Data Protection Act 2018

SCHEDULE 2 (1) For the purposes of enforcing these Regulations and the eIDAS Regulation, the following provisions of Parts 5 to 7 of the Data Protection Act 2018 apply with the modifications set out in paragraphs 2 to 26— (a) section 140 (publication by the Commissioner); (b) section 141 (notices from the Commissioner); (c) section 142 (information notices); (d) section 143 (information notices: restrictions); (e) section 144 (false statements made in response to an information notice); (f) section 145 (information orders); (g) section 146 (assessment notices); (h) section 147 (assessment notices: restrictions); (i) section 148 (destroying or falsifying information and documents etc); (j) section 149 (enforcement notices); (k) section 150 (enforcement notices: supplementary); (l) section 152 (enforcement notices: restrictions); (m) section 153 (enforcement notices: cancellation and variation); (n) section 154 and Schedule 15 (powers of entry and inspection); (o) section 155 and Schedule 16 (penalty notices); (p) section 156(4)(a) (penalty notices: restrictions); (q) section 157 (maximum amount of penalty); (r) section 159 (amount of penalties: supplementary); (s) section 160 (guidance about regulatory action); (t) section 161 (approval of first guidance about regulatory action); (u) section 162 (rights of appeal); (v) section 163 (determination of appeals); (w) section 164 (applications in respect of urgent notices); (x) section 180 (jurisdiction); (y) section 182(1), (2), (5), (7) and (13) (regulations and consultation); (z) section 196 (penalties for offences); (z1) section 197 (prosecution); (z2) section 202 (proceedings in the First-tier Tribunal: contempt); (z3) section 203 (Tribunal Procedure Rules). (2) The provisions listed in paragraph 1 have effect as if— (a) references to the Data Protection Act 2018 were references to the provisions of that Act as applied by these Regulations; (b) references to a particular provision of that Act were references to that provision as applied by these Regulations. (3) (1) Section 142 has effect as if subsections (9) and (10) were omitted. (2) In that section, subsection (1) has effect as if— (a) in paragraph (a)— (i) for “controller or processor” there were substituted “ trust service provider ”; (ii) for “the data protection legislation” there were substituted “ the eIDAS Regulation and the EITSET Regulations ”; (b) paragraph (b) were omitted. (3) In that section, subsection (2) has effect as if paragraph (a) were omitted. (4) (1) Section 143 has effect as if subsections (1) and (9) were omitted. (2) In that section— (a) subsections (3)(b) and (4)(b) have effect as if for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”; (b) subsection (7)(a) has effect as if for “this Act” there were substituted “ section 144 or 148 or paragraph 15 of Schedule 15 ”; (c) subsection (8) has effect as if for “this Act (other than an offence under section 144)” there were substituted “ section 148 or paragraph 15 of Schedule 15 ”. (5) Section 145(2)(b) has effect as if for “section 142(2)(b)” there were substituted “ section 142(2) ”. (6) (1) Section 146 has effect as if subsection (11) were omitted. (2) In that section— (a) subsection (1) has effect as if— (i) for “controller or processor” (in both places) there were substituted “ trust service provider ”; (ii) for “the data protection legislation” there were substituted “ the eIDAS requirements ”; (b) subsection (2) has effect as if paragraphs (h) and (i) were omitted; (c) subsections (7), (8), (9) and (10) have effect as if for “controller or processor” (in each place) there were substituted “trust service provider. (d) subsection (9)(a) has effect as if for “as described in section 149(2) or that an offence under this Act” there were substituted “ to comply with the eIDAS requirements or that an offence under section 144 or 148 or paragraph 15 of Schedule 15 ”. (7) (1) Section 147 has effect as if subsections (5) and (6) were omitted. (2) In that section, subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”. (8) (1) Section 149 has effect as if subsections (2) to (5) and (7) to (9) were omitted. (2) In that section— (a) subsection (1) has effect as if— (i) for “as described in subsection (2), (3), (4) or (5)” there were substituted “ to comply with the eIDAS requirements ”; (ii) for “sections 150 and 151” there were substituted “ section 150 ”; (b) subsection (6) has effect as if the words “given in reliance on subsection (2), (3) or (5)” were omitted. (9) (1) Section 150 has effect as if subsection (3) were omitted. (2) In that section, subsection (2) has effect as if the words “in reliance on section 149(2)” and “or distress” were omitted. (10) Section 152 has effect as if subsections (1), (2) and (4) were omitted. (11) The provisions listed in paragraph 1 have effect as if after section 153 there were inserted— (153A) (1) The Commissioner may, by written notice (a “withdrawal notice”), withdraw the qualified status from a trust service provider, or the qualified status of a service provided by a trust service provider, if— (a) the Commissioner is satisfied that the trust service provider has failed to comply with an information notice or an enforcement notice, and (b) the condition in subsection (2) or (3) is met. (2) The condition in this subsection is met if the period for the trust service provider to appeal against the information notice or enforcement notice has ended without an appeal having been brought. (3) The condition in this subsection is met if an appeal against the information notice or enforcement notice has been brought and— (a) the appeal and any further appeal in relation to the notice has been decided or has otherwise ended, and (b) the time for appealing against the result of the appeal or further appeal has ended without another appeal having been brought. (4) A withdrawal notice must— (a) state when the withdrawal takes effect, and (b) provide information about the rights of appeal under section 162. (12) (1) Schedule 15 has effect as if paragraph 3 were omitted. (2) Paragraph 1(1) of that Schedule (issue of warrants in connection with non-compliance and offences) has effect as if for paragraph (a) (but not the final “and”) there were substituted— (a) there are reasonable grounds for suspecting that— (i) a trust service provider has failed or is failing to comply with the eIDAS requirements, or (ii) an offence under section 144 or 148 or paragraph 15 of Schedule 15 has been or is being committed, (3) Paragraph 2 of that Schedule (issue of warrants in connection with assessment notices) has effect as if— (a) in sub-paragraphs (1) and (2), for “controller or processor” there were substituted “ trust service provider ”; (b) in sub-paragraph (2), for “the data protection legislation” there were substituted “ the eIDAS requirements ”. (4) Paragraph 5 of that Schedule (content of warrants) has effect as if— (a) in sub-paragraph (1)(c), for “the processing of personal data” there were substituted “ the provision of trust services ”; (b) in sub-paragraph (2)(d)— (i) for “controller or processor” there were substituted “ trust service provider ”; (ii) for “as described in section 149(2)” there were substituted “ to comply with the eIDAS requirements ”; (c) in sub-paragraph (3)(a) and (d)— (i) for “controller or processor” there were substituted “ trust service provider ”; (ii) for “the data protection legislation” there were substituted “ the eIDAS requirements ”. (5) Paragraph 11 of that Schedule (privileged communications) has effect as if, in sub-paragraphs (1)(b) and (2)(b), for “the data protection legislation” there were substituted “ the eIDAS Regulation or the EITSET Regulations ”. (13) (1) Section 155 has effect as if subsections (1)(a), (2)(a), (3)(g), (4) and (6) to (8) were omitted. (2) Subsection (2) of that section has effect as if— (a) the words “Subject to subsection (4),” were omitted; (b) in paragraph (b), the words “to the extent that the notice concerns another matter,” were omitted. (3) Subsection (3) of that section has effect as if— (a) for “controller or processor”, in each place, there were substituted “ trust services provider ”; (b) in paragraph (c), the words “or distress” were omitted; (c) in paragraph (c), for “data subjects” there were substituted “ relying parties ”; (d) in paragraph (d), for “section 57, 66, 103 or 107” there were substituted “ Article 19(1) of the eIDAS Regulation ”. (14) Schedule 16 has effect as if paragraphs 3(2)(b) and 5(2)(b) were omitted. (15) Section 157 has effect as if subsections (1) to (3) and (6) were omitted. (16) Section 159 has effect as if— (a) in subsection (1), the words “Article 83 of the GDPR and” were omitted; (b) in subsection (2), the words “Article 83 of the GDPR” and “and section 158” were omitted. (17) (1) Section 160 has effect as if subsections (5) and (12) were omitted. (2) In that section, subsection (4)(f) has effect as if for “controllers and processors” there were substituted “ trust service providers ”. (18) (1) Section 162 has effect as if subsection (4) were omitted. (2) In that section, subsection (1) has effect as if, after paragraph (c), there were inserted— (ca) a withdrawal notice; (19) Section 163 has effect as if subsection (6) were omitted. (20) (1) Section 180 has effect as if subsections (2)(d) and (e) and (3) were omitted. (2) Subsection (1) of that section has effect as if for “subsections (3) and (4)” there were substituted “ subsection (4) ”. (21) Section 182 has effect as if subsections (3), (4), (6), (8) to (11) and (14) were omitted. (22) (1) Section 196 has effect as if subsections (3) to (5) were omitted. (2) In that section— (a) subsection (1) has effect as if the words “section 119 or 173 or” were omitted; (b) subsection (2) has effect as if for “section 132, 144, 148, 170, 171 or 184” there were substituted “ section 144 or 148 ”. (23) Section 197 has effect as if subsections (3) to (6) were omitted. (24) Section 202 has effect as if in subsection (1)(a), for sub-paragraphs (i) and (ii) there were substituted “ on an appeal under section 162 ”. (25) Section 203 has effect as if— (a) in subsection (1), for paragraphs (a) and (b) there were substituted “ the exercise of the rights of appeal conferred by section 162 ”; (b) in subsection (2)(a) and (b), for “the processing of personal data” there were substituted “ the provision of trust services ”. (26) (1) This paragraph applies if the first guidance produced under section 160(1) of the Data Protection Act 2018 and the first guidance produced under that provision as applied by this Schedule are laid before Parliament as a single document (“the combined guidance”). (2) Section 161 of that Act (including that section as applied by this Schedule) has effect as if the references to “the guidance” were references to the combined guidance, except in subsections (2)(b) and (4). (3) Nothing in subsection (2)(a) of that section (including as applied by this Schedule) prevents another version of the combined guidance being laid before Parliament. (4) Any duty under subsection (2)(b) of that section (including as applied by this Schedule) may be satisfied by producing another version of the combined guidance. (27) In this Schedule— - “the eIDAS requirements” means the requirements of Chapter III of the eIDAS Regulation; - “the EITSET Regulations” means these Regulations; - “withdrawal notice” has the meaning given in section 153A of the Data Protection Act 2018 (as inserted in that Act by this Schedule).

