5 of the Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (information whose disclosure would be affected by the application of other legislation) is amended as follows.U.K.
(2)In paragraph (3)—
(a)omit “within the meaning of section 1(1) of the Data Protection Act 1998”, and
(b)for the words from “where” to the end substitute “ if the condition in paragraph (3A) or (3B) is satisfied ”.
(3)After paragraph (3) insert—
“(3A)The condition in this paragraph is that the disclosure of the information to a member of the public—
(a)would contravene any of the data protection principles, or
(b)would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.
(3B)The condition in this paragraph is that the disclosure of the information to a member of the public would contravene—
(a)Article 21 of the GDPR (general processing: right to object to processing), or
(b)section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).”
(4)After paragraph (4) insert—
“(5)In this regulation—
“the data protection principles” means the principles set out in—
Article 5(1) of the GDPR,
section 34(1) of the Data Protection Act 2018, and
section 85(1) of that Act;
“the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);
“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).”
Commencement Information
I111Sch. 19 para. 338 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
339(1)Paragraph 6 of Schedule 2 to the Companies (Disclosure of Address) Regulations 2009 (conditions for permitted disclosure to a credit reference agency) is amended as follows.U.K.
(2)The existing text becomes sub-paragraph (1).
(3)In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—
“(ii)for the purposes of ensuring that it complies with its data protection obligations;”.
(4)In paragraph (c) of that sub-paragraph—
(a)omit “or” at the end of sub-paragraph (i), and
(b)at the end insert “; or
(iii)section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);”.
(5)After paragraph (c) of that sub-paragraph insert—
“(d)has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.”
(6)After sub-paragraph (1) insert—
“(2)In this paragraph, “data protection obligations”, in relation to a credit reference agency, means—
(a)where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);
(b)where the agency carries on business in a EEA State other than the United Kingdom, obligations under—
(i)the GDPR (as defined in section 3(10) of the Data Protection Act 2018),
(ii)legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and
(iii)legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).”
Commencement Information
I112Sch. 19 para. 339 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
340(1)Paragraph 6 of Schedule 2 to the Overseas Companies Regulations 2009 (conditions for permitted disclosure to a credit reference agency) is amended as follows.U.K.
(2)The existing text becomes sub-paragraph (1).
(3)In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—
“(ii)for the purposes of ensuring that it complies with its data protection obligations;”.
(4)In paragraph (c) of that sub-paragraph—
(a)omit “or” at the end of sub-paragraph (i), and
(b)at the end insert “; or
(iii)section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);”.
(5)After paragraph (c) of that sub-paragraph insert—
“(d)has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.”
(6)After sub-paragraph (1) insert—
“(2)In this paragraph, “data protection obligations”, in relation to a credit reference agency, means—
(a)where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);
(b)where the agency carries on business in a EEA State other than the United Kingdom, obligations under—
(i)the GDPR (as defined in section 3(10) of the Data Protection Act 2018),
(ii)legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and
(iii)legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).”
Commencement Information
I113Sch. 19 para. 340 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
341U.K.The Data Protection (Processing of Sensitive Personal Data) Order 2009 is revoked.
Commencement Information
I114Sch. 19 para. 341 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
342U.K.In regulation 25 of the Provision of Services Regulations 2009 (derogations from the freedom to provide services), for paragraph (d) substitute—
“(d)matters covered by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.
Commencement Information
I115Sch. 19 para. 342 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
343(1)Regulation 9 of the INSPIRE Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows.U.K.
(2)In paragraph (2)—
(a)omit “or” at the end of sub-paragraph (a),
(b)for sub-paragraph (b) substitute—
“(b)Article 21 of the GDPR (general processing: right to object to processing), or
(c)section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).”, and
(c)omit the words following sub-paragraph (b).
(3)After paragraph (7) insert—
“(8)In this regulation—
“the data protection principles” means the principles set out in—
Article 5(1) of the GDPR,
section 34(1) of the Data Protection Act 2018, and
section 85(1) of that Act;
“the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);
“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).
(9)In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”
Commencement Information
I116Sch. 19 para. 343 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
344(1)Regulation 10 of the INSPIRE (Scotland) Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows.U.K.
(2)In paragraph (2)—
(a)omit “or” at the end of sub-paragraph (a),
(b)for sub-paragraph (b) substitute—
“(b)Article 21 of the GDPR (general processing: right to object to processing), or
(c)section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).”, and
(c)omit the words following sub-paragraph (b).
(3)After paragraph (6) insert—
“(7)In this regulation—
“the data protection principles” means the principles set out in—
Article 5(1) of the GDPR,
section 34(1) of the Data Protection Act 2018, and
section 85(1) of that Act;
“the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);
“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).
(8)In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.”
Commencement Information
I117Sch. 19 para. 344 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
345U.K.The Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 are amended as follows.
Commencement Information
I118Sch. 19 para. 345 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
346U.K.In regulation 2(2) (interpretation), at the appropriate place insert—
““the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);”.”
Commencement Information
I119Sch. 19 para. 346 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
347(1)Regulation 25 (duty to co-operate by disclosing information as regards relevant persons) is amended as follows.U.K.
(2)In paragraph (7), at the end insert “ or the GDPR ”.
(3)For paragraph (8) substitute—
“(8)In determining for the purposes of paragraph (7) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”
Commencement Information
I120Sch. 19 para. 347 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
348(1)Regulation 26 (responsible bodies requesting additional information be disclosed about relevant persons) is amended as follows.U.K.
(2)In paragraph (6), at the end insert “ or the GDPR ”.
