Data Protection Act 2018

• (2) To the extent that the request is dealt with after the relevant time, the amendments of sections 2 and 40 of the 2000 Act in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2000 Act.

• (3) To the extent that the request was dealt with before the relevant time—

• (a) the amendments of sections 2 and 40 of the 2000 Act in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with Part 1 of the 2000 Act, but

• (b) the powers of the Commissioner and the Tribunal, on an application or appeal under the 2000 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2000 Act as amended by Schedule 19 to this Act.

• (4) In this paragraph—

• “public authority” has the same meaning as in the 2000 Act;

• “the relevant time” means the time when the amendments of sections 2 and 40 of the 2000 Act in Schedule 19 to this Act come into force.

53

• (1) Tribunal Procedure Rules made under paragraph 7(1)(b) of Schedule 6 to the 1998 Act (appeal rights under the 2000 Act) and in force immediately before the relevant time have effect after that time as if they were also made under section 61 of the 2000 Act (as inserted by Schedule 19 to this Act).

• (2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 7(1)(b) of Schedule 6 to the 1998 Act comes into force.

54

• (1) The repeal of paragraph 8 of Schedule 6 to the 1998 Act (obstruction etc in proceedings before the Tribunal) does not affect the application of that paragraph after the relevant time in relation to an act or omission before that time in relation to an appeal under the 2000 Act.

• (2) In this paragraph, “the relevant time” means the time when the repeal of paragraph 8 of Schedule 6 to the 1998 Act comes into force.

55

• (1) The amendment of section 77 of the 2000 Act in Schedule 19 to this Act (offence of altering etc record with intent to prevent disclosure: omission of reference to section 7 of the 1998 Act) does not affect the application of that section after the relevant time in relation to a case in which—

• (a) the request for information mentioned in section 77(1) of the 2000 Act was made before the relevant time, and

• (b) when the request was made, section 77(1)(b) of the 2000 Act was satisfied by virtue of section 7 of the 1998 Act.

• (2) In this paragraph, “the relevant time” means the time when the repeal of section 7 of the 1998 Act comes into force.

Freedom of Information (Scotland) Act 2002

56

• (1) This paragraph applies where a request for information was made to a Scottish public authority under the Freedom of Information (Scotland) Act 2002 (“the 2002 Act”) before the relevant time.

• (2) To the extent that the request is dealt with after the relevant time, the amendments of the 2002 Act in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Part 1 of the 2002 Act.

• (3) To the extent that the request was dealt with before the relevant time—

• (a) the amendments of the 2002 Act in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with Part 1 of the 2002 Act, but

• (b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act, do not include power to require the authority to take steps which it would not be required to take in order to comply with Part 1 of the 2002 Act as amended by Schedule 19 to this Act.

• (4) In this paragraph—

• “Scottish public authority” has the same meaning as in the 2002 Act;

• “the relevant time” means the time when the amendments of the 2002 Act in Schedule 19 to this Act come into force.

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))

57

Until the first regulations under Article 5(4)(a) of the Access to Health Records (Northern Ireland) Order 1993 (as amended by Schedule 19 to this Act) come into force, the maximum amount of a fee that may be required for giving access under that Article is £10.

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2450)

58

• (1) The repeal of a provision of the 1998 Act does not affect its operation for the purposes of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“the PECR 2003”) (see regulation 2 of those Regulations).

• (2) Where subordinate legislation made under a provision of the 1998 Act is in force immediately before the repeal of that provision, neither the revocation of the subordinate legislation nor the repeal of the provision of the 1998 Act affect the application of the subordinate legislation for the purposes of the PECR 2003 after that time.

• (3) Part 3 of Schedule 19 to this Act (modifications) does not have effect in relation to the PECR 2003.

• (4) Part 7 of this Schedule does not have effect in relation to the provisions of the 1998 Act as applied by the PECR 2003.

Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))

59

Part 3 of Schedule 19 to this Act (modifications) does not have effect in relation to the reference to an accessible record within the meaning of section 68 of the 1998 Act in Article 43 of the Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003.

Environmental Information Regulations 2004 (S.I. 2004/3391)

60

• (1) This paragraph applies where a request for information was made to a public authority under the Environmental Information Regulations 2004 (“the 2004 Regulations”) before the relevant time.

• (2) To the extent that the request is dealt with after the relevant time, the amendments of the 2004 Regulations in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with Parts 2 and 3 of those Regulations.

