Data Protection Act 2018

• (2) In paragraph (4)—

• (a) in sub-paragraph (a), for “the Data Protection Act 1998” substitute “ the GDPR ”, and

• (b) in sub-paragraph (b), for “that Act or by virtue of any order made under section 30(2) or section 38(1) of the Act” substitute “ the GDPR ”.

• (3) After paragraph (6) insert—

(7) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.

Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042)

317

• (1) Regulation 45 of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (sensitive information) is amended as follows.

• (2) In paragraph (1)(d)—

• (a) omit “, within the meaning of section 1(1) of the Data Protection Act 1998”, and

• (b) for “(2) or (3)” substitute “ (1A), (1B) or (1C) ”.

• (3) After paragraph (1) insert—

(1A) The condition in this paragraph is that the disclosure of the information to a member of the public— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (1B) The condition in this paragraph is that the disclosure of the information to a member of the public would contravene— (a) Article 21 of the GDPR (general processing: right to object to processing), or (b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing). (1C) The condition in this paragraph is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or (c) on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act. (1D) In this regulation— - “the data protection principles” means the principles set out in— 1. Article 5(1) of the GDPR, 2. section 34(1) of the Data Protection Act 2018, and 3. section 85(1) of that Act; - “the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act); - “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). (1E) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

• (4) Omit paragraphs (2) to (4).

Register of Judgments, Orders and Fines Regulations 2005 (S.I. 2005/3595)

318

In regulation 3 of the Register of Judgments, Orders and Fines Regulations 2005 (interpretation)—

• (a) for the definition of “data protection principles” substitute—

“data protection principles” means the principles set out in Article 5(1) of the GDPR;

, and

• (b) at the appropriate place insert—

“the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);

.

Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494)

319

The Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 are amended as follows.

320

• (1) Regulation 39 (sensitive information) is amended as follows.

• (2) In paragraph (1)(d)—

• (a) omit “, within the meaning of section 1(1) of the Data Protection Act 1998”, and

• (b) for “(2) or (3)” substitute “ (1A), (1B) or (1C) ”.

• (3) After paragraph (1) insert—

(1A) The condition in this paragraph is that the disclosure of the information to a member of the public— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (1B) The condition in this paragraph is that the disclosure of the information to a member of the public would contravene— (a) Article 21 of the GDPR (general processing: right to object to processing), or (b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing). (1C) The condition in this paragraph is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or (c) on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act. (1D) In this regulation— - “the data protection principles” means the principles set out in— 1. Article 5(1) of the GDPR, 2. section 34(1) of the Data Protection Act 2018, and 3. section 85(1) of that Act; - “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); - “the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act); - “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). (1E) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

• (4) Omit paragraphs (2) to (4).

Data Protection (Processing of Sensitive Personal Data) Order 2006 (S.I. 2006/2068)

321

The Data Protection (Processing of Sensitive Personal Data) Order 2006 is revoked.

National Assembly for Wales (Representation of the People) Order 2007 (S.I. 2007/236)

322

• (1) Paragraph 14 of Schedule 1 to the National Assembly for Wales (Representation of the People) Order 2007 (absent voting at Assembly elections: conditions on the use, supply and inspection of absent vote records or lists) is amended as follows.

• (2) The existing text becomes sub-paragraph (1).

• (3) For paragraph (a) of that sub-paragraph (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

.

• (4) After that sub-paragraph insert—

(2) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (S.I. 2007/679)

323

In regulation 3 of the Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (research which may be carried out despite a participant's loss of capacity), for paragraph (b) substitute—

(b) any material used consists of or includes human cells or human DNA,

.

National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118)

324

For article 5 of the National Assembly for Wales Commission (Crown Status) Order 2007 substitute—

(5) (1) The Assembly Commission is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article. (2) The Assembly Commission is to be treated as a government department for the purposes of the following provisions— (a) section 8(d) (lawfulness of processing under the GDPR: public interest etc), (b) section 209 (application to the Crown), (c) paragraph 6 of Schedule 1 (statutory etc and government purposes), (d) paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and (e) paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data). (3) In the provisions mentioned in paragraph (4)— (a) references to employment by or under the Crown are to be treated as including employment as a member of staff of the Assembly Commission, and (b) references to a person in the service of the Crown are to be treated as including a person so employed. (4) The provisions are— (a) section 24(3) (exemption for certain data relating to employment under the Crown), and (b) section 209(6) (application of certain provisions to a person in the service of the Crown). (5) In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).

Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (S.I. 2007/837 (W.72))

325

In regulation 3 of the Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (research which may be carried out despite a participant's loss of capacity) —

• (a) in the English language text, for paragraph (c) substitute—

(c) any material used consists of or includes human cells or human DNA; and

, and

• (b) in the Welsh language text, for paragraph (c) substitute—

(c) os yw unrhyw ddeunydd a ddefnyddir yn gelloedd dynol neu'n DNA dynol neu yn eu cynnwys; ac

.

Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (S.S.I. 2007/170)

326

• (1) Regulation 18 of the Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (conditions on the supply and inspection of absent voter records or lists) is amended as follows.

• (2) In paragraph (1), for sub-paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

.

• (3) After paragraph (1) insert—

(2) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (S.S.I. 2007/264)

327

In regulation 5 of the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (conditions on the use, supply and disclosure of documents open to public inspection)—

• (a) in paragraph (2), for sub-paragraph (i) (but not the final “or”) substitute—

(i) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

, and

• (b) after paragraph (3) insert—

(4) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 (S.R. (N.I.) 2007 No. 43)

328

The Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 are amended as follows.

329

In regulation 2 (interpretation), at the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

.

330

In regulation 10(2) (duties of Boards of Governors), for “documents which are the subject of an order under section 30(2) of the Data Protection Act 1998” substitute “ information to which the pupil to whom the information relates would have no right of access under the GDPR ”.

Representation of the People (Northern Ireland) Regulations 2008 (S.I. 2008/1741)

331

In regulation 118 of the Representation of the People (Northern Ireland) Regulations 2008 (conditions on the use, supply and disclosure of documents open to public inspection)—

• (a) in paragraph (2), for “research purposes within the meaning of that term in section 33 of the Data Protection Act 1998” substitute “ purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics) ”, and

• (b) after paragraph (3) insert—

(4) In this regulation, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (S.I. 2008/3122)

332

In paragraph 1(c) of the Schedule to the Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (modifications with which Chapter 1 of Part 28 of the Companies Act 2006 extends to the Isle of Man), for “the Data Protection Act 1998 (c 29)” substitute “ the data protection legislation ”.

Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 (S.I. 2008/3239 (W.286))

333

The Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 are amended as follows.

334

In regulation 2(1) (interpretation)—

• (a) at the appropriate place in the English language text insert—

“the GDPR” (“y GDPR”) and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

, and

• (b) at the appropriate place in the Welsh language text insert—

“mae i “y GDPR” a chyfeiriadau at Atodlen 2 i Ddeddf Diogelu Data 2018 yr un ystyr ag a roddir i “the GDPR” a chyfeiriadau at yr Atodlen honno yn Rhannau 5 i 7 o'r Ddeddf honno (gweler adran 3(10), (11) a (14) o'r Ddeddf honno);”.

335

• (1) Regulation 25 (duty to co-operate by disclosing information as regards relevant persons) is amended as follows.

• (2) In paragraph (7)—

• (a) in the English language text, at the end insert “ or the GDPR ”, and

• (b) in the Welsh language text, at the end insert “neu'r GDPR”.

• (3) For paragraph (8)—

• (a) in the English language text substitute—

(8) In determining for the purposes of paragraph (7) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

, and

• (b) in the Welsh language text substitute—

(8) Wrth benderfynu at ddibenion paragraff (7) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.

336

• (1) Regulation 26 (responsible bodies requesting additional information be disclosed about relevant persons) is amended as follows.

• (2) In paragraph (6)—

• (a) in the English language text, at the end insert “ or the GDPR ”, and

• (b) in the Welsh language text, at the end insert “neu'r GDPR”.

• (3) For paragraph (7)—

• (a) in the English language text substitute—

(7) In determining for the purposes of paragraph (6) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

, and

• (b) in the Welsh language text substitute—

(7) Wrth benderfynu at ddibenion paragraff (6) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.

337

• (1) Regulation 29 (occurrence reports) is amended as follows.

• (2) In paragraph (3)—

• (a) in the English language text, at the end insert “ or the GDPR ”, and

• (b) in the Welsh language text, at the end insert “neu'r GDPR”.