Court Files Privileged Access Rules (Northern Ireland) 2016 (S.R. (N.I.) 2016 No. 123)

407

The Court Files Privileged Access Rules (Northern Ireland) 2016 are amended as follows.

408

In rule 5 (information that may released) for “Schedule 1 of the Data Protection Act 1998” substitute

— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018.

409

In rule 7(2) (provision of information) for “Schedule 1 of the Data Protection Act 1998” substitute

— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018.

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (S.I. 2017/692)

410

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 are amended as follows.

411

In regulation 3(1) (interpretation), at the appropriate places insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

;

“the GDPR” and references to provisions of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

.

412

In regulation 16(8) (risk assessment by the Treasury and Home Office), for “the Data Protection Act 1998 or any other enactment” substitute

— (a) the Data Protection Act 2018 or any other enactment, or (b) the GDPR.

413

In regulation 17(9) (risk assessment by supervisory authorities), for “the Data Protection Act 1998 or any other enactment” substitute

— (a) the Data Protection Act 2018 or any other enactment, or (b) the GDPR.

414

For regulation 40(9)(c) (record keeping) substitute—

(c) “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); (d) “personal data” has the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).

415

• (1) Regulation 41 (data protection) is amended as follows.

• (2) Omit paragraph (2).

• (3) In paragraph (3)(a), after “Regulations” insert “ or the GDPR ”.

• (4) Omit paragraphs (4) and (5).

• (5) After those paragraphs insert—

(6) Before establishing a business relationship or entering into an occasional transaction with a new customer, as well as providing the customer with the information required under Article 13 of the GDPR (information to be provided where personal data are collected from the data subject), relevant persons must provide the customer with a statement that any personal data received from the customer will be processed only— (a) for the purposes of preventing money laundering or terrorist financing, or (b) as permitted under paragraph (3). (7) In Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest includes processing of personal data in accordance with these Regulations that is necessary for the prevention of money laundering or terrorist financing. (8) In the case of sensitive processing of personal data for the purposes of the prevention of money laundering or terrorist financing, section 10 of, and Schedule 1 to, the Data Protection Act 2018 make provision about when the processing meets a requirement in Article 9(2) or 10 of the GDPR for authorisation under the law of the United Kingdom (see, for example, paragraphs 10, 11 and 12 of that Schedule). (9) In this regulation— - “data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); - “personal data” and “processing” have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4) and (14) of that Act); - “sensitive processing” means the processing of personal data described in Article 9(1) or 10 of the GDPR (special categories of personal data and personal data relating to criminal convictions and offences etc).

416

• (1) Regulation 84 (publication: the Financial Conduct Authority) is amended as follows.

• (2) In paragraph (10), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) For paragraph (11) substitute—

(11) For the purposes of this regulation, “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

417

• (1) Regulation 85 (publication: the Commissioners) is amended as follows.

• (2) In paragraph (9), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) For paragraph (10) substitute—

(10) For the purposes of this regulation, “personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).

418

For regulation 106(a) (general restrictions) substitute—

(a) a disclosure in contravention of the data protection legislation; or

.