• (3) To the extent that the request was dealt with before the relevant time—

• (a) the amendments of the 2004 Regulations in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with Parts 2 and 3 of those Regulations, but

• (b) the powers of the Commissioner and the Tribunal, on an application or appeal under the 2000 Act (as applied by the 2004 Regulations), do not include power to require the authority to take steps which it would not be required to take in order to comply with Parts 2 and 3 of those Regulations as amended by Schedule 19 to this Act.

• (4) In this paragraph—

• “public authority” has the same meaning as in the 2004 Regulations;

• “the relevant time” means the time when the amendments of the 2004 Regulations in Schedule 19 to this Act come into force.

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

61

• (1) This paragraph applies where a request for information was made to a Scottish public authority under the Environmental Information (Scotland) Regulations 2004 (“the 2004 Regulations”) before the relevant time.

• (2) To the extent that the request is dealt with after the relevant time, the amendments of the 2004 Regulations in Schedule 19 to this Act have effect for the purposes of determining whether the authority deals with the request in accordance with those Regulations.

• (3) To the extent that the request was dealt with before the relevant time—

• (a) the amendments of the 2004 Regulations in Schedule 19 to this Act do not have effect for the purposes of determining whether the authority dealt with the request in accordance with those Regulations, but

• (b) the powers of the Scottish Information Commissioner and the Court of Session, on an application or appeal under the 2002 Act (as applied by the 2004 Regulations), do not include power to require the authority to take steps which it would not be required to take in order to comply with those Regulations as amended by Schedule 19 to this Act.

• (4) In this paragraph—

• “Scottish public authority” has the same meaning as in the 2004 Regulations;

• “the relevant time” means the time when the amendments of the 2004 Regulations in Schedule 19 to this Act come into force.

Overview

Processing to which this Part applies

Special categories of personal data etc: supplementary

National security and defence exemption

Processing to which this Part applies

Meaning of “controller” and “processor”

Regulations and consultation

Index of defined expressions

Employment, social security and social protection

Health or social care purposes

Public health

Research etc

Requirement for an appropriate policy document when relying on conditions in this Part

Statutory etc and government purposes

Administration of justice and parliamentary purposes

Equality of opportunity or treatment

Racial and ethnic diversity at senior levels of organisations

Preventing etc unlawful acts

Protecting the public against dishonesty etc

Regulatory requirements relating to unlawful acts and dishonesty etc

Journalism etc in connection with unlawful acts and dishonesty etc

Preventing fraud

Suspicion of terrorist financing or money laundering

Support for individuals with a particular disability or medical condition

Counselling etc

Safeguarding of children and of individuals at risk

Safeguarding of economic well-being of certain individuals

Insurance

Occupational pensions

Political parties

Elected representatives responding to requests

Disclosure to elected representatives

Informing elected representatives about prisoners

Publication of legal judgments

Anti-doping in sport

Standards of behaviour in sport

Consent

Protecting individual's vital interests

Processing by not-for-profit bodies

Personal data in the public domain

Legal claims

Judicial acts

Administration of accounts used in commission of indecency offences involving children

Extension of conditions in Part 2 of this Schedule referring to substantial public interest

Extension of insurance conditions

Application of this Part of this Schedule

Requirement to have an appropriate policy document in place

Additional safeguard: retention of appropriate policy document

Additional safeguard: record of processing

UK GDPR provisions to be adapted or restricted: “the listed GDPR provisions”

Crime and taxation: general

Crime and taxation: risk assessment systems

Immigration

Information required to be disclosed by law etc or in connection with legal proceedings

UK GDPR provisions to be restricted: “the listed GDPR provisions”

Functions designed to protect the public etc

Audit functions

Functions of the Bank of England

Regulatory functions relating to legal services, the health service and children's services

Regulatory functions of certain other persons

Parliamentary privilege

Judicial appointments, judicial independence and judicial proceedings

Crown honours, dignities and appointments

Protection of the rights of others: general

Assumption of reasonableness for health workers, social workers and education workers

UK GDPR provisions to be restricted: “the listed GDPR provisions”

Legal professional privilege

Self incrimination

Corporate finance

Management forecasts

Negotiations

Confidential references

Exam scripts and exam marks

Journalistic, academic, artistic and literary purposes

Research and statistics

Archiving in the public interest

Definitions

Exemption from the listed GDPR provisions: data processed by a court

Exemption from the listed GDPR provisions: data subject's expectations and wishes

