Legalize / United Kingdom / Public General Act

Data Protection Act 2018

Type Public General Act

Publication 2018-05-23

Last updated 2026-04-07

State In force

Department Statute Law Database

Source legislation.gov.uk

articles 2

Reform history JSON API

(e) regulation 28 of the Adoption Agencies (Scotland) Regulations 2009 (S.S.I. 2009/154);

(f) regulation 3 of the Adoption (Disclosure of Information and Medical Information about Natural Parents) (Scotland) Regulations 2009 (S.S.I. 2009/268).

(4) The enactments extending to Northern Ireland are—

(a) Articles 50 and 54 of the Adoption (Northern Ireland) Order 1987 (S.I. 1987/2203 (N.I. 22));

(b) rule 53 of Order 84 of the Rules of the Court of Judicature (Northern Ireland) 1980 (S.R. (N.I.) 1980 No. 346);

(c) rules 4A.4(5), 4A.5(1), 4A.6(6), 4A.22(5) and 4C.7 of Part IVA of the Family Proceedings Rules (Northern Ireland) 1996 (S.R. (N.I.) 1996 No. 322).

Statements of special educational needs

4

(1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment listed in sub-paragraph (2).

(2) The enactments are—

(a) regulation 17 of the Special Educational Needs and Disability Regulations 2014 (S.I. 2014/1530);

(b) regulation 10 of the Additional Support for Learning (Co-ordinated Support Plan) (Scotland) Amendment Regulations 2005 (S.S.I. 2005/518);

(c) regulation 22 of the Education (Special Educational Needs) Regulations (Northern Ireland) 2005 (S.R. (N.I.) 2005 No. 384).

Parental order records and reports

5

(1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment listed in sub-paragraph (2), (3) or (4).

(2) The enactments extending to England and Wales are—

(a) sections 60, 77, 78 and 79 of the Adoption and Children Act 2002, as applied with modifications by regulation 2 of and Schedule 1 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 (S.I. 2010/985) in relation to parental orders made under—

(i) section 30 of the Human Fertilisation and Embryology Act 1990, or

(ii) section 54 of the Human Fertilisation and Embryology Act 2008;

(b) rules made under section 144 of the Magistrates' Courts Act 1980 by virtue of section 141(1) of the Adoption and Children Act 2002, as applied with modifications by regulation 2 of and Schedule 1 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010, so far as the rules relate to—

(i) the appointment and duties of the parental order reporter, and

(ii) the keeping of registers and the custody, inspection and disclosure of documents and information relating to parental order proceedings or related proceedings;

(c) rules made under section 75 of the Courts Act 2003 by virtue of section 141(1) of the Adoption and Children Act 2002, as applied with modifications by regulation 2 of Schedule 1 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 (S.I. 2010/985), so far as the rules relate to—

(i) the appointment and duties of the parental order reporter, and

(ii) the keeping of registers and the custody, inspection and disclosure of documents and information relating to parental order proceedings or related proceedings.

(3) The enactments extending to Scotland are—

(a) sections 53 and 55 of the Adoption and Children (Scotland) Act 2007 (asp 4), as applied with modifications by regulation 4 of and Schedule 3 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 (S.I. 2010/985) in relation to parental orders made under—

(i) section 30 of the Human Fertilisation and Embryology Act 1990, or

(ii) section 54 of the Human Fertilisation and Embryology Act 2008;

(b) rules 2.47 and 2.59 of the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));

(4) The enactments extending to Northern Ireland are—

(a) Articles 50 and 54 of the Adoption (Northern Ireland) Order 1987 (S.I. 1987/2203 (N.I. 22)), as applied with modifications by regulation 3 of and Schedule 2 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 in respect of parental orders made under—

(i) section 30 of the Human Fertilisation and Embryology Act 1990, or

(ii) section 54 of the Human Fertilisation and Embryology Act 2008;

(b) rules 4, 5 and 16 of Order 84A of the Rules of the Court of Judicature (Northern Ireland) 1980 (S.R. (N.I.) 1980 No. 346);

Information provided by Principal Reporter for children’s hearing

6

The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by any of the following enactments—

(a) section 178 of the Children's Hearings (Scotland) Act 2011 (asp 1);

(b) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).

SCHEDULE 5

Introduction

1

(1) This Schedule applies where—

(a) a person (“the applicant”) applies to an accreditation authority for accreditation as a certification provider, and

(b) is dissatisfied with the decision on that application.

(2) In this Schedule—

“accreditation authority” means—the Commissioner, orthe UK national accreditation body;

“certification provider” and “UK national accreditation body” have the same meaning as in section 17.

Review

2

(1) The applicant may ask the accreditation authority to review the decision.

(2) The request must be made in writing before the end of the period of 28 days beginning with the day on which the person receives written notice of the accreditation authority's decision.

(3) The request must specify—

(a) the decision to be reviewed, and

(b) the reasons for asking for the review.

(4) The request may be accompanied by additional documents which the applicant wants the accreditation authority to take into account for the purposes of the review.

(5) If the applicant makes a request in accordance with sub-paragraphs (1) to (4), the accreditation authority must—

(a) review the decision, and

(b) inform the applicant of the outcome of the review in writing before the end of the period of 28 days beginning with the day on which the request for a review is received.

Right to appeal

3

(1) If the applicant is dissatisfied with the decision on the review under paragraph 2, the applicant may ask the accreditation authority to refer the decision to an appeal panel constituted in accordance with paragraph 4.

(2) The request must be made in writing before the end of the period of 3 months beginning with the day on which the person receives written notice of the decision on the review.

(3) A request must specify—

(a) the decision to be referred to the appeal panel, and

(b) the reasons for asking for it to be referred.