(3)For paragraph (7) substitute—
“(7)In determining for the purposes of paragraph (6) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”
Commencement Information
I121Sch. 19 para. 348 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
349(1)Regulation 29 (occurrence reports) is amended as follows.U.K.
(2)In paragraph (3), at the end insert “ or the GDPR ”.
(3)For paragraph (4) substitute—
“(4)In determining for the purposes of paragraph (3) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”
Commencement Information
I122Sch. 19 para. 349 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
350U.K.The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 are revoked.
Commencement Information
I123Sch. 19 para. 350 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
351U.K.The Pharmacy Order 2010 is amended as follows.
Commencement Information
I124Sch. 19 para. 351 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
352U.K.In article 3(1) (interpretation), omit the definition of “Directive 95/46/EC”.
Commencement Information
I125Sch. 19 para. 352 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
353(1)Article 9 (inspection and enforcement) is amended as follows.U.K.
(2)For paragraph (4) substitute—
“(4)If a report that the Council proposes to publish pursuant to paragraph (3) includes personal data, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure of the personal data is required by paragraph (3) of this article.”
(3)After paragraph (4) insert—
“(5)In this article, “personal data” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).”
Commencement Information
I126Sch. 19 para. 353 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
354U.K.In article 33A (European professional card), after paragraph (2) insert—
“(3)In Schedule 2A, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”
Commencement Information
I127Sch. 19 para. 354 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
355(1)Article 49 (disclosure of information: general) is amended as follows.U.K.
(2)In paragraph (2)(a), after “enactment” insert “ or the GDPR ”.
(3)For paragraph (3) substitute—
“(3)In determining for the purposes of paragraph (2)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by paragraph (1) of this article.”
(4)After paragraph (5) insert—
“(6)In this article, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”
Commencement Information
I128Sch. 19 para. 355 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
356(1)Article 55 (professional performance assessments) is amended as follows.U.K.
(2)In paragraph (5)(a), after “enactment” insert “ or the GDPR ”.
(3)For paragraph (6) substitute—
“(6)In determining for the purposes of paragraph (5)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by paragraph (4) of this article.”
(4)After paragraph (8) insert—
“(9)In this article, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”
Commencement Information
I129Sch. 19 para. 356 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
357U.K.In article 67(6) (Directive 2005/36/EC: designation of competent authority etc.), after sub-paragraph (a) insert—
“(aa)“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.
Commencement Information
I130Sch. 19 para. 357 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
358(1)Schedule 2A (Directive 2005/36/EC: European professional card) is amended as follows.U.K.
(2)In paragraph 8(1) (access to data), for “Directive 95/46/EC)” substitute “ the GDPR ”.
(3)In paragraph 9 (processing data)—
(a)omit sub-paragraph (2) (deeming the Council to be the controller for the purposes of Directive 95/46/EC), and
(b)after sub-paragraph (2) insert—
“(3)In this paragraph, “personal data” has the same meaning as in the Data Protection Act 2018 (see section 3(2) of that Act).”
Commencement Information
I131Sch. 19 para. 358 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
359(1)The table in Schedule 3 (Directive 2005/36/EC: designation of competent authority etc.) is amended as follows.U.K.
(2)In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
(3)In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.
Commencement Information
I132Sch. 19 para. 359 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
360U.K.The Data Protection (Monetary Penalties) Order 2010 is revoked.
Commencement Information
I133Sch. 19 para. 360 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
361U.K.The National Employment Savings Trust Order 2010 is amended as follows.
Commencement Information
I134Sch. 19 para. 361 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
362U.K.In article 2 (interpretation)—
(a)omit the definition of “data” and “personal data”, and
(b)at the appropriate place insert—
““personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).”
Commencement Information
I135Sch. 19 para. 362 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
363(1)Article 10 (disclosure of requested data to the Secretary of State) is amended as follows.U.K.
(2)In paragraph (1)—
(a)for “disclosure of data” substitute “ disclosure of information ”, and
(b)for “requested data” substitute “ requested information ”.
(3)In paragraph (2)—
(a)for “requested data” substitute “ requested information ”,
(b)for “those data are” substitute “ the information is ”, and
(c)for “receive those data” substitute “ receive that information ”.
(4)In paragraph (3), for “requested data” substitute “ requested information ”.
(5)In paragraph (4), for “requested data” substitute “ requested information ”.
Commencement Information
I136Sch. 19 para. 363 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
364(1)Schedule 3 to the Local Elections (Northern Ireland) Order 2010 (access to marked registers and other documents open to public inspection after an election) is amended as follows.U.K.
(2)In paragraph 1(1) (interpretation and general)—
(a)omit the definition of “research purposes”, and
(b)at the appropriate places insert—
““Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”;
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.
(3)In paragraph 5(3) (restrictions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “ Article 89 GDPR purposes ”.
Commencement Information
I137Sch. 19 para. 364 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
365(1)Regulation 5 of the Pupil Information (Wales) Regulations 2011 (duties of head teacher - educational records) is amended as follows.U.K.
(2)In paragraph (5)—
(a)in the English language text, for “documents which are subject to any order under section 30(2) of the Data Protection Act 1998” substitute “information—
(a)which the head teacher could not lawfully disclose to the pupil under the GDPR, or
(b)to which the pupil would have no right of access under the GDPR.”, and
(b)in the Welsh language text, for “ddogfennau sy'n ddarostyngedig i unrhyw orchymyn o dan adran 30(2) o Ddeddf Diogelu Data 1998” substitute “wybodaeth—
(a)na allai'r pennaeth ei datgelu'n gyfreithlon i'r disgybl o dan y GDPR, neu
(b)na fyddai gan y disgybl hawl mynediad ati o dan y GDPR.”