• (3) For paragraph (4)—

• (a) in the English language text substitute—

(4) In determining for the purposes of paragraph (3) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

, and

• (b) in the Welsh language text substitute—

(4) Wrth benderfynu at ddibenion paragraff (3) a yw datgeliad wedi'i wahardd, mae i'w dybied at ddibenion paragraff 5(2) o Atodlen 2 i Ddeddf Diogelu Data 2018 a pharagraff 3(2) o Atodlen 11 i'r Ddeddf honno (esemptiadau rhag darpariaethau penodol o'r ddeddfwriaeth diogelu data: datgeliadau sy'n ofynnol gan y gyfraith) bod y datgeliad yn ofynnol gan y rheoliad hwn.

Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (S.R. (N.I.) 2008 No. 3)

338

• (1) Regulation 5 of the Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (information whose disclosure would be affected by the application of other legislation) is amended as follows.

• (2) In paragraph (3)—

• (a) omit “within the meaning of section 1(1) of the Data Protection Act 1998”, and

• (b) for the words from “where” to the end substitute “ if the condition in paragraph (3A) or (3B) is satisfied ”.

• (3) After paragraph (3) insert—

(3A) The condition in this paragraph is that the disclosure of the information to a member of the public— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B) The condition in this paragraph is that the disclosure of the information to a member of the public would contravene— (a) Article 21 of the GDPR (general processing: right to object to processing), or (b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).

• (4) After paragraph (4) insert—

(5) In this regulation— - “the data protection principles” means the principles set out in— 1. Article 5(1) of the GDPR, 2. section 34(1) of the Data Protection Act 2018, and 3. section 85(1) of that Act; - “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act); - “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

Companies (Disclosure of Address) Regulations 2009 (S.I. 2009/214)

339

• (1) Paragraph 6 of Schedule 2 to the Companies (Disclosure of Address) Regulations 2009 (conditions for permitted disclosure to a credit reference agency) is amended as follows.

• (2) The existing text becomes sub-paragraph (1).

• (3) In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—

(ii) for the purposes of ensuring that it complies with its data protection obligations;

.

• (4) In paragraph (c) of that sub-paragraph—

• (a) omit “or” at the end of sub-paragraph (i), and

• (b) at the end insert

; or (iii) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);

.

• (5) After paragraph (c) of that sub-paragraph insert—

(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.

• (6) After sub-paragraph (1) insert—

(2) In this paragraph, “data protection obligations”, in relation to a credit reference agency, means— (a) where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018); (b) where the agency carries on business in a EEA State other than the United Kingdom, obligations under— (i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018), (ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and (iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).

Overseas Companies Regulations 2009 (S.I. 2009/1801)

340

• (1) Paragraph 6 of Schedule 2 to the Overseas Companies Regulations 2009 (conditions for permitted disclosure to a credit reference agency) is amended as follows.

• (2) The existing text becomes sub-paragraph (1).

• (3) In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—

(ii) for the purposes of ensuring that it complies with its data protection obligations;

.

• (4) In paragraph (c) of that sub-paragraph—

• (a) omit “or” at the end of sub-paragraph (i), and

• (b) at the end insert

; or (iii) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);

.

• (5) After paragraph (c) of that sub-paragraph insert—

(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.

• (6) After sub-paragraph (1) insert—

(2) In this paragraph, “data protection obligations”, in relation to a credit reference agency, means— (a) where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018); (b) where the agency carries on business in a EEA State other than the United Kingdom, obligations under— (i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018), (ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and (iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).

Data Protection (Processing of Sensitive Personal Data) Order 2009 (S.I. 2009/1811)

341

The Data Protection (Processing of Sensitive Personal Data) Order 2009 is revoked.

Provision of Services Regulations 2009 (S.I. 2009/2999)

342

In regulation 25 of the Provision of Services Regulations 2009 (derogations from the freedom to provide services), for paragraph (d) substitute—

(d) matters covered by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

.

INSPIRE Regulations 2009 (S.I. 2009/3157)

343

• (1) Regulation 9 of the INSPIRE Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows.

• (2) In paragraph (2)—

• (a) omit “or” at the end of sub-paragraph (a),

• (b) for sub-paragraph (b) substitute—

(b) Article 21 of the GDPR (general processing: right to object to processing), or (c) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).

, and

• (c) omit the words following sub-paragraph (b).