(4) The request may be accompanied by additional documents which the applicant wants the appeal panel to take into account.

(5) The applicant may discontinue an appeal at any time by giving notice in writing to the accreditation authority.

Appeal panel

4

(1) If the applicant makes a request in accordance with paragraph 3, an appeal panel must be established in accordance with this paragraph.

(2) An appeal panel must consist of a chair and at least two other members.

(3) Where the request relates to a decision of the Commissioner—

(a) the Secretary of State may appoint one person to be a member of the appeal panel other than the chair, and

(b) subject to paragraph (a), the Commissioner must appoint the members of the appeal panel.

(4) Where the request relates to a decision of the UK national accreditation body—

(a) the Secretary of State—

(i) may appoint one person to be a member of the appeal panel other than the chair, or

(ii) may direct the Commissioner to appoint one person to be a member of the appeal panel other than the chair, and

(b) subject to paragraph (a), the chair of the UK national accreditation body must appoint the members of the appeal panel.

(5) A person may not be a member of an appeal panel if the person—

(a) has a commercial interest in the decision referred to the panel,

(b) has had any prior involvement in any matters relating to the decision, or

(6) The Commissioner may not be a member of an appeal panel to which a decision of the Commissioner is referred.

(7) The applicant may object to all or any of the members of the appeal panel appointed under sub-paragraph (3) or (4).

(8) If the applicant objects to a member of the appeal panel under sub-paragraph (7), the person who appointed that member must appoint a replacement.

(9) The applicant may not object to a member of the appeal panel appointed under sub-paragraph (8).

Hearing

5

(1) If the appeal panel considers it necessary, a hearing must be held at which both the applicant and the accreditation authority may be represented.

(2) Any additional documents which the applicant or the accreditation authority want the appeal panel to take into account must be submitted to the chair of the appeal panel at least 5 working days before the hearing.

(3) The appeal panel may allow experts and witnesses to give evidence at a hearing.

Decision following referral to appeal panel

6

(1) The appeal panel must, before the end of the period of 28 days beginning with the day on which the appeal panel is established in accordance with paragraph 4—

(a) make a reasoned recommendation in writing to the accreditation authority, and

(b) give a copy of the recommendation to the applicant.

(2) For the purposes of sub-paragraph (1), where there is an objection under paragraph 4(7), an appeal panel is not to be taken to be established in accordance with paragraph 4 until the replacement member is appointed (or, if there is more than one objection, until the last replacement member is appointed).

(3) The accreditation authority must, before the end of the period of 3 working days beginning with the day on which the authority receives the recommendation—

(a) make a reasoned final decision in writing, and

(b) give a copy of the decision to the applicant.

(4) Where the accreditation authority is the UK national accreditation body, the recommendation must be given to, and the final decision must be made by, the chief executive of that body.

Meaning of “working day”

7

In this Schedule, “working day” means any day other than—

(a) Saturday or Sunday,

(b) Christmas Day or Good Friday, or

SCHEDULE 6

Introductory

1

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

References to Union law and Member State law

3

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

References to the Union and to Member States

4

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

References to supervisory authorities

5

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

References to the national parliament

6

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

7

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

10

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

12

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

13

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

14

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

15

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

16

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

17

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

18

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

19

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

21

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

22

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

23

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

24

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

25

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

26

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

27

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

28

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

29

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

30

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

31

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

32

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

33

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

34

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

35

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

36

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

37

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

38

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

39

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

40

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

41

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

42

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

43

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

44

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

45

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

46

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

47

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

48

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

49

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

50

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

51

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

52

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

53

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

54

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

55

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

56

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

57

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

58

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

59

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

60

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

61

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

62

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

63

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

64

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

65

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

66

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

67

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

68

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

69

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

70

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

71

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

72

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

PART 2 — Modifications to Chapter 2 of Part 2

Introductory

73

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

General modifications

74

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Exemptions

75

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

SCHEDULE 7

1

Any United Kingdom government department other than a non-ministerial government department.

2

The Scottish Ministers.

3

Any Northern Ireland department.

4

The Welsh Ministers.

Chief officers of police and other policing bodies

5

The chief constable of a police force maintained under section 2 of the Police Act 1996.

6

The Commissioner of Police of the Metropolis.

7

The Commissioner of Police for the City of London.

8

The Chief Constable of the Police Service of Northern Ireland.

9

The chief constable of the Police Service of Scotland.

10

The chief constable of the British Transport Police.

11

The chief constable of the Civil Nuclear Constabulary.

12

The chief constable of the Ministry of Defence Police.

13

The Provost Marshal of the Royal Navy Police.

14

The Provost Marshal of the Royal Military Police.

15

The Provost Marshal of the Royal Air Force Police.

16

The chief officer of—

(a) a body of constables appointed under provision incorporating section 79 of the Harbours, Docks, and Piers Clauses Act 1847;

(b) a body of constables appointed under an order made under section 14 of the Harbours Act 1964;

17

A body established in accordance with a collaboration agreement under section 22A of the Police Act 1996.

18

The Director General of the Independent Office for Police Conduct.

19

The Police Investigations and Review Commissioner.

20

The Police Ombudsman for Northern Ireland.

Other authorities with investigatory functions

21

The Commissioners for Her Majesty's Revenue and Customs.

22

The Welsh Revenue Authority.

23

Revenue Scotland.

24

The Director General of the National Crime Agency.

25

The Director of the Serious Fraud Office.

26

The Director of Border Revenue.

27

The Financial Conduct Authority.

28

The Health and Safety Executive.

29

The Competition and Markets Authority.

30

The Gas and Electricity Markets Authority.

31

The Food Standards Agency.

32

Food Standards Scotland.

33

Her Majesty's Land Registry.