419

After paragraph 27 of Schedule 3 (relevant offences) insert—

(27A) An offence under the Data Protection Act 2018, apart from an offence under section 173 of that Act.

Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (S.I. 2017/694)

420

• (1) Paragraph 6 of Schedule 5 to the Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (conditions for permitted disclosure to a credit institution or a financial institution) is amended as follows.

• (2) The existing text becomes sub-paragraph (1).

• (3) For paragraph (b) of that sub-paragraph substitute—

(b) for the purposes of ensuring that it complies with its data protection obligations.

• (4) After sub-paragraph (1) insert—

(2) In this paragraph, “data protection obligations”, in relation to a relevant institution, means— (a) where the institution carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018); (b) where the institution carries on business in a EEA State other than the United Kingdom, obligations under— (i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018), (ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and (iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).

Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480)

421

In regulation 1(2) of the Data Protection (Charges and Information) Regulations 2018 (interpretation), at the appropriate places insert—

“data controller” means a person who is a controller for the purposes of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act);

;

“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);

.

National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66)

422

The National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 are amended as follows.

423

• (1) Regulation 1 (citation and commencement) is amended as follows.

• (2) In paragraph (2), omit “Subject to paragraph (3),”.

• (3) Omit paragraph (3).

424

In regulation 3(1) (interpretation)—

• (a) omit the definition of “the 1998 Act”,

• (b) at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

, and

• (c) omit the definition of “GDPR”.

425

• (1) Schedule 6 (other contractual terms) is amended as follows.

• (2) In paragraph 63(2) (interpretation: general), for “the 1998 Act or any directly applicable EU instrument relating to data protection” substitute

— (a) the data protection legislation, or (b) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection.

• (3) For paragraph 64 (meaning of data controller etc.) substitute—

(64A) For the purposes of this Part— - “controller” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act); - “data protection officer” means a person designated as a data protection officer under the data protection legislation; - “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act).

• (4) In paragraph 65(2)(b) (roles, responsibilities and obligations: general), for “data controllers” substitute “ controllers ”.

• (5) In paragraph 69(2)(a) (processing and access of data), for “the 1998 Act, and any directly applicable EU instrument relating to data protection;” substitute

— (i) the data protection legislation, and (ii) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;

.

• (6) In paragraph 94(4) (variation of a contract: general)—

• (a) omit paragraph (b), and

• (b) after paragraph (d) (but before the final “and”) insert—

(da) the data protection legislation; (db) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;

.

National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 (S.S.I. 2018/67)

426

The National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 are amended as follows.

427

• (1) Regulation 1 (citation and commencement) is amended as follows.

• (2) In paragraph (2), omit “Subject to paragraph (3),”.

• (3) Omit paragraph (3).

428

In regulation 3(1) (interpretation)—

• (a) omit the definition of “the 1998 Act”, and

• (b) at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

, and

• (c) omit the definition of “GDPR”.

429

• (1) Schedule 1 (content of agreements) is amended as follows.

• (2) In paragraph 34 (interpretation)—

• (a) in sub-paragraph (1)—

• (i) omit “Subject to sub-paragraph (3),”,

• (ii) before paragraph (a) insert—

(za) “controller” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(6) and (14) of that Act); (zb) “data protection officer” means a person designated as a data protection officer under the data protection legislation;

, and

• (iii) for paragraph (d) substitute—

(e) “personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act).

,

• (b) omit sub-paragraphs (2) and (3),

• (c) in sub-paragraph (4), for “the 1998 Act and any directly applicable EU instrument relating to data protection” substitute

— (a) the data protection legislation, or (b) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection.

, and

• (d) in sub-paragraph (6)(b), for “data controllers” substitute “ controllers ”.

• (3) In paragraph 37(2)(a) (processing and access of data), for “the 1998 Act, and any directly applicable EU instrument relating to data protection;” substitute

— (i) the data protection legislation, and (ii) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;

.

• (4) In paragraph 61(3) (variation of agreement: general)—

• (a) omit paragraph (b), and

• (b) after paragraph (d) (but before the final “and”) insert—

(da) the data protection legislation; (db) any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection;

.

PART 3 — Modifications

Introduction

430

• (1) Unless the context otherwise requires, legislation described in sub-paragraph (2) has effect on and after the day on which this Part of this Schedule comes into force as if it were modified in accordance with this Part of this Schedule.

• (2) That legislation is—

• (a) subordinate legislation made before the day on which this Part of this Schedule comes into force;

• (b) primary legislation that is passed or made before the end of the Session in which this Act is passed.

• (3) In this Part of this Schedule—

• “primary legislation” has the meaning given in section 211(7);

• “references” includes any references, however expressed.

General modifications

431

• (1) References to a particular provision of, or made under, the Data Protection Act 1998 have effect as references to the equivalent provision or provisions of, or made under, the data protection legislation.

• (2) Other references to the Data Protection Act 1998 have effect as references to the data protection legislation.

• (3) References to disclosure, use or other processing of information that is prohibited or restricted by an enactment which include disclosure, use or other processing of information that is prohibited or restricted by the Data Protection Act 1998 have effect as if they included disclosure, use or other processing of information that is prohibited or restricted by the UK GDPR.

Specific modification of references to terms used in the Data Protection Act 1998

432

• (1) References to personal data, and to the processing of such data, as defined in the Data Protection Act 1998, have effect as references to personal data, and to the processing of such data, as defined for the purposes of Parts 5 to 7 of this Act (see section 3(2), (4) and (14)).

• (2) References to processing as defined in the Data Protection Act 1998, in relation to information, have effect as references to processing as defined in section 3(4).

• (3) References to a data subject as defined in the Data Protection Act 1998 have effect as references to a data subject as defined in section 3(5).

• (4) References to a data controller as defined in the Data Protection Act 1998 have effect as references to a controller as defined for the purposes of Parts 5 to 7 of this Act (see section 3(6) and (14)).

• (5) References to the data protection principles set out in the Data Protection Act 1998 have effect as references to the principles set out in—

• (a) Article 5(1) of the UK GDPR, and

• (b) sections 34(1) and 85(1) of this Act.

• (6) References to direct marketing as defined in section 11 of the Data Protection Act 1998 have effect as references to direct marketing as defined in section 122 of this Act.

• (7) References to a health professional within the meaning of section 69(1) of the Data Protection Act 1998 have effect as references to a health professional within the meaning of section 204 of this Act.

• (8) References to a health record within the meaning of section 68(2) of the Data Protection Act 1998 have effect as references to a health record within the meaning of section 205 of this Act.

PART 4 — Supplementary

Definitions

433

Section 3(14) does not apply to this Schedule.

Provision inserted in subordinate legislation by this Schedule

434

Provision inserted into subordinate legislation by this Schedule may be amended or revoked as if it had been inserted using the power under which the subordinate legislation was originally made.