Exemption from Article 15 of the UK GDPR: serious harm

Restriction of Article 15 of the UK GDPR: prior opinion of appropriate health professional

Definitions

Exemption from the listed GDPR provisions: data processed by a court

Exemption from the listed GDPR provisions: data subject's expectations and wishes

Exemption from Article 15 of the UK GDPR: serious harm

Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter

Educational records

Other definitions

Exemption from the listed GDPR provisions: data processed by a court

Exemption from Article 15 of the UK GDPR: serious harm

Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter

Exemption from Article 15 of the UK GDPR: child abuse data

UK GDPR provisions to be restricted: “the listed GDPR provisions”

Human fertilisation and embryology information

Adoption records and reports

Statements of special educational needs

Parental order records and reports

Information provided by Principal Reporter for children's hearing

Introduction

Review

Right to appeal

Appeal panel

Hearing

Decision following referral to appeal panel

Meaning of “working day”

Introductory

References to the GDPR and its provisions

References to Union law and Member State law

References to the Union and to Member States

References to supervisory authorities

References to the national parliament

Chapter I of the GDPR (general provisions)

Chapter II of the GDPR (principles)

Section 1 of Chapter III of the GDPR (rights of the data subject: transparency and modalities)

Section 2 of Chapter III of the GDPR (rights of the data subject: information and access to personal data)

Section 3 of Chapter III of the GDPR (rights of the data subject: rectification and erasure)

Section 4 of Chapter III of the GDPR (rights of the data subject: right to object and automated individual decision-making)

Section 5 of Chapter III of the GDPR (rights of the data subject: restrictions)

Section 1 of Chapter IV of the GDPR (controller and processor: general obligations)

Section 3 of Chapter IV of the GDPR (controller and processor: data protection impact assessment and prior consultation)

Section 4 of Chapter IV of the GDPR (controller and processor: data protection officer)

Section 5 of Chapter IV of the GDPR (controller and processor: codes of conduct and certification)

Chapter V of the GDPR (transfers of data to third countries or international organisations)

Section 1 of Chapter VI of the GDPR (independent supervisory authorities: independent status)

Section 2 of Chapter VI of the GDPR (independent supervisory authorities: competence, tasks and powers)

Chapter VII of the GDPR (co-operation and consistency)

Chapter VIII of the GDPR (remedies, liability and penalties)

Chapter IX of the GDPR (provisions relating to specific processing situations)

Chapter X of the GDPR (delegated acts and implementing acts)

Chapter XI of the GDPR (final provisions)

Introductory

General modifications

Exemptions

Chief officers of police and other policing bodies

Other authorities with investigatory functions

Authorities with functions relating to offender management

Other authorities

Statutory etc purposes

Administration of justice

Protecting individual's vital interests

Safeguarding of children and of individuals at risk

Personal data already in the public domain

Legal claims

Judicial acts

Preventing fraud

Archiving etc

Consent to particular processing

Right or obligation relating to employment

Vital interests of a person

Safeguarding of children and of individuals at risk

Data already published by data subject

Legal proceedings etc

Administration of justice, parliamentary, statutory etc and government purposes

Medical purposes

Equality

Preliminary

Crime

Information required to be disclosed by law etc or in connection with legal proceedings

Parliamentary privilege

Judicial proceedings

Crown honours and dignities

Armed forces

Economic well-being

Legal professional privilege

Negotiations

Confidential references given by the controller

Exam scripts and marks

Research and statistics

Archiving in the public interest

Status and capacity

Appointment

Resignation and removal

Salary etc

Officers and staff

Carrying out of the Commissioner's functions by officers and staff

Authentication of the seal of the Commissioner

Presumption of authenticity of documents issued by the Commissioner

Money

Fees etc and other sums

Accounts

Scotland

General tasks

General powers

Definitions

Co-operation

Requests for information and assistance from LED supervisory authorities

Fees

Restrictions on use of information

LED supervisory authority

Co-operation between the Commissioner and foreign designated authorities

Assisting persons resident outside the UK with requests under Article 14 of the Convention

Assisting UK residents with requests under Article 8 of the Convention

Restrictions on use of information

Foreign designated authority

Issue of warrants in connection with non-compliance and offences

Issue of warrants in connection with assessment notices

Restrictions on issuing warrants: processing for the special purposes

Restrictions on issuing warrants: procedural requirements

Content of warrants

Copies of warrants

Execution of warrants: reasonable force

Execution of warrants: time when executed

Execution of warrants: occupier of premises

Execution of warrants: seizure of documents etc

Matters exempt from inspection and seizure: privileged communications

Matters exempt from inspection and seizure: Parliamentary privilege

Partially exempt material

Return of warrants

Offences

Self-incrimination

Vessels, vehicles etc

Scotland

Northern Ireland

Meaning of “penalty”