34

The Criminal Cases Review Commission.

35

The Scottish Criminal Cases Review Commission.

Authorities with functions relating to offender management

36

A provider of probation services (other than the Secretary of State), acting in pursuance of arrangements made under section 3(2) of the Offender Management Act 2007.

37

The Youth Justice Board for England and Wales.

38

The Parole Board for England and Wales.

39

The Parole Board for Scotland.

40

The Parole Commissioners for Northern Ireland.

41

The Probation Board for Northern Ireland.

42

The Prisoner Ombudsman for Northern Ireland.

43

A person who has entered into a contract for the running of, or part of—

(a) a prison or young offender institution under section 84 of the Criminal Justice Act 1991, or

(b) a secure training centre under section 7 of the Criminal Justice and Public Order Act 1994.

44

A person who has entered into a contract with the Secretary of State—

(a) under section 80 of the Criminal Justice Act 1991 for the purposes of prisoner escort arrangements, or

(b) under paragraph 1 of Schedule 1 to the Criminal Justice and Public Order Act 1994 for the purposes of escort arrangements.

45

A person who is, under or by virtue of any enactment, responsible for securing the electronic monitoring of an individual.

46

A youth offending team established under section 39 of the Crime and Disorder Act 1998.

Other authorities

47

The Director of Public Prosecutions.

48

The Director of Public Prosecutions for Northern Ireland.

49

The Lord Advocate.

50

A Procurator Fiscal.

51

The Director of Service Prosecutions.

52

The Information Commissioner.

53

The Scottish Information Commissioner.

54

The Scottish Courts and Tribunal Service.

55

The Crown agent.

56

A court or tribunal.

SCHEDULE 8

Statutory etc purposes

1

This condition is met if the processing—

(a) is necessary for the exercise of a function conferred on a person by an enactment or rule of law, and

(b) is necessary for reasons of substantial public interest.

Administration of justice

2

This condition is met if the processing is necessary for the administration of justice.

Protecting individual’s vital interests

3

This condition is met if the processing is necessary to protect the vital interests of the data subject or of another individual.

Safeguarding of children and of individuals at risk

4

(1) This condition is met if—

(a) the processing is necessary for the purposes of—

(i) protecting an individual from neglect or physical, mental or emotional harm, or

(ii) protecting the physical, mental or emotional well-being of an individual,

(b) the individual is—

(i) aged under 18, or

(ii) aged 18 or over and at risk,

(c) the processing is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and

(d) the processing is necessary for reasons of substantial public interest.

(2) The reasons mentioned in sub-paragraph (1)(c) are—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;

(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).

(3) For the purposes of this paragraph, an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—

(a) has needs for care and support,

(b) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and

(4) In sub-paragraph (1)(a), the reference to the protection of an individual or of the well-being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.

Personal data already in the public domain

5

This condition is met if the processing relates to personal data which is manifestly made public by the data subject.

Legal claims

6

This condition is met if the processing—

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

Judicial acts

7

This condition is met if the processing is necessary when a court or other judicial authority is acting in its judicial capacity.

Preventing fraud

8

(1) This condition is met if the processing—

(a) is necessary for the purposes of preventing fraud or a particular kind of fraud, and

(b) consists of—

(i) the disclosure of personal data by a competent authority as a member of an anti-fraud organisation,

(ii) the disclosure of personal data by a competent authority in accordance with arrangements made by an anti-fraud organisation,

(iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii), or

(iii) the processing of personal data disclosed as described in sub-paragraph (i) or (ii).

(2) In this paragraph, “anti-fraud organisation” has the same meaning as in section 68 of the Serious Crime Act 2007.

Archiving etc

9

This condition is met if the processing is necessary—

(a) for archiving purposes in the public interest,

(b) for scientific or historical research purposes, or

SCHEDULE 9

1

The data subject has given consent to the processing.

2

The processing is necessary—

(a) for the performance of a contract to which the data subject is a party, or

(b) in order to take steps at the request of the data subject prior to entering into a contract.

3

The processing is necessary for compliance with a legal obligation to which the controller is subject, other than an obligation imposed by contract.

4

The processing is necessary in order to protect the vital interests of the data subject or of another individual.

5

The processing is necessary—

(a) for the administration of justice,

(b) for the exercise of any functions of either House of Parliament,

(d) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or

(e) for the exercise of any other functions of a public nature exercised in the public interest by a person.

6

(1) The processing is necessary for the purposes of legitimate interests pursued by—

(a) the controller, or

(b) the third party or parties to whom the data is disclosed.

(2) Sub-paragraph (1) does not apply where the processing is unwarranted in any particular case because of prejudice to the rights and freedoms or legitimate interests of the data subject.

(3) In this paragraph, “third party”, in relation to personal data, means a person other than the data subject, the controller or a processor or other person authorised to process personal data for the controller or processor.

SCHEDULE 10

1

The data subject has given consent to the processing.

Right or obligation relating to employment

2

The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by an enactment or rule of law on the controller in connection with employment.

Vital interests of a person

3

The processing is necessary—

(a) in order to protect the vital interests of the data subject or of another person, in a case where—

(i) consent cannot be given by or on behalf of the data subject, or

(ii) the controller cannot reasonably be expected to obtain the consent of the data subject, or

(b) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.

Safeguarding of children and of individuals at risk

4

(1) This condition is met if—

(a) the processing is necessary for the purposes of—

(i) protecting an individual from neglect or physical, mental or emotional harm, or

(ii) protecting the physical, mental or emotional well-being of an individual,

(b) the individual is—

(i) aged under 18, or

(ii) aged 18 or over and at risk,

(c) the processing is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and

(d) the processing is necessary for reasons of substantial public interest.