(3)After paragraph (5)—
(a)in the English language text insert—
“(6)In this regulation, “the GDPR” (“y GDPR”) means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”, and
(b)in the Welsh language text insert—
“(6)Yn y rheoliad hwn, ystyr “y GDPR” (“the GDPR”) yw Rheoliad (EU) 2016/679 Senedd Ewrop a'r Cyngor dyddiedig 27 Ebrill 2016 ar ddiogelu personau naturiol o ran prosesu data personol a rhyddid symud data o'r fath (y Rheoliad Diogelu Data Cyffredinol), fel y'i darllenir ynghyd â Phennod 2 o Ran 2 o Ddeddf Diogelu Data 2018.”
Commencement Information
I138Sch. 19 para. 365 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
366U.K.In Schedule 4 to the Debt Arrangement Scheme (Scotland) Regulations 2011 (payments distributors), omit paragraph 2.
Commencement Information
I139Sch. 19 para. 366 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
367U.K.The Police and Crime Commissioner Elections Order 2012 is amended as follows.
Commencement Information
I140Sch. 19 para. 367 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
368(1)Schedule 2 (absent voting in Police and Crime Commissioner elections) is amended as follows.U.K.
(2)In paragraph 20 (absent voter lists: supply of copies etc)—
(a)in sub-paragraph (8), for paragraph (a) (but not the final “or”) substitute—
“(a)purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”, and
(b)after sub-paragraph (10) insert—
“(11)In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”
(3)In paragraph 24 (restriction on use of absent voter records or lists or the information contained in them)—
(a)in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—
“(a)purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics),”, and
(b)after that sub-paragraph insert—
“(4)In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”
Commencement Information
I141Sch. 19 para. 368 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
369(1)Schedule 10 (access to marked registers and other documents open to public inspection after an election) is amended as follows.U.K.
(2)In paragraph 1(2) (interpretation), omit paragraphs (c) and (d) (but not the final “and”).
(3)In paragraph 5 (restriction on use of documents or of information contained in them)—
(a)in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—
“(a)purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics),”, and
(b)after sub-paragraph (4) insert—
“(5)In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”
Commencement Information
I142Sch. 19 para. 369 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
370U.K.The Data Protection (Processing of Sensitive Personal Data) Order 2012 is revoked.
Commencement Information
I143Sch. 19 para. 370 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
371U.K.Schedule 6 to the Neighbourhood Planning (Referendums) Regulations 2012 (registering to vote in a business referendum) is amended as follows.
Commencement Information
I144Sch. 19 para. 371 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
372(1)Paragraph 29(1) (interpretation of Part 8) is amended as follows.U.K.
(2)At the appropriate places insert—
““Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”;
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);”.
(3)For the definition of “relevant conditions” substitute—
““relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards;”.
(4)Omit the definition of “research purposes”.
Commencement Information
I145Sch. 19 para. 372 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
373U.K.In paragraph 32(3)(b)(i), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.
Commencement Information
I146Sch. 19 para. 373 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
374U.K.In paragraph 33(6) and (7) (supply of copy of business voting register to the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.
Commencement Information
I147Sch. 19 para. 374 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
375U.K.In paragraph 34(6) and (7) (supply of copy of business voting register to the Office of National Statistics and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.
Commencement Information
I148Sch. 19 para. 375 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
376U.K.In paragraph 39(8) and (97) (supply of copy of business voting register to public libraries and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.
Commencement Information
I149Sch. 19 para. 376 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
377U.K.In paragraph 45(2) (conditions on the use, supply and disclosure of documents open to public inspection), for paragraph (a) (but not the final “or”) substitute—
“(a)Article 89 GDPR purposes (as defined in paragraph 29),”.
Commencement Information
I150Sch. 19 para. 377 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
378(1)Regulation 20 of the Controlled Drugs (Supervision of Management and Use) Regulations 2013 (information management) is amended as follows.U.K.
(2)For paragraph (4) substitute—
“(4)Where a CDAO, a responsible body or someone acting on their behalf is permitted to share information which includes personal data by virtue of a function under these Regulations, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.”
(3)In paragraph (5), after “enactment” insert “ or the GDPR ”.
(4)After paragraph (6) insert—
“(7)In this regulation, “the GDPR”, “personal data” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (10), (11) and (14) of that Act).”
Commencement Information
I151Sch. 19 para. 378 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
379(1)Article 3 of the Communications Act 2003 (Disclosure of Information) Order 2014 (specification of relevant functions) is amended as follows.U.K.
(2)The existing text becomes paragraph (1).
(3)In that paragraph, in sub-paragraph (a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(4)After that paragraph insert—
“(2)In this article, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Commencement Information
I152Sch. 19 para. 379 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
380U.K.In the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014, omit Part 4 (data protection in relation to police and judicial co-operation in criminal matters).
Commencement Information
I153Sch. 19 para. 380 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
381U.K.The Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 is revoked.
Commencement Information
I154Sch. 19 para. 381 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
382U.K.In regulation 6 of the Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (applications)—
(a)in paragraph (9), omit sub-paragraph (b) and the word “and” before it, and
(b)in paragraph (11), omit the definition of “processing” and “sensitive personal data” and the word “and” before it.
Commencement Information
I155Sch. 19 para. 382 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
383U.K.In regulation 3 of the Control of Poisons and Explosives Precursors Regulations 2015 (applications in relation to licences under section 4A of the Poisons Act 1972)—
(a)in paragraph (7), omit sub-paragraph (b) and the word “and” before it, and
(b)omit paragraph (8).