SCHEDULE 20

PART 1 — General

Interpretation

1

• (1) In this Schedule—

• “the 1984 Act” means the Data Protection Act 1984;

• “the 1998 Act” means the Data Protection Act 1998;

• “the 2014 Regulations” means the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141);

• “data controller” has the same meaning as in the 1998 Act (see section 1 of that Act);

• “the old data protection principles” means the principles set out in—Part 1 of Schedule 1 to the 1998 Act, andregulation 30 of the 2014 Regulations.

• (2) A provision of the 1998 Act that has effect by virtue of this Schedule is not, by virtue of that, part of the data protection legislation (as defined in section 3).

PART 2 — Rights of data subjects

Right of access to personal data under the 1998 Act

2

• (1) The repeal of sections 7 to 9A of the 1998 Act (right of access to personal data) does not affect the application of those sections after the relevant time in a case in which a data controller received a request under section 7 of that Act (right of access to personal data) before the relevant time.

• (2) The repeal of sections 7 and 8 of the 1998 Act and the revocation of regulation 44 of the 2014 Regulations (which applies those sections with modifications) do not affect the application of those sections and that regulation after the relevant time in a case in which a UK competent authority received a request under section 7 of the 1998 Act (as applied by that regulation) before the relevant time.

• (3) The revocation of the relevant regulations, or their amendment by Schedule 19 to this Act, and the repeals and revocation mentioned in sub-paragraphs (1) and (2), do not affect the application of the relevant regulations after the relevant time in a case described in those sub-paragraphs.

• (4) In this paragraph—

• “the relevant regulations” means—the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191);regulation 4 of, and Schedule 1 to, the Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290);regulation 3 of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244);

• “the relevant time” means the time when the repeal of section 7 of the 1998 Act comes into force;

• “UK competent authority” has the same meaning as in Part 4 of the 2014 Regulations (see regulation 27 of those Regulations).

Right to prevent processing likely to cause damage or distress under the 1998 Act

3

• (1) The repeal of section 10 of the 1998 Act (right to prevent processing likely to cause damage or distress) does not affect the application of that section after the relevant time in a case in which an individual gave notice in writing to a data controller under that section before the relevant time.

• (2) In this paragraph, “the relevant time” means the time when the repeal of section 10 of the 1998 Act comes into force.

Right to prevent processing for purposes of direct marketing under the 1998 Act

4

• (1) The repeal of section 11 of the 1998 Act (right to prevent processing for purposes of direct marketing) does not affect the application of that section after the relevant time in a case in which an individual gave notice in writing to a data controller under that section before the relevant time.

• (2) In this paragraph, “the relevant time” means the time when the repeal of section 11 of the 1998 Act comes into force.

Automated processing under the 1998 Act

5

• (1) The repeal of section 12 of the 1998 Act (rights in relation to automated decision-taking) does not affect the application of that section after the relevant time in relation to a decision taken by a person before that time if—

• (a) in taking the decision the person failed to comply with section 12(1) of the 1998 Act, or

• (b) at the relevant time—

• (i) the person had not taken all of the steps required under section 12(2) or (3) of the 1998 Act, or

• (ii) the period specified in section 12(2)(b) of the 1998 Act (for an individual to require a person to reconsider a decision) had not expired.

• (2) In this paragraph, “the relevant time” means the time when the repeal of section 12 of the 1998 Act comes into force.

Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations

6

• (1) The repeal of section 13 of the 1998 Act (compensation for failure to comply with certain requirements) does not affect the application of that section after the relevant time in relation to damage or distress suffered at any time by reason of an act or omission before the relevant time.

• (2) The revocation of regulation 45 of the 2014 Regulations (right to compensation) does not affect the application of that regulation after the relevant time in relation to damage or distress suffered at any time by reason of an act or omission before the relevant time.

• (3) “The relevant time” means—

• (a) in sub-paragraph (1), the time when the repeal of section 13 of the 1998 Act comes into force;

• (b) in sub-paragraph (2), the time when the revocation of regulation 45 of the 2014 Regulation comes into force.

Rectification, blocking, erasure and destruction under the 1998 Act

7

• (1) The repeal of section 14(1) to (3) and (6) of the 1998 Act (rectification, blocking, erasure and destruction of inaccurate personal data) does not affect the application of those provisions after the relevant time in a case in which an application was made under subsection (1) of that section before the relevant time.

• (2) The repeal of section 14(4) to (6) of the 1998 Act (rectification, blocking, erasure and destruction: risk of further contravention in circumstances entitling data subject to compensation under section 13 of the 1998 Act) does not affect the application of those provisions after the relevant time in a case in which an application was made under subsection (4) of that section before the relevant time.

• (3) In this paragraph, “the relevant time” means the time when the repeal of section 14 of the 1998 Act comes into force.

Jurisdiction and procedure under the 1998 Act

8

The repeal of section 15 of the 1998 Act (jurisdiction and procedure) does not affect the application of that section in connection with sections 7 to 14 of the 1998 Act as they have effect by virtue of this Schedule.

Exemptions under the 1998 Act

9

• (1) The repeal of Part 4 of the 1998 Act (exemptions) does not affect the application of that Part after the relevant time in connection with a provision of Part 2 of the 1998 Act as it has effect after that time by virtue of paragraphs 2 to 7 of this Schedule.

• (2) The revocation of the relevant Orders, and the repeal mentioned in sub-paragraph (1), do not affect the application of the relevant Orders after the relevant time in connection with a provision of Part 2 of the 1998 Act as it has effect as described in sub-paragraph (1).

• (3) In this paragraph—

• “the relevant Orders” means—the Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184);the Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413);the Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414);the Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415);the Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416);Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419);Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864);

• “the relevant time” means the time when the repeal of the provision of Part 2 of the 1998 Act in question comes into force.

• (4) As regards certificates issued under section 28(2) of the 1998 Act, see Part 5 of this Schedule.

Prohibition by this Act of requirement to produce relevant records

10

• (1) In Schedule 18 to this Act, references to a record obtained in the exercise of a data subject access right include a record obtained at any time in the exercise of a right under section 7 of the 1998 Act.

• (2) In section 184 of this Act, references to a “relevant record” include a record which does not fall within the definition in Schedule 18 to this Act (read with sub-paragraph (1)) but which, immediately before the relevant time, was a “relevant record” for the purposes of section 56 of the 1998 Act.

• (3) In this paragraph, “the relevant time” means the time when the repeal of section 56 of the 1998 Act comes into force.

Avoidance under this Act of certain contractual terms relating to health records

11

In section 185 of this Act, references to a record obtained in the exercise of a data subject access right include a record obtained at any time in the exercise of a right under section 7 of the 1998 Act.