(2) The reasons mentioned in sub-paragraph (1)(c) are—

(a) in the circumstances, consent to the processing cannot be given by the data subject;

(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;

(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).

(3) For the purposes of this paragraph, an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—

(a) has needs for care and support,

(b) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and

(4) In sub-paragraph (1)(a), the reference to the protection of an individual or of the well-being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.

Data already published by data subject

5

The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

Legal proceedings etc

6

The processing—

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

Administration of justice, parliamentary, statutory etc and government purposes

7

The processing is necessary—

(a) for the administration of justice,

(b) for the exercise of any functions of either House of Parliament,

(d) for the exercise of any functions of the Crown, a Minister of the Crown or a government department.

Medical purposes

8

(1) The processing is necessary for medical purposes and is undertaken by—

(a) a health professional, or

(b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.

(2) In this paragraph, “medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.

Equality

9

(1) The processing—

(a) is of sensitive personal data consisting of information as to racial or ethnic origin,

(b) is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and

(2) In this paragraph, “sensitive personal data” means personal data the processing of which constitutes sensitive processing (see section 86(7)).

SCHEDULE 11

Preliminary

1

In this Schedule, “the listed provisions” means—

(a) Chapter 2 of Part 4 (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and 10;

(b) Chapter 3 of Part 4 (rights of data subjects);

Crime

2

The listed provisions do not apply to personal data processed for any of the following purposes—

(a) the prevention , investigation and detection of crime, or

(b) the apprehension and prosecution of offenders,

to the extent that the application of the listed provisions would be likely to prejudice any of the matters mentioned in paragraph (a) or (b).

Information required to be disclosed by law etc or in connection with legal proceedings

3

(1) The listed provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of the listed provisions would prevent the controller from complying with that obligation.

(2) The listed provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or the order of a court, to the extent that the application of the listed provisions would prevent the controller from making the disclosure.

(3) The listed provisions do not apply to personal data where disclosure of the data—

(a) is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

to the extent that the application of the listed provisions would prevent the controller from making the disclosure.

Parliamentary privilege

4

The listed provisions do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.

Judicial proceedings

5

The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice judicial proceedings.

Crown honours and dignities

6

The listed provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity.

Armed forces

7

The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice the combat effectiveness of any of the armed forces of the Crown.

Economic well-being

8

The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice the economic well-being of the United Kingdom.

Legal professional privilege

9

The listed provisions do not apply to personal data that consists of—

(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications, could be maintained in legal proceedings, or

(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.

Negotiations

10

The listed provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the data subject to the extent that the application of the listed provisions would be likely to prejudice the negotiations.

Confidential references given by the controller

11

The listed provisions do not apply to personal data consisting of a reference given (or to be given) in confidence by the controller for the purposes of—

(a) the education, training or employment (or prospective education, training or employment) of the data subject,

(b) the appointment (or prospective appointment) of the data subject to any office, or

Exam scripts and marks

12

(1) The listed provisions do not apply to personal data consisting of information recorded by candidates during an exam.

(2) Where personal data consists of marks or other information processed by a controller—

(a) for the purposes of determining the results of an exam, or

(b) in consequence of the determination of the results of an exam,

section 94 has effect subject to sub-paragraph (3).

(3) Where the relevant time falls before the results of the exam are announced, the period mentioned in section 94(10)(b) is extended until the earlier of—

(a) the end of the period of 5 months beginning with the relevant time, and

(b) the end of the period of 40 days beginning with the announcement of the results.

(4) In this paragraph—

“exam” means an academic, professional or other examination used for determining the knowledge, intelligence, skill or ability of a candidate and may include an exam consisting of an assessment of the candidate's performance while undertaking work or any other activity;

“the relevant time” has the same meaning as in section 94.

(5) For the purposes of this paragraph, the results of an exam are treated as announced when they are first published or, if not published, first communicated to the candidate.

Research and statistics

13

(1) The listed provisions do not apply to personal data processed for—

(a) scientific or historical research purposes, or

(b) statistical purposes,

to the extent that the application of those provisions would prevent or seriously impair the achievement of the purposes in question.

(2) The exemption in sub-paragraph (1) is available only where—

(a) the personal data is processed subject to appropriate safeguards for the rights and freedoms of data subjects, and

(b) the results of the research or any resulting statistics are not made available in a form which identifies a data subject.

Archiving in the public interest

14

(1) The listed provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of those provisions would prevent or seriously impair the achievement of those purposes.

(2) The exemption in sub-paragraph (1) is available only where the personal data is processed subject to appropriate safeguards for the rights and freedoms of data subjects.

SCHEDULE 12

Status and capacity

1

(1) The Commissioner is to continue to be a corporation sole.

(2) The Commissioner and the Commissioner's officers and staff are not to be regarded as servants or agents of the Crown.

Appointment

2

(1) The Commissioner is to be appointed by Her Majesty by Letters Patent.

(2) No recommendation may be made to Her Majesty for the appointment of a person as the Commissioner unless the person concerned has been selected on merit on the basis of fair and open competition.

(3) The Commissioner is to hold office for such term not exceeding 7 years as may be determined at the time of the Commissioner's appointment, subject to paragraph 3.

(4) A person cannot be appointed as the Commissioner more than once.

Resignation and removal

3

(1) The Commissioner may be relieved of office by Her Majesty at the Commissioner's own request.

(2) The Commissioner may be removed from office by Her Majesty on an Address from both Houses of Parliament.

(3) No motion is to be made in either House of Parliament for such an Address unless a Minister of the Crown has presented a report to that House stating that the Minister is satisfied that one or both of the following grounds is made out—

(a) the Commissioner is guilty of serious misconduct;

(b) the Commissioner no longer fulfils the conditions required for the performance of the Commissioner's functions.