• (3) After paragraph (7) insert—

(8) In this regulation— - “the data protection principles” means the principles set out in— 1. Article 5(1) of the GDPR, 2. section 34(1) of the Data Protection Act 2018, and 3. section 85(1) of that Act; - “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act); - “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). (9) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440)

344

• (1) Regulation 10 of the INSPIRE (Scotland) Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows.

• (2) In paragraph (2)—

• (a) omit “or” at the end of sub-paragraph (a),

• (b) for sub-paragraph (b) substitute—

(b) Article 21 of the GDPR (general processing: right to object to processing), or (c) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).

, and

• (c) omit the words following sub-paragraph (b).

• (3) After paragraph (6) insert—

(7) In this regulation— - “the data protection principles” means the principles set out in— 1. Article 5(1) of the GDPR, 2. section 34(1) of the Data Protection Act 2018, and 3. section 85(1) of that Act; - “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act); - “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act). (8) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 (S.R (N.I.) 2009 No. 225)

345

The Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 are amended as follows.

346

In regulation 2(2) (interpretation), at the appropriate place insert—

“the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

.”

347

• (1) Regulation 25 (duty to co-operate by disclosing information as regards relevant persons) is amended as follows.

• (2) In paragraph (7), at the end insert “ or the GDPR ”.

• (3) For paragraph (8) substitute—

(8) In determining for the purposes of paragraph (7) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

348

• (1) Regulation 26 (responsible bodies requesting additional information be disclosed about relevant persons) is amended as follows.

• (2) In paragraph (6), at the end insert “ or the GDPR ”.

• (3) For paragraph (7) substitute—

(7) In determining for the purposes of paragraph (6) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

349

• (1) Regulation 29 (occurrence reports) is amended as follows.

• (2) In paragraph (3), at the end insert “ or the GDPR ”.

• (3) For paragraph (4) substitute—

(4) In determining for the purposes of paragraph (3) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31)

350

The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 are revoked.

Pharmacy Order 2010 (S.I. 2010/231)

351

The Pharmacy Order 2010 is amended as follows.

352

In article 3(1) (interpretation), omit the definition of “Directive 95/46/EC”.

353

• (1) Article 9 (inspection and enforcement) is amended as follows.

• (2) For paragraph (4) substitute—

(4) If a report that the Council proposes to publish pursuant to paragraph (3) includes personal data, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure of the personal data is required by paragraph (3) of this article.

• (3) After paragraph (4) insert—

(5) In this article, “personal data” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).

354

In article 33A (European professional card), after paragraph (2) insert—

(3) In Schedule 2A, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.

355

• (1) Article 49 (disclosure of information: general) is amended as follows.

• (2) In paragraph (2)(a), after “enactment” insert “ or the GDPR ”.

• (3) For paragraph (3) substitute—

(3) In determining for the purposes of paragraph (2)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by paragraph (1) of this article.

• (4) After paragraph (5) insert—

(6) In this article, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

356

• (1) Article 55 (professional performance assessments) is amended as follows.

• (2) In paragraph (5)(a), after “enactment” insert “ or the GDPR ”.

• (3) For paragraph (6) substitute—

(6) In determining for the purposes of paragraph (5)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by paragraph (4) of this article.

• (4) After paragraph (8) insert—

(9) In this article, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

357

In article 67(6) (Directive 2005/36/EC: designation of competent authority etc.), after sub-paragraph (a) insert—

(aa) “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

.

358

• (1) Schedule 2A (Directive 2005/36/EC: European professional card) is amended as follows.

• (2) In paragraph 8(1) (access to data), for “Directive 95/46/EC)” substitute “ the GDPR ”.

• (3) In paragraph 9 (processing data)—

• (a) omit sub-paragraph (2) (deeming the Council to be the controller for the purposes of Directive 95/46/EC), and

• (b) after sub-paragraph (2) insert—

(3) In this paragraph, “personal data” has the same meaning as in the Data Protection Act 2018 (see section 3(2) of that Act).

359

• (1) The table in Schedule 3 (Directive 2005/36/EC: designation of competent authority etc.) is amended as follows.

• (2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

• (3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910)

360

The Data Protection (Monetary Penalties) Order 2010 is revoked.

National Employment Savings Trust Order 2010 (S.I. 2010/917)

361

The National Employment Savings Trust Order 2010 is amended as follows.