PART 3 — The UK GDPR and Part 2 of this Act

Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR

12

In paragraph 20(2) of Schedule 2 to this Act (self-incrimination), the reference to an offence under this Act includes an offence under the 1998 Act or the 1984 Act.

Manual unstructured data held by FOI public authorities

13

Until the first regulations under section 24(8) of this Act come into force, “the appropriate maximum” for the purposes of that section is—

• (a) where the controller is a public authority listed in Part 1 of Schedule 1 to the Freedom of Information Act 2000, £600, and

• (b) otherwise, £450.

PART 4 — Law enforcement and intelligence services processing

Logging

14

• (1) In relation to an automated processing system set up before 6 May 2016, subsections (1) to (3) of section 62 of this Act do not apply if and to the extent that compliance with them would involve disproportionate effort.

• (2) Sub-paragraph (1) ceases to have effect at the beginning of 6 May 2026.

Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)

15

Nothing in this Schedule, read with the revocation of regulation 50 of the 2014 Regulations, has the effect of applying a provision of the 1998 Act to the processing of personal data to which Part 4 of the 2014 Regulations applies in a case in which that provision did not apply before the revocation of that regulation.

Maximum fee for data subject access requests to intelligence services

16

Until the first regulations under section 94(4)(b) of this Act come into force, the maximum amount of a fee that may be required by a controller under that section is £10.

PART 5 — National security certificates

National security certificates: processing of personal data under the 1998 Act

17

• (1) The repeal of section 28(2) to (12) of the 1998 Act does not affect the application of those provisions after the relevant time with respect to the processing of personal data to which the 1998 Act (including as it has effect by virtue of this Schedule) applies.

• (2) A certificate issued under section 28(2) of the 1998 Act continues to have effect after the relevant time with respect to the processing of personal data to which the 1998 Act (including as it has effect by virtue of this Schedule) applies.

• (3) Where a certificate continues to have effect under sub-paragraph (2) after the relevant time, it may be revoked or quashed in accordance with section 28 of the 1998 Act after the relevant time.

• (4) In this paragraph, “the relevant time” means the time when the repeal of section 28 of the 1998 Act comes into force.

National security certificates: processing of personal data under the 2018 Act

18

• (1) This paragraph applies to a certificate issued under section 28(2) of the 1998 Act (an “old certificate”) which has effect immediately before the relevant time.

• (2) If and to the extent that the old certificate provides protection with respect to personal data which corresponds to protection that could be provided by a certificate issued under section 27, 79 or 111 of this Act, the old certificate also has effect to that extent after the relevant time as if—

• (a) it were a certificate issued under one or more of sections 27, 79 and 111 (as the case may be),

• (b) it provided protection in respect of that personal data in relation to the corresponding provisions of this Act or the UK GDPR, and

• (c) where it has effect as a certificate issued under section 79, it certified that each restriction in question is a necessary and proportionate measure to protect national security.

• (3) Where an old certificate also has effect as if it were a certificate issued under one or more of sections 27, 79 and 111, that section has, or those sections have, effect accordingly in relation to the certificate.

• (4) Where an old certificate has an extended effect because of sub-paragraph (2), section 130 of this Act does not apply in relation to it.

• (5) An old certificate that has an extended effect because of sub-paragraph (2) provides protection only with respect to the processing of personal data that occurs during the period of 1 year beginning with the relevant time (and a Minister of the Crown may curtail that protection by wholly or partly revoking the old certificate).

• (6) For the purposes of this paragraph—

• (a) a reference to the protection provided by a certificate issued under—

• (i) section 28(2) of the 1998 Act, or

• (ii) section 27, 79 or 111 of this Act,

is a reference to the effect of the evidence that is provided by the certificate;

• (b) protection provided by a certificate under section 28(2) of the 1998 Act is to be regarded as corresponding to protection that could be provided by a certificate under section 27, 79 or 111 of this Act where, in respect of provision in the 1998 Act to which the certificate under section 28(2) relates, there is corresponding provision in this Act or the UK GDPR to which a certificate under section 27, 79 or 111 could relate.

• (7) In this paragraph, “the relevant time” means the time when the repeal of section 28 of the 1998 Act comes into force.

• (8) In this paragraph, references to the UK GDPR do not include the EU GDPR as it was directly applicable to the United Kingdom before IP completion day (see paragraph 2 of Schedule 21).

PART 6 — The Information Commissioner

Appointment etc

19

• (1) On and after the relevant day, the individual who was the Commissioner immediately before that day—

• (a) continues to be the Commissioner,

• (b) is to be treated as having been appointed under Schedule 12 to this Act, and

• (c) holds office for the period—

• (i) beginning with the relevant day, and

• (ii) lasting for 7 years less a period equal to the individual's pre-commencement term.

• (2) On and after the relevant day, a resolution passed by the House of Commons for the purposes of paragraph 3 of Schedule 5 to the 1998 Act (salary and pension of Commissioner), and not superseded before that day, is to be treated as having been passed for the purposes of paragraph 4 of Schedule 12 to this Act.

• (3) In this paragraph—

• “pre-commencement term”, in relation to an individual, means the period during which the individual was the Commissioner before the relevant day;

• “the relevant day” means the day on which Schedule 12 to this Act comes into force.

Accounts

20

• (1) The repeal of paragraph 10 of Schedule 5 to the 1998 Act does not affect the duties of the Commissioner and the Comptroller and Auditor General under that paragraph in respect of the Commissioner's statement of account for the financial year beginning with 1 April 2017.

• (2) The Commissioner's duty under paragraph 11 of Schedule 12 to this Act to prepare a statement of account for each financial year includes a duty to do so for the financial year beginning with 1 April 2018.

Annual report

21

• (1) The repeal of section 52(1) of the 1998 Act (annual report) does not affect the Commissioner's duty under that subsection to produce a general report on the exercise of the Commissioner's functions under the 1998 Act during the period of 1 year beginning with 1 April 2017 and to lay it before Parliament.

• (2) The repeal of section 49 of the Freedom of Information Act 2000 (annual report) does not affect the Commissioner's duty under that section to produce a general report on the exercise of the Commissioner's functions under that Act during the period of 1 year beginning with 1 April 2017 and to lay it before Parliament.

• (3) The first report produced by the Commissioner under section 139 of this Act must relate to the period of 1 year beginning with 1 April 2018.

Fees etc received by the Commissioner

22

• (1) The repeal of Schedule 5 to the 1998 Act (Information Commissioner) does not affect the application of paragraph 9 of that Schedule after the relevant time to amounts received by the Commissioner before the relevant time.

• (2) In this paragraph, “the relevant time” means the time when the repeal of Schedule 5 to the 1998 Act comes into force.

23

Paragraph 10 of Schedule 12 to this Act applies only to amounts received by the Commissioner after the time when that Schedule comes into force.