Notice of intent to impose penalty

Contents of notice of intent

Giving a penalty notice

Contents of penalty notice

Period for payment of penalty

Variation of penalty

Cancellation of penalty

Enforcement of payment

Interpretation

Information notices

Assessment notices

Applications in respect of urgent notices

Relevant records

Relevant health records

Relevant records relating to a conviction or caution

Relevant records relating to statutory functions

Data subject access right

Records stating that personal data is not processed

Power to amend

Registration Service Act 1953 (c. 37)

Veterinary Surgeons Act 1966 (c. 36)

Parliamentary Commissioner Act 1967 (c. 13)

Local Government Act 1974 (c. 7)

Consumer Credit Act 1974 (c. 39)

Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22))

Representation of the People Act 1983 (c. 2)

Medical Act 1983 (c. 54)

Dentists Act 1984 (c. 24)

Companies Act 1985 (c. 6)

Access to Medical Reports Act 1988 (c. 28)

Opticians Act 1989 (c. 44)

Access to Health Records Act 1990 (c. 23)

Human Fertilisation and Embryology Act 1990 (c. 37)

Trade Union and Labour Relations (Consolidation) Act 1992 (c. 52)

Tribunals and Inquiries Act 1992 (c. 53)

Industrial Relations (Northern Ireland) Order 1992 (S.I. 1992/807 (N.I. 5))

Health Service Commissioners Act 1993 (c. 46)

Data Protection Act 1998 (c. 29)

Crime and Disorder Act 1998 (c. 37)

Food Standards Act 1999 (c. 28)

Immigration and Asylum Act 1999 (c. 33)

Financial Services and Markets Act 2000 (c. 8)

Terrorism Act 2000 (c. 11)

Freedom of Information Act 2000 (c. 36)

Political Parties, Elections and Referendums Act 2000 (c. 41)

Public Finance and Accountability (Scotland) Act 2000 (asp 1)

Criminal Justice and Police Act 2001 (c. 16)

Anti-terrorism, Crime and Security Act 2001 (c.24)

Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.))

Justice (Northern Ireland) Act 2002 (c. 26)

Proceeds of Crime Act 2002 (c. 29)

Enterprise Act 2002 (c. 40)

Scottish Public Services Ombudsman Act 2002 (asp 11)

Freedom of Information (Scotland) Act 2002 (asp 13)

Courts Act 2003 (c. 39)

Sexual Offences Act 2003 (c. 42)

Criminal Justice Act 2003 (c. 44)

Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13)

Public Audit (Wales) Act 2004 (c. 23)

Companies (Audit, Investigations and Community Enterprise) Act 2004 (c. 27)

Domestic Violence, Crime and Victims Act 2004 (c. 28)

Children Act 2004 (c. 31)

Constitutional Reform Act 2005 (c. 4)

Mental Capacity Act 2005 (c. 9)

Public Services Ombudsman (Wales) Act 2005 (c. 10)

Commissioners for Revenue and Customs Act 2005 (c. 11)

Gambling Act 2005 (c. 19)

Commissioner for Older People (Wales) Act 2006 (c. 30)

National Health Service Act 2006 (c. 41)

National Health Service (Wales) Act 2006 (c. 42)

Companies Act 2006 (c. 46)

Tribunals, Courts and Enforcement Act 2007 (c. 15)

Statistics and Registration Service Act 2007 (c. 18)

Serious Crime Act 2007 (c. 27)

Legal Services Act 2007 (c. 29)

Adoption and Children (Scotland) Act 2007 (asp 4)

Criminal Justice and Immigration Act 2008 (c. 4)

Regulatory Enforcement and Sanctions Act 2008 (c. 13)

Health and Social Care Act 2008 (c. 14)

Counter-Terrorism Act 2008 (c. 28)

Public Health etc. (Scotland) Act 2008 (asp 5)

Banking Act 2009 (c. 1)

Borders, Citizenship and Immigration Act 2009 (c. 11)

Marine and Coastal Access Act 2009 (c. 23)

Coroners and Justice Act 2009 (c. 25)

Broads Authority Act 2009 (c. i)

Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.))