362

In article 2 (interpretation)—

• (a) omit the definition of “data” and “personal data”, and

• (b) at the appropriate place insert—

“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

363

• (1) Article 10 (disclosure of requested data to the Secretary of State) is amended as follows.

• (2) In paragraph (1)—

• (a) for “disclosure of data” substitute “ disclosure of information ”, and

• (b) for “requested data” substitute “ requested information ”.

• (3) In paragraph (2)—

• (a) for “requested data” substitute “ requested information ”,

• (b) for “those data are” substitute “ the information is ”, and

• (c) for “receive those data” substitute “ receive that information ”.

• (4) In paragraph (3), for “requested data” substitute “ requested information ”.

• (5) In paragraph (4), for “requested data” substitute “ requested information ”.

Local Elections (Northern Ireland) Order 2010 (S.I. 2010/2977)

364

• (1) Schedule 3 to the Local Elections (Northern Ireland) Order 2010 (access to marked registers and other documents open to public inspection after an election) is amended as follows.

• (2) In paragraph 1(1) (interpretation and general)—

• (a) omit the definition of “research purposes”, and

• (b) at the appropriate places insert—

“Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

;

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

.

• (3) In paragraph 5(3) (restrictions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “ Article 89 GDPR purposes ”.

Pupil Information (Wales) Regulations 2011 (S.I. 2011/1942 (W.209))

365

• (1) Regulation 5 of the Pupil Information (Wales) Regulations 2011 (duties of head teacher - educational records) is amended as follows.

• (2) In paragraph (5)—

• (a) in the English language text, for “documents which are subject to any order under section 30(2) of the Data Protection Act 1998” substitute

information— (a) which the head teacher could not lawfully disclose to the pupil under the GDPR, or (b) to which the pupil would have no right of access under the GDPR.

, and

• (b) in the Welsh language text, for “ddogfennau sy'n ddarostyngedig i unrhyw orchymyn o dan adran 30(2) o Ddeddf Diogelu Data 1998” substitute

wybodaeth— (a) na allai'r pennaeth ei datgelu'n gyfreithlon i'r disgybl o dan y GDPR, neu (b) na fyddai gan y disgybl hawl mynediad ati o dan y GDPR.

• (3) After paragraph (5)—

• (a) in the English language text insert—

(6) In this regulation, “the GDPR” (“y GDPR”) means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.

, and

• (b) in the Welsh language text insert—

(6) Yn y rheoliad hwn, ystyr “y GDPR” (“the GDPR”) yw Rheoliad (EU) 2016/679 Senedd Ewrop a'r Cyngor dyddiedig 27 Ebrill 2016 ar ddiogelu personau naturiol o ran prosesu data personol a rhyddid symud data o'r fath (y Rheoliad Diogelu Data Cyffredinol), fel y'i darllenir ynghyd â Phennod 2 o Ran 2 o Ddeddf Diogelu Data 2018.

Debt Arrangement Scheme (Scotland) Regulations 2011 (S.S.I. 2011/141)

366

In Schedule 4 to the Debt Arrangement Scheme (Scotland) Regulations 2011 (payments distributors), omit paragraph 2.

Police and Crime Commissioner Elections Order 2012 (S.I. 2012/1917)

367

The Police and Crime Commissioner Elections Order 2012 is amended as follows.

368

• (1) Schedule 2 (absent voting in Police and Crime Commissioner elections) is amended as follows.

• (2) In paragraph 20 (absent voter lists: supply of copies etc)—

• (a) in sub-paragraph (8), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

, and

• (b) after sub-paragraph (10) insert—

(11) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

• (3) In paragraph 24 (restriction on use of absent voter records or lists or the information contained in them)—

• (a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics),

, and

• (b) after that sub-paragraph insert—

(4) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

369

• (1) Schedule 10 (access to marked registers and other documents open to public inspection after an election) is amended as follows.

• (2) In paragraph 1(2) (interpretation), omit paragraphs (c) and (d) (but not the final “and”).

• (3) In paragraph 5 (restriction on use of documents or of information contained in them)—

• (a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics),

, and

• (b) after sub-paragraph (4) insert—

(5) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978)

370

The Data Protection (Processing of Sensitive Personal Data) Order 2012 is revoked.