Functions in connection with the Data Protection Convention

24

• (1) The repeal of section 54(2) of the 1998 Act (functions to be discharged by the Commissioner for the purposes of Article 13 of the Data Protection Convention), and the revocation of the Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186), do not affect the application of articles 1 to 5 of that Order after the relevant time in relation to a request described in those articles which was made before that time.

• (2) The references in paragraph 9 of Schedule 14 to this Act (Data Protection Convention: restrictions on use of information) to requests made or received by the Commissioner under paragraph 6 or 7 of that Schedule include a request made or received by the Commissioner under article 3 or 4 of the Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186).

• (3) The repeal of section 54(7) of the 1998 Act (duty to notify the European Commission of certain approvals and authorisations) does not affect the application of that provision after the relevant time in relation to an approval or authorisation granted before the relevant time.

• (4) In this paragraph, “the relevant time” means the time when the repeal of section 54 of the 1998 Act comes into force.

Co-operation with the European Commission: transfers of personal data outside the EEA

25

• (1) The repeal of section 54(3) of the 1998 Act (co-operation by the Commissioner with the European Commission etc), and the revocation of the Data Protection (International Co-operation) Order 2000 (S.I. 2000/190), do not affect the application of articles 1 to 4 of that Order after the relevant time in relation to transfers that took place before the relevant time.

• (2) In this paragraph—

• “the relevant time” means the time when the repeal of section 54 of the 1998 Act comes into force;

• “transfer” has the meaning given in article 2 of the Data Protection (International Co-operation) Order 2000 (S.I. 2000/190).

Charges payable to the Commissioner by controllers

26

• (1) The Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480) have effect after the relevant time (until revoked) as if they were made under section 137 of this Act.

• (2) In this paragraph, “the relevant time” means the time when section 137 of this Act comes into force.

Requests for assessment

27

• (1) The repeal of section 42 of the 1998 Act (requests for assessment) does not affect the application of that section after the relevant time in a case in which the Commissioner received a request under that section before the relevant time, subject to sub-paragraph (2).

• (2) The Commissioner is only required to make an assessment of acts and omissions that took place before the relevant time.

• (3) In this paragraph, “the relevant time” means the time when the repeal of section 42 of the 1998 Act comes into force.

Codes of practice

28

• (1) The repeal of section 52E of the 1998 Act (effect of codes of practice) does not affect the application of that section after the relevant time in relation to legal proceedings or to the exercise of the Commissioner's functions under the 1998 Act as it has effect by virtue of this Schedule.

• (2) In section 52E of the 1998 Act, as it has effect by virtue of this paragraph, the references to the 1998 Act include that Act as it has effect by virtue of this Schedule.

• (3) For the purposes of subsection (3) of that section, as it has effect by virtue of this paragraph, the data-sharing code and direct marketing code in force immediately before the relevant time are to be treated as having continued in force after that time.

• (4) In this paragraph—

• “the data-sharing code” and “the direct marketing code” mean the codes respectively prepared under sections 52A and 52AA of the 1998 Act and issued under section 52B(5) of that Act;

• “the relevant time” means the time when the repeal of section 52E of the 1998 Act comes into force.

PART 7 — Enforcement etc under the 1998 Act

Interpretation of this Part

29

• (1) In this Part of this Schedule, references to contravention of the sixth data protection principle sections are to relevant contravention of any of sections 7, 10, 11 or 12 of the 1998 Act, as they continue to have effect by virtue of this Schedule after their repeal (and references to compliance with the sixth data protection principle sections are to be read accordingly).

• (2) In sub-paragraph (1), “relevant contravention” means contravention in a manner described in paragraph 8 of Part 2 of Schedule 1 to the 1998 Act (sixth data protection principle).

Information notices

30

• (1) The repeal of section 43 of the 1998 Act (information notices) does not affect the application of that section after the relevant time in a case in which—

• (a) the Commissioner served a notice under that section before the relevant time (and did not cancel it before that time), or

• (b) the Commissioner requires information after the relevant time for the purposes of—

• (i) responding to a request made under section 42 of the 1998 Act before that time,

• (ii) determining whether a data controller complied with the old data protection principles before that time, or

• (iii) determining whether a data controller complied with the sixth data protection principle sections after that time.

• (2) In section 43 of the 1998 Act, as it has effect by virtue of this paragraph—

• (a) the reference to an offence under section 47 of the 1998 Act includes an offence under section 144 of this Act, and

• (b) the references to an offence under the 1998 Act include an offence under this Act.

• (3) In this paragraph, “the relevant time” means the time when the repeal of section 43 of the 1998 Act comes into force.

Special information notices

31

• (1) The repeal of section 44 of the 1998 Act (special information notices) does not affect the application of that section after the relevant time in a case in which—

• (a) the Commissioner served a notice under that section before the relevant time (and did not cancel it before that time), or

• (b) the Commissioner requires information after the relevant time for the purposes of—

• (i) responding to a request made under section 42 of the 1998 Act before that time, or

• (ii) ascertaining whether section 44(2)(a) or (b) of the 1998 Act was satisfied before that time.

• (2) In section 44 of the 1998 Act, as it has effect by virtue of this paragraph—

• (a) the reference to an offence under section 47 of the 1998 Act includes an offence under section 144 of this Act, and

• (b) the references to an offence under the 1998 Act include an offence under this Act.

• (3) In this paragraph, “the relevant time” means the time when the repeal of section 44 of the 1998 Act comes into force.

Assessment notices

32

• (1) The repeal of sections 41A and 41B of the 1998 Act (assessment notices) does not affect the application of those sections after the relevant time in a case in which—

• (a) the Commissioner served a notice under section 41A of the 1998 Act before the relevant time (and did not cancel it before that time), or

• (b) the Commissioner considers it appropriate, after the relevant time, to investigate—

• (i) whether a data controller complied with the old data protection principles before that time, or

• (ii) whether a data controller complied with the sixth data protection principle sections after that time.

• (2) The revocation of the Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282), and the repeals mentioned in sub-paragraph (1), do not affect the application of that Order in a case described in sub-paragraph (1).

• (3) Sub-paragraph (1) does not enable the Secretary of State, after the relevant time, to make an order under section 41A(2)(b) or (c) of the 1998 Act (data controllers on whom an assessment notice may be served) designating a public authority or person for the purposes of that section.

• (4) Section 41A of the 1998 Act, as it has effect by virtue of sub-paragraph (1), has effect as if subsections (8) and (11) (duty to review designation orders) were omitted.

• (5) The repeal of section 41C of the 1998 Act (code of practice about assessment notice) does not affect the application, after the relevant time, of the code issued under that section and in force immediately before the relevant time in relation to the exercise of the Commissioner's functions under and in connection with section 41A of the 1998 Act, as it has effect by virtue of sub-paragraph (1).