Terrorist Asset-Freezing etc. Act 2010 (c. 38)

Marine (Scotland) Act 2010 (asp 5)

Charities Act 2011 (c. 25)

Welsh Language (Wales) Measure 2011 (nawm 1)

Safeguarding Board Act (Northern Ireland) 2011 (c. 7 (N.I))

Health and Social Care Act 2012 (c. 7)

Protection of Freedoms Act 2012 (c. 9)

HGV Road User Levy Act 2013 (c. 7)

Crime and Courts Act 2013 (c. 22)

Marine Act (Northern Ireland) 2013 (c. 10 (N.I.))

Local Audit and Accountability Act 2014 (c. 2)

Anti-social Behaviour, Crime and Policing Act 2014 (c. 12)

Immigration Act 2014 (c. 22)

Care Act 2014 (c. 23)

Social Services and Well-being (Wales) Act 2014 (anaw 4)

Counter-Terrorism and Security Act 2015 (c. 6)

Small Business, Enterprise and Employment Act 2015 (c. 26)

Modern Slavery Act 2015 (c. 30)

Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.))

Justice Act (Northern Ireland) 2015 (c. 9 (N.I.))

Immigration Act 2016 (c. 19)

Investigatory Powers Act 2016 (c. 25)

Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.))

Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12 (N.I.))

Mental Capacity Act (Northern Ireland) 2016 (c. 18 (N.I.))

Justice Act (Northern Ireland) 2016 (c. 21 (N.I.))

Policing and Crime Act 2017 (c. 3)

Children and Social Work Act 2017 (c. 12)

Higher Education and Research Act 2017 (c. 29)

Digital Economy Act 2017 (c. 30)

Landfill Disposals Tax (Wales) Act 2017 (anaw 3)

Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (anaw 2)

This Act

Estate Agents (Specified Offences) (No. 2) Order 1991 (S.I. 1991/1091)

Channel Tunnel (International Arrangements) Order 1993 (S.I. 1993/1813)

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))

Channel Tunnel (Miscellaneous Provisions) Order 1994 (S.I. 1994/1405)

European Primary and Specialist Dental Qualifications Regulations 1998 (S.I. 1998/811)

Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (S.I. 1999/677)

Northern Ireland Assembly Commission (Crown Status) Order 1999 (S.I. 1999/3145)

Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184)

Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 (S.I. 2000/185)

Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186)

Data Protection (International Co-operation) Order 2000 (S.I. 2000/190)

Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191)

Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290)

Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413)

Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414)

Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415)

Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416)

Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417)

Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419)

Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864)

Representation of the People (England and Wales) Regulations 2001 (S.I. 2001/341)

Representation of the People (Scotland) Regulations 2001 (S.I. 2001/497)

Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (S.I. 2001/2188)

Nursing and Midwifery Order 2001 (S.I. 2002/253)

Electronic Commerce (EC Directive) Regulations 2002 (S.I. 2002/2013)

Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 (S.I. 2002/2905)

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426)

Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818)

Pupils' Educational Records (Scotland) Regulations 2003 (S.S.I. 2003/581)

European Parliamentary Elections (Northern Ireland) Regulations 2004 (S.I. 2004/1267)

Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244)

Environmental Information Regulations 2004 (S.I. 2004/3391)

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

Licensing Act 2003 (Personal Licences) Regulations 2005 (S.I. 2005/41)

Education (Pupil Information) (England) Regulations 2005 (S.I. 2005/1437)

Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042)

Register of Judgments, Orders and Fines Regulations 2005 (S.I. 2005/3595)

Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494)

Data Protection (Processing of Sensitive Personal Data) Order 2006 (S.I. 2006/2068)

National Assembly for Wales (Representation of the People) Order 2007 (S.I. 2007/236)

Mental Capacity Act 2005 (Loss of Capacity during Research Project) (England) Regulations 2007 (S.I. 2007/679)

National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118)

Mental Capacity Act 2005 (Loss of Capacity during Research Project) (Wales) Regulations 2007 (S.I. 2007/837 (W.72))

Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (S.S.I. 2007/170)

Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (S.S.I. 2007/264)

Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 (S.R. (N.I.) 2007 No. 43)

Representation of the People (Northern Ireland) Regulations 2008 (S.I. 2008/1741)

Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (S.I. 2008/3122)

Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008 (S.I. 2008/3239 (W.286))

Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (S.R. (N.I.) 2008 No. 3)

Companies (Disclosure of Address) Regulations 2009 (S.I. 2009/214)

