Data Protection Act 2018

Provision 1· GB, DPA2018, section s1

Data Protection Act 2018, section 1 (1) (1) This Act makes provision about the processing of personal data. (2) Most processing of personal data is subject to the UK GDPR. (3) Part 2 supplements the UK GDPR. (4) Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes .... (5) Part 4 makes provision about the processing of personal data by the intelligence services (and certain processing carried out by competent authorities jointly with the intelligence services). (6) Part 5 makes provision about the Information Commissioner. (7) Part 6 makes provision about the enforcement of the data protection legislation. (8) Part 7 makes supplementary provision, including provision about the application of this Act to the Crown and to Parliame [...]

Provision 2· GB, DPA2018, section s2

Data Protection Act 2018, section 2 (2) (1) The UK GDPR and this Act protect individuals with regard to the processing of personal data, in particular by— (a) requiring personal data to be processed lawfully and fairly, on the basis of the data subject's consent or another specified basis, (b) conferring rights on the data subject to obtain information about the processing of personal data and to require inaccurate personal data to be rectified, and (c) conferring functions on the Commissioner, giving the holder of that office responsibility for monitoring and enforcing their provisions. Terms relating to the processing of personal data

Provision 3· GB, DPA2018, section s3

Data Protection Act 2018, section 3 (3) (1) This section defines some terms used in this Act. (2) “Personal data” means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)). (3) “Identifiable living individual” means a living individual who can be identified, directly or indirectly, in particular by reference to— (a) an identifier such as a name, an identification number, location data or an online identifier, or (b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual. (4) “Processing”, in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as— (a) collection, recording, organ [...]

Provision 4· GB, DPA2018, section s3

Data Protection Act 2018, section 3 (8) “The Commissioner” means the Information Commissioner (see section 114). (8A) “The Commission” means the Information Commission (see section 114A). (9) “The data protection legislation” means— (a) the UK GDPR, (c) this Act, and (d) regulations made under this Act or the UK GDPR, ... (10) “The UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4)). (10A) “The EU G [...]

Provision 5· GB, DPA2018, section s3

Data Protection Act 2018, section 3 (14) In Parts 5 to 7, except where otherwise provided— (a) references to the UK GDPR are to the UK GDPR read with Part 2; (c) references to personal data, and the processing of personal data, are to personal data and processing to which ... Part 2, Part 3 or Part 4 applies; (d) references to a controller or processor are to a controller or processor in relation to the processing of personal data to which ... Part 2, Part 3 or Part 4 applies. (15) There is an index of defined expressions in section 206. PART 2 General processing CHAPTER 1 Scope and definitions Processing to which this Part applies

Provision 6· GB, DPA2018, section s4

Data Protection Act 2018, section 4 (4) (1) This Part is relevant to most processing of personal data. (2) This Part— (a) applies to the types of processing of personal data to which the UK GDPR applies by virtue of Article 2 of the UK GDPR, and (b) supplements, and must be read with, the UK GDPR. Definitions

Provision 7· GB, DPA2018, section s5

Data Protection Act 2018, section 5 (5) (1) Terms used in ... this Part and in the UK GDPR have the same meaning in this Part as they have in the UK GDPR. (2) In subsection (1), the reference to a term's meaning in the UK GDPR is to its meaning in the UK GDPR read with any provision of this Part which modifies the term's meaning for the purposes of the UK GDPR. (3) Subsection (1) is subject to any provision in this Part which provides expressly for the term to have a different meaning and to section 204. (7) A reference in ... this Part to the processing of personal data is to processing to which this Part applies. (8) Sections 3 and 205 include definitions of other expressions used in this Part. CHAPTER 2 The UK GDPR Meaning of certain terms used in the UK GDPR Meaning of “controller”

Provision 8· GB, DPA2018, section s6

Data Protection Act 2018, section 6 (6) (1) The definition of “controller” in Article 4(1)(7) of the UK GDPR has effect subject to— (a) subsection (2), (b) section 209, and (c) section 210. (2) For the purposes of the UK GDPR, where personal data is processed only— (a) for purposes for which it is required by an enactment to be processed, and (b) by means by which it is required by an enactment to be processed, the person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller. Meaning of “public authority” and “public body”

