Data Protection Act 2018

In section 20A(5) of the Health and Social Care Act 2008 (functions relating to processing of information by registered persons), in the definition of “processing”, for “the Data Protection Act 1998” substitute “ Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act); ”.

Counter-Terrorism Act 2008 (c. 28)

154

• (1) Section 20 of the Counter-Terrorism Act 2008 (disclosure and the intelligence services: supplementary provisions) is amended as follows.

• (2) In subsection (2)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

• (3) After subsection (4) insert—

(5) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Public Health etc. (Scotland) Act 2008 (asp 5)

155

• (1) Section 117 of the Public Health etc. (Scotland) Act 2008 (disclosure of information) is amended as follows.

• (2) In subsection (6), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

• (3) After subsection (7) insert—

(7A) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Banking Act 2009 (c. 1)

156

• (1) Section 83ZY of the Banking Act 2009 (special resolution regime: publication of notices etc) is amended as follows.

• (2) In subsection (10), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) In subsection (11), after “section” insert

— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

.

Borders, Citizenship and Immigration Act 2009 (c. 11)

157

• (1) Section 19 of the Borders, Citizenship and Immigration Act 2009 (use and disclosure of customs information: application of statutory provisions) is amended as follows.

• (2) In subsection (1)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

• (3) After subsection (4) insert—

(5) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Marine and Coastal Access Act 2009 (c. 23)

158

The Marine and Coastal Access Act 2009 is amended as follows.

159

• (1) Paragraph 13 of Schedule 7 (further provision about civil sanctions under Part 4: disclosure of information) is amended as follows.

• (2) In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

• (3) After sub-paragraph (6) insert—

(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

160

• (1) Paragraph 9 of Schedule 10 (further provision about fixed monetary penalties: disclosure of information) is amended as follows.

• (2) In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

• (3) After sub-paragraph (6) insert—

(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Coroners and Justice Act 2009 (c. 25)

161

In Schedule 21 to the Coroners and Justice Act 2009 (minor and consequential amendments), omit paragraph 29(3).

Broads Authority Act 2009 (c. i)

162

• (1) Section 38 of the Broads Authority Act 2009 (provision of information) is amended as follows.

• (2) In subsection (3), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

• (3) In subsection (6), after “section” insert

— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

.

Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.))

163

• (1) Section 13 of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (functions of the Regional Agency) is amended as follows.

• (2) In subsection (8), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

• (3) After subsection (8) insert—

(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Terrorist Asset-Freezing etc. Act 2010 (c. 38)

164

• (1) Section 25 of the Terrorist Asset-Freezing etc. Act 2010 (application of provisions) is amended as follows.

• (2) In subsection (2)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) In subsection (6), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

.

Marine (Scotland) Act 2010 (asp 5)

165

• (1) Paragraph 12 of Schedule 2 to the Marine (Scotland) Act 2010 (further provision about civil sanctions under Part 4: disclosure of information) is amended as follows.

• (2) In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

• (3) After sub-paragraph (6) insert—

(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Charities Act 2011 (c. 25)

166

• (1) Section 59 of the Charities Act 2011 (disclosure: supplementary) is amended as follows.

• (2) The existing text becomes subsection (1).

• (3) In that subsection, in paragraph (a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (4) After that subsection insert—

(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Welsh Language (Wales) Measure 2011 (nawm 1)

167

The Welsh Language (Wales) Measure 2011 is amended as follows.

168

• (1) Section 22 (power to disclose information) is amended as follows.

• (2) In subsection (4)—

• (a) in the English language text, for paragraph (a) substitute—

(a) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement);

, and

• (b) in the Welsh language text, for paragraph (a) substitute—

(a) adrannau 142 i 154, 160 i 164, neu 174 i 176 o Ddeddf Diogelu Data 2018 neu Atodlen 15 i'r Ddeddf honno (darpariaethau penodol yn ymwneud â gorfodi);

.

• (3) For subsection (5)—

• (a) in the English language text substitute—

(5) The offences referred to under subsection (3)(b) are those under— (a) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of exercise of warrant etc); or (b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

, and

• (b) in the Welsh language text substitute—

(5) Y tramgwyddau y cyfeirir atynt yn is-adran (3)(b) yw'r rhai— (a) o dan ddarpariaeth yn Neddf Diogelu Data 2018 ac eithrio paragraff 15 o Atodlen 15 (rhwystro gweithredu gwarant etc); neu (b) o dan adran 77 o Ddeddf Rhyddid Gwybodaeth 2000 (trosedd o altro etc cofnodion gyda'r bwriad o atal datgelu).

• (4) In subsection (8)—

• (a) in the English language text, for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

• (b) in the Welsh language text, for “gymhwyso Deddf Diogelu Data 1998” substitute “gymhwyso'r ddeddfwriaeth diogelu data”.

• (5) In subsection (9)—

• (a) at the appropriate place in the English language text insert—

“the data protection legislation” (“y ddeddfwriaeth diogelu data”) has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

, and

• (b) at the appropriate place in the Welsh language text insert—

“mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno);

.

169

• (1) Paragraph 8 of Schedule 2 (inquiries by the Commissioner: reports) is amended as follows.

• (2) In sub-paragraph (7)—

• (a) in the English language text, for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

• (b) in the Welsh language text, for “gymhwyso Deddf Diogelu Data 1998” substitute “gymhwyso'r ddeddfwriaeth diogelu data”.