Salary etc

4

(1) The Commissioner is to be paid such salary as may be specified by a resolution of the House of Commons.

(2) There is to be paid in respect of the Commissioner such pension as may be specified by a resolution of the House of Commons.

(3) A resolution for the purposes of this paragraph may—

(a) specify the salary or pension,

(b) specify the salary or pension and provide for it to be increased by reference to such variables as may be specified in the resolution, or

(c) provide that the salary or pension is to be the same as, or calculated on the same basis as, that payable to, or in respect of, a person employed in a specified office under, or in a specified capacity in the service of, the Crown.

(4) A resolution for the purposes of this paragraph may take effect from—

(a) the date on which it is passed, or

(b) from an earlier date or later date specified in the resolution.

(5) A resolution for the purposes of this paragraph may make different provision in relation to the pension payable to, or in respect of, different holders of the office of Commissioner.

(6) A salary or pension payable under this paragraph is to be charged on and issued out of the Consolidated Fund.

(7) In this paragraph, “pension” includes an allowance or gratuity and a reference to the payment of a pension includes a reference to the making of payments towards the provision of a pension.

Officers and staff

5

(1) The Commissioner—

(a) must appoint one or more deputy commissioners, and

(b) may appoint other officers and staff.

(2) The Commissioner is to determine the remuneration and other conditions of service of people appointed under this paragraph.

(3) The Commissioner may pay pensions, allowances or gratuities to, or in respect of, people appointed under this paragraph, including pensions, allowances or gratuities paid by way of compensation in respect of loss of office or employment.

(4) The references in sub-paragraph (3) to paying pensions, allowances or gratuities includes making payments towards the provision of pensions, allowances or gratuities.

(5) In making appointments under this paragraph, the Commissioner must have regard to the principle of selection on merit on the basis of fair and open competition.

(6) The Employers' Liability (Compulsory Insurance) Act 1969 does not require insurance to be effected by the Commissioner.

Carrying out of the Commissioner’s functions by officers and staff

6

(1) The functions of the Commissioner are to be carried out by the deputy commissioner or deputy commissioners if—

(a) there is a vacancy in the office of the Commissioner, or

(b) the Commissioner is for any reason unable to act.

(2) When the Commissioner appoints a second or subsequent deputy commissioner, the Commissioner must specify which deputy commissioner is to carry out which of the Commissioner's functions in the circumstances referred to in sub-paragraph (1).

(3) A function of the Commissioner may, to the extent authorised by the Commissioner, be carried out by any of the Commissioner's officers or staff.

Authentication of the seal of the Commissioner

7

The application of the seal of the Commissioner is to be authenticated by—

(a) the Commissioner's signature, or

(b) the signature of another person authorised for the purpose.

Presumption of authenticity of documents issued by the Commissioner

8

A document purporting to be an instrument issued by the Commissioner and to be—

(a) duly executed under the Commissioner's seal, or

(b) signed by or on behalf of the Commissioner,

is to be received in evidence and is to be deemed to be such an instrument unless the contrary is shown.

Money

9

The Secretary of State may make payments to the Commissioner out of money provided by Parliament.

Fees etc and other sums

10

(1) All fees, charges, penalties and other sums received by the Commissioner in carrying out the Commissioner's functions are to be paid by the Commissioner to the Secretary of State.

(2) Sub-paragraph (1) does not apply where the Secretary of State, with the consent of the Treasury, otherwise directs.

(3) Any sums received by the Secretary of State under sub-paragraph (1) are to be paid into the Consolidated Fund.

Accounts

11

(1) The Commissioner must—

(a) keep proper accounts and other records in relation to the accounts, and

(b) prepare in respect of each financial year a statement of account in such form as the Secretary of State may direct.

(2) The Commissioner must send a copy of the statement to the Comptroller and Auditor General—

(a) on or before 31 August next following the end of the year to which the statement relates, or

(b) on or before such earlier date after the end of that year as the Treasury may direct.

(3) The Comptroller and Auditor General must examine, certify and report on the statement.

(4) The Commissioner must arrange for copies of the statement and the Comptroller and Auditor General's report to be laid before Parliament.

(5) In this paragraph, “financial year” means a period of 12 months beginning with 1 April.

Scotland

12

Paragraphs 1(1), 7 and 8 do not extend to Scotland.

SCHEDULE 13

General tasks

1

(1) The Commissioner must—

(a) monitor and enforce Parts 3 and 4 of this Act;

(b) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing of personal data to which those Parts apply;

(c) advise Parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of individuals' rights and freedoms with regard to processing of personal data to which those Parts apply;

(d) promote the awareness of controllers and processors of their obligations under Parts 3 and 4 of this Act;

(e) on request, provide information to a data subject concerning the exercise of the data subject's rights under Parts 3 and 4 of this Act and, if appropriate, co-operate with ... foreign designated authorities to provide such information;

(f) co-operate with ... foreign designated authorities with a view to ensuring the consistency of application and enforcement of ... the Data Protection Convention, including by sharing information and providing mutual assistance;

(g) conduct investigations on the application of Parts 3 and 4 of this Act, including on the basis of information received from ... a foreign designated authority or another public authority;

(h) monitor relevant developments to the extent that they have an impact on the protection of personal data, including the development of information and communication technologies;

(i) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) Section 3(14)(c) does not apply to the reference to personal data in sub-paragraph (1)(h).

General powers

2

The Commissioner has the following investigative, corrective, authorisation and advisory powers in relation to processing of personal data to which Part 3 or 4 of this Act applies—

(a) to notify the controller or the processor of an alleged infringement of Part 3 or 4 of this Act;

(b) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of Part 3 or 4 of this Act;

(c) to issue reprimands to a controller or processor where processing operations have infringed provisions of Part 3 or 4 of this Act;

(d) to issue, on the Commissioner's own initiative or on request, opinions to Parliament, the government or other institutions and bodies as well as to the public on any issue related to the protection of personal data.