Provision 9· GB, DPA2018, section s7

Data Protection Act 2018, section 7 (7) (1) For the purposes of the UK GDPR, the following (and only the following) are “public authorities” and “public bodies” ...— (a) a public authority as defined by the Freedom of Information Act 2000, (b) a Scottish public authority as defined by the Freedom of Information (Scotland) Act 2002 (asp 13), (ba) the Advanced Research and Invention Agency, and (c) an authority or body specified or described by the Secretary of State in regulations, subject to subsections (2), (3) and (4). (2) An authority or body that falls within subsection (1) is only a “public authority” or “public body” for the purposes of the UK GDPR when performing a task carried out in the public interest or in the exercise of official authority vested in it. (3) The references in su [...]

Provision 10· GB, DPA2018, section s7

Data Protection Act 2018, section 7 (5) Regulations under this section are subject to the affirmative resolution procedure. Lawfulness of processing Lawfulness of processing: public interest etc

Provision 11· GB, DPA2018, section s8

Data Protection Act 2018, section 8 (8) In Article 6(1) of the UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of ... official authority includes processing of personal data that is necessary for— (a) the administration of justice, (b) the exercise of a function of either House of Parliament, (c) the exercise of a function conferred on a person by an enactment or rule of law, (d) the exercise of a function of the Crown, a Minister of the Crown or a government department, or (e) an activity that supports or promotes democratic engagement. Child's consent in relation to information society services

Provision 12· GB, DPA2018, section s9

Data Protection Act 2018, section 9 Relevant international law Processing in reliance on relevant international law

Provision 13· GB, DPA2018, section s9a

Data Protection Act 2018, section 9a (9A) (1) Processing of personal data meets the requirement in Article 6(3), 8A(3)(e), 9(2)(g) or 10(1) of the UK GDPR for a basis in, or authorisation by, relevant international law only if it meets a condition in Schedule A1. (2) A condition in Schedule A1 may be relied on for the purposes of any of those provisions, unless that Schedule provides otherwise. (3) The Secretary of State may by regulations amend Schedule A1 by adding, varying or omitting— (a) conditions, (b) provision about the purposes for which a condition may be relied on, and (c) safeguards in connection with processing carried out in reliance on a condition in the Schedule. (4) Regulations under this section may only add a condition relating entirely or partly to a treaty ratified by [...]

Provision 14· GB, DPA2018, section s10

Data Protection Act 2018, section 10 (10) (1) Subsections (2) and (3) make provision about the processing of personal data described in Article 9(1) of the UK GDPR (prohibition on processing of special categories of personal data) in reliance on an exception in one of the following points of Article 9(2)— (a) point (b) (employment, social security and social protection); (b) point (g) (substantial public interest); (c) point (h) (health and social care); (d) point (i) (public health); (e) point (j) (archiving, research and statistics). (2) The processing meets the requirement in point (b), (h), (i) or (j) of Article 9(2) of the UK GDPR for authorisation by, or a basis in, the law of the United Kingdom or a part of the United Kingdom only if it meets a condition in Part 1 of Schedule 1. (3) [...]

Provision 15· GB, DPA2018, section s11

Data Protection Act 2018, section 11 (11) (1) For the purposes of Article 9(2)(h) of the UK GDPR (processing for health or social care purposes etc), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the UK GDPR (obligation of secrecy) include circumstances in which it is carried out— (a) by or under the responsibility of a health professional or a social work professional, or (b) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law. (2) In Article 10 of the UK GDPR and section 10, references to personal data relating to criminal convictions and offences or related security measures include personal data relating to— (a) the alleged commissi [...]

Provision 16· GB, DPA2018, section s12

Data Protection Act 2018, section 12 (12) (1) The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on— (a) Article 12(5) of the UK GDPR (reasonable fees when responding to manifestly unfounded or excessive requests), or (b) Article 15(3) of the UK GDPR (reasonable fees for provision of further copies). (2) The Secretary of State may by regulations— (a) require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in reliance on those provisions, and (b) specify what the guidance must include. (3) Regulations under this section are subject to the negative resolution procedure. Obligations of credit reference agencies

Provision 17· GB, DPA2018, section s13

Data Protection Act 2018, section 13 (13) (1) This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974). (2) The controller's obligations under Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject's financial standing, unless the data subject has indicated a contrary intention. (3) Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the UK GDPR, the disclosure must be accompanied by a statement informing the data subject of the data subject's rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information). Meani [...]

Provision 18· GB, DPA2018, section s13a

Data Protection Act 2018, section 13a (13A) (1) The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR. (2) Regulations under this section are subject to the affirmative resolution procedure. Automated decision-making authorised by law: safeguards

Provision 19· GB, DPA2018, section s15

Data Protection Act 2018, section 15 (15) (1) Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the UK GDPR. (2) In Schedule 2— (a) Part 1 makes provision adapting or restricting the application of rules contained in Articles 13 to 21 and 34 of the UK GDPR in specified circumstances (of a kind described in Article 6(3) and Article 23(1) of the UK GDPR); (b) Part 2 makes provision restricting the application of rules contained in Articles 13 to 21 and 34 of the UK GDPR in specified circumstances (of a kind described in Article 23(1) of the UK GDPR); (c) Part 3 makes provision restricting the application of Article 15 of the UK GDPR where this is necessary to protect the rights of others (of a kind described in Article 2 [...]

Provision 20· GB, DPA2018, section s15

Data Protection Act 2018, section 15 (4) Schedule 4 makes provision restricting the application of rules contained in Articles 13 to 21 of the UK GDPR to information the disclosure of which is prohibited or restricted by an enactment (of a kind described in Article 23(1) of the UK GDPR). (4A) In connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25). (5) In connection with the safeguarding of national security and with defence, see Chapter 3 of this Part (sections 26 to 28). Power to make further exemptions etc by regulations

Provision 21· GB, DPA2018, section s16

Data Protection Act 2018, section 16 (16) (1) The following powers to make provision altering the application of the UK GDPR may be exercised by way of regulations made by the Secretary of State under this section— (a) the power in Article 6(3) ... to lay down a legal basis containing specific provisions to adapt the application of rules of the UK GDPR where processing is necessary for compliance with a legal obligation, for the performance of a task in the public interest or in the exercise of official authority; (b) the power in Article 23(1) to make provision restricting the scope of the obligations and rights mentioned in that Article where necessary and proportionate to safeguard certain objectives of general public interest; (c) the power in Article 85(2) to provide for exemptions or [...]

Provision 22· GB, DPA2018, section s17

Data Protection Act 2018, section 17 (17) (1) Accreditation of a person as a certification provider is only valid when carried out by— (a) the Commissioner, or (b) the UK national accreditation body. (2) The Commissioner may only accredit a person as a certification provider where the Commissioner— (a) has published a statement that the Commissioner will carry out such accreditation, and (b) has not published a notice withdrawing that statement. (3) The UK national accreditation body may only accredit a person as a certification provider where the Commissioner— (a) has published a statement that the body may carry out such accreditation, and (b) has not published a notice withdrawing that statement. (4) The publication of a notice under subsection (2)(b) or (3)(b) does not affect the valid [...]

Provision 23· GB, DPA2018, section s17

Data Protection Act 2018, section 17 “the UK national accreditation body” means the UK national accreditation body for the purposes of Article 4(1) of Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93. ... Transfers based on adequacy regulations

Provision 24· GB, DPA2018, section s17c

Data Protection Act 2018, section 17c Transfers of personal data to third countries etc : public interest

Provision 25· GB, DPA2018, section s18

Data Protection Act 2018, section 18 ... Processing for archiving, research and statistical purposes: safeguards