Commencement Information
I156Sch. 19 para. 383 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
384(1)Paragraph 6 of Schedule 2 to the Companies (Disclosure of Date of Birth Information) Regulations 2015 (conditions for permitted disclosure to a credit reference agency) is amended as follows.U.K.
(2)The existing text becomes sub-paragraph (1).
(3)In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—
“(ii)for the purposes of ensuring that it complies with its data protection obligations;”.
(4)In paragraph (c) of that sub-paragraph—
(a)omit “or” at the end of sub-paragraph (i), and
(b)at the end insert “; or
(iii)section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);”.
(5)After paragraph (c) of that sub-paragraph insert—
“(d)has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.”
(6)After sub-paragraph (1) insert—
“(2)In this paragraph, “data protection obligations”, in relation to a credit reference agency, means—
(a)where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);
(b)where the agency carries on business in a EEA State other than the United Kingdom, obligations under—
(i)the GDPR (as defined in section 3(10) of the Data Protection Act 2018),
(ii)legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and
(iii)legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).”
Commencement Information
I157Sch. 19 para. 384 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
385U.K.The Small and Medium Sized Business (Credit Information) Regulations 2015 are amended as follows.
Commencement Information
I158Sch. 19 para. 385 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
386(1)Regulation 12 (criteria for the designation of a credit reference agency) is amended as follows.U.K.
(2)In paragraph (1)(b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)After paragraph (2) insert—
“(3)In this regulation, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”
Commencement Information
I159Sch. 19 para. 386 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
387(1)Regulation 15 (access to and correction of information for individuals and small firms) is amended as follows.U.K.
(2)For paragraph (1) substitute—
“(1)Section 13 of the Data Protection Act 2018 (rights of the data subject under the GDPR: obligations of credit reference agencies) applies in respect of a designated credit reference agency which is not a credit reference agency within the meaning of section 145(8) of the Consumer Credit Act 1974 as if it were such an agency.”
(3)After paragraph (3) insert—
“(4)In this regulation, the reference to section 13 of the Data Protection Act 2018 has the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).”
Commencement Information
I160Sch. 19 para. 387 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
388U.K.The European Union (Recognition of Professional Qualifications) Regulations 2015 are amended as follows.
Commencement Information
I161Sch. 19 para. 388 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
389(1)Regulation 2(1) (interpretation) is amended as follows.U.K.
(2)Omit the definition of “Directive 95/46/EC”.
(3)At the appropriate place insert—
““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.
Commencement Information
I162Sch. 19 para. 389 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
390U.K.In regulation 5(5) (functions of competent authorities in the United Kingdom) for “Directives 95/46/EC” substitute “ the GDPR and Directive ”.
Commencement Information
I163Sch. 19 para. 390 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
391U.K.In regulation 45(3) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “ the GDPR ”.
Commencement Information
I164Sch. 19 para. 391 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
392U.K.In regulation 46(1) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “ the GDPR ”.
Commencement Information
I165Sch. 19 para. 392 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
393U.K.In regulation 48(2) (processing and access to data regarding the European Professional Card), omit paragraph (2) (deeming the relevant designated competent authorities to be controllers for the purposes of Directive 95/46/EC).
Commencement Information
I166Sch. 19 para. 393 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
394U.K.In regulation 66(3) (exchange of information), for “Directives 95/46/EC” substitute “ the GDPR and Directive ”.
Commencement Information
I167Sch. 19 para. 394 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
395U.K.The Scottish Parliament (Elections etc) Order 2015 is amended as follows.
Commencement Information
I168Sch. 19 para. 395 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
396(1)Schedule 3 (absent voting) is amended as follows.U.K.
(2)In paragraph 16 (absent voting lists: supply of copies etc)—
(a)in sub-paragraph (4), for paragraph (a) (but not the final “or”) substitute—
“(a)purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”, and
(b)after sub-paragraph (10) insert—
“(11)In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”
(3)In paragraph 20 (restriction on use of absent voting lists)—
(a)in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—
“(a)purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”, and
(b)after that sub-paragraph insert—
“(4)In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”
Commencement Information
I169Sch. 19 para. 396 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
397(1)Schedule 8 (access to marked registers and other documents open to public inspection after an election) is amended as follows.U.K.
(2)In paragraph 1(2) (interpretation), omit paragraphs (c) and (d) (but not the final “and”).
(3)In paragraph 5 (restriction on use of documents or of information contained in them)—
(a)in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—
“(a)purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);”, and
(b)after sub-paragraph (4) insert—
“(5)In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).”
Commencement Information
I170Sch. 19 para. 397 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
398U.K.In paragraph 1(3) of Schedule 3 to the Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (access to marked registers after a petition), omit the definition of “relevant conditions”.
Commencement Information
I171Sch. 19 para. 398 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
399U.K.Schedule 4 to the Register of People with Significant Control Regulations 2016 (conditions for permitted disclosure) is amended as follows.
Commencement Information
I172Sch. 19 para. 399 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
400(1)Paragraph 6 (disclosure to a credit reference agency) is amended as follows.U.K.
(2)In sub-paragraph (b), for paragraph (ii) (together with the final “; and”) substitute—
“(ii)for the purposes of ensuring that it complies with its data protection obligations;”.
(3)In sub-paragraph (c)—
(a)omit “or” at the end of paragraph (ii), and
(b)at the end insert—
“(iv)section 144 of the Data Protection Act 2018 (false statements made in response to an information notice); or
(v)section 148 of that Act (destroying or falsifying information and documents etc);”
(4)After sub-paragraph (c) insert—
“(d)has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in sub-paragraph (c)(iii), other than a penalty notice that has been cancelled.”