• (6) In this paragraph, “the relevant time” means the time when the repeal of section 41A of the 1998 Act comes into force.

Enforcement notices

33

• (1) The repeal of sections 40 and 41 of the 1998 Act (enforcement notices) does not affect the application of those sections after the relevant time in a case in which—

• (a) the Commissioner served a notice under section 40 of the 1998 Act before the relevant time (and did not cancel it before that time), or

• (b) the Commissioner is satisfied, after that time, that a data controller —

• (i) contravened the old data protection principles before that time, or

• (ii) contravened the sixth data protection principle sections after that time.

• (2) In this paragraph, “the relevant time” means the time when the repeal of section 40 of the 1998 Act comes into force.

Determination by Commissioner as to the special purposes

34

• (1) The repeal of section 45 of the 1998 Act (determination by Commissioner as to the special purposes) does not affect the application of that section after the relevant time in a case in which—

• (a) the Commissioner made a determination under that section before the relevant time, or

• (b) the Commissioner considers it appropriate, after the relevant time, to make a determination under that section.

• (2) In this paragraph, “the relevant time” means the time when the repeal of section 45 of the 1998 Act comes into force.

Restriction on enforcement in case of processing for the special purposes

35

• (1) The repeal of section 46 of the 1998 Act (restriction on enforcement in case of processing for the special purposes) does not affect the application of that section after the relevant time in relation to an enforcement notice or information notice served under the 1998 Act—

• (a) before the relevant time, or

• (b) after the relevant time in reliance on this Schedule.

• (2) In this paragraph, “the relevant time” means the time when the repeal of section 46 of the 1998 Act comes into force.

Offences

36

• (1) The repeal of sections 47, 60 and 61 of the 1998 Act (offences of failing to comply with certain notices and of providing false information etc in response to a notice) does not affect the application of those sections after the relevant time in connection with an information notice, special information notice or enforcement notice served under Part 5 of the 1998 Act—

• (a) before the relevant time, or

• (b) after that time in reliance on this Schedule.

• (2) In this paragraph, “the relevant time” means the time when the repeal of section 47 of the 1998 Act comes into force.

Powers of entry

37

• (1) The repeal of sections 50, 60 and 61 of, and Schedule 9 to, the 1998 Act (powers of entry) does not affect the application of those provisions after the relevant time in a case in which—

• (a) a warrant issued under that Schedule was in force immediately before the relevant time,

• (b) before the relevant time, the Commissioner supplied information on oath for the purposes of obtaining a warrant under that Schedule but that had not been considered by a circuit judge or a District Judge (Magistrates' Courts), or

• (c) after the relevant time, the Commissioner supplies information on oath to a circuit judge or a District Judge (Magistrates' Courts) in respect of—

• (i) a contravention of the old data protection principles before the relevant time;

• (ii) a contravention of the sixth data protection principle sections after the relevant time;

• (iii) the commission of an offence under a provision of the 1998 Act (including as the provision has effect by virtue of this Schedule);

• (iv) a failure to comply with a requirement imposed by an assessment notice issued under section 41A the 1998 Act (including as it has effect by virtue of this Schedule).

• (2) In paragraph 16 of Schedule 9 to the 1998 Act, as it has effect by virtue of this paragraph, the reference to an offence under paragraph 12 of that Schedule includes an offence under paragraph 15 of Schedule 15 to this Act.

• (3) In this paragraph, “the relevant time” means the time when the repeal of Schedule 9 to the 1998 Act comes into force.

• (4) Paragraphs 14 and 15 of Schedule 9 to the 1998 Act (application of that Schedule to Scotland and Northern Ireland) apply for the purposes of this paragraph as they apply for the purposes of that Schedule.

Monetary penalties

38

• (1) The repeal of sections 55A, 55B, 55D and 55E of the 1998 Act (monetary penalties) does not affect the application of those provisions after the relevant time in a case in which—

• (a) the Commissioner served a monetary penalty notice under section 55A of the 1998 Act before the relevant time,

• (b) the Commissioner served a notice of intent under section 55B of the 1998 Act before the relevant time, or

• (c) the Commissioner considers it appropriate, after the relevant time, to serve a notice mentioned in paragraph (a) or (b) in respect of—

• (i) a contravention of section 4(4) of the 1998 Act before the relevant time, or

• (ii) a contravention of the sixth data protection principle sections after the relevant time.

• (2) The revocation of the relevant subordinate legislation, and the repeals mentioned in sub-paragraph (1), do not affect the application of the relevant subordinate legislation (or of provisions of the 1998 Act applied by them) after the relevant time in a case described in sub-paragraph (1).

• (3) Guidance issued under section 55C of the 1998 Act (guidance about monetary penalty notices) which is in force immediately before the relevant time continues in force after that time for the purposes of the Commissioner's exercise of functions under sections 55A and 55B of the 1998 Act as they have effect by virtue of this paragraph.

• (4) In this paragraph—

• “the relevant subordinate legislation” means—the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31);the Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910);

• “the relevant time” means the time when the repeal of section 55A of the 1998 Act comes into force.

Appeals

39

• (1) The repeal of sections 48 and 49 of the 1998 Act (appeals) does not affect the application of those sections after the relevant time in relation to a notice served under the 1998 Act or a determination made under section 45 of that Act—

• (a) before the relevant time, or

• (b) after that time in reliance on this Schedule.

• (2) In this paragraph, “the relevant time” means the time when the repeal of section 48 of the 1998 Act comes into force.

Exemptions

40

• (1) The repeal of section 28 of the 1998 Act (national security) does not affect the application of that section after the relevant time for the purposes of a provision of Part 5 of the 1998 Act as it has effect after that time by virtue of the preceding paragraphs of this Part of this Schedule.

• (2) In this paragraph, “the relevant time” means the time when the repeal of the provision of Part 5 of the 1998 Act in question comes into force.

• (3) As regards certificates issued under section 28(2) of the 1998 Act, see Part 5 of this Schedule.

Tribunal Procedure Rules

41

• (1) The repeal of paragraph 7 of Schedule 6 to the 1998 Act (Tribunal Procedure Rules) does not affect the application of that paragraph, or of rules made under that paragraph, after the relevant time in relation to the exercise of rights of appeal conferred by section 28 or 48 of the 1998 Act, as they have effect by virtue of this Schedule.

• (2) Part 3 of Schedule 19 to this Act does not apply for the purposes of Tribunal Procedure Rules made under paragraph 7(1)(a) of Schedule 6 to the 1998 Act as they apply, after the relevant time, in relation to the exercise of rights of appeal described in sub-paragraph (1).

• (3) In this paragraph, “the relevant time” means the time when the repeal of paragraph 7 of Schedule 6 to the 1998 Act comes into force.