Definitions

3

In this Schedule—

“foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;

SCHEDULE 14

PART 1 — Law Enforcement Directive

Co-operation

1

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Requests for information and assistance from LED supervisory authorities

2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Fees

3

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Restrictions on use of information

4

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

LED supervisory authority

5

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

PART 2 — Data Protection Convention

Co-operation between the Commissioner and foreign designated authorities

6

(1) The Commissioner must, at the request of a foreign designated authority—

(a) provide that authority with such information referred to in Article 13(3)(a) of the Data Protection Convention (information on law and administrative practice in the field of data protection) as is the subject of the request, and

(b) take appropriate measures in accordance with Article 13(3)(b) of the Data Protection Convention for providing that authority with information relating to the processing of personal data in the United Kingdom.

(2) The Commissioner may ask a foreign designated authority—

(a) to provide the Commissioner with information referred to in Article 13(3) of the Data Protection Convention, or

(b) to take appropriate measures to provide such information.

Assisting persons resident outside the UK with requests under Article 14 of the Convention

7

(1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in the United Kingdom is made by a person resident outside the United Kingdom, including where the request is forwarded to the Commissioner through the Secretary of State or a foreign designated authority.

(2) The Commissioner must take appropriate measures to assist the person to exercise those rights.

Assisting UK residents with requests under Article 8 of the Convention

8

(1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in a country or territory (other than the United Kingdom) specified in the request is—

(a) made by a person resident in the United Kingdom, and

(b) submitted through the Commissioner under Article 14(2) of the Convention.

(2) If the Commissioner is satisfied that the request contains all necessary particulars referred to in Article 14(3) of the Data Protection Convention, the Commissioner must send the request to the foreign designated authority in the specified country or territory.

(3) Otherwise, the Commissioner must, where practicable, notify the person making the request of the reasons why the Commissioner is not required to assist.

Restrictions on use of information

9

Where the Commissioner receives information from a foreign designated authority as a result of—

(a) a request made by the Commissioner under paragraph 6(2), or

(b) a request received by the Commissioner under paragraph 6(1) or 7,

the Commissioner may use the information only for the purposes specified in the request.

Foreign designated authority

10

In this Part of this Schedule, “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Data Protection Convention.

SCHEDULE 15

Issue of warrants in connection with non-compliance and offences

1

(1) This paragraph applies if a judge of the High Court, a circuit judge or a District Judge (Magistrates' Courts) is satisfied by information on oath supplied by the Commissioner that—

(a) there are reasonable grounds for suspecting that—

(i) a controller or processor has failed or is failing as described in section 149(2), or

(ii) an offence under this Act has been or is being committed, and

(b) there are reasonable grounds for suspecting that evidence of the failure or of the commission of the offence is to be found on premises specified in the information or is capable of being viewed using equipment on such premises.

(2) The judge may grant a warrant to the Commissioner.

Issue of warrants in connection with assessment notices

2

(1) This paragraph applies if a judge of the High Court, a circuit judge or a District Judge (Magistrates' Courts) is satisfied by information on oath supplied by the Commissioner that a controller or processor has failed to comply with a requirement imposed by an assessment notice.

(2) The judge may, for the purpose of enabling the Commissioner to determine whether the controller or processor has complied or is complying with the data protection legislation, grant a warrant to the Commissioner in relation to premises that were specified in the assessment notice.

Restrictions on issuing warrants: processing for the special purposes

3

A judge must not issue a warrant under this Schedule in respect of personal data processed for the special purposes unless a determination under section 174 with respect to the data or the processing has taken effect.

Restrictions on issuing warrants: procedural requirements

4

(1) A judge must not issue a warrant under this Schedule unless satisfied that—

(a) the conditions in sub-paragraphs (2) to (4) are met,

(b) compliance with those conditions would defeat the object of entry to the premises in question, or

(2) The first condition is that the Commissioner has given 7 days' notice in writing to the occupier of the premises in question demanding access to the premises.

(3) The second condition is that—

(a) access to the premises was demanded at a reasonable hour and was unreasonably refused, or

(b) entry to the premises was granted but the occupier unreasonably refused to comply with a request by the Commissioner or the Commissioner's officers or staff to be allowed to do any of the things referred to in paragraph 5.

(4) The third condition is that, since the refusal, the occupier of the premises—

(a) has been notified by the Commissioner of the application for the warrant, and

(b) has had an opportunity to be heard by the judge on the question of whether or not the warrant should be issued.

(5) In determining whether the first condition is met, an assessment notice given to the occupier is to be disregarded.

Content of warrants

5

(1) A warrant issued under this Schedule must authorise the Commissioner or any of the Commissioner's officers or staff—

(a) to enter the premises,

(b) to search the premises, and

(c) to inspect, examine, operate and test any equipment found on the premises which is used or intended to be used for the processing of personal data.

(2) A warrant issued under paragraph 1 must authorise the Commissioner or any of the Commissioner's officers or staff—

(a) to inspect and seize any documents or other material found on the premises which may be evidence of the failure or offence mentioned in that paragraph,

(b) to require any person on the premises to provide, in an appropriate form, a copy of information capable of being viewed using equipment on the premises which may be evidence of that failure or offence,

(c) to require any person on the premises to provide an explanation of any document or other material found on the premises and of any information capable of being viewed using equipment on the premises, and

(d) to require any person on the premises to provide such other information as may reasonably be required for the purpose of determining whether the controller or processor has failed or is failing as described in section 149(2).