Overseas Companies Regulations 2009 (S.I. 2009/1801)

Data Protection (Processing of Sensitive Personal Data) Order 2009 (S.I. 2009/1811)

Provision of Services Regulations 2009 (S.I. 2009/2999)

INSPIRE Regulations 2009 (S.I. 2009/3157)

INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440)

Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 (S.R (N.I.) 2009 No. 225)

Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (S.I. 2010/31)

Pharmacy Order 2010 (S.I. 2010/231)

Data Protection (Monetary Penalties) Order 2010 (S.I. 2010/910)

National Employment Savings Trust Order 2010 (S.I. 2010/917)

Local Elections (Northern Ireland) Order 2010 (S.I. 2010/2977)

Pupil Information (Wales) Regulations 2011 (S.I. 2011/1942 (W.209))

Debt Arrangement Scheme (Scotland) Regulations 2011 (S.S.I. 2011/141)

Police and Crime Commissioner Elections Order 2012 (S.I. 2012/1917)

Data Protection (Processing of Sensitive Personal Data) Order 2012 (S.I. 2012/1978)

Neighbourhood Planning (Referendums) Regulations 2012 (S.I. 2012/2031)

Controlled Drugs (Supervision of Management and Use) Regulations 2013 (S.I. 2013/373)

Communications Act 2003 (Disclosure of Information) Order 2014 (S.I. 2014/1825)

Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141)

Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 (S.I. 2014/3282)

The Control of Explosives Precursors etc Regulations (Northern Ireland) 2014 (S.R. (N.I.) 2014 No. 224)

Control of Poisons and Explosives Precursors Regulations 2015 (S.I. 2015/966)

Companies (Disclosure of Date of Birth Information) Regulations 2015 (S.I. 2015/1694)

Small and Medium Sized Business (Credit Information) Regulations 2015 (S.I. 2015/1945)

European Union (Recognition of Professional Qualifications) Regulations 2015 (S.I. 2015/2059)

Scottish Parliament (Elections etc) Order 2015 (S.S.I. 2015/425)

Recall of MPs Act 2015 (Recall Petition) Regulations 2016 (S.I. 2016/295)

Register of People with Significant Control Regulations 2016 (S.I. 2016/339)

Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696)

Court Files Privileged Access Rules (Northern Ireland) 2016 (S.R. (N.I.) 2016 No. 123)

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (S.I. 2017/692)

Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (S.I. 2017/694)

Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480)

National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018 (S.S.I. 2018/66)

National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 (S.S.I. 2018/67)

Introduction

General modifications

Specific modification of references to terms used in the Data Protection Act 1998

Definitions

Provision inserted in subordinate legislation by this Schedule

Interpretation

Right of access to personal data under the 1998 Act

Right to prevent processing likely to cause damage or distress under the 1998 Act

Right to prevent processing for purposes of direct marketing under the 1998 Act

Automated processing under the 1998 Act

Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations

Rectification, blocking, erasure and destruction under the 1998 Act

Jurisdiction and procedure under the 1998 Act

Exemptions under the 1998 Act

Prohibition by this Act of requirement to produce relevant records

Avoidance under this Act of certain contractual terms relating to health records

Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR

Manual unstructured data held by FOI public authorities

Logging

Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)

Maximum fee for data subject access requests to intelligence services

National security certificates: processing of personal data under the 1998 Act

National security certificates: processing of personal data under the 2018 Act

Appointment etc

Accounts

Annual report

Fees etc received by the Commissioner

Functions in connection with the Data Protection Convention

Co-operation with the European Commission: transfers of personal data outside the EEA

Charges payable to the Commissioner by controllers

Requests for assessment

Codes of practice

Interpretation of this Part

Information notices

Special information notices

Assessment notices

Enforcement notices

Determination by Commissioner as to the special purposes

Restriction on enforcement in case of processing for the special purposes

Offences

Powers of entry

Monetary penalties

Appeals

Exemptions

Tribunal Procedure Rules

Obstruction etc

Enforcement etc under the 2014 Regulations

Information notices

Powers of entry

Tribunal Procedure Rules

Powers to disclose information to the Commissioner

Codes etc required to be consistent with the Commissioner's data-sharing code

Consumer Credit Act 1974

Freedom of Information Act 2000

Freedom of Information (Scotland) Act 2002

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2450)

Health and Personal Social Services (Quality, Improvement and Regulation) (Northern Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))

Environmental Information Regulations 2004 (S.I. 2004/3391)

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

Editorial notes