Obstruction etc

42

• (1) The repeal of paragraph 8 of Schedule 6 to the 1998 Act (obstruction etc in proceedings before the Tribunal) does not affect the application of that paragraph after the relevant time in relation to an act or omission in relation to proceedings under the 1998 Act (including as it has effect by virtue of this Schedule).

• (2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 8 of Schedule 6 to the 1998 Act comes into force.

Enforcement etc under the 2014 Regulations

43

• (1) The references in the preceding paragraphs of this Part of this Schedule to provisions of the 1998 Act include those provisions as applied, with modifications, by regulation 51 of the 2014 Regulations (other functions of the Commissioner).

• (2) The revocation of regulation 51 of the 2014 Regulations does not affect the application of those provisions of the 1998 Act (as so applied) as described in those paragraphs.

PART 8 — Enforcement etc under this Act

Information notices

44

In section 143 of this Act—

• (a) the reference to an offence under section 144 of this Act includes an offence under section 47 of the 1998 Act (including as it has effect by virtue of this Schedule), and

• (b) the references to an offence under this Act include an offence under the 1998 Act (including as it has effect by virtue of this Schedule) or the 1984 Act.

Powers of entry

45

In paragraph 16 of Schedule 15 to this Act (powers of entry: self-incrimination), the reference to an offence under paragraph 15 of that Schedule includes an offence under paragraph 12 of Schedule 9 to the 1998 Act (including as it has effect by virtue of this Schedule).

Tribunal Procedure Rules

46

• (1) Tribunal Procedure Rules made under paragraph 7(1)(a) of Schedule 6 to the 1998 Act (appeal rights under the 1998 Act) and in force immediately before the relevant time have effect after that time as if they were also made under section 203 of this Act.

• (2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 7(1)(a) of Schedule 6 to the 1998 Act comes into force.

PART 9 — Other enactments

Powers to disclose information to the Commissioner

47

• (1) The following provisions (as amended by Schedule 19 to this Act) have effect after the relevant time as if the matters they refer to included a matter in respect of which the Commissioner could exercise a power conferred by a provision of Part 5 of the 1998 Act, as it has effect by virtue of this Schedule—

• (a) section 11AA(1)(a) of the Parliamentary Commissioner Act 1967 (disclosure of information by Parliamentary Commissioner);

• (b) sections 33A(1)(a) and 34O(1)(a) of the Local Government Act 1974 (disclosure of information by Local Commissioner);

• (c) section 18A(1)(a) of the Health Service Commissioners Act 1993 (disclosure of information by Health Service Commissioner);

• (d) paragraph 1 of the entry for the Information Commissioner in Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (asp 11) (disclosure of information by the Ombudsman);

• (e) section 34X(3)(a) of the Public Services Ombudsman (Wales) Act 2005 (disclosure of information by the Ombudsman);

• (f) section 18(6)(a) of the Commissioner for Older People (Wales) Act 2006 (disclosure of information by the Commissioner);

• (g) section 22(3)(a) of the Welsh Language (Wales) Measure 2011 (nawm 1) (disclosure of information by the Welsh Language Commissioner);

• (h) section 49(3)(a) of the Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.))(disclosure of information by the Ombudsman);

• (i) section 44(3)(a) of the Justice Act (Northern Ireland) 2016 (c. 21 (N.I.)) (disclosure of information by the Prison Ombudsman for Northern Ireland).

• (2) The following provisions (as amended by Schedule 19 to this Act) have effect after the relevant time as if the offences they refer to included an offence under any provision of the 1998 Act other than paragraph 12 of Schedule 9 to that Act (obstruction of execution of warrant)—

• (a) section 11AA(1)(b) of the Parliamentary Commissioner Act 1967;

• (b) sections 33A(1)(b) and 34O(1)(b) of the Local Government Act 1974;

• (c) section 18A(1)(b) of the Health Service Commissioners Act 1993;

• (d) paragraph 2 of the entry for the Information Commissioner in Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (asp 11);

• (e) section 34X(5) of the Public Services Ombudsman (Wales) Act 2005 (disclosure of information by the Ombudsman);

• (f) section 18(8) of the Commissioner for Older People (Wales) Act 2006;

• (g) section 22(5) of the Welsh Language (Wales) Measure 2011 (nawm 1);

• (h) section 49(5) of the Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.));

• (i) section 44(3)(b) of the Justice Act (Northern Ireland) 2016 (c. 21 (N.I.)).

• (3) In this paragraph, “the relevant time”, in relation to a provision of a section or Schedule listed in sub-paragraph (1) or (2), means the time when the amendment of the section or Schedule by Schedule 19 to this Act comes into force.

Codes etc required to be consistent with the Commissioner’s data-sharing code

48

• (1) This paragraph applies in relation to the code of practice issued under each of the following provisions—

• (a) section 19AC of the Registration Service Act 1953 (code of practice about disclosure of information by civil registration officials);

• (b) section 43 of the Digital Economy Act 2017 (code of practice about disclosure of information to improve public service delivery);

• (c) section 52 of that Act (code of practice about disclosure of information to reduce debt owed to the public sector);

• (d) section 60 of that Act (code of practice about disclosure of information to combat fraud against the public sector);

• (e) section 70 of that Act (code of practice about disclosure of information for research purposes).

• (2) During the relevant period, the code of practice does not have effect to the extent that it is inconsistent with the code of practice prepared under section 121 of this Act (data-sharing code) and issued under section 125(4) of this Act (as altered or replaced from time to time).

• (3) In this paragraph, “the relevant period”, in relation to a code issued under a section mentioned in sub-paragraph (1), means the period—

• (a) beginning when the amendments of that section in Schedule 19 to this Act come into force, and

• (b) ending when the code is first reissued under that section.

49

• (1) This paragraph applies in relation to the original statement published under section 45E of the Statistics and Registration Service Act 2007 (statement of principles and procedures in connection with access to information by the Statistics Board).

• (2) During the relevant period, the statement does not have effect to the extent that it is inconsistent with the code of practice prepared under section 121 of this Act (data-sharing code) and issued under section 125(4) of this Act (as altered or replaced from time to time).

• (3) In this paragraph, “the relevant period” means the period—

• (a) beginning when the amendments of section 45E of the Statistics and Registration Service Act 2007 in Schedule 19 to this Act come into force, and

• (b) ending when the first revised statement is published under that section.

Consumer Credit Act 1974

50

In section 159(1)(a) of the Consumer Credit Act 1974 (correction of wrong information) (as amended by Schedule 19 to this Act), the reference to information given under Article 15(1) to (3) of the UK GDPR includes information given at any time under section 7 of the 1998 Act.

Freedom of Information Act 2000

51

Paragraphs 52 to 55 make provision about the Freedom of Information Act 2000 (“the 2000 Act”).

52

• (1) This paragraph applies where a request for information was made to a public authority under the 2000 Act before the relevant time.