Commencement Information
I173Sch. 19 para. 400 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
401U.K.In paragraph 12A (disclosure to a credit institution or a financial institution), for sub-paragraph (b) substitute—
“(b)for the purposes of ensuring that it complies with its data protection obligations.”
Commencement Information
I174Sch. 19 para. 401 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
402U.K.In Part 3 (interpretation), after paragraph 13 insert—
“14In this Schedule, “data protection obligations”, in relation to a credit reference agency, a credit institution or a financial institution, means—
(a)where the agency or institution carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);
(b)where the agency or institution carries on business in a EEA State other than the United Kingdom, obligations under—
(i)the GDPR (as defined in section 3(10) of the Data Protection Act 2018),
(ii)legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and
(iii)legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).”
Commencement Information
I175Sch. 19 para. 402 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
403U.K.The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 are amended as follows.
Commencement Information
I176Sch. 19 para. 403 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
404U.K.In regulation 2(1) (interpretation), omit the definition of “the 1998 Act”.
Commencement Information
I177Sch. 19 para. 404 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
405U.K.In regulation 3(3) (supervision), omit “under the 1998 Act”.
Commencement Information
I178Sch. 19 para. 405 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
406U.K.For Schedule 2 substitute—
1For the purposes of enforcing these Regulations and the eIDAS Regulation, the following provisions of Parts 5 to 7 of the Data Protection Act 2018 apply with the modifications set out in paragraphs 2 to 26—
(a)section 140 (publication by the Commissioner);
(b)section 141 (notices from the Commissioner);
(c)section 142 (information notices);
(d)section 143 (information notices: restrictions);
(e)section 144 (false statements made in response to an information notice);
(f)section 145 (information orders);
(g)section 146 (assessment notices);
(h)section 147 (assessment notices: restrictions);
(i)section 148 (destroying or falsifying information and documents etc);
(j)section 149 (enforcement notices);
(k)section 150 (enforcement notices: supplementary);
(l)section 152 (enforcement notices: restrictions);
(m)section 153 (enforcement notices: cancellation and variation);
(n)section 154 and Schedule 15 (powers of entry and inspection);
(o)section 155 and Schedule 16 (penalty notices);
(p)section 156(4)(a) (penalty notices: restrictions);
(q)section 157 (maximum amount of penalty);
(r)section 159 (amount of penalties: supplementary);
(s)section 160 (guidance about regulatory action);
(t)section 161 (approval of first guidance about regulatory action);
(u)section 162 (rights of appeal);
(v)section 163 (determination of appeals);
(w)section 164 (applications in respect of urgent notices);
(x)section 180 (jurisdiction);
(y)section 182(1), (2), (5), (7) and (13) (regulations and consultation);
(z)section 196 (penalties for offences);
(z1)section 197 (prosecution);
(z2)section 202 (proceedings in the First-tier Tribunal: contempt);
(z3)section 203 (Tribunal Procedure Rules).
2The provisions listed in paragraph 1 have effect as if—
(a)references to the Data Protection Act 2018 were references to the provisions of that Act as applied by these Regulations;
(b)references to a particular provision of that Act were references to that provision as applied by these Regulations.
3(1)Section 142 has effect as if subsections (9) and (10) were omitted.
(2)In that section, subsection (1) has effect as if—
(a)in paragraph (a)—
(i)for “controller or processor” there were substituted “ trust service provider ”;
(ii)for “the data protection legislation” there were substituted “ the eIDAS Regulation and the EITSET Regulations ”;
(b)paragraph (b) were omitted.
(3)In that section, subsection (2) has effect as if paragraph (a) were omitted.
4(1)Section 143 has effect as if subsections (1) and (9) were omitted.
(2)In that section—
(a)subsections (3)(b) and (4)(b) have effect as if for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”;
(b)subsection (7)(a) has effect as if for “this Act” there were substituted “ section 144 or 148 or paragraph 15 of Schedule 15 ”;
(c)subsection (8) has effect as if for “this Act (other than an offence under section 144)” there were substituted “ section 148 or paragraph 15 of Schedule 15 ”.
5Section 145(2)(b) has effect as if for “section 142(2)(b)” there were substituted “ section 142(2) ”.
6(1)Section 146 has effect as if subsection (11) were omitted.
(2)In that section—
(a)subsection (1) has effect as if—
(i)for “controller or processor” (in both places) there were substituted “ trust service provider ”;
(ii)for “the data protection legislation” there were substituted “ the eIDAS requirements ”;
(b)subsection (2) has effect as if paragraphs (h) and (i) were omitted;
(c)subsections (7), (8), (9) and (10) have effect as if for “controller or processor” (in each place) there were substituted “trust service provider.
(d)subsection (9)(a) has effect as if for “as described in section 149(2) or that an offence under this Act” there were substituted “ to comply with the eIDAS requirements or that an offence under section 144 or 148 or paragraph 15 of Schedule 15 ”.
7(1)Section 147 has effect as if subsections (5) and (6) were omitted.
(2)In that section, subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”.
8(1)Section 149 has effect as if subsections (2) to (5) and (7) to (9) were omitted.
(2)In that section—
(a)subsection (1) has effect as if—
(i)for “as described in subsection (2), (3), (4) or (5)” there were substituted “ to comply with the eIDAS requirements ”;
(ii)for “sections 150 and 151” there were substituted “ section 150 ”;
(b)subsection (6) has effect as if the words “given in reliance on subsection (2), (3) or (5)” were omitted.