Neighbourhood Planning (Referendums) Regulations 2012 (S.I. 2012/2031)

371

Schedule 6 to the Neighbourhood Planning (Referendums) Regulations 2012 (registering to vote in a business referendum) is amended as follows.

372

• (1) Paragraph 29(1) (interpretation of Part 8) is amended as follows.

• (2) At the appropriate places insert—

“Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

;

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

.

• (3) For the definition of “relevant conditions” substitute—

“relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards;

.

• (4) Omit the definition of “research purposes”.

373

In paragraph 32(3)(b)(i), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.

374

In paragraph 33(6) and (7) (supply of copy of business voting register to the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

375

In paragraph 34(6) and (7) (supply of copy of business voting register to the Office of National Statistics and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

376

In paragraph 39(8) and (97) (supply of copy of business voting register to public libraries and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

377

In paragraph 45(2) (conditions on the use, supply and disclosure of documents open to public inspection), for paragraph (a) (but not the final “or”) substitute—

(a) Article 89 GDPR purposes (as defined in paragraph 29),

.

Controlled Drugs (Supervision of Management and Use) Regulations 2013 (S.I. 2013/373)

378

• (1) Regulation 20 of the Controlled Drugs (Supervision of Management and Use) Regulations 2013 (information management) is amended as follows.

• (2) For paragraph (4) substitute—

(4) Where a CDAO, a responsible body or someone acting on their behalf is permitted to share information which includes personal data by virtue of a function under these Regulations, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.

• (3) In paragraph (5), after “enactment” insert “ or the GDPR ”.

• (4) After paragraph (6) insert—

(7) In this regulation, “the GDPR”, “personal data” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (10), (11) and (14) of that Act).

Communications Act 2003 (Disclosure of Information) Order 2014 (S.I. 2014/1825)

379

• (1) Article 3 of the Communications Act 2003 (Disclosure of Information) Order 2014 (specification of relevant functions) is amended as follows.

• (2) The existing text becomes paragraph (1).

• (3) In that paragraph, in sub-paragraph (a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (4) After that paragraph insert—

(2) In this article, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141)

380

In the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014, omit Part 4 (data protection in relation to police and judicial co-operation in criminal matters).

Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282)

381

The Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 is revoked.

The Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (S.R. (N.I.) 2014 No. 224)

382

In regulation 6 of the Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (applications)—

• (a) in paragraph (9), omit sub-paragraph (b) and the word “and” before it, and

• (b) in paragraph (11), omit the definition of “processing” and “sensitive personal data” and the word “and” before it.

Control of Poisons and Explosives Precursors Regulations 2015 (S.I. 2015/966)

383

In regulation 3 of the Control of Poisons and Explosives Precursors Regulations 2015 (applications in relation to licences under section 4A of the Poisons Act 1972)—

• (a) in paragraph (7), omit sub-paragraph (b) and the word “and” before it, and

• (b) omit paragraph (8).

Companies (Disclosure of Date of Birth Information) Regulations 2015 (S.I. 2015/1694)

384

• (1) Paragraph 6 of Schedule 2 to the Companies (Disclosure of Date of Birth Information) Regulations 2015 (conditions for permitted disclosure to a credit reference agency) is amended as follows.

• (2) The existing text becomes sub-paragraph (1).

• (3) In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—

(ii) for the purposes of ensuring that it complies with its data protection obligations;

.

• (4) In paragraph (c) of that sub-paragraph—

• (a) omit “or” at the end of sub-paragraph (i), and

• (b) at the end insert

; or (iii) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice) or section 148 of that Act (destroying or falsifying information and documents etc);

.

• (5) After paragraph (c) of that sub-paragraph insert—

(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in paragraph (c)(ii), other than a penalty notice that has been cancelled.

• (6) After sub-paragraph (1) insert—

(2) In this paragraph, “data protection obligations”, in relation to a credit reference agency, means— (a) where the agency carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018); (b) where the agency carries on business in a EEA State other than the United Kingdom, obligations under— (i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018), (ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and (iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).

Small and Medium Sized Business (Credit Information) Regulations 2015 (S.I. 2015/1945)

385

The Small and Medium Sized Business (Credit Information) Regulations 2015 are amended as follows.

386

• (1) Regulation 12 (criteria for the designation of a credit reference agency) is amended as follows.