(3) A warrant issued under paragraph 2 must authorise the Commissioner or any of the Commissioner's officers or staff—

(a) to inspect and seize any documents or other material found on the premises which may enable the Commissioner to determine whether the controller or processor has complied or is complying with the data protection legislation,

(b) to require any person on the premises to provide, in an appropriate form, a copy of information capable of being viewed using equipment on the premises which may enable the Commissioner to make such a determination,

(c) to require any person on the premises to provide an explanation of any document or other material found on the premises and of any information capable of being viewed using equipment on the premises, and

(d) to require any person on the premises to provide such other information as may reasonably be required for the purpose of determining whether the controller or processor has complied or is complying with the data protection legislation.

(4) A warrant issued under this Schedule must authorise the Commissioner or any of the Commissioner's officers or staff to do the things described in sub-paragraphs (1) to (3) at any time in the period of 7 days beginning with the day on which the warrant is issued.

(5) For the purposes of this paragraph, a copy of information is in an “appropriate form” if —

(a) it can be taken away, and

(b) it is visible and legible or it can readily be made visible and legible.

Copies of warrants

6

A judge who issues a warrant under this Schedule must—

(a) issue two copies of it, and

(b) certify them clearly as copies.

Execution of warrants: reasonable force

7

A person executing a warrant issued under this Schedule may use such reasonable force as may be necessary.

Execution of warrants: time when executed

8

A warrant issued under this Schedule may be executed only at a reasonable hour, unless it appears to the person executing it that there are grounds for suspecting that exercising it at a reasonable hour would defeat the object of the warrant.

Execution of warrants: occupier of premises

9

(1) If an occupier of the premises in respect of which a warrant is issued under this Schedule is present when the warrant is executed, the person executing the warrant must—

(a) show the occupier the warrant, and

(b) give the occupier a copy of it.

(2) Otherwise, a copy of the warrant must be left in a prominent place on the premises.

Execution of warrants: seizure of documents etc

10

(1) This paragraph applies where a person executing a warrant under this Schedule seizes something.

(2) The person must, on request—

(a) give a receipt for it, and

(b) give an occupier of the premises a copy of it.

(3) Sub-paragraph (2)(b) does not apply if the person executing the warrant considers that providing a copy would result in undue delay.

(4) Anything seized may be retained for so long as is necessary in all the circumstances.

Matters exempt from inspection and seizure: privileged communications

11

(1) The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable in respect of a communication which is made—

(a) between a professional legal adviser and the adviser's client, and

(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.

(2) The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable in respect of a communication which is made—

(a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,

(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and

(3) Sub-paragraphs (1) and (2) do not prevent the exercise of powers conferred by a warrant issued under this Schedule in respect of—

(a) anything in the possession of a person other than the professional legal adviser or the adviser's client, or

(b) anything held with the intention of furthering a criminal purpose.

(4) The references to a communication in sub-paragraphs (1) and (2) include—

(a) a copy or other record of the communication, and

(b) anything enclosed with or referred to in the communication if made as described in sub-paragraph (1)(b) or in sub-paragraph (2)(b) and (c).

(5) In sub-paragraphs (1) to (3), the references to the client of a professional legal adviser include a person acting on behalf of such a client.

Matters exempt from inspection and seizure: Parliamentary privilege

12

The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable where their exercise would involve an infringement of the privileges of either House of Parliament.

Partially exempt material

13

(1) This paragraph applies if a person in occupation of premises in respect of which a warrant is issued under this Schedule objects to the inspection or seizure of any material under the warrant on the grounds that it consists partly of matters in respect of which those powers are not exercisable.

(2) The person must, if the person executing the warrant so requests, provide that person with a copy of so much of the material as is not exempt from those powers.

Return of warrants

14

(1) Where a warrant issued under this Schedule is executed—

(a) it must be returned to the court from which it was issued after being executed, and

(b) the person by whom it is executed must write on the warrant a statement of the powers that have been exercised under the warrant.

(2) Where a warrant issued under this Schedule is not executed, it must be returned to the court from which it was issued within the time authorised for its execution.

Offences

15

(1) It is an offence for a person—

(a) intentionally to obstruct a person in the execution of a warrant issued under this Schedule, or

(b) to fail without reasonable excuse to give a person executing such a warrant such assistance as the person may reasonably require for the execution of the warrant.

(2) It is an offence for a person—

(a) to make a statement in response to a requirement under paragraph 5(2)(c) or (d) or (3)(c) or (d) which the person knows to be false in a material respect, or

(b) recklessly to make a statement in response to such a requirement which is false in a material respect.

Self-incrimination

16

(1) An explanation given, or information provided, by a person in response to a requirement under paragraph 5(2)(c) or (d) or (3)(c) or (d) may only be used in evidence against that person—

(a) on a prosecution for an offence under a provision listed in sub-paragraph (2), or

(b) on a prosecution for any other offence where—

(i) in giving evidence that person makes a statement inconsistent with that explanation or information, and

(ii) evidence relating to that explanation or information is adduced, or a question relating to it is asked, by that person or on that person's behalf.

(2) Those provisions are—

(a) paragraph 15,

(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath),

(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath), or

(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

Vessels, vehicles etc

17

In this Schedule—

(a) “premises” includes a vehicle, vessel or other means of transport, and

(b) references to the occupier of premises include the person in charge of a vehicle, vessel or other means of transport.

Scotland

18

In the application of this Schedule to Scotland—

(a) references to a judge of the High Court have effect as if they were references to a judge of the Court of Session,

(b) references to a circuit judge have effect as if they were references to the sheriff or the summary sheriff,

(d) references to the court from which the warrant was issued have effect as if they were references to the sheriff clerk.