9(1)Section 150 has effect as if subsection (3) were omitted.
(2)In that section, subsection (2) has effect as if the words “in reliance on section 149(2)” and “or distress” were omitted.
10Section 152 has effect as if subsections (1), (2) and (4) were omitted.
11The provisions listed in paragraph 1 have effect as if after section 153 there were inserted—
(1)The Commissioner may, by written notice (a “withdrawal notice”), withdraw the qualified status from a trust service provider, or the qualified status of a service provided by a trust service provider, if—
(a)the Commissioner is satisfied that the trust service provider has failed to comply with an information notice or an enforcement notice, and
(b)the condition in subsection (2) or (3) is met.
(2)The condition in this subsection is met if the period for the trust service provider to appeal against the information notice or enforcement notice has ended without an appeal having been brought.
(3)The condition in this subsection is met if an appeal against the information notice or enforcement notice has been brought and—
(a)the appeal and any further appeal in relation to the notice has been decided or has otherwise ended, and
(b)the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought.
(4)A withdrawal notice must—
(a)state when the withdrawal takes effect, and
(b)provide information about the rights of appeal under section 162.”
12(1)Schedule 15 has effect as if paragraph 3 were omitted.
(2)Paragraph 1(1) of that Schedule (issue of warrants in connection with non-compliance and offences) has effect as if for paragraph (a) (but not the final “and”) there were substituted—
“(a)there are reasonable grounds for suspecting that—
(i)a trust service provider has failed or is failing to comply with the eIDAS requirements, or
(ii)an offence under section 144 or 148 or paragraph 15 of Schedule 15 has been or is being committed,”.
(3)Paragraph 2 of that Schedule (issue of warrants in connection with assessment notices) has effect as if—
(a)in sub-paragraphs (1) and (2), for “controller or processor” there were substituted “ trust service provider ”;
(b)in sub-paragraph (2), for “the data protection legislation” there were substituted “ the eIDAS requirements ”.
(4)Paragraph 5 of that Schedule (content of warrants) has effect as if—
(a)in sub-paragraph (1)(c), for “the processing of personal data” there were substituted “ the provision of trust services ”;
(b)in sub-paragraph (2)(d)—
(i)for “controller or processor” there were substituted “ trust service provider ”;
(ii)for “as described in section 149(2)” there were substituted “ to comply with the eIDAS requirements ”;
(c)in sub-paragraph (3)(a) and (d)—
(i)for “controller or processor” there were substituted “ trust service provider ”;
(ii)for “the data protection legislation” there were substituted “ the eIDAS requirements ”.
(5)Paragraph 11 of that Schedule (privileged communications) has effect as if, in sub-paragraphs (1)(b) and (2)(b), for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”.
13(1)Section 155 has effect as if subsections (1)(a), (2)(a), (3)(g), (4) and (6) to (8) were omitted.
(2)Subsection (2) of that section has effect as if—
(a)the words “Subject to subsection (4),” were omitted;
(b)in paragraph (b), the words “to the extent that the notice concerns another matter,” were omitted.
(3)Subsection (3) of that section has effect as if—
(a)for “controller or processor”, in each place, there were substituted “ trust services provider ”;
(b)in paragraph (c), the words “or distress” were omitted;
(c)in paragraph (c), for “data subjects” there were substituted “ relying parties ”;
(d)in paragraph (d), for “section 57, 66, 103 or 107” there were substituted “ Article 19(1) of the eIDAS Regulation ”.
14Schedule 16 has effect as if paragraphs 3(2)(b) and 5(2)(b) were omitted.
15Section 157 has effect as if subsections (1) to (3) and (6) were omitted.
16Section 159 has effect as if—
(a)in subsection (1), the words “Article 83 of the GDPR and” were omitted;
(b)in subsection (2), the words “Article 83 of the GDPR” and “and section 158” were omitted.
17(1)Section 160 has effect as if subsections (5) and (12) were omitted.
(2)In that section, subsection (4)(f) has effect as if for “controllers and processors” there were substituted “ trust service providers ”.
18(1)Section 162 has effect as if subsection (4) were omitted.
(2)In that section, subsection (1) has effect as if, after paragraph (c), there were inserted—
“(ca)a withdrawal notice;”.
19Section 163 has effect as if subsection (6) were omitted.
20(1)Section 180 has effect as if subsections (2)(d) and (e) and (3) were omitted.
(2)Subsection (1) of that section has effect as if for “subsections (3) and (4)” there were substituted “ subsection (4) ”.
21Section 182 has effect as if subsections (3), (4), (6), (8) to (11) and (14) were omitted.
22(1)Section 196 has effect as if subsections (3) to (5) were omitted.
(2)In that section—
(a)subsection (1) has effect as if the words “section 119 or 173 or” were omitted;
(b)subsection (2) has effect as if for “section 132, 144, 148, 170, 171 or 184” there were substituted “ section 144 or 148 ”.
23Section 197 has effect as if subsections (3) to (6) were omitted.
24Section 202 has effect as if in subsection (1)(a), for sub-paragraphs (i) and (ii) there were substituted “ on an appeal under section 162 ”.
25Section 203 has effect as if—
(a)in subsection (1), for paragraphs (a) and (b) there were substituted “ the exercise of the rights of appeal conferred by section 162 ”;
(b)in subsection (2)(a) and (b), for “the processing of personal data” there were substituted “ the provision of trust services ”.
26(1)This paragraph applies if the first guidance produced under section 160(1) of the Data Protection Act 2018 and the first guidance produced under that provision as applied by this Schedule are laid before Parliament as a single document (“the combined guidance”).