• (2) In paragraph (1)(b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After paragraph (2) insert—

(3) In this regulation, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

387

• (1) Regulation 15 (access to and correction of information for individuals and small firms) is amended as follows.

• (2) For paragraph (1) substitute—

(1) Section 13 of the Data Protection Act 2018 (rights of the data subject under the GDPR: obligations of credit reference agencies) applies in respect of a designated credit reference agency which is not a credit reference agency within the meaning of section 145(8) of the Consumer Credit Act 1974 as if it were such an agency.

• (3) After paragraph (3) insert—

(4) In this regulation, the reference to section 13 of the Data Protection Act 2018 has the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).

European Union (Recognition of Professional Qualifications) Regulations 2015 (S.I. 2015/2059)

388

The European Union (Recognition of Professional Qualifications) Regulations 2015 are amended as follows.

389

• (1) Regulation 2(1) (interpretation) is amended as follows.

• (2) Omit the definition of “Directive 95/46/EC”.

• (3) At the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

.

390

In regulation 5(5) (functions of competent authorities in the United Kingdom) for “Directives 95/46/EC” substitute “ the GDPR and Directive ”.

391

In regulation 45(3) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “ the GDPR ”.

392

In regulation 46(1) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “ the GDPR ”.

393

In regulation 48(2) (processing and access to data regarding the European Professional Card), omit paragraph (2) (deeming the relevant designated competent authorities to be controllers for the purposes of Directive 95/46/EC).

394

In regulation 66(3) (exchange of information), for “Directives 95/46/EC” substitute “ the GDPR and Directive ”.

Scottish Parliament (Elections etc) Order 2015 (S.S.I. 2015/425)

395

The Scottish Parliament (Elections etc) Order 2015 is amended as follows.

396

• (1) Schedule 3 (absent voting) is amended as follows.

• (2) In paragraph 16 (absent voting lists: supply of copies etc)—

• (a) in sub-paragraph (4), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

, and

• (b) after sub-paragraph (10) insert—

(11) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

• (3) In paragraph 20 (restriction on use of absent voting lists)—

• (a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

, and

• (b) after that sub-paragraph insert—

(4) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

397

• (1) Schedule 8 (access to marked registers and other documents open to public inspection after an election) is amended as follows.

• (2) In paragraph 1(2) (interpretation), omit paragraphs (c) and (d) (but not the final “and”).

• (3) In paragraph 5 (restriction on use of documents or of information contained in them)—

• (a) in sub-paragraph (3), for paragraph (a) (but not the final “or”) substitute—

(a) purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

, and

• (b) after sub-paragraph (4) insert—

(5) In this paragraph, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (S.I. 2016/295)

398

In paragraph 1(3) of Schedule 3 to the Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (access to marked registers after a petition), omit the definition of “relevant conditions”.

Register of People with Significant Control Regulations 2016 (S.I. 2016/339)

399

Schedule 4 to the Register of People with Significant Control Regulations 2016 (conditions for permitted disclosure) is amended as follows.

400

• (1) Paragraph 6 (disclosure to a credit reference agency) is amended as follows.

• (2) In sub-paragraph (b), for paragraph (ii) (together with the final “; and”) substitute—

(ii) for the purposes of ensuring that it complies with its data protection obligations;

.

• (3) In sub-paragraph (c)—

• (a) omit “or” at the end of paragraph (ii), and

• (b) at the end insert—

(iv) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice); or (v) section 148 of that Act (destroying or falsifying information and documents etc);

• (4) After sub-paragraph (c) insert—

(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in sub-paragraph (c)(iii), other than a penalty notice that has been cancelled.

401

In paragraph 12A (disclosure to a credit institution or a financial institution), for sub-paragraph (b) substitute—

(b) for the purposes of ensuring that it complies with its data protection obligations.

402

In Part 3 (interpretation), after paragraph 13 insert—

(14) In this Schedule, “data protection obligations”, in relation to a credit reference agency, a credit institution or a financial institution, means— (a) where the agency or institution carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018); (b) where the agency or institution carries on business in a EEA State other than the United Kingdom, obligations under— (i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018), (ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and (iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).

Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696)

403

The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 are amended as follows.

404

In regulation 2(1) (interpretation), omit the definition of “the 1998 Act”.

405

In regulation 3(3) (supervision), omit “under the 1998 Act”.

406

For Schedule 2 substitute—