Northern Ireland

19

In the application of this Schedule to Northern Ireland—

(a) references to a circuit judge have effect as if they were references to a county court judge, and

(b) references to information on oath have effect as if they were references to a complaint on oath.

SCHEDULE 16

Meaning of “penalty”

1

In this Schedule, “penalty” means a penalty imposed by a penalty notice.

Notice of intent to impose penalty

2

(1) Before giving a person a penalty notice, the Commissioner must, by written notice (a “notice of intent”) inform the person that the Commissioner intends to give a penalty notice.

(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Contents of notice of intent

3

(1) A notice of intent must contain the following information—

(a) the name and address of the person to whom the Commissioner proposes to give a penalty notice;

(b) the reasons why the Commissioner proposes to give a penalty notice (see sub-paragraph (2));

(c) an indication of the amount of the penalty the Commissioner proposes to impose, including any aggravating or mitigating factors that the Commissioner proposes to take into account.

(2) The information required under sub-paragraph (1)(b) includes—

(a) a description of the circumstances of the failure, and

(b) where the notice is given in respect of a failure described in section 149(2), the nature of the personal data involved in the failure.

(3) A notice of intent must also—

(a) state that the person may make written representations about the Commissioner's intention to give a penalty notice, and

(b) specify the period within which such representations may be made.

(4) The period specified for making written representations must be a period of not less than 21 days beginning when the notice of intent is given.

(5) If the Commissioner considers that it is appropriate for the person to have an opportunity to make oral representations about the Commissioner's intention to give a penalty notice, the notice of intent must also—

(a) state that the person may make such representations, and

(b) specify the arrangements for making such representations and the time at which, or the period within which, they may be made.

Giving a penalty notice

4

(A1) This paragraph applies where the Commissioner gives a notice of intent to a person.

(A2) Within the period of 6 months beginning when the notice is given, or as soon as reasonably practicable thereafter, the Commission must give to the person—

(a) a penalty notice, or

(b) written notice that the Commissioner has decided not to give a penalty notice to the person.

(1) But the Commissioner may not give a penalty notice to the person before a time, or before the end of a period, specified in the notice of intent for making oral or written representations.

(2) When deciding whether to give a penalty notice to the person and determining the amount of the penalty, the Commissioner must consider any oral or written representations made by the person in accordance with the notice of intent.

Contents of penalty notice

5

(1) A penalty notice must contain the following information—

(a) the name and address of the person to whom it is addressed;

(b) details of the notice of intent given to the person;

(d) the reasons why the Commissioner proposes to impose the penalty (see sub-paragraph (2));

(e) the reasons for the amount of the penalty, including any aggravating or mitigating factors that the Commissioner has taken into account;

(f) details of how the penalty is to be paid;

(g) details of the rights of appeal under section 162;

(h) details of the Commissioner's enforcement powers under this Schedule.

(2) The information required under sub-paragraph (1)(d) includes—

(a) a description of the circumstances of the failure, and

(b) where the notice is given in respect of a failure described in section 149(2), the nature of the personal data involved in the failure.

Period for payment of penalty

6

(1) A penalty must be paid to the Commissioner within the period specified in the penalty notice.

(2) The period specified must be a period of not less than 28 days beginning when the penalty notice is given.

Variation of penalty

7

(1) The Commissioner may vary a penalty notice by giving written notice (a “penalty variation notice”) to the person to whom it was given.

(2) A penalty variation notice must specify—

(a) the penalty notice concerned, and

(b) how it is varied.

(3) A penalty variation notice may not—

(a) reduce the period for payment of the penalty;

(b) increase the amount of the penalty;

(4) If—

(a) a penalty variation notice reduces the amount of the penalty, and

(b) when that notice is given, an amount has already been paid that exceeds the amount of the reduced penalty,

the Commissioner must repay the excess.

Cancellation of penalty

8

(1) The Commissioner may cancel a penalty notice by giving written notice to the person to whom it was given.

(2) If a penalty notice is cancelled, the Commissioner—

(a) may not take any further action under section 155 or this Schedule in relation to the failure to which that notice relates, and

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.

Data Protection Act 2018

Statements of special educational needs

4

Parental order records and reports

5

Information provided by Principal Reporter for children’s hearing

6

SCHEDULE 5

Introduction

1

Review

2

Right to appeal

3

Appeal panel

4

Hearing

5

Decision following referral to appeal panel

6

Meaning of “working day”

7

SCHEDULE 6

PART 1 — Modifications to the GDPR

Introductory

1

References to the GDPR and its provisions

2

References to Union law and Member State law

3

References to the Union and to Member States

4

References to supervisory authorities

5

References to the national parliament

6

Chapter I of the GDPR (general provisions)

7

8

9

Chapter II of the GDPR (principles)

10

11

12

13

Section 1 of Chapter III of the GDPR (rights of the data subject: transparency and modalities)

14

Section 2 of Chapter III of the GDPR (rights of the data subject: information and access to personal data)

15

16

Section 3 of Chapter III of the GDPR (rights of the data subject: rectification and erasure)

17

18

Section 4 of Chapter III of the GDPR (rights of the data subject: right to object and automated individual decision-making)

19

20

Section 5 of Chapter III of the GDPR (rights of the data subject: restrictions)

21

Section 1 of Chapter IV of the GDPR (controller and processor: general obligations)

22

23

24

25

26

Section 3 of Chapter IV of the GDPR (controller and processor: data protection impact assessment and prior consultation)

27

28

Section 4 of Chapter IV of the GDPR (controller and processor: data protection officer)

29

30

Section 5 of Chapter IV of the GDPR (controller and processor: codes of conduct and certification)

31

32

33

34

Chapter V of the GDPR (transfers of data to third countries or international organisations)

35

36

37

38