(2)Section 161 of that Act (including that section as applied by this Schedule) has effect as if the references to “the guidance” were references to the combined guidance, except in subsections (2)(b) and (4).
(3)Nothing in subsection (2)(a) of that section (including as applied by this Schedule) prevents another version of the combined guidance being laid before Parliament.
(4)Any duty under subsection (2)(b) of that section (including as applied by this Schedule) may be satisfied by producing another version of the combined guidance.
27In this Schedule—
“the eIDAS requirements” means the requirements of Chapter III of the eIDAS Regulation;
“the EITSET Regulations” means these Regulations;
“withdrawal notice” has the meaning given in section 153A of the Data Protection Act 2018 (as inserted in that Act by this Schedule).”
Commencement Information
I179Sch. 19 para. 406 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g) (with reg. 4)
407U.K.The Court Files Privileged Access Rules (Northern Ireland) 2016 are amended as follows.
Commencement Information
I180Sch. 19 para. 407 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
408U.K.In rule 5 (information that may released) for “Schedule 1 of the Data Protection Act 1998” substitute “—
(a)Article 5(1) of the GDPR, and
(b)section 34(1) of the Data Protection Act 2018.”
Commencement Information
I181Sch. 19 para. 408 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
409U.K.In rule 7(2) (provision of information) for “Schedule 1 of the Data Protection Act 1998” substitute “—
(a)Article 5(1) of the GDPR, and
(b)section 34(1) of the Data Protection Act 2018.”
Commencement Information
I182Sch. 19 para. 409 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
410U.K.The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 are amended as follows.
Commencement Information
I183Sch. 19 para. 410 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
411U.K.In regulation 3(1) (interpretation), at the appropriate places insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”;
““the GDPR” and references to provisions of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);”.
Commencement Information
I184Sch. 19 para. 411 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
412U.K.In regulation 16(8) (risk assessment by the Treasury and Home Office), for “the Data Protection Act 1998 or any other enactment” substitute “—
(a)the Data Protection Act 2018 or any other enactment, or
(b)the GDPR.”
Commencement Information
I185Sch. 19 para. 412 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
413U.K.In regulation 17(9) (risk assessment by supervisory authorities), for “the Data Protection Act 1998 or any other enactment” substitute “—
(a)the Data Protection Act 2018 or any other enactment, or
(b)the GDPR.”
Commencement Information
I186Sch. 19 para. 413 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
414U.K.For regulation 40(9)(c) (record keeping) substitute—
“(c)“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
(d)“personal data” has the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).”
Commencement Information
I187Sch. 19 para. 414 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
415(1)Regulation 41 (data protection) is amended as follows.U.K.
(2)Omit paragraph (2).
(3)In paragraph (3)(a), after “Regulations” insert “ or the GDPR ”.
(4)Omit paragraphs (4) and (5).
(5)After those paragraphs insert—
“(6)Before establishing a business relationship or entering into an occasional transaction with a new customer, as well as providing the customer with the information required under Article 13 of the GDPR (information to be provided where personal data are collected from the data subject), relevant persons must provide the customer with a statement that any personal data received from the customer will be processed only—
(a)for the purposes of preventing money laundering or terrorist financing, or
(b)as permitted under paragraph (3).
(7)In Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest includes processing of personal data in accordance with these Regulations that is necessary for the prevention of money laundering or terrorist financing.
(8)In the case of sensitive processing of personal data for the purposes of the prevention of money laundering or terrorist financing, section 10 of, and Schedule 1 to, the Data Protection Act 2018 make provision about when the processing meets a requirement in Article 9(2) or 10 of the GDPR for authorisation under the law of the United Kingdom (see, for example, paragraphs 10, 11 and 12 of that Schedule).
(9)In this regulation—
“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4) and (14) of that Act);
“sensitive processing” means the processing of personal data described in Article 9(1) or 10 of the GDPR (special categories of personal data and personal data relating to criminal convictions and offences etc).”
Commencement Information
I188Sch. 19 para. 415 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
416(1)Regulation 84 (publication: the Financial Conduct Authority) is amended as follows.U.K.
(2)In paragraph (10), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)For paragraph (11) substitute—
“(11)For the purposes of this regulation, “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).”
Commencement Information
I189Sch. 19 para. 416 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
417(1)Regulation 85 (publication: the Commissioners) is amended as follows.U.K.
(2)In paragraph (9), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.
(3)For paragraph (10) substitute—
“(10)For the purposes of this regulation, “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).”
Commencement Information
I190Sch. 19 para. 417 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
418U.K.For regulation 106(a) (general restrictions) substitute—
“(a)a disclosure in contravention of the data protection legislation; or”.
Commencement Information
I191Sch. 19 para. 418 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
419U.K.After paragraph 27 of Schedule 3 (relevant offences) insert—
“27AAn offence under the Data Protection Act 2018, apart from an offence under section 173 of that Act.”
Commencement Information
I192Sch. 19 para. 419 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
420(1)Paragraph 6 of Schedule 5 to the Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (conditions for permitted disclosure to a credit institution or a financial institution) is amended as follows.U.K.
(2)The existing text becomes sub-paragraph (1).
(3)For paragraph (b) of that sub-paragraph substitute—
“(b)for the purposes of ensuring that it complies with its data protection obligations.”
(4)After sub-paragraph (1) insert—
“(2)In this paragraph, “data protection obligations”, in relation to a relevant institution, means—
(a)where the institution carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);
(b)where the institution carries on business in a EEA State other than the United Kingdom, obligations under—
(i)the GDPR (as defined in section 3(10) of the Data Protection Act 2018),
(ii)legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and
(iii)legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).”