• (3) In sub-paragraph (8)—

• (a) in the English language text, after “this paragraph” insert

— “the data protection legislation” (“y ddeddfwriaeth diogelu data”) has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

, and

• (b) in the Welsh language text, after “hwn” insert—

“mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno);

.

Safeguarding Board Act (Northern Ireland) 2011 (c. 7 (N.I))

170

• (1) Section 10 of the Safeguarding Board Act (Northern Ireland) 2011 (duty to co-operate) is amended as follows.

• (2) In subsection (3), for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”.

• (3) After subsection (3) insert—

(4) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Health and Social Care Act 2012 (c. 7)

171

The Health and Social Care Act 2012 is amended as follows.

172

In section 250(7) (power to publish information standards), for the definition of “processing” substitute—

“processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);

.

173

• (1) Section 251A (consistent identifiers) is amended as follows.

• (2) In subsection (7)(a), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.

• (3) After subsection (8) insert—

(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

174

• (1) Section 251B (duty to share information) is amended as follows.

• (2) In subsection (5)(a), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.

• (3) After subsection (6) insert—

(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Protection of Freedoms Act 2012 (c. 9)

175

The Protection of Freedoms Act 2012 is amended as follows.

176

• (1) Section 27 (exceptions and further provision about consent and notification) is amended as follows.

• (2) In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After subsection (5) insert—

(6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

177

In section 28(1) (interpretation: Chapter 2), for the definition of “processing” substitute—

“processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);

.

178

In section 29(7) (code of practice for surveillance camera systems), for the definition of “processing” substitute—

“processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act);

.

HGV Road User Levy Act 2013 (c. 7)

179

• (1) Section 14A of the HGV Road User Levy Act 2013 (disclosure of information by Revenue and Customs) is amended as follows.

• (2) In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After subsection (5) insert—

(6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Crime and Courts Act 2013 (c. 22)

180

The Crime and Courts Act 2013 is amended as follows.

181

• (1) Section 42 (other interpretive provisions) is amended as follows.

• (2) In subsection (5)(a), for “section 13 of the Data Protection Act 1998 (damage or distress suffered as a result of a contravention of a requirement of that Act)” substitute “ Article 82 of the GDPR or section 168 or 169 of the Data Protection Act 2018 (compensation for contravention of the data protection legislation) ”.

• (3) After subsection (5) insert—

(5A) In subsection (5)(a), “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

182

• (1) Paragraph 1 of Schedule 7 (statutory restrictions on disclosure) is amended as follows.

• (2) The existing text becomes sub-paragraph (1).

• (3) In that sub-paragraph, in paragraph (a)—

• (a) for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

• (b) for “are” substitute “ is ”.

• (4) After that sub-paragraph, insert—

(2) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Marine Act (Northern Ireland) 2013 (c. 10 (N.I.))

183

• (1) Paragraph 8 of Schedule 2 to the Marine Act (Northern Ireland) 2013 (further provision about fixed monetary penalties under section 35: disclosure of information) is amended as follows.

• (2) In sub-paragraph (5)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After sub-paragraph (6) insert—

(7) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Local Audit and Accountability Act 2014 (c. 2)

184

• (1) Paragraph 3 of Schedule 9 to the Local Audit and Accountability Act 2014 (data matching: voluntary provision of data) is amended as follows.

• (2) In sub-paragraph (3)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After sub-paragraph (3) insert—

(3A) “The data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

• (4) In sub-paragraph (4), for “comprise or include” substitute “ comprises or includes ”.

Anti-social Behaviour, Crime and Policing Act 2014 (c. 12)

185

• (1) Paragraph 7 of Schedule 4 to the Anti-social Behaviour, Crime and Policing Act 2014 (anti-social behaviour case reviews: information) is amended as follows.

• (2) In sub-paragraph (4)—

• (a) for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

• (b) for “are” substitute “ is ”.

• (3) After sub-paragraph (5) insert—

(6) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Immigration Act 2014 (c. 22)

186

• (1) Paragraph 6 of Schedule 6 to the Immigration Act 2014 (information: limitation on powers) is amended as follows.

• (2) The existing text becomes sub-paragraph (1).

• (3) In that sub-paragraph, in paragraph (a)—

• (a) for “the Data Protection Act 1998” substitute “ the data protection legislation ”, and

• (b) for “are” substitute “ is ”.

• (4) After that sub-paragraph insert—

(2) In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Care Act 2014 (c. 23)

187

In section 67(9) of the Care Act 2014 (involvement in assessment, plans etc), for paragraph (a) substitute—

(a) a health record (within the meaning given in section 205 of the Data Protection Act 2018),

.

Social Services and Well-being (Wales) Act 2014 (anaw 4)

188

In section 18(10)(b) of the Social Services and Well-being (Wales) Act 2014 (registers of sight-impaired, hearing-impaired and other disabled people)—

• (a) in the English language text, for “(within the meaning of the Data Protection Act 1998)” substitute “ (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act)) ”, and

• (b) in the Welsh language text, for “(o fewn ystyr “personal data” yn Neddf Diogelu Data 1998)” substitute “(o fewn ystyr “ personal data ” yn Rhan 5 i 7 o Ddeddf Diogelu Data 2018 (gweler adran 3(2) a (14) o'r Ddeddf honno))”.

Counter-Terrorism and Security Act 2015 (c. 6)

189

• (1) Section 38 of the Counter-Terrorism and Security Act 2015 (support etc for people vulnerable to being drawn into terrorism: co-operation) is amended as follows.

• (2) In subsection (4)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After subsection (4) insert—

(4A) “The data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Small Business, Enterprise and Employment Act 2015 (c. 26)

190

• (1) Section 6 of the Small Business, Enterprise and Employment Act 2015 (application of listed provisions to designated credit reference agencies) is amended as follows.

• (2) In subsection (7)—

• (a) for paragraph (b) substitute—

(b) Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers);

, and

• (b) omit paragraph (c).

• (3) After subsection (7) insert—

(7A) In subsection (7) “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

Modern Slavery Act 2015 (c. 30)

191

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 (c. 2 (N.I.))

192

The Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 is amended as follows.

193

In section 13(5) (duty to notify National Crime Agency about suspected victims of certain offences) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

194

In section 25(1) (interpretation of this Act), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

.

195

In paragraph 18(5) of Schedule 3 (supply of information to relevant Northern Ireland departments, Secretary of State, etc) for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Justice Act (Northern Ireland) 2015 (c. 9 (N.I.))

196

• (1) Section 72 of the Justice Act (Northern Ireland) 2015 (supply of information to relevant Northern Ireland departments or Secretary of State) is amended as follows.

• (2) In subsection (5), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) In subsection (7), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

.

Immigration Act 2016 (c. 19)

197

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Investigatory Powers Act 2016 (c. 25)

198

The Investigatory Powers Act 2016 is amended as follows.

199

In section 1(5)(b), for sub-paragraph (ii) substitute—

(ii) in section 170 of the Data Protection Act 2018 (unlawful obtaining etc of personal data),

.

200

In section 199 (bulk personal datasets: interpretation), for subsection (2) substitute—

(2) In this Part, “personal data” means— (a) personal data within the meaning of section 3(2) of the Data Protection Act 2018 which is subject to processing described in section 82(1) of that Act, and (b) data relating to a deceased individual where the data would fall within paragraph (a) if it related to a living individual.

201

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

202

In section 206 (additional safeguards for health records), for subsection (7) substitute—

(7) In subsection (6)— - “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204(1) of that Act); - “health service body” has meaning given by section 204(4) of that Act.

203

• (1) Section 237 (information gateway) is amended as follows.

• (2) In subsection (2), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After subsection (2) insert—

(3) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Public Services Ombudsman Act (Northern Ireland) 2016 (c. 4 (N.I.))

204

• (1) Section 49 of the Police Services Ombudsman Act (Northern Ireland) 2016 (disclosure of information) is amended as follows.

• (2) In subsection (4), for paragraph (a) substitute—

(a) sections 142 to 154, 160 to 164 and 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),

.

• (3) For subsection (5) substitute—

(5) The offences are those under— (a) any provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (powers of entry and inspection: offences), (b) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

• (4) After subsection (6) insert—

(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (c. 12 (N.I.))

205

• (1) Section 1 of the Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (control of information of a relevant person) is amended as follows.

• (2) In subsection (8), for “made by or under the Data Protection Act 1998” substitute “ of the data protection legislation ”.

• (3) After subsection (12) insert—

(12A) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Mental Capacity Act (Northern Ireland) 2016 (c. 18 (N.I.))

206

In section 306(1) of the Mental Capacity Act (Northern Ireland) 2016 (definitions for purposes of Act), for the definition of “health record” substitute—

“health record” has the meaning given by section 205 of the Data Protection Act 2018;

.

Justice Act (Northern Ireland) 2016 (c. 21 (N.I.))

207

The Justice Act (Northern Ireland) 2016 is amended as follows.

208

• (1) Section 17 (disclosure of information) is amended as follows.

• (2) In subsection (7), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) In subsection (8), after “section” insert

— “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

.

209

In section 44(3) (disclosure of information)—

• (a) in paragraph (a), for “Part 5 of the Data Protection Act 1998” substitute “ sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 ”, and

• (b) for paragraph (b) substitute—

(b) the commission of an offence under— (i) a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc); or (ii) section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).

Policing and Crime Act 2017 (c. 3)

210

• (1) Section 50 of the Policing and Crime Act 2017 (Freedom of Information Act etc: Police Federation for England and Wales) is amended as follows.

• (2) The existing text becomes subsection (1).

• (3) In that subsection, in paragraph (b), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (4) After that subsection, insert—

(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Children and Social Work Act 2017 (c. 12)

211

In Schedule 5 to the Children and Social Work Act 2017—

• (a) in Part 1 (general amendments to do with social workers etc in England), omit paragraph 6, and

• (b) in Part 2 (renaming of Health and Social Work Professions Order 2001), omit paragraph 47(g).

Higher Education and Research Act 2017 (c. 29)

212

The Higher Education and Research Act 2017 is amended as follows.

213

• (1) Section 63 (cooperation and information sharing by the Office for Students) is amended as follows.

• (2) In subsection (6), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) In subsection (7), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

.

214

• (1) Section 112 (cooperation and information sharing between the Office for Students and UKRI) is amended as follows.

• (2) In subsection (6), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After subsection (6) insert —

(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Digital Economy Act 2017 (c. 30)

215

The Digital Economy Act 2017 is amended as follows.

216

• (1) Section 40 (further provisions about disclosures under sections 35 to 39) is amended as follows.

• (2) In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After subsection (10) insert—

(11) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

217

• (1) Section 43 (codes of practice) is amended as follows.

• (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

• (3) In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 ”.

218

• (1) Section 49 (further provision about disclosures under section 48) is amended as follows.

• (2) In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After subsection (10) insert—

(11) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

219

• (1) Section 52 (code of practice) is amended as follows.

• (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

• (3) In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.

220

• (1) Section 57 (further provision about disclosures under section 56) is amended as follows.

• (2) In subsection (8)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After subsection (10) insert—

(11) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

221

• (1) Section 60 (code of practice) is amended as follows.

• (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

• (3) In subsection (13), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.

222

• (1) Section 65 (supplementary provision about disclosures under section 64) is amended as follows.

• (2) In subsection (2)(a), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (3) After subsection (8) insert—

(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

223

• (1) Section 70 (code of practice) is amended as follows.

• (2) In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “ prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act ”.

• (3) In subsection (15), for “section 51(3) of the Data Protection Act 1998” substitute “ section 128 of the Data Protection Act 2018 (other codes of practice) ”.

224

Omit sections 108 to 110 (charges payable to the Information Commissioner).

Landfill Disposals Tax (Wales) Act 2017 (anaw 3)

225

• (1) Section 60 of the Landfill Disposals Tax (Wales) Act 2017 (disclosure of information to the Welsh Revenue Authority) is amended as follows.

• (2) In subsection (4)(a)—

• (a) in the English language text, for “the Data Protection Act 1998 (c. 29)” substitute “ the data protection legislation ”, and

• (b) in the Welsh language text, for “torri Deddf Diogelu Data 1998 (p. 29)” substitute “torri'r ddeddfwriaeth diogelu data”.

• (3) After subsection (7)—

• (a) in the English language text insert—

(8) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

, and

• (b) in the Welsh language text insert—

(8) Yn yr adran hon, mae i “y ddeddfwriaeth diogelu data” yr un ystyr ag a roddir i “the data protection legislation” yn Neddf Diogelu Data 2018 (gweler adran 3 o'r Ddeddf honno).

Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (anaw 2)

226

• (1) Section 4 of the Additional Learning Needs and Educational Tribunal (Wales) Act 2018 (additional learning needs code) is amended as follows.

• (2) In the English language text—

• (a) in subsection (9), omit from “and in this subsection” to the end, and

• (b) after subsection (9) insert—

(9A) In subsection (9)— - “data subject” (“testun y data”) has the meaning given by section 3(5) of the Data Protection Act 2018; - “personal data” (“data personol”) has the same meaning as in Parts 5 to 7 of that Act (see section 3(2) and (14) of that Act).

• (3) In the Welsh language text—

• (a) in subsection (9), omit from “ac yn yr is-adran hon” to the end, and

• (b) after subsection (9) insert—

(9A) Yn is-adran (9)— - mae i “data personol” yr un ystyr ag a roddir i “personal data” yn Rhannau 5 i 7 o Ddeddf Diogelu Data 2018 (gweler adran 3(2) a (14) o'r Ddeddf honno); - mae i “testun y data” yr ystyr a roddir i “data subject” gan adran 3(5) o'r Ddeddf honno.

This Act

227

• (1) Section 204 of this Act (meaning of “health professional” and “social work professional”) is amended as follows (to reflect the arrangements for the registration of social workers in England under Part 2 of the Children and Social Work Act 2017).

• (2) In subsection (1)(g)—

• (a) omit “and Social Work”, and

• (b) omit “, other than the social work profession in England”.

• (3) In subsection (2), for paragraph (a) substitute—

(a) a person registered as a social worker in the register maintained by Social Work England under section 39(1) of the Children and Social Work Act 2017;

.

PART 2 — Amendments of other legislation

Estate Agents (Specified Offences) (No. 2) Order 1991 (S.I. 1991/1091)

228

In the table in the Schedule to the Estate Agents (Specified Offences) (No. 2) Order 1991 (specified offences), at the end insert—

Data Protection Act 2018	Section 144	False statements made in response to an information notice
Data Protection Act 2018	Section 148	Destroying or falsifying information and documents etc

Channel Tunnel (International Arrangements) Order 1993 (S.I. 1993/1813)

229

• (1) Article 4 of the Channel Tunnel (International Arrangements) Order 1993 (application of enactments) is amended as follows.

• (2) In paragraph (2)—

• (a) for “section 5 of the Data Protection Act 1998 (“the 1998 Act”), data which are” substitute “ section 207 of the Data Protection Act 2018 (“the 2018 Act”), data which is ”,

• (b) for “data controller” substitute “ controller ”,

• (c) after “in the context of” insert “ the activities of ”, and

• (d) for “and the 1998 Act” substitute “ and the 2018 Act ”.

• (3) In paragraph (3)—

• (a) for “section 5 of the 1998 Act, data which are” substitute “ section 207 of the 2018 Act, data which is ”,

• (b) for “data controller” substitute “ controller ”,

• (c) after “in the context of” insert “ the activities of ”, and

• (d) for “and the 1998 Act” substitute “ and the 2018 Act ”.

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))

230

The Access to Health Records (Northern Ireland) Order 1993 is amended as follows.

231

In Article 4 (health professionals), for paragraph (1) substitute—

(1) In this Order, “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act).

232

In Article 5(4)(a) (fees for access to health records), for “under section 7 of the Data Protection Act 1998” substitute “ made by the Department ”.

Channel Tunnel (Miscellaneous Provisions) Order 1994 (S.I. 1994/1405)

233

In article 4 of the Channel Tunnel (Miscellaneous Provisions) Order 1994 (application of enactments), for paragraphs (2) and (3) substitute—

(2) For the purposes of section 207 of the Data Protection Act 2018 (“the 2018 Act”), data which is processed in a control zone in Belgium, in connection with the carrying out of frontier controls, by an officer belonging to the United Kingdom is to be treated as processed by a controller established in the United Kingdom in the context of the activities of that establishment (and accordingly the 2018 Act applies in respect of such data). (3) For the purposes of section 207 of the 2018 Act, data which is processed in a control zone in Belgium, in connection with the carrying out of frontier controls, by an officer belonging to the Kingdom of Belgium is to be treated as processed by a controller established in the Kingdom of Belgium in the context of the activities of that establishment (and accordingly the 2018 Act does not apply in respect of such data).

European Primary and Specialist Dental Qualifications Regulations 1998 (S.I. 1998/811)

234

The European Primary and Specialist Dental Qualifications Regulations 1998 are amended as follows.

235

• (1) Regulation 2(1) (interpretation) is amended as follows.

• (2) Omit the definition of “Directive 95/46/EC”.

• (3) At the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

.

236

• (1) The table in Schedule A1 (functions of the GDC under Directive 2005/36) is amended as follows.

• (2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

• (3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (S.I. 1999/677)

237

For article 7 of the Scottish Parliamentary Corporate Body (Crown Status) Order 1999 substitute—

(7) (1) The Parliamentary corporation is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article. (2) The Parliamentary corporation is to be treated as a government department for the purposes of the following provisions— (a) section 8(d) (lawfulness of processing under the GDPR: public interest etc), (b) section 209 (application to the Crown), (c) paragraph 6 of Schedule 1 (statutory etc and government purposes), (d) paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and (e) paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data). (3) In the provisions mentioned in paragraph (4)— (a) references to employment by or under the Crown are to be treated as including employment as a member of staff of the Parliamentary corporation, and (b) references to a person in the service of the Crown are to be treated as including a person so employed. (4) The provisions are— (a) section 24(3) (exemption for certain data relating to employment under the Crown), and (b) section 209(6) (application of certain provisions to a person in the service of the Crown). (5) In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).

Northern Ireland Assembly Commission (Crown Status) Order 1999 (S.I. 1999/3145)

238

For article 9 of the Northern Ireland Assembly Commission (Crown Status) Order 1999 substitute—

(9) (1) The Commission is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article. (2) The Commission is to be treated as a government department for the purposes of the following provisions— (a) section 8(d) (lawfulness of processing under the GDPR: public interest etc), (b) section 209 (application to the Crown), (c) paragraph 6 of Schedule 1 (statutory etc and government purposes), (d) paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and (e) paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data). (3) In the provisions mentioned in paragraph (4)— (a) references to employment by or under the Crown are to be treated as including employment as a member of staff of the Commission, and (b) references to a person in the service of the Crown are to be treated as including a person so employed. (4) The provisions are— (a) section 24(3) (exemption for certain data relating to employment under the Crown), and (b) section 209(6) (application of certain provisions to a person in the service of the Crown). (5) In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).

Data Protection (Corporate Finance Exemption) Order 2000 (S.I. 2000/184)

239

The Data Protection (Corporate Finance Exemption) Order 2000 is revoked.

Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 (S.I. 2000/185)

240

The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 is revoked.

Data Protection (Functions of Designated Authority) Order 2000 (S.I. 2000/186)

241

The Data Protection (Functions of Designated Authority) Order 2000 is revoked.

Data Protection (International Co-operation) Order 2000 (S.I. 2000/190)

242

The Data Protection (International Co-operation) Order 2000 is revoked.

Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 (S.I. 2000/191)

243

The Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 are revoked.

Consumer Credit (Credit Reference Agency) Regulations 2000 (S.I. 2000/290)

244

In the Consumer Credit (Credit Reference Agency) Regulations 2000, regulation 4(1) and Schedule 1 (statement of rights under section 9(3) of the Data Protection Act 1998) are revoked.

Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413)

245

The Data Protection (Subject Access Modification) (Health) Order 2000 is revoked.

Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414)

246

The Data Protection (Subject Access Modification) (Education) Order 2000 is revoked.

Data Protection (Subject Access Modification) (Social Work) Order 2000 (S.I. 2000/415)

247

The Data Protection (Subject Access Modification) (Social Work) Order 2000 is revoked.

Data Protection (Crown Appointments) Order 2000 (S.I. 2000/416)

248

The Data Protection (Crown Appointments) Order 2000 is revoked.

Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417)

249

The Data Protection (Processing of Sensitive Personal Data) Order 2000 is revoked.

Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 (S.I. 2000/419)

250

The Data Protection (Miscellaneous Subject Access Exemptions) Order 2000 is revoked.

Data Protection (Designated Codes of Practice) (No. 2) Order 2000 (S.I. 2000/1864)

251

The Data Protection (Designated Codes of Practice) (No. 2) Order 2000 is revoked.

Representation of the People (England and Wales) Regulations 2001 (S.I. 2001/341)

252

The Representation of the People (England and Wales) Regulations 2001 are amended as follows.

253

In regulation 3(1) (interpretation), at the appropriate places insert—

“Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

;

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

;

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

.

254

In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

255

In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

256

In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

257

In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute—

(a) Article 89 GDPR purposes;

.

258

• (1) Regulation 92(2) (interpretation and application of Part VI etc) is amended as follows.

• (2) After sub-paragraph (b) insert—

(ba) “relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards.

• (3) Omit sub-paragraphs (c) and (d).

259

In regulation 96(2A)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.

260

In regulation 97(5) and (6) (supply of free copy of full register to the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

261

In regulation 97A(7) and (8) (supply of free copy of full register to the National Library of Wales and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

262

In regulation 99(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

263

In regulation 109A(9) and (10) (supply of free copy of full register to public libraries and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

264

In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”) substitute—

(i) Article 89 GDPR purposes;

.

Representation of the People (Scotland) Regulations 2001 (S.I. 2001/497)

265

The Representation of the People (Scotland) Regulations 2001 are amended as follows.

266

In regulation 3(1) (interpretation), at the appropriate places, insert—

“Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

;

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

;

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

.

267

In regulation 26(3)(a) (applications for registration), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

268

In regulation 26A(2)(a) (application for alteration of register in respect of name under section 10ZD), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

269

In regulation 32ZA(3)(f) (annual canvass), for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

270

In regulation 61(3) (records and lists kept under Schedule 4), for paragraph (a) (but not the final “or”) substitute—

(a) Article 89 GDPR purposes;

.

271

In regulation 61A (conditions on the use, supply and inspection of absent voter records or lists), for paragraph (a) (but not the final “or”) substitute—

(a) Article 89 GDPR purposes;

.

272

• (1) Regulation 92(2) (interpretation of Part VI etc) is amended as follows.

• (2) After sub-paragraph (b) insert—

(ba) “relevant requirement” means the requirement under Article 89 of the GDPR, read with section 19 of the Data Protection Act 2018, that personal data processed for Article 89 GDPR purposes must be subject to appropriate safeguards.

• (3) Omit sub-paragraphs (c) and (d).

273

In regulation 95(3)(b)(i) (restriction on use of the full register), for “section 11(3) of the Data Protection Act 1998” substitute “ section 122(5) of the Data Protection Act 2018 ”.

274

In regulation 96(5) and (6) (supply of free copy of full register to the National Library of Scotland and the British Library and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

275

In regulation 98(6) and (7) (supply of free copy of full register etc to Statistics Board and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

276

In regulation 108A(9) and (10) (supply of full register to statutory library authorities and local authority archives services and restrictions on use), for “research purposes in compliance with the relevant conditions” substitute “ Article 89 GDPR purposes in accordance with the relevant requirement ”.

277

In regulation 119(2) (conditions on the use, supply and disclosure of documents open to public inspection), for sub-paragraph (i) (but not the final “or”) substitute—

(i) Article 89 GDPR purposes;

.

Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (S.I. 2001/2188)

278

• (1) Article 9 of the Financial Services and Markets 2000 (Disclosure of Confidential Information) Regulations 2001 (disclosure by regulators or regulator workers to certain other persons) is amended as follows.

• (2) In paragraph (2B), for sub-paragraph (a) substitute—

(a) the disclosure is made in accordance with Chapter V of the GDPR;

.

• (3) After paragraph (5) insert—

(6) In this article, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

Nursing and Midwifery Order 2001 (S.I. 2002/253)

279

The Nursing and Midwifery Order 2001 is amended as follows.

280

• (1) Article 3 (the Nursing and Midwifery Council and its Committees) is amended as follows.

• (2) In paragraph (18), after “enactment” insert “ or the GDPR ”.

• (3) After paragraph (18) insert—

(19) In this paragraph, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

281

• (1) Article 25 (the Council's power to require disclosure of information) is amended as follows.

• (2) In paragraph (3), after “enactment” insert “ or the GDPR ”.

• (3) In paragraph (6)—

• (a) for “paragraph (5),” substitute “ paragraph (3)— ”, and

• (b) at the appropriate place insert—

“the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

282

In article 39B (European professional card), after paragraph (2) insert—

(3) For the purposes of Schedule 2B, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.

283

In article 40(6) (Directive 2005/36/EC: designation of competent authority etc), at the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

.

284

• (1) Schedule 2B (Directive 2005/36/EC: European professional card) is amended as follows.

• (2) In paragraph 8(1) (access to data) for “Directive 95/46/EC” substitute “ the GDPR ”.

• (3) In paragraph 9 (processing data), omit sub-paragraph (2) (deeming the Society to be the controller for the purposes of Directive 95/46/EC).

285

• (1) The table in Schedule 3 (functions of the Council under Directive 2005/36) is amended as follows.

• (2) In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

• (3) In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “ the GDPR ”.

286

In Schedule 4 (interpretation), omit the definition of “Directive 95/46/EC”.

Electronic Commerce (EC Directive) Regulations 2002 (S.I. 2002/2013)

287

Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002 (exclusions) is amended as follows.

288

In paragraph (1)(b) for “the Data Protection Directive and the Telecommunications Data Protection Directive” substitute “ the GDPR ”.

289

In paragraph (3)—

• (a) omit the definitions of “Data Protection Directive” and “Telecommunications Data Protection Directive”, and

• (b) at the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

.

Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 (S.I. 2002/2905)

290

The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 is revoked.

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426)

291

The Privacy and Electronic Communications (EC Directive) Regulations 2003 are amended as follows.

292

In regulation 2(1) (interpretation), in the definition of “the Information Commissioner” and “the Commissioner”, for “section 6 of the Data Protection Act 1998” substitute “ the Data Protection Act 2018 ”.

293

• (1) Regulation 4 (relationship between these Regulations and the Data Protection Act 1998) is amended as follows.

• (2) The existing text becomes sub-paragraph (1).

• (3) In that sub-paragraph, for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

• (4) After that sub-paragraph insert—

(2) In this regulation— - “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act); - “personal data” and “processing” have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4) and (14) of that Act). (3) Regulation 2(2) and (3) (meaning of certain expressions) do not apply for the purposes of this regulation.

• (5) In the heading of that regulation, for “the Data Protection Act 1998” substitute “ the data protection legislation ”.

Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 (S.I. 2003/2818)

294

The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 is amended as follows.

295

In article 8(2) (exercise of powers by French officers in a control zone in the United Kingdom: disapplication of law of England and Wales)—

• (a) for “The Data Protection Act 1998” substitute “ The Data Protection Act 2018 ”, and

• (b) for “are” substitute “ is ”.

296

In article 11(4) (exercise of powers by UK immigration officers and constables in a control zone in France: enactments having effect)—

• (a) for “The Data Protection Act 1998” substitute “ The Data Protection Act 2018 ”,

• (b) for “are” substitute “ is ”,

• (c) for “section 5” substitute “ section 207 ”,

• (d) for “data controller” substitute “ controller ”, and

• (e) after “in the context of” insert “ the activities of ”.

Pupils’ Educational Records (Scotland) Regulations 2003 (S.S.I. 2003/581)

297

The Pupils' Educational Records (Scotland) Regulations 2003 are amended as follows.

298

• (1) Regulation 2 (interpretation) is amended as follows.

• (2) Omit the definition of “the 1998 Act”.

• (3) At the appropriate place insert—

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;

.

299

• (1) Regulation 6 (circumstances where information should not be disclosed) is amended as follows.

• (2) After “any information” insert “ to the extent that any of the following conditions are satisfied ”.

• (3) For paragraphs (a) to (c) substitute—

(aa) the pupil to whom the information relates would have no right of access to the information under the GDPR; (ab) the information is personal data described in Article 9(1) or 10 of the GDPR (special categories of personal data and personal data relating to criminal convictions and offences);

.

• (4) In paragraph (d), for “to the extent that its disclosure” substitute “ the disclosure of the information ”.

• (5) In paragraph (e), for “that” substitute “ the information ”.

300

In regulation 9 (fees), for paragraph (1) substitute—

(1A) In complying with a request made under regulation 5(2), the responsible body may only charge a fee where Article 12(5) or Article 15(3) of the GDPR would permit the charging of a fee if the request had been made by the pupil to whom the information relates under Article 15 of the GDPR. (1B) Where paragraph (1A) permits the charging of a fee, the responsible body may not charge a fee that— (a) exceeds the cost of supply, or (b) exceeds any limit in regulations made under section 12 of the Data Protection Act 2018 that would apply if the request had been made by the pupil to whom the information relates under Article 15 of the GDPR.

European Parliamentary Elections (Northern Ireland) Regulations 2004 (S.I. 2004/1267)

301

Schedule 1 to the European Parliamentary Elections (Northern Ireland) Regulations 2004 (European Parliamentary elections rules) is amended as follows.

302

• (1) Paragraph 74(1) (interpretation) is amended as follows.

• (2) Omit the definitions of “relevant conditions” and “research purposes”.

• (3) At the appropriate places insert—

“Article 89 GDPR purposes” means the purposes mentioned in Article 89(1) of the GDPR (archiving in the public interest, scientific or historical research and statistics);

;

“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation);

.

303

In paragraph 77(2)(b) (conditions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “ Article 89 GDPR purposes ”.

Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/3244)

304

In regulation 3(1) of the Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004, omit “the appropriate limit referred to in section 9A(3) and (4) of the 1998 Act and”.

Environmental Information Regulations 2004 (S.I. 2004/3391)

305

The Environmental Information Regulations 2004 are amended as follows.

306

• (1) Regulation 2 (interpretation) is amended as follows.

• (2) In paragraph (1), at the appropriate places, insert—

“the data protection principles” means the principles set out in— (a) Article 5(1) of the GDPR, (b) section 34(1) of the Data Protection Act 2018, and (c) section 85(1) of that Act;

;

“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

;

“the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

;

“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);

.

• (3) For paragraph (4) substitute—

(4A) In these Regulations, references to the Data Protection Act 2018 have effect as if in Chapter 3 of Part 2 of that Act (other general processing)— (a) the references to an FOI public authority were references to a public authority as defined in these Regulations, and (b) the references to personal data held by such an authority were to be interpreted in accordance with regulation 3(2).

307

• (1) Regulation 13 (personal data) is amended as follows.

• (2) For paragraph (1) substitute—

(1) To the extent that the information requested includes personal data of which the applicant is not the data subject, a public authority must not disclose the personal data if— (a) the first condition is satisfied, or (b) the second or third condition is satisfied and, in all the circumstances of the case, the public interest in not disclosing the information outweighs the public interest in disclosing it.

• (3) For paragraph (2) substitute—

(2A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (2B) The second condition is that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene— (a) Article 21 of the GDPR (general processing: right to object to processing), or (b) section 99 of the Data Protection Act 2018 (intelligence services processing: right to object to processing).

• (4) For paragraph (3) substitute—

(3A) The third condition is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section, or (c) on a request under section 94(1)(b) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.

• (5) Omit paragraph (4).

• (6) For paragraph (5) substitute—

(5A) For the purposes of this regulation a public authority may respond to a request by neither confirming nor denying whether such information exists and is held by the public authority, whether or not it holds such information, to the extent that— (a) the condition in paragraph (5B)(a) is satisfied, or (b) a condition in paragraph (5B)(b) to (e) is satisfied and in all the circumstances of the case, the public interest in not confirming or denying whether the information exists outweighs the public interest in doing so. (5B) The conditions mentioned in paragraph (5A) are— (a) giving a member of the public the confirmation or denial— (i) would (apart from these Regulations) contravene any of the data protection principles, or (ii) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded; (b) giving a member of the public the confirmation or denial would (apart from these Regulations) contravene Article 21 of the GDPR or section 99 of the Data Protection Act 2018 (right to object to processing); (c) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for confirmation of whether personal data is being processed, the information would be withheld in reliance on a provision listed in paragraph (3A)(a); (d) on a request under section 45(1)(a) of the Data Protection Act 2018 (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section; (e) on a request under section 94(1)(a) of that Act (intelligence services processing: rights of access by the data subject), the information would be withheld in reliance on a provision of Chapter 6 of Part 4 of that Act.

• (7) After that paragraph insert—

(6) In determining for the purposes of this regulation whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

308

In regulation 14 (refusal to disclose information), in paragraph (3)(b), for “regulations 13(2)(a)(ii) or 13(3)” substitute “ regulation 13(1)(b) or (5A) ”.

309

In regulation 18 (enforcement and appeal provisions), in paragraph (5), for “regulation 13(5)” substitute “ regulation 13(5A) ”.

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

310

The Environmental Information (Scotland) Regulations 2004 are amended as follows.

311

• (1) Regulation 2 (interpretation) is amended as follows.

• (2) In paragraph (1), at the appropriate places, insert—

“the data protection principles” means the principles set out in— (a) Article 5(1) of the GDPR, and (b) section 34(1) of the Data Protection Act 2018;”;

;

“data subject” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

;

“the GDPR” and references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act);

;

“personal data” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act);

.

• (3) For paragraph (3) substitute—

(3A) In these Regulations, references to the Data Protection Act 2018 have effect as if in Chapter 3 of Part 2 of that Act (other general processing)— (a) the references to an FOI public authority were references to a Scottish public authority as defined in these Regulations, and (b) the references to personal data held by such an authority were to be interpreted in accordance with paragraph (2) of this regulation.

312

• (1) Regulation 11 (personal data) is amended as follows.

• (2) For paragraph (2) substitute—

(2) To the extent that environmental information requested includes personal data of which the applicant is not the data subject, a Scottish public authority must not make the personal data available if— (a) the first condition set out in paragraph (3A) is satisfied, or (b) the second or third condition set out in paragraph (3B) or (4A) is satisfied and, in all the circumstances of the case, the public interest in making the information available is outweighed by that in not doing so.

• (3) For paragraph (3) substitute—

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under these Regulations— (a) would contravene any of the data protection principles, or (b) would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded. (3B) The second condition is that the disclosure of the information to a member of the public otherwise than under these Regulations would contravene Article 21 of the GDPR (general processing: right to object to processing).

• (4) For paragraph (4) substitute—

(4A) The third condition is that any of the following applies to the information— (a) it is exempt from the obligation under Article 15(1) of the GDPR (general processing: right of access by the data subject) to provide access to, and information about, personal data by virtue of provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.

• (5) Omit paragraph (5).

• (6) After paragraph (6) insert—

(7) In determining, for the purposes of this regulation, whether the lawfulness principle in Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph (disapplying the legitimate interests gateway in relation to public authorities) were omitted.

Licensing Act 2003 (Personal Licences) Regulations 2005 (S.I. 2005/41)

313

• (1) Regulation 7 of the Licensing Act 2003 (Personal Licences) Regulations 2005 (application for grant of a personal licence) is amended as follows.

• (2) In paragraph (1)(b)—

• (a) for paragraph (iii) (but not the final “, and”) substitute—

(iii) the results of a request made under Article 15 of the GDPR or section 45 of the Data Protection Act 2018 (rights of access by the data subject) to the National Identification Service for information contained in the Police National Computer

, and

• (b) in the words following paragraph (iii), omit “search”.

• (3) After paragraph (2) insert—

(3) In this regulation, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).

Education (Pupil Information) (England) Regulations 2005 (S.I. 2005/1437)

314

The Education (Pupil Information) (England) Regulations 2005 are amended as follows.

315

In regulation 3(5) (meaning of educational record) for “section 1(1) of the Data Protection Act 1998” substitute “ section 3(4) of the Data Protection Act 2018 ”.

316

• (1) Regulation 5 (disclosure of curricular and educational records) is amended as follows.