Commencement Information
I193Sch. 19 para. 420 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
421U.K.In regulation 1(2) of the Data Protection (Charges and Information) Regulations 2018 (interpretation), at the appropriate places insert—
““data controller” means a person who is a controller for the purposes of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act);”;
““personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);”.
Commencement Information
I194Sch. 19 para. 421 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
422U.K.The National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 are amended as follows.
Commencement Information
I195Sch. 19 para. 422 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
423(1)Regulation 1 (citation and commencement) is amended as follows.U.K.
(2)In paragraph (2), omit “Subject to paragraph (3),”.
(3)Omit paragraph (3).
Commencement Information
I196Sch. 19 para. 423 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
424U.K.In regulation 3(1) (interpretation)—
(a)omit the definition of “the 1998 Act”,
(b)at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”, and
(c)omit the definition of “GDPR”.
Commencement Information
I197Sch. 19 para. 424 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
425(1)Schedule 6 (other contractual terms) is amended as follows.U.K.
(2)In paragraph 63(2) (interpretation: general), for “the 1998 Act or any directly applicable EU instrument relating to data protection” substitute “—
(a)the data protection legislation, or
(b)any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection.”
(3)For paragraph 64 (meaning of data controller etc.) substitute—
64AFor the purposes of this Part—
“controller” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act);
“data protection officer” means a person designated as a data protection officer under the data protection legislation;
“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act).”
(4)In paragraph 65(2)(b) (roles, responsibilities and obligations: general), for “data controllers” substitute “ controllers ”.
(5)In paragraph 69(2)(a) (processing and access of data), for “the 1998 Act, and any directly applicable EU instrument relating to data protection;” substitute “—
(i)the data protection legislation, and
(ii)any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;”.
(6)In paragraph 94(4) (variation of a contract: general)—
(a)omit paragraph (b), and
(b)after paragraph (d) (but before the final “and”) insert—
“(da)the data protection legislation;
(db)any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;”.
Commencement Information
I198Sch. 19 para. 425 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
426U.K.The National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 are amended as follows.
Commencement Information
I199Sch. 19 para. 426 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
427(1)Regulation 1 (citation and commencement) is amended as follows.U.K.
(2)In paragraph (2), omit “Subject to paragraph (3),”.
(3)Omit paragraph (3).
Commencement Information
I200Sch. 19 para. 427 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
428U.K.In regulation 3(1) (interpretation)—
(a)omit the definition of “the 1998 Act”, and
(b)at the appropriate place insert—
““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”, and
(c)omit the definition of “GDPR”.
Commencement Information
I201Sch. 19 para. 428 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
429(1)Schedule 1 (content of agreements) is amended as follows.U.K.
(2)In paragraph 34 (interpretation)—
(a)in sub-paragraph (1)—
(i)omit “Subject to sub-paragraph (3),”,
(ii)before paragraph (a) insert—
“(za)“controller” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act);
(zb)“data protection officer” means a person designated as a data protection officer under the data protection legislation;”, and
(iii)for paragraph (d) substitute—
“(e)“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act).”,
(b)omit sub-paragraphs (2) and (3),
(c)in sub-paragraph (4), for “the 1998 Act and any directly applicable EU instrument relating to data protection” substitute “—
(a)the data protection legislation, or
(b)any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection.”, and
(d)in sub-paragraph (6)(b), for “data controllers” substitute “ controllers ”.
(3)In paragraph 37(2)(a) (processing and access of data), for “the 1998 Act, and any directly applicable EU instrument relating to data protection;” substitute “—
(i)the data protection legislation, and
(ii)any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;”.
(4)In paragraph 61(3) (variation of agreement: general)—
(a)omit paragraph (b), and
(b)after paragraph (d) (but before the final “and”) insert—
“(da)the data protection legislation;
(db)any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;”.
Commencement Information
I202Sch. 19 para. 429 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
The Whole Schedule you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Schedule you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
This Part only you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
This Part only you have selected contains over 200 provisions and might take some time to download.
Would you like to continue?
The Whole Act you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Whole Act without Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
The Schedules you have selected contains over 200 provisions and might take some time to download. You may also experience some issues with your browser, such as an alert box that a script is taking a long time to run.
Would you like to continue?
Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.
Point in Time: This becomes available after navigating to view revised legislation as it stood at a certain point in time via Advanced Features > Show Timeline of Changes or via a point in time advanced search.
Geographical Extent: Indicates the geographical area that this provision applies to. For further information see ‘Frequently Asked Questions’.
Show Timeline of Changes: See how this legislation has or could change over time. Turning this feature on will show extra navigation options to go to these specific points in time. Return to the latest available version by using the controls above in the What Version box.
Text created by the government department responsible for the subject matter of the Act to explain what the Act sets out to achieve and to make the Act accessible to readers who are not legally qualified. Explanatory Notes were introduced in 1999 and accompany all Public Acts except Appropriation, Consolidated Fund, Finance and Consolidation Acts.
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:
This timeline shows the different points in time where a change occurred. The dates will coincide with the earliest date on which the change (e.g an insertion, a repeal or a substitution) that was applied came into force. The first date in the timeline will usually be the earliest date when the provision came into force. In some cases the first date is 01/02/1991 (or for Northern Ireland legislation 01/01/2006). This date is our basedate. No versions before this date are available. For further information see the Editorial Practice Guide and Glossary under Help.
Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:
Click 'View More' or select 'More Resources' tab for additional information including: