United Kingdom · statute
Ask the law about thisMore laws of United KingdomFor machines: Markdown
In force since 2026-09-30, as the publisher states.
Copy read on 2026-11-08. The page it was read from
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.
sha256 da614e94f4f638aa957e11d74e9430fa63b4f22829676411deab7957d59873d7
No one has proposed a change to this act yet.
In sections 130 to 134, “the eIDAS Regulation” means Regulation (EU) No. 910/2014 of the European Parliament and the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market.
Propose a changeIn Chapter 3 of the eIDAS Regulation (trust services), after Article 24A insert— Recognition of EU conformity assessment bodies Article 24B For the purposes of Articles 20(1), 21 and 24(1)(d), a body is to be treated as if it were a conformity assessment body in relation to a description of trust services provider (and trust service) if it is a conformity assessment body in relation to that description of provider (and service) for the purposes of the equivalent EU law.
Propose a change(1) The eIDAS Regulation is amended as follows. (2) In Chapter 3 (trust services), after Article 45 insert— SECTION 9 Recognition of overseas trust services Legal effects of overseas electronic signatures etc Article 45A 1. The Secretary of State may by regulations provide that, for the purposes of Articles 25(2), 35(2), 41(2) and 43(2), an overseas trust product of a specified description is to be treated as qualified. 2. In this Article— “overseas”, in relation to a trust product, means provided by a person established in a country or territory outside the United Kingdom; “specified” means specified by regulations under this Article; “trust product” means an electronic signature, an electronic seal, an electronic time stamp or an electronic registered delivery service. 3. The Secretary of State may not make regulations under this Article specifying a description of overseas trust product unless satisfied that the reliability of such a product is at least equivalent to the reliability of a comparable trust product that is qualified. 4. When making regulations under this Article in relation to a description of overseas trust product, the Secretary of State must have regard to (among other things) the law in the other country or territory relevant to that description of product and related trust services. Overseas signatures and seals in public service Article 45B 1. The Secretary of State may by regulations provide that an overseas electronic signature of a specified description is to be treated— (a) for the purposes of Article 27(1), as an advanced electronic signature that complies with the Implementing Decision; (b) for the purposes of Article 27(2), as an advanced electronic signature based on a qualified certificate for electronic signature, or a qualified signature, that complies with the Implementing Decision. 2. The Secretary of State may by regulations provide that an overseas electronic seal of a specified description is to be treated— (a) for the purposes of Article 37(1), as an advanced electronic seal that complies with the Implementing Decision; (b) for the purposes of Article 37(2), as an advanced electronic seal based on a qualified certificate for electronic seal, or a qualified seal, that complies with the Implementing Decision. 3. In this Article— “the Implementing Decision” means Commission Implementing Decision (EU) 2015/1506 laying down specifications relating to formats of advanced electronic signatures and advanced seals to be recognised by public sector bodies; “overseas”, in relation to an electronic signature or electronic seal, means provided by a person established in a country or territory outside the United Kingdom; “specified” means specified by regulations made under this Article. 4. The Secretary of State may not make regulations under point (a) or (b) of paragraph 1 or point (a) or (b) of paragraph 2 specifying a description of overseas electronic signature or overseas electronic seal unless satisfied that the reliability of such a signature or seal is at least equivalent to the reliability of a signature or seal described in that point. 5. When making regulations under this Article in relation to a description of overseas electronic signature or overseas electronic seal, the Secretary of State must have regard to (among other things) the law in the other country or territory relevant to that description of signature or seal and related trust services. Regulations under this Section Article 45C 1. Before making regulations under Article 45A or 45B, the Secretary of State must consult the supervisory body. 2. Regulations under Article 45A or 45B— (a) may describe something by (among other things) describing something that meets a condition specified in the regulations or is provided by a person who meets such a condition, and (b) may include a condition referring to (among other things) the law of the other country or territory or a standard or other document, including the law, standard or other document as amended from time to time. 3. Regulations under Article 45A or 45B may— (a) make different provision for different purposes, including for the purposes of different provisions of this Regulation, and (b) include transitional or transitory provision or savings. 4. Regulations under Article 45A or 45B are to be made by statutory instrument. 5. A statutory instrument containing regulations under Article 45A or 45B is subject to annulment in pursuance of either House of Parliament. (3) In Article 3(21) (definition of “product”), at the end insert “(except in the expression “trust product”)”.
Propose a change(1) Article 18 of the eIDAS Regulation (co-operation with EU authorities) is amended as follows. (2) In the heading, for “EU” substitute “overseas”. (3) In paragraph 1, for “public authority in the EU” substitute “designated overseas authority”. (4) In paragraph 2, for “other than in accordance with the data protection legislation” substitute “if the processing would contravene the data protection legislation (but in determining whether processing would do so, take into account the power conferred by that paragraph)”. (5) After paragraph 2 insert— 3. In this Article— “designated” means designated by regulations made by the Secretary of State that are in force; “overseas authority” means a person, or description of person, with functions relating to the regulation or supervision of trust services outside the United Kingdom. 4. Before making regulations under this Article, the Secretary of State must consult the supervisory body. 5. Regulations under this Article may include transitional or transitory provision or savings. 6. Regulations under this Article are to be made by statutory instrument. 7. A statutory instrument containing regulations under this Article is subject to annulment in pursuance of either House of Parliament.
Propose a change(1) In Chapter 1 of the eIDAS Regulation (general provisions), after Article 3 insert— Periods of time Article 3A References in this Regulation to a period expressed in hours, days, months or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits. (2) The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) are amended as follows. (3) In regulation 2 (interpretation), at the end insert— (3) References in these regulations to a period expressed in days or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits. (4) In Schedule 1 (monetary penalties)— (a) in paragraph 4(f), for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is served”, (b) in paragraph 5, for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is received”, and (c) in paragraph 6, for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is served”.
Propose a change(1) The Secretary of State must, before the end of the period of 9 months beginning with the day on which this Act is passed— (a) prepare and publish an assessment of the economic impact in the United Kingdom of each of the four policy options described in section B.4 of the Copyright and AI Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and (b) lay a document containing the assessment before Parliament. (2) The document may include an assessment of the economic impact in the United Kingdom of policy options which are alternatives to the options described in subsection (1)(a). (3) An assessment included in the document must, among other things, include assessment of the economic impact of each option on— (a) copyright owners, and (b) persons who develop or use AI systems, including the impact on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses. (4) In this section— “AI system” means a machine-based system that, from the input it receives, can infer how to— generate predictions, digital content, recommendations, decisions or other similar outputs, or influence a physical or virtual environment, with a view to achieving an explicit or implicit objective; “the Copyright and AI Consultation Paper” means the command paper “Copyright and AI: Consultation”, numbered CP1205, published on 17 December 2024; “copyright owner” has the same meaning as in Part 1 of the Copyright, Designs and Patents Act 1988; “develop” an AI system means carry on an activity involved in producing the system, such as (for example) designing, programming, training or testing the system (and related terms are to be interpreted accordingly); “digital content” means data which is produced and supplied in digital form; “medium-sized business” means a business with at least 50 but fewer than 250 staff; “micro business” means a business with fewer than 10 staff; “small business” means a business with at least 10 but fewer than 50 staff; “use” an AI system means instruct an AI system to generate outputs or to influence an environment (and related terms are to be interpreted accordingly).
Propose a change(1) The Secretary of State must, before the end of the period of 9 months beginning with the day on which this Act is passed— (a) prepare and publish a report on the use of copyright works in the development of AI systems, and (b) lay the report before Parliament. (2) The report must consider— (a) the four policy options described in section B.4 of the Copyright and AI Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and (b) such alternative options as the Secretary of State considers appropriate. (3) The report must consider, and make proposals in relation to, each of the following— (a) technical measures and standards (for example, measures and standards concerned with metadata) that may be used to control— (i) the use of copyright works to develop AI systems, and (ii) the accessing of copyright works for that purpose (for example, by web crawlers); (b) the effect of copyright on access to, and use of, data by developers of AI systems (for example, on text and data mining), including the effect on developers who are individuals, micro businesses, small businesses or medium-sized businesses; (c) the disclosure of information by developers of AI systems about— (i) their use of copyright works to develop AI systems, and (ii) how they access copyright works for that purpose (for example, by means of web crawlers); (d) the granting of licences to developers of AI systems to do acts restricted by copyright, including the granting of licences by and to individuals, micro businesses, small businesses and medium-sized businesses; (e) ways of enforcing requirements and restrictions relating to— (i) the use of copyright works to develop AI systems, and (ii) the accessing of copyright works for that purpose (for example, by web crawlers), including enforcement by a regulator. (4) The consideration and proposals under each of paragraphs (a) to (e) of subsection (3) must include consideration of, and proposals relating to, AI systems developed outside the United Kingdom. (5) In preparing the report, the Secretary of State must consider the likely effect of proposals, in the United Kingdom, on— (a) copyright owners, and (b) persons who develop or use AI systems, including the likely effect on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses. (6) In preparing the report, the Secretary of State must have regard to, among other things, the Consultation Paper responses. (7) The Secretary of State may comply with this section by preparing and publishing two or more reports which, taken together, satisfy the requirements in this section. (8) In this section— “Consultation Paper responses” means responses to the Copyright and AI Consultation Paper received by the Secretary of State on or before 25 February 2025; “copyright” means the property right which subsists in accordance with Part 1 of the Copyright, Designs and Patents Act 1988; “copyright work” has the same meaning as in Part 1 of the Copyright, Designs and Patents Act 1988; “web crawler” means a computer program that obtains data from websites in accordance with instructions and that can autonomously determine which websites to visit. (9) Terms used in this section and in section 135 have the same meaning in this section as they have in that section.
Propose a change(1) The Secretary of State must, before the end of the period of 6 months beginning with the day on which this Act is passed, lay before Parliament a statement setting out what progress has been made towards the publication of— (a) the economic impact assessment required by section 135, and (b) the report required by section 136. (2) The duty in subsection (1) does not apply where the economic impact assessment and the report have been published before the end of the period described in that subsection.
Propose a change(1) The Sexual Offences Act 2003 is amended in accordance with subsections (2) and (3). (2) After section 66D insert— Creating purported intimate image of adult 66E (1) A person (A) commits an offence if— (a) A intentionally creates a purported intimate image of another person (B), (b) B does not consent to the creation of the purported intimate image, and (c) A does not reasonably believe that B consents. (2) “Purported intimate image” of a person means an image which— (a) appears to be, or to include, a photograph or film of the person (but is not, or is not only, a photograph or film of the person), (b) appears to be of an adult, and (c) appears to show the person in an intimate state. (3) Subsections (5) to (9) of section 66D (person in an intimate state) apply for the purposes of this section as if references in those subsections to a photograph or film were references to an image. (4) References in this section to creating a purported intimate image of a person do not include doing so by modifying a photograph or film of the person where what is created by the modification is an image which— (a) appears to show the person, but (b) does not appear to show— (i) something within section 66D(5)(a) to (e) (read with subsections (6) and (7) of that section) which is not shown in the photograph or film, or (ii) a person who is not shown in the photograph or film. (5) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for creating the purported intimate image. (6) A person who commits an offence under this section is liable on summary conviction to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both). (7) The Secretary of State must— (a) review the operation of subsection (5), (b) publish the outcome of the review in a report before the end of the period of two years beginning with the day on which this section comes into force, and (c) lay the report before Parliament. Requesting the creation of purported intimate image of adult 66F (1) A person (A) commits an offence if— (a) A intentionally requests the creation of a purported intimate image of another person (B) (either in general or specific terms), (b) B does not consent to A requesting the creation of the purported intimate image, and (c) A does not reasonably believe that B consents. (2) A person (A) commits an offence if— (a) A intentionally requests that, if a purported intimate image of another person (B) is created, it includes or excludes something in particular (whether relating to B’s appearance, the intimate state in which B is shown or anything else), (b) B does not consent to A requesting the inclusion or exclusion of that thing, and (c) A does not reasonably believe that B consents. (3) References in this section to making a request (however expressed) include doing an act which could reasonably be taken to be a request (such as, for example, indicating agreement in response to an offer or complying with conditions of an offer). (4) References in this section to making a request (however expressed) are references to— (a) making a request directed to a particular person or persons, or (b) making a request so that it is available to one or more persons (or people generally), without directing it to a particular person or persons. (5) References in this section to consent to a person requesting something are— (a) in a case described in subsection (4)(a), references to consent to a request being made that is directed to the particular person or persons, and (b) in a case described in subsection (4)(b), references to consent to a request being made so that it is available to the person or persons (or people generally), as appropriate. (6) An offence under this section is committed— (a) regardless of whether the purported intimate image is created, (b) regardless of whether the purported intimate image, or the particular thing to be included in or excluded from such an image, is also requested by another person, and (c) regardless of where in the world the person or persons mentioned in subsection (4)(a)and (b) is or are located. (7) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for making the request. (8) A person who commits an offence under this section is liable on summary conviction to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both). (9) In this section, references to a purported intimate image, to creating such an image and to a person shown in an intimate state have the same meaning as in section 66E. (10) The Secretary of State must— (a) review the operation of subsection (7), (b) publish the outcome of the review in a report before the end of the period of two years beginning with the day on which this section comes into force, and (c) lay the report before Parliament. Creating, or requesting the creation of, purported intimate image of adult: further definitions etc 66G (1) This section applies for the purposes of sections 66E and 66F. (2) “Consent” to an act includes general consent covering the particular act as well as specific consent to that particular act (and see also section 66F(5)). (3) Whether a belief is “reasonable” is to be determined having regard to all the circumstances, including any steps A has taken to ascertain whether B consents. (4) “Photograph” includes the negative as well as the positive version. (5) “Film” means a moving image. (6) A reference to an “image”, “photograph” or “film” includes data stored by any means which is capable of conversion into an image, photograph or film. (7) An image of a person appears to be an image of an adult if— (a) the impression conveyed by the image is that the person shown is aged 18 or over, or (b) the predominant impression conveyed by the image is that the person shown is aged 18 or over (even if some of the physical characteristics shown are those of a person under 18). (8) The “maximum term for summary offences” means— (a) if the offence is committed before the time when section 281(5) of the Criminal Justice Act 2003 comes into force, six months; (b) if the offence is committed after that time, 51 weeks. Creating, or requesting the creation of, purported intimate image of adult: time limit for prosecution 66H (1) Notwithstanding section 127(1) of the Magistrates’ Courts Act 1980, a magistrates’ court may try an information or written charge relating to an offence under section 66E or 66F if the information is laid or the charge is issued— (a) before the end of the period of 3 years beginning with the day on which the offence was committed, and (b) before the end of the period of 6 months beginning with the day on which evidence which the prosecutor thinks is sufficient to justify a prosecution comes to the prosecutor’s knowledge. (2) A certificate signed by or on behalf of a prosecutor stating the date on which evidence described in subsection (1)(b) came to the prosecutor’s knowledge is conclusive evidence of that fact. (3) In section 79(5) (meaning of references to image of a person), after “a person” insert “(except in sections 66E, 66F and 66G)”. (4) In the Armed Forces Act 2006, after section 177D insert— Purported intimate images to be treated as used for purpose of certain offences 177DA (1) This section applies where a person commits an offence under section 42 as respects which the corresponding offence under the law of England and Wales is an offence under section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult). (2) The purported intimate image to which the offence relates, and anything containing it, is to be regarded for the purposes of section 177C(3) (and section 94A(3)(b)(ii)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring). (5) In Part 2 of Schedule 3 to the Serious Crime Act 2007 (offences to be disregarded in reckoning whether an act is capable of encouraging or assisting the commission of an offence: England and Wales), after paragraph 38 insert— Sexual Offences Act 2003 38ZA An offence under section 66F of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult). (6) In the Sentencing Code, after section 154 insert— Purported intimate images to be treated as used for purpose of certain offences 154A (1) Subsection (2) applies where a person commits an offence under section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult). (2) The purported intimate image to which the offence relates, and anything containing it, is to be regarded for the purposes of section 153 (and section 157(3)(b)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring). (3) Subsection (4) applies where a person commits an offence under section 66F of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult). (4) A purported intimate image which is connected with the offence, and anything containing it, is to be regarded for the purposes of section 153 (and section 157(3)(b)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring). (5) A purported intimate image is connected with an offence under section 66F of the Sexual Offences Act 2003 if — (a) it appears to be of a person who was the subject of the request to which the offence relates (whether or not it is what was requested), and (b) it was in the offender’s possession, or under the offender’s control, as a result of that request.
Propose a change(1) The Secretary of State may by regulations make provision that is consequential on any provision made by this Act. (2) Regulations under this section— (a) may make different provision for different purposes; (b) may include transitional, transitory or saving provision; (c) may amend, repeal or revoke any provision made by an enactment. (3) The reference in subsection (2)(c) to provision made by an enactment is— (a) where the amendment, repeal or revocation is consequential on section 117, 118 or 119(1) or Schedule 14, a reference to provision made by an enactment whenever passed or made (including this Act), and (b) in any other case, a reference to provision made by an enactment passed or made before the end of the Session in which this Act is passed. (4) Regulations under this section made in consequence of section 183A of the Data Protection Act 2018 (inserted by section 106 of this Act) may amend, repeal or revoke provision which refers to the data protection legislation (as defined in section 3 of the Data Protection Act 2018) as they could if the provision referred instead to the main data protection legislation (as defined in section 183A of that Act). (5) Regulations under this section that amend, repeal or revoke primary legislation are subject to the affirmative resolution procedure. (6) Any other regulations under this section are subject to the negative resolution procedure. (7) In this section— “enactment” includes— an enactment comprised in subordinate legislation (as defined in section 21 of the Interpretation Act 1978), an enactment comprised in, or in an instrument made under, a Measure or Act of Senedd Cymru, an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, an enactment comprised in, or in an instrument made under, Northern Ireland legislation, and assimilated direct legislation; “primary legislation” means— an Act of Parliament; an Act of the Scottish Parliament; a Measure or Act of Senedd Cymru; Northern Ireland legislation.
Propose a change(1) Regulations under this Act are to be made by statutory instrument. (2) Where regulations under this Act are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament. (3) Where regulations under this Act are subject to “the negative resolution procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament. (4) Any provision that may be included in regulations under this Act made by the Secretary of State or the Treasury subject to the negative resolution procedure may be made by regulations subject to the affirmative resolution procedure.
Propose a change(1) This Act extends to England and Wales, Scotland and Northern Ireland, subject to subsections (2) to (5). (2) In Part 3 (National Underground Asset Register)— (a) sections 56, 57(1) to (7) and 60(1) and Schedule 1 extend to England and Wales only, and (b) sections 58, 59 and 60(2) and Schedule 2 extend to Northern Ireland only. (3) In Part 4 (registers of births and deaths)— (a) sections 61 to 64 extend to England and Wales only, and (b) an amendment or repeal made by Schedule 3 (minor and consequential amendments) has the same extent as the enactment amended or repealed. (4) In Part 6 (the Information Commission), paragraph 23 of Schedule 12A to the Data Protection Act 2018 (inserted by Schedule 14 to this Act) extends to England and Wales and Northern Ireland only. (5) In Part 7— (a) section 121 and Schedule 15 (information standards for health and adult social care) extend to England and Wales only; (b) paragraphs 2, 3 and 5 to 7 of Schedule 16 (grant of smart meter communication licences) extend to England and Wales and Scotland only; (c) section 138(1) to (3) and (6) (creating, or requesting the creation of, purported intimate image of adult) extend to England and Wales only; (d) section 138(4) (amendment of the Armed Forces Act 2006) extends to— (i) England and Wales, Scotland and Northern Ireland, (ii) the Isle of Man, and (iii) the British overseas territories, except Gibraltar; (e) section 138(5) (amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only. (6) The powers conferred by section 384(1) and (2) of the Armed Forces Act 2006 (powers to extend provisions to the Channel Islands and to make provisions apply with modifications as they extend to the Channel Islands, the Isle of Man and British overseas territories other than Gibraltar) may be exercised in relation to section 177DA of that Act (inserted by section 138(4) of this Act). (7) The power conferred by section 63(3) of the Immigration, Asylum and Nationality Act 2006 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modification or adaptation). (8) The power conferred by section 76(6) of the Immigration Act 2014 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modifications). (9) The power conferred by section 95(5) of the Immigration Act 2016 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modifications). (10) The power conferred by section 239(7) of the Online Safety Act 2023 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment or repeal made by this Act of any part of that Act (with or without modifications). (11) In this section, “enactment” has the same meaning as in section 139.
Propose a change(1) Except as provided by subsections (2) to (4), this Act comes into force on such day as the Secretary of State may by regulations appoint. (2) The following provisions come into force on the day on which this Act is passed— (a) section 66 (meaning of “the 2018 Act” and “the UK GDPR”); (b) section 78 (searches in response to data subjects’ requests); (c) Part 1 of Schedule 16 (grant of smart meter communication licences) and section 122 so far as relating to that Part of that Schedule; (d) section 126 (retention of biometric data and recordable offences); (e) section 127 (retention of pseudonymised biometric data); (f) section 128 (retention of biometric data from INTERPOL); (g) this Part; (h) any other provision of this Act (including provision modifying other legislation) so far as it confers power to make regulations or is otherwise necessary for enabling the exercise of such a power on or after the day on which this Act is passed. (3) The following provisions come into force at the end of the period of two months beginning with the day on which this Act is passed— (a) section 69 (consent to law enforcement processing); (b) section 82 (logging of law enforcement processing); (c) section 96 (notices from the Information Commissioner); (d) section 97 (power of the Information Commissioner to require documents). (4) Part 2 of Schedule 16 (grant of smart meter communication licences), and section 122 so far as relating to that Part of that Schedule, come into force on the day on which the first regulations under section 91A(1) of the Energy Act 2008 (inserted by Part 1 of Schedule 16) come into force. (5) Regulations under this section may make different provision for different purposes.
Propose a change(1) The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act. (2) Regulations under this section may amend Schedule 21 to the Data Protection Act 2018 or Part 2 of Schedule 9 to this Act by adding, varying or repealing provision. (3) Regulations under this section containing provision described in subsection (2) are subject to the negative resolution procedure. (4) Regulations under this section may make different provision for different purposes.
Propose a changeThis Act may be cited as the Data (Use and Access) Act 2025.
Propose a changeSection 56 In the New Roads and Street Works Act 1991, after Schedule 5 insert— Schedule 5A Monetary penalties in relation to requirements under Part 3A Section 106G Power to impose monetary penalties 1 (1) The Secretary of State may give a notice (a “penalty notice”) imposing a penalty on a person if satisfied on the balance of probabilities that the person— (a) has failed to comply with a requirement imposed on the person to— (i) pay a fee in accordance with regulations under section 106E(1), or (ii) provide information in accordance with regulations under section 106F(1) or (2), or (b) has, in purported compliance with a requirement imposed on the person under regulations under section 106F(1) or (2), provided information that is false or misleading in a material respect. (2) The amount of a penalty imposed by a penalty notice must be such amount as is specified in, or determined in accordance with, regulations made by the Secretary of State. (3) A penalty imposed by a penalty notice must be paid to the Secretary of State within such period as may be specified in the notice. (4) The Secretary of State may not give more than one penalty notice to a person in respect of the same failure or conduct. (5) Regulations under this paragraph are subject to the affirmative procedure. Warning notices 2 (1) Where the Secretary of State proposes to give a penalty notice to a person the Secretary of State must give the person a notice (a “warning notice”) notifying the person of the Secretary of State’s proposal. (2) A warning notice must— (a) state the name and address of the person to whom the Secretary of State proposes to give a penalty notice; (b) give reasons why the Secretary of State proposes to give the person a penalty notice; (c) state the amount of the proposed penalty; (d) specify the date before which the person may make written representations to the Secretary of State. (3) The date specified under sub-paragraph (2)(d) must be a date falling at least 28 days after the day on which the warning notice is given. Penalty notices 3 (1) Within the period of six months beginning with the day on which a warning notice is given to a person the Secretary of State must give to the person— (a) a notice stating that the Secretary of State has decided not to give a penalty notice to the person, or (b) a penalty notice. (2) But the Secretary of State may not give a penalty notice to a person before the date specified in the warning notice in accordance with paragraph 2(2)(d). (3) A penalty notice given to a person must— (a) state the name and address of the person; (b) give details of the warning notice given to the person; (c) state whether or not the Secretary of State has received written representations in accordance with that notice; (d) give reasons for the Secretary of State’s decision to impose a penalty on the person; (e) state the amount of the penalty; (f) give details of how the penalty may be paid; (g) specify the date before which the penalty must be paid; (h) give details about the person’s rights of appeal; (i) give details about the consequences of non-payment. (4) The date specified under sub-paragraph (3)(g) must be a date falling at least 28 days after the day on which the penalty notice is given. (5) The Secretary of State may cancel a penalty notice by giving a notice to that effect to the person to whom the penalty notice is given. (6) If a penalty notice is cancelled, the Secretary of State— (a) may not give a further penalty notice in relation to the failure or conduct to which the notice relates, and (b) must repay any amount that has been paid in accordance with the notice. Enforcement 4 If a person does not pay the whole or any part of a penalty which the person is liable to pay under this Schedule the penalty or part of the penalty is recoverable— (a) if the county court so orders, as if it were payable under an order of that court; (b) if the High Court so orders, as if it were payable under an order of that court. Appeals 5 (1) A person who is given a penalty notice may appeal to the First-tier Tribunal (“the Tribunal”) against the decision to give the notice or any requirement of it. (2) An appeal may be on the ground that the decision or requirement— (a) is based on an error of fact, (b) is wrong in law, or (c) is unreasonable. (3) But an appeal against the amount of a penalty may not be made on the ground mentioned in sub-paragraph (2)(c). (4) An appeal under this paragraph must be made before the end of the period of 28 days beginning with the day on which the penalty notice is given. (5) On an appeal the Tribunal may— (a) confirm or quash the decision to give the penalty notice, or (b) confirm or vary any requirement of it. (6) In determining an appeal the Tribunal may— (a) review any determination of fact on which the decision or requirement appealed against is based, and (b) take into account evidence which was not available to the Secretary of State when giving the notice. (7) Where an appeal in respect of a penalty notice is made under this paragraph the notice is of no effect until the appeal is determined or withdrawn. (8) Where an appeal is or may be made to the Upper Tribunal in relation to a decision of the Tribunal under this paragraph, the Upper Tribunal may suspend the notice to which the appeal relates until the appeal is determined or withdrawn. (9) If the Tribunal confirms or varies a decision or requirement appealed against under this paragraph, the person to whom the penalty notice is given must comply with the notice or the notice as varied (as the case may be)— (a) within such period as may be specified by the Tribunal, or (b) if the Tribunal does not specify a period, within such period as may be specified by the Secretary of State and notified to the person.
Propose a changeSection 58 In the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)), after Schedule 2 insert— Schedule 2ZA Monetary penalties in relation to requirements under Articles 45E and 45F Article 45G Power to impose monetary penaltiesamen 1 (1) The Secretary of State may give a notice (a “penalty notice”) imposing a penalty on a person if satisfied on the balance of probabilities that the person— (a) has failed to comply with a requirement imposed on the person to— (i) pay a fee in accordance with regulations under Article 45E(1), or (ii) provide information in accordance with regulations under Article 45F(1) or (2), or (b) has, in purported compliance with a requirement imposed on the person under regulations under Article 45F(1) or (2), provided information that is false or misleading in a material respect. (2) The amount of a penalty imposed by a penalty notice must be such amount as is specified in, or determined in accordance with, regulations made by the Secretary of State. (3) A penalty imposed by a penalty notice must be paid to the Secretary of State within such period as may be specified in the notice. (4) The Secretary of State may not give more than one penalty notice to a person in respect of the same failure or conduct. Warning notices 2 (1) Where the Secretary of State proposes to give a penalty notice to a person the Secretary of State must give the person a notice (a “warning notice”) notifying the person of the Secretary of State’s proposal. (2) A warning notice must— (a) state the name and address of the person to whom the Secretary of State proposes to give a penalty notice; (b) give reasons why the Secretary of State proposes to give the person a penalty notice; (c) state the amount of the proposed penalty; (d) specify the date before which the person may make written representations to the Secretary of State. (3) The date specified under sub-paragraph (2)(d) must be a date falling at least 28 days after the day on which the warning notice is given. Penalty notices 3 (1) Within the period of six months beginning with the day on which a warning notice is given to a person the Secretary of State must give to the person— (a) a notice stating that the Secretary of State has decided not to give a penalty notice to the person, or (b) a penalty notice. (2) But the Secretary of State may not give a penalty notice to a person before the date specified in the warning notice in accordance with paragraph 2(2)(d). (3) A penalty notice given to a person must— (a) state the name and address of the person; (b) give details of the warning notice given to the person; (c) state whether or not the Secretary of State has received written representations in accordance with that notice; (d) give reasons for the Secretary of State’s decision to impose a penalty on the person; (e) state the amount of the penalty; (f) give details of how the penalty may be paid; (g) specify the date before which the penalty must be paid; (h) give details about the person’s rights of appeal; (i) give details about the consequences of non-payment. (4) The date specified under sub-paragraph (3)(g) must be a date falling at least 28 days after the day on which the penalty notice is given. (5) The Secretary of State may cancel a penalty notice by giving a notice to that effect to the person to whom the penalty notice is given. (6) If a penalty notice is cancelled, the Secretary of State— (a) may not give a further penalty notice in relation to the failure or conduct to which the notice relates, and (b) must repay any amount that has been paid in accordance with the notice. Enforcement 4 If a person does not pay the whole or any part of a penalty which the person is liable to pay under this Schedule the penalty or part of the penalty is recoverable— (a) if a county court so orders, as if it were payable under an order of that court; (b) if the High Court so orders, as if it were payable under an order of that court. Appeals 5 (1) A person who is given a penalty notice may appeal to the First-tier Tribunal (“the Tribunal”) against the decision to give the notice or any requirement of it. (2) An appeal may be on the ground that the decision or requirement— (a) is based on an error of fact, (b) is wrong in law, or (c) is unreasonable. (3) But an appeal against the amount of a penalty may not be made on the ground mentioned in sub-paragraph (2)(c). (4) An appeal under this paragraph must be made before the end of the period of 28 days beginning with the day on which the penalty notice is given. (5) On an appeal the Tribunal may— (a) confirm or quash the decision to give the penalty notice, or (b) confirm or vary any requirement of it. (6) In determining an appeal the Tribunal may— (a) review any determination of fact on which the decision or requirement appealed against is based, and (b) take into account evidence which was not available to the Secretary of State when giving the notice. (7) Where an appeal in respect of a penalty notice is made under this paragraph the notice is of no effect until the appeal is determined or withdrawn. (8) Where an appeal is or may be made to the Upper Tribunal in relation to a decision of the Tribunal under this paragraph, the Upper Tribunal may suspend the notice to which the appeal relates until the appeal is determined or withdrawn. (9) If the Tribunal confirms or varies a decision or requirement appealed against under this paragraph, the person to whom the penalty notice is given must comply with the notice or the notice as varied (as the case may be)— (a) within such period as may be specified by the Tribunal, or (b) if the Tribunal does not specify a period, within such period as may be specified by the Secretary of State and notified to the person.
Propose a changeSection 70 In the UK GDPR, at the end insert— ANNEX 1 LAWFULNESS OF PROCESSING: RECOGNISED LEGITIMATE INTERESTS Disclosure for purposes of processing described in Article 6(1)(e) 1. This condition is met where— (a) the processing is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person, and (b) the request states that the other person needs the personal data for the purposes of carrying out processing described in Article 6(1)(e) that has a legal basis that satisfies Article 6(3). National security, public security and defence 2. This condition is met where the processing is necessary— (a) for the purposes of safeguarding national security, (b) for the purposes of protecting public security, or (c) for defence purposes. Emergencies 3. This condition is met where the processing is necessary for the purposes of responding to an emergency. 4. In paragraph 3, “emergency” has the same meaning as in Part 2 of the Civil Contingencies Act 2004. Crime 5. This condition is met where the processing is necessary for the purposes of— (a) detecting, investigating or preventing crime, or (b) apprehending or prosecuting offenders. Safeguarding vulnerable individuals 6. This condition is met where the processing is necessary for the purposes of safeguarding a vulnerable individual. 7. In paragraph 6— “safeguarding”, in relation to a vulnerable individual, means— protecting a vulnerable individual from neglect or physical, mental or emotional harm, or protecting the physical, mental or emotional well-being of a vulnerable individual; “vulnerable individual” means an individual— aged under 18, or aged 18 or over and at risk. 8. For the purposes of paragraph 7— (a) protection of an individual, or of the well-being of an individual, includes both protection relating to a particular individual and protection relating to a type of individual, and (b) an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual— (i) has needs for care and support, (ii) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and (iii) as a result of those needs is unable to protect themselves against the neglect, harm or risk.
Propose a changeSection 71 In the UK GDPR, after Annex 1 (inserted by Schedule 4 to this Act) insert— ANNEX 2 PURPOSE LIMITATION: PROCESSING TO BE TREATED AS COMPATIBLE WITH ORIGINAL PURPOSE Disclosure for purposes of processing described in Article 6(1)(e) 1. This condition is met where— (a) the processing— (i) is necessary for the purposes of making a disclosure of personal data to another person in response to a request from the other person, and (ii) is not carried out by a public authority in the performance of its tasks, and (b) the request states that the other person needs the personal data for the purposes of carrying out processing that— (i) is described in Article 6(1)(e), (ii) has a legal basis that satisfies Article 6(3), and (iii) is necessary to safeguard an objective listed in Article 23(1)(c) to (j). Disclosure for the purposes of archiving in the public interest 2. This condition is met where— (a) the processing— (i) is necessary for the purposes of making a disclosure of personal data to another person (“R”) in response to a request from R, and (ii) is carried out in accordance with Article 84B, (b) the controller in relation to the processing collected the personal data based on Article 6(1)(a) (data subject’s consent), (c) the request from R states that R intends to process the personal data only for the purposes of archiving in the public interest, and (d) the controller reasonably believes that R will carry out that processing in accordance with generally recognised standards relevant to R’s archiving in the public interest. Public security 3. This condition is met where the processing is necessary for the purposes of protecting public security. Emergencies 4. This condition is met where the processing is necessary for the purposes of responding to an emergency. 5. In paragraph 4, “emergency” has the same meaning as in Part 2 of the Civil Contingencies Act 2004. Crime 6. This condition is met where the processing is necessary for the purposes of— (a) detecting, investigating or preventing crime, or (b) apprehending or prosecuting offenders. Protection of vital interests of data subjects and others 7. This condition is met where the processing is necessary for the purposes of protecting the vital interests of the data subject or another individual. Safeguarding vulnerable individuals 8. This condition is met where the processing is necessary for the purposes of safeguarding a vulnerable individual. 9. In paragraph 8— “safeguarding”, in relation to a vulnerable individual, means — protecting a vulnerable individual from neglect or physical, mental or emotional harm, or protecting the physical, mental or emotional well-being of a vulnerable individual; “vulnerable individual” means an individual— aged under 18, or aged 18 or over and at risk. 10. For the purposes of paragraph 9— (a) protection of an individual, or of the well-being of an individual, includes both protection relating to a particular individual and protection relating to a type of individual, and (b) an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual— (i) has needs for care and support, (ii) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and (iii) as a result of those needs is unable to protect themselves against the neglect, harm or risk. Taxation 11. This condition is met where the processing is necessary for the purposes of the assessment or collection of a tax or duty or an imposition of a similar nature. Legal obligations 12. This condition is met where the processing is necessary for the purposes of complying with an obligation of the controller under an enactment, a rule of law or an order of a court or tribunal.
Propose a changeSection 80 The UK GDPR 1 The UK GDPR is amended as follows. 2 (1) Article 12 (transparent information, communication and modalities for the exercise of the rights of the data subject) is amended as follows. (2) In paragraph 1, for “under Articles 15 to 22” substitute “made under or by virtue of Articles 15 to 22D”. (3) In paragraph 2— (a) for “under Articles 15 to 22”, in the first place it occurs, substitute “arising under or by virtue of Articles 15 to 22D”, and (b) for “his or her rights under Articles 15 to 22” substitute “those rights”. (4) In paragraph 3, for “under Articles 15 to 22” substitute “made under or by virtue of Articles 15 to 22D”. (5) In paragraph 5, for “under Articles 15 to 22” substitute “under or by virtue of Articles 15 to 22D”. (6) In paragraph 6, for “referred to in Articles 15 to 21” substitute “made under or by virtue of Articles 15 to 22D”. 3 In Article 13(2)(f) (information about automated decision-making to be provided where personal data is collected from the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”. 4 In Article 14(2)(g) (information about automated decision-making to be provided where personal data is not obtained from the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”. 5 In Article 15(1)(h) (right of access by the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”. 6 In the heading of Section 4 of Chapter 3, omit “and automated decision-making”. 7 In Article 23(1) (restrictions), for “provided for in Articles 12 to 22”, in both places it occurs, substitute “arising under or by virtue of Articles 12 to 22D”. 8 In Article 47(2)(e) (binding corporate rules), for the words from “the right not” to “Article 22” substitute “the right to protection in accordance with, and with regulations made under, Articles 22A to 22D in connection with decisions based solely on automated processing (including decisions reached by means of profiling)”. 9 In Article 83(5) (general conditions for imposing administrative fines)— (a) in point (b), for “22” substitute “21”, and (b) after that point insert— (ba) Article 22B or 22C (restrictions on, and safeguards for, automated decision-making); . The 2018 Act 10 The 2018 Act is amended as follows. 11 Omit section 14 (automated decision-making authorised by law: safeguards). 12 In section 43(1)(d) (overview and scope of provisions in Part 3 about rights of the data subject), for “sections 49 and 50” substitute “sections 50A to 50D”. 13 (1) Section 52 (form of provision of information etc) is amended as follows. (2) In subsection (1), after “by” insert “or under”. (3) In subsection (3), for “by the data subject under section 45, 46, 47 or 50” substitute “made by the data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D”. (4) In subsection (4), for “under section 45, 46 or 47” substitute “under or by virtue of any of sections 45, 46, 47, 50C or 50D”. (5) In subsection (5), after “by” insert “or under”. (6) In subsection (6), for “under sections 45 to 50” substitute “arising under or by virtue of sections 45 to 50D”. 14 (1) Section 53 (manifestly unfounded or excessive requests by the data subject) is amended as follows. (2) In subsection (1), for “from a data subject under section 45, 46, 47 or 50” substitute “made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D”. (3) In subsection (3), for “under section 45, 46, 47 or 50” substitute “described in subsection (1)”. 15 In section 149(2)(b) (enforcement notices)— (a) after “provision of” insert “or made under”, and (b) for “22” substitute “22D”. 16 In section 157(2)(a) (maximum amount of penalty), for “49,” substitute “50B, 50C,”.
Propose a changeSection 85 Introduction 1 Chapter 5 of the UK GDPR (transfers of personal data to third countries or international organisations) is amended as follows. General principles for transfers 2 (1) Omit Article 44 (transfers of personal data to third countries etc: general principle for transfers). (2) After that Article insert— General principles for transfers Article 44A 1. A controller or processor may transfer personal data to a third country or an international organisation only if— (a) the condition in paragraph 2 is met, and (b) the transfer is carried out in compliance with the other provisions of this Regulation. 2. The condition is met if the transfer— (a) is approved by regulations under Article 45A that are in force at the time of the transfer, (b) is made subject to appropriate safeguards (see Article 46), or (c) is made in reliance on a derogation for specific situations (see Article 49). 3. A transfer may not be made in reliance on paragraph 2(b) or (c) if, or to the extent that, it would breach a restriction in regulations under Article 49A. Transfers approved by regulations 3 Omit Article 45 (transfers on the basis of an adequacy decision). 4 After that Article insert— Transfers approved by regulations Article 45A 1. For the purposes of Article 44A, the Secretary of State may by regulations approve transfers of personal data to— (a) a third country, or (b) an international organisation. 2. The Secretary of State may only make regulations under this Article approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see Article 45B). 3. In making regulations under this Article, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom. 4. Regulations under this Article may, among other things— (a) make provision in relation to a third country or international organisation specified in the regulations or a description of country or organisation; (b) approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations; (c) identify a transfer of personal data by any means, including by reference to— (i) a sector or geographic area within a third country, (ii) the controller or processor, (iii) the recipient of the personal data, (iv) the personal data transferred, (v) the means by which the transfer is made, or (vi) relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time; (d) confer a discretion on a person. 5. Regulations under this Article are subject to the negative resolution procedure. The data protection test Article 45B 1. For the purposes of Article 45A, the data protection test is met in relation to transfers of personal data to a third country or international organisation if the standard of the protection provided for data subjects with regard to general processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under— (a) this Regulation, (b) Part 2 of the 2018 Act, and (c) Parts 5 to 7 of that Act, so far as relevant to general processing. 2. In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things— (a) respect for the rule of law and for human rights in the country or by the organisation, (b) the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation, (c) arrangements for judicial or non-judicial redress for data subjects in connection with such processing, (d) rules about the transfer of personal data from the country or by the organisation to other countries or international organisations, (e) relevant international obligations of the country or organisation, and (f) the constitution, traditions and culture of the country or organisation. 3. In paragraphs 1 and 2— (a) the references to the protection provided for data subjects are to that protection taken as a whole, (b) the references to general processing are to processing to which this Regulation applies or equivalent types of processing in the third country or by the international organisation (as appropriate), and (c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Regulation applies as described in Article 3. 4. When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with Article 45A(4)(b))— (a) the references in paragraphs 1 to 3 to personal data are to be read as references only to personal data likely to be the subject of such transfers, and (b) the reference in paragraph 2(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation. Transfers approved by regulations: monitoring 5 After Article 45B (inserted by paragraph 4) insert— Transfers approved by regulations: monitoring Article 45C 1. The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under Article 45A or to amend or revoke such regulations. 2. Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under Article 45A, the Secretary of State must, to the extent necessary, amend or revoke the regulations. 3. Where regulations under Article 45A are amended or revoked in accordance with paragraph 2, the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation. 4. The Secretary of State must publish— (a) a list of the third countries and international organisations, and the descriptions of such countries and organisations, which are for the time being approved by regulations under Article 45A as places or persons to which personal data may be transferred, and (b) a list of the third countries and international organisations, and the descriptions of such countries and organisations, which have been but are no longer approved by such regulations. 5. In the case of regulations under Article 45A which approve only certain transfers to a third country or international organisation specified or described in the regulations (in accordance with Article 45A(4)(b)), the lists published under paragraph 4 must specify or describe the relevant transfers. Transfers subject to appropriate safeguards 6 (1) Article 46 (transfers subject to appropriate safeguards) is amended as follows. (2) Omit paragraph 1. (3) After that paragraph insert— 1A. A transfer of personal data to a third country or an international organisation by a controller or processor is made subject to appropriate safeguards only— (a) in a case in which— (i) safeguards are provided in connection with the transfer as described in paragraph 2 or 3 or regulations made under Article 47A(4), and (ii) the controller or processor, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see paragraph 6), or (b) in a case in which— (i) safeguards are provided in accordance with paragraph 2(a) by an instrument that is intended to be relied on in connection with the transfer or that type of transfer, and (ii) each public body that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see paragraph 6). (4) In paragraph 2— (a) in the words before point (a)— (i) omit “appropriate”, and (ii) for “paragraph 1” substitute “paragraph 1A(a)”, (b) in point (a), for “public authorities or bodies” substitute “a public body and another relevant person or persons”, (c) in point (b), after “rules” insert “approved”, (d) in point (c), for “section 17C of the 2018 Act” substitute “Article 47A(1)”, (e) in point (e), for “appropriate safeguards” substitute “safeguards provided by the code”, and (f) in point (f), for “appropriate safeguards” substitute “safeguards provided by the mechanism”. (5) In paragraph 3, in the words before point (a)— (a) omit “appropriate”, (b) for “paragraph 1” substitute “paragraph 1A(a)”, (c) omit “, in particular,”, and (d) in point (b), for “public authorities or bodies” substitute “a public body and another relevant person or persons”. (6) At the end insert— 6. For the purposes of this Article, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data by the safeguards required under paragraph 1A, and (where relevant) by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under— (a) this Regulation, (b) Part 2 of the 2018 Act, and (c) Parts 5 to 7 of that Act, so far as relevant to processing to which this Regulation applies. 7. For the purposes of paragraph 1A(a)(ii) and (b)(ii), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred. 8. In this Article— (a) references to the protection provided for the data subject are to that protection taken as a whole; (b) “relevant person” means a public body or another person exercising functions of a public nature. 7 In the heading of Article 47 (binding corporate rules) at the beginning insert “Transfers subject to appropriate safeguards:”. 8 After Article 47 insert— Transfers subject to appropriate safeguards: further provision Article 47A 1. The Secretary of State may by regulations specify standard data protection clauses which the Secretary of State considers are capable of securing that the data protection test set out in Article 46 is met in relation to transfers of personal data generally or in relation to a type of transfer specified in the regulations. 2. The Secretary of State must keep under review the standard data protection clauses specified in regulations under paragraph 1 that are for the time being in force. 3. Regulations under paragraph 1 are subject to the negative resolution procedure. 4. The Secretary of State may by regulations make provision about further safeguards that may be relied on for the purposes of Article 46(1A)(a). 5. The Secretary of State may only make regulations under paragraph 4 if the Secretary of State considers that the further safeguards are capable of securing that the data protection test set out in Article 46 is met in relation to transfers of personal data generally or in relation to a type of transfer specified in the regulations. 6. Regulations under paragraph 4 may, among other things— (a) make provision by adopting safeguards prepared or published by another person; (b) make provision about ways of providing safeguards which require authorisation from the Commissioner. 7. Regulations under paragraph 4 which amend Article 46 may do so only in the following ways— (a) by adding ways of providing safeguards, or (b) by varying or omitting ways of providing safeguards which were added by regulations under this Article. 8. Regulations under paragraph 4 are subject to the affirmative resolution procedure. Derogations for specific situations 9 (1) Article 49 (derogations for specific situations) is amended as follows. (2) In paragraph 1, in the first subparagraph— (a) for “adequacy regulations under section 17A of the 2018 Act, or of appropriate safeguards pursuant to Article 46, including binding corporate rules” substitute “approval by regulations under Article 45A and of compliance with Article 46 (appropriate safeguards)”, and (b) in point (a), for “an adequacy decision” substitute “approval by regulations under Article 45A”. (3) In paragraph 1, in the second subparagraph, for “a provision in Article 45” substitute “Article 45A”. (4) In paragraph 4, for “section 18(1) of the 2018 Act” substitute “paragraph 4A”. (5) After paragraph 4 insert— 4A. The Secretary of State may by regulations specify for the purposes of point (d) of paragraph 1— (a) circumstances in which a transfer of personal data to a third country or international organisation is to be taken to be necessary for important reasons of public interest, and (b) circumstances in which a transfer of personal data to a third country or international organisation which is not required by an enactment is not to be taken to be necessary for important reasons of public interest. (6) Omit paragraph 5A. (7) After paragraph 6 insert— 7. Regulations under this Article— (a) are subject to the made affirmative resolution procedure where the Secretary of State has made an urgency statement in respect of them; (b) otherwise, are subject to the affirmative resolution procedure. 8. For the purposes of this Article, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay. Public interest restrictions 10 After Article 49 insert— Restriction in the public interest Article 49A 1. The Secretary of State may by regulations restrict the transfer of a category of personal data to a third country or international organisation where— (a) the transfer is not approved by regulations under Article 45A for the time being in force, and (b) the Secretary of State considers the restriction to be necessary for important reasons of public interest. 2. Regulations under this Article— (a) are subject to the made affirmative resolution procedure where the Secretary of State has made an urgency statement in respect of them; (b) otherwise, are subject to the affirmative resolution procedure. 3. For the purposes of this Article, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.
Propose a changeSection 85 Introduction 1 Chapter 5 of Part 3 of the 2018 Act (transfers of personal data to third countries etc) is amended as follows. Overview and interpretation 2 In section 72 (overview and interpretation), in subsection (1)(b)— (a) for “the special conditions that apply” substitute “additional conditions that apply in certain cases”, and (b) after “organisation” insert “(see section 73(4)(b))”. General principles for transfer 3 (1) Section 73 (general principles for transfers) is amended as follows. (2) Before subsection (1) insert— (A1) This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose. (3) In subsection (1)— (a) for the words before paragraph (a) substitute “The controller in relation to the transfer must secure that the transfer takes place only if—”, (b) omit the “and” at the end of paragraph (a), and (c) after paragraph (b) insert , and— (c) the transfer is carried out in accordance with the other provisions of this Part. (4) For subsection (3) substitute— (3) Condition 2 is that the transfer— (a) is approved by regulations under section 74AA that are in force at the time of the transfer, (b) is made subject to appropriate safeguards (see section 75), or (c) is based on special circumstances (see section 76). (5) In subsection (4)— (a) after paragraph (a) (but before the “or” at the end of that paragraph) insert— (aa) the intended recipient is a person in a third country who— (i) is not a person described in paragraph (a), but (ii) is a processor whose processing, on behalf of the controller, of the personal data transferred is governed by, or authorised in accordance with, a contract with the controller that complies with section 59, , and (b) in paragraph (b)(i), for “other than a relevant authority” substitute “who is not a person described in paragraph (a) or (aa)”. (6) In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”. Transfers approved by regulations 4 (1) Omit section 74A (transfers based on adequacy regulations). (2) After that section insert— Transfers approved by regulations 74AA (1) For the purposes of section 73, the Secretary of State may by regulations approve transfers of personal data to— (a) a third country, or (b) an international organisation. (2) The Secretary of State may only make regulations under this section approving transfers to a third country or international organisation if the Secretary of State considers that the data protection test is met in relation to the transfers (see section 74AB). (3) In making regulations under this section, the Secretary of State may have regard to any matter which the Secretary of State considers relevant, including the desirability of facilitating transfers of personal data to and from the United Kingdom. (4) Regulations under this section may, among other things— (a) make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation; (b) approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations; (c) identify a transfer of personal data by any means, including by reference to— (i) a sector or geographic area within a third country, (ii) the controller or processor, (iii) the recipient of the personal data, (iv) the personal data transferred, (v) the means by which the transfer is made, or (vi) relevant legislation, schemes, lists or other arrangements or documents, as they have effect from time to time; (d) confer a discretion on a person. (5) Regulations under this section are subject to the negative resolution procedure. The data protection test 74AB (1) For the purposes of section 74AA, the data protection test is met in relation to transfers to a third country or international organisation if the standard of the protection provided for data subjects with regard to law enforcement processing of personal data in the country or by the organisation is not materially lower than the standard of the protection provided for data subjects by or under— (a) this Part, and (b) Parts 5 to 7, so far as relevant to law enforcement processing. (2) In considering whether the data protection test is met in relation to transfers of personal data to a third country or international organisation, the Secretary of State must consider, among other things— (a) respect for the rule of law and for human rights in the country or by the organisation, (b) the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation, (c) arrangements for judicial or non-judicial redress for data subjects in connection with such processing, (d) rules about the transfer of personal data from the country or by the organisation to other countries or international organisations, (e) relevant international obligations of the country or organisation, and (f) the constitution, traditions and culture of the country or organisation. (3) In subsections (1) and (2)— (a) the references to the protection provided for data subjects are to that protection taken as a whole, (b) the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and (c) the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2). (4) When the data protection test is applied only to certain transfers to a third country or international organisation that are specified or described, or to be specified or described, in regulations (in accordance with section 74AA(4)(b))— (a) the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and (b) the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation. Transfers approved by regulations: monitoring 5 (1) Section 74B (transfers based on adequacy regulations: review etc) is amended as follows. (2) For the heading substitute “Transfers approved by regulations: monitoring”. (3) Omit subsections (1) and (2). (4) In subsection (3), for “under section 74A” substitute “giving approval under section 74AA”. (5) In subsection (4), for the words from the beginning to “otherwise,” substitute “Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA,”. (6) In subsection (5)— (a) for “section 74A” substitute “section 74AA”, and (b) for “remedying the lack of an adequate level of protection” substitute “improving the protection provided to data subjects with regard to the processing of personal data in the country or by the organisation”. (7) In subsection (6)(a)— (a) omit “, territories and specified sectors within a third country”, (b) omit “, territories, sectors”, and (c) for “specified in regulations under section 74A” substitute “approved by regulations under section 74AA as places or persons to which personal data may be transferred”. (8) In subsection (6)(b)— (a) omit “, territories and specified sectors within a third country”, (b) omit “, territories, sectors”, and (c) for “specified in” substitute “approved by”. (9) In subsection (7)— (a) for “regulations under section 74A which specify that an adequate level of protection of personal data is ensured only for a transfer” substitute “regulations under section 74AA which approve only certain transfers to a third country or international organisation that are”, (b) after “the regulations” insert “(in accordance with section 74AA(4)(b))”, and (c) omit paragraph (a) (together with the final “and”). Transfers subject to appropriate safeguards 6 (1) Section 75 (transfers on the basis of appropriate safeguards) is amended as follows. (2) In the heading, for “on the basis of” substitute “subject to”. (3) Omit subsection (1). (4) After that subsection insert— (1A) A transfer of personal data to a third country or an international organisation is made subject to appropriate safeguards only if— (a) an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or (b) the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)). (5) In subsection (2), for “subsection (1)(b)” substitute “subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)”. (6) In subsection (3), for “subsection (1)” substitute “this section but not in reliance on section 73(4)(aa) (transfer to processor)”. (7) At the end insert— (4) For the purposes of this section, a legal instrument is “appropriate”, in relation to a transfer of personal data, if— (a) the instrument is intended to be relied on in connection with the transfer or that type of transfer, (b) at least one competent authority is a party to the instrument, and (c) each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)). (5) For the purposes of this section, the data protection test is met in relation to a transfer, or a type of transfer, of personal data if, after the transfer, the standard of the protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided for the data subject with regard to the personal data by or under— (a) this Part, and (b) Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes. (6) For the purposes of subsections (1A)(b) and (4)(c), what is reasonable and proportionate is to be determined by reference to all the circumstances, or likely circumstances, of the transfer or type of transfer, including the nature and volume of the personal data transferred. (7) In this section, references to the protection provided for the data subject are to that protection taken as a whole. Transfers based on special circumstances 7 (1) Section 76 (transfers on the basis of special circumstances) is amended as follows. (2) In the heading, for “on the basis of” substitute “based on”. (3) Before subsection (1) insert— (A1) A transfer of personal data to a third country or international organisation is based on special circumstances where— (a) it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and (b) it is necessary for a special purpose. (4) In subsection (1)— (a) for the words before paragraph (a) substitute “A transfer of personal data is necessary for a special purpose if it is necessary—”, (b) in paragraph (c)— (i) after “public security” insert “or national security”, and (ii) at the end insert “or the United Kingdom”, (c) in paragraph (d), for “in individual cases” substitute “in particular circumstances,”, and (d) in paragraph (e), for “in individual cases” substitute “in particular circumstances,”. (5) In subsection (2), for “But subsection (1)(d) and (e) do not apply” substitute “But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e)”. (6) After subsection (2) insert— (2A) In accordance with the third data protection principle, the amount of personal data transferred in reliance on this section must not be excessive in relation to the special purpose relied on. (7) In subsection (3), for “subsection (1)” substitute “this section”. Transfers to particular recipients 8 For the italic heading before section 77 substitute “Additional conditions”. 9 (1) Section 77 (conditions for transfers of personal data to persons other than relevant authorities) is amended as follows. (2) For the heading substitute “Additional conditions for transfers in reliance on section 73(4)(b)”. (3) In subsection (6), for “other than a relevant authority” substitute “in reliance on section 73(4)(b)”. (4) In subsection (7)(a), for “other than a relevant authority” substitute “that takes place in reliance on section 73(4)(b)”. Subsequent transfers 10 (1) Section 78 (subsequent transfers) is amended as follows. (2) Before subsection (1) insert— (A1) Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section 73(4)(aa) (transfer to processor). (3) In subsection (1)— (a) omit “Where personal data is transferred in accordance with section 73,”, (b) after “transfer” insert — (a) , (c) for “the data” substitute “the personal data”, and (d) at the end insert “(the “UK authoriser”), or (b) that— (i) the personal data is not to be so transferred without such authorisation except where subsection (1A) applies, and (ii) where a transfer is made without such authorisation, the UK authoriser must be informed without delay. (4) After subsection (1) insert— (1A) This subsection applies if— (a) the transfer is necessary for the prevention of an immediate and serious threat to the public security or national security of a third country or the United Kingdom, and (b) authorisation from the UK authoriser cannot be obtained in good time. (5) In subsection (2)— (a) for “A competent authority” substitute “The UK authoriser”, and (b) for “under subsection (1)” substitute “for the purposes of a condition described in subsection (1)”. (6) In subsection (3), for “competent authority” substitute “UK authoriser”. (7) In subsection (4), for “an authorisation may not be given under subsection (1)” substitute “the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1)”. (8) In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”. (9) In subsection (6)— (a) after “made” insert “in a case described in subsection (4)”, (b) for “subsection (4)” substitute “that subsection (whether made with or without authorisation from the UK authoriser), the UK authoriser must, without delay, inform”, and (c) omit “must be informed without delay”. (10) At the end insert— (7) Where a transfer takes place in reliance on section 73(4)(aa) (transfer to processor), the transferring controller must make it a condition of the transfer that the data is only to be further transferred to a third country or international organisation where— (a) the terms of any relevant contract entered into, or authorisation given, by the transferring controller in accordance with section 59 are complied with, and (b) the further transfer satisfies the requirements in section 73(1).
Propose a changeSection 85 Part 1 Minor and consequential amendments The UK GDPR 1 The UK GDPR is amended as follows. 2 In Article 13(1)(f) (information to be provided where personal data is collected from the data subject)— (a) for “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”, and (b) for “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”. 3 In Article 14(1)(f) (information to be provided where personal data is not obtained from the data subject)— (a) for “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”, and (b) for “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”. 4 In Article 15(2) (right of access by the data subject)— (a) after “organisation” insert “in reliance on Article 46”, and (b) for “appropriate safeguards pursuant to Article 46 relating to” substitute “safeguards provided in accordance with Article 46(1A)(a)(i) or (b)(i) for the purposes of”. 5 (1) Article 40 (codes of conduct) is amended as follows. (2) In paragraph 3 omit “appropriate” in both places. (3) In paragraph 5, for “provides sufficient appropriate safeguards” substitute “is capable of providing safeguards for the purposes of Article 46”. 6 In Article 42(2) (certification) omit “appropriate” in both places. 7 In Article 46(2)(d) (transfers subject to appropriate safeguards: standard data protection clauses), after “Commissioner” insert “for the purposes of this Article”. 8 In Article 57(1) (Commissioner’s tasks)— (a) in point (m) omit “which provide sufficient safeguards,”, and (b) after point (s) insert— (sa) provide authorisation required under regulations made under Article 47A; . 9 In Article 58(3) (authorisation and advisory powers of the Commissioner), after point (j) insert— (k) to provide authorisation required under regulations made under Article 47A . 10 In Article 83(5)(c) (general conditions for imposing administrative fines), for “44” substitute “44A”. The 2018 Act 11 The 2018 Act is amended as follows. 12 Omit section 17A (transfers based on adequacy regulations) and the italic heading before it. 13 Omit section 17B (transfers based on adequacy regulations: review etc). 14 Omit section 17C (standard data protection clauses). 15 Omit section 18 (transfers of personal data to third countries etc: public interest). 16 In section 24(2) (manual unstructured data held by FOI public authorities)— (a) in paragraph (c), for “44 to 49” substitute “44A to 49A”, and (b) omit paragraph (ca). 17 In section 26(2) (national security and defence exemption), omit paragraph (fa). 18 In section 75 (transfers on the basis of appropriate safeguards), after subsection (7) (inserted by Schedule 8 to this Act) insert— (8) For provision about standard data protection clauses which the Commissioner considers are capable of securing that the data protection test in this section is met, see section 119A. 19 In section 78A (law enforcement processing: national security exemption) (inserted by section 88 of this Act), in subsection (2)(e), after sub-paragraph (i) insert— (ia) section 119A (standard clauses for transfers to third countries); . 20 (1) Section 119A (power of Commissioner to specify standard clauses for transfers to third countries etc providing appropriate safeguards) is amended as follows. (2) In subsection (1), for the words from “provide” to the end substitute “are capable of securing that the data protection test set out in Article 46 of the UK GDPR or section 75 of this Act (or both) is met in relation to transfers of personal data”. (3) In subsection (3), after paragraph (a) insert— (aa) may make provision generally or in relation to types of transfer described in the document, . 21 In section 149(2)(e) (enforcement notices), for “44 to 49” substitute “44A to 49A”. 22 (1) Section 182 (regulations and consultation) is amended as follows. (2) Omit subsection (4). (3) In subsection (6), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”. (4) In subsection (7), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”. (5) In subsection (8)— (a) for “Where regulations under this Act” substitute “For the purposes of this Act, regulations”, (b) after “procedure”” insert “if”, (c) in paragraph (a), for “the urgency” substitute “an urgency”, and (d) in paragraph (b), for “the period of 120 days” substitute “a period”. (6) Omit subsections (9) and (10). (7) In subsection (11), after “by regulations” insert “made under this Act or another enactment that are”. (8) For subsection (14) substitute— (14) For the purposes of this section, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for regulations to come into force without delay. 23 In section 205(2)(e) (references to periods of time) omit “and (9)”. 24 In paragraph 26(9)(d) of Schedule 2 (exemptions etc for journalistic, academic, artistic and literary purposes), for “44” substitute “44A”. 25 (1) Part 3 of Schedule 21 (further transitional provision etc: transfers to third countries and international organisations) is amended as follows. (2) In the heading before paragraph 4, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”. (3) In paragraph 4 (UK GDPR: adequacy decisions and adequacy regulations)— (a) in sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under Article 45A of the UK GDPR”, (b) in sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”, and (c) omit sub-paragraph (6). (4) In paragraph 6 (UK GDPR: application of certain provisions referring to regulations made under section 17A of the 2018 Act)— (a) in sub-paragraph (1)(a), for “section 17A” substitute “Article 45A of the UK GDPR”, (b) for sub-paragraph (2) substitute— (2) Those provisions are Articles 13(1)(f), 14(1)(f), 45C, 49(1) and 49A(1) of the UK GDPR. , and (c) after that sub-paragraph insert— (3) In its application to transfers treated as approved by virtue of paragraph 1, Article 45C(5) of the UK GDPR (transfers approved by regulations: monitoring) has effect as if the reference to Article 45A(4)(b) were omitted. (5) Omit paragraphs 7 and 8 (UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses). (6) In paragraph 9 (UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules)— (a) in sub-paragraph (1)— (i) for “The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for” substitute “The requirement for safeguards to be provided under Article 46(1A)(a)(i) of the UK GDPR may be satisfied”, and (ii) after “described” insert “in”, (b) in sub-paragraph (3)(a)— (i) for “or provision” substitute “, of provision”, and (ii) for “(or both)” substitute “or of the amendment of Chapter 5 of the UK GDPR by the Data (Use and Access) Act 2025”, and (c) in sub-paragraph (4), after paragraph (a) insert— (aa) changing references to provision made by regulations under section 17A into references to provision made by regulations made under Article 45A of the UK GDPR; . (7) In the heading before paragraph 10, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”. (8) In paragraph 10 (law enforcement processing: adequacy decisions and adequacy regulations)— (a) in sub-paragraph (1), for “based on adequacy regulations” substitute “to be treated as approved by regulations made under section 74AA”, (b) in sub-paragraph (4)(a), for “lists or other” substitute “schemes, lists or other arrangements or”, and (c) omit sub-paragraph (6). (9) In paragraph 12 (Part 3 (law enforcement processing): application of certain provisions referring to regulations made under section 74A)— (a) the existing text becomes sub-paragraph (1), (b) in that sub-paragraph— (i) for the words before paragraph (a) substitute “In sections 74B and 76(A1)—”, and (ii) in paragraph (a), for “74A” substitute “74AA”, and (c) after that sub-paragraph insert— (2) In its application to transfers treated as approved by virtue of paragraph 10, section 74B(7) (transfers approved by regulations: monitoring) has effect as if the reference to section 74AA(4)(b) were omitted. Part 2 Transitional provision The UK GDPR: transfers approved by regulations 26 (1) Regulations made under section 17A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 45A of the UK GDPR (inserted by Schedule 7 to this Act). (2) In this paragraph, “the relevant day” means the day on which paragraph 4 of Schedule 7 to this Act comes into force. The UK GDPR: transfers subject to appropriate safeguards 27 (1) For the purposes of Article 44A(1)(a) and (2)(b) of the UK GDPR (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is made subject to appropriate safeguards where— (a) the transfer is made under arrangements entered into before the relevant day, (b) safeguards are provided in accordance with paragraph 2 or 3 of Article 46 of the UK GDPR or paragraph 9 of Schedule 21 to the 2018 Act, and (c) if the transfer had been made immediately before the relevant day, it would have satisfied— (i) the condition in Article 46(1) of the UK GDPR relating to data subjects’ rights and legal remedies, and (ii) the requirements of the last sentence of Article 44 of the UK GDPR (level of protection must not be undermined). (2) Sub-paragraph (1) has effect in addition to Article 46(1A) of the UK GDPR. (3) In this paragraph— “international organisation” has the same meaning as in the 2018 Act (see section 205 of that Act); “personal data” has the same meaning as in the 2018 Act (see section 3 of that Act); “the relevant day” means the day on which paragraph 6 of Schedule 7 to this Act comes into force; “third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act). The UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses 28 (1) Regulations made under section 17C of the 2018 Act (standard data protection clauses) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 47A(1) of the UK GDPR (inserted by Schedule 7 to this Act). (2) In this paragraph, “the relevant day” means the day on which paragraph 8 of Schedule 7 to this Act comes into force. 29 (1) This paragraph applies to a requirement for safeguards to be provided under— (a) Article 46(1A)(a)(i) of the UK GDPR, or (b) paragraph 27(1)(b) of this Schedule. (2) The requirement may be satisfied on and after the relevant day by a version of pre-commencement standard clauses incorporating changes where— (a) all of the changes are made in consequence of the amendment of Chapter 5 of the UK GDPR by this Act, and (b) none of the changes alters the effect of the clauses. (3) Changing a reference to regulations under section 17A of the 2018 Act into a reference to regulations made under Article 45A of the UK GDPR is to be treated as a change falling within sub-paragraph (2). (4) Sub-paragraphs (2) and (3) cease to apply in relation to pre-commencement standard clauses if— (a) the clauses are specified in regulations and a provision of the regulations relating to the clauses is amended or revoked on or after the relevant day, or (b) the clauses are specified in another document and a provision of the document relating to the clauses is amended or withdrawn by the Information Commissioner or the Information Commission on or after the relevant day. (5) Sub-paragraph (2) has effect in addition to Article 46(2) and (3) of the UK GDPR. (6) In this paragraph— “pre-commencement standard clauses” means standard data protection clauses specified in— regulations made under section 17C of the 2018 Act and in force immediately before the relevant day, or a document issued by the Information Commissioner under section 119A of the 2018 Act before the relevant day and not withdrawn before that day; “the relevant day” means the day on which paragraph 6 of Schedule 7 to this Act comes into force. The UK GDPR: transfers necessary for important reasons of public interest 30 (1) Regulations made under section 18(1) of the 2018 Act (transfers necessary for important reasons of public interest) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49(4A) of the UK GDPR (inserted by Schedule 7 to this Act). (2) In this paragraph, “the relevant day” means the day on which paragraph 9(5) of Schedule 7 to this Act comes into force. The UK GDPR: restrictions on transfers of personal data to third countries and international organisations 31 (1) Regulations made under section 18(2) of the 2018 Act (restrictions on transfers of personal data to third countries and international organisations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49A of the UK GDPR (inserted by Schedule 7 to this Act). (2) In this paragraph, “the relevant day” means the day on which paragraph 10 of Schedule 7 to this Act comes into force. Part 3 of the 2018 Act (law enforcement processing): transfers approved by regulations 32 (1) Regulations made under section 74A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under section 74AA of that Act (inserted by Schedule 8 to this Act). (2) In this paragraph, “the relevant day” means the day on which paragraph 4 of Schedule 8 to this Act comes into force. Part 3 of the 2018 Act (law enforcement processing): transfers subject to appropriate safeguards 33 (1) For the purposes of section 73(3) of the 2018 Act (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is a transfer made subject to appropriate safeguards where— (a) an appropriate pre-commencement legal instrument binds the intended recipient of the data, and (b) if the transfer had been made immediately before the relevant day, the requirement in section 75(1)(a) of the 2018 Act (binding legal instrument containing appropriate safeguards) would have been satisfied by virtue of that instrument. (2) Sub-paragraph (1) has effect in addition to section 75(1A) of the 2018 Act. (3) For the purposes of sub-paragraph (1), a legal instrument is an “appropriate pre-commencement legal instrument”, in relation to a transfer of personal data, if— (a) it was entered into before the relevant day, (b) it is intended to be relied on in connection with the transfer or that type of transfer, and (c) at least one competent authority is a party to the instrument. (4) In this paragraph— “competent authority” has the same meaning as in Part 3 of the 2018 Act (see section 30 of that Act); “international organisation” has the same meaning as in the 2018 Act (see section 205 of that Act); “personal data” has the same meaning as in the 2018 Act (see section 3 of that Act); “the relevant day” means the day on which paragraph 6 of Schedule 8 to this Act comes into force; “third country” has the same meaning as in Part 3 of the 2018 Act (see section 33 of that Act).
Propose a changeSection 103 The UK GDPR 1 The UK GDPR is amended as follows. 2 In Article 12(4) (transparent information, communication and modalities for the exercise of the rights of the data subject), for “lodging a complaint with the Commissioner” substitute “making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commissioner under section 165 of that Act”. 3 (1) Article 13(2) (information to be provided where personal data is collected from the data subject) is amended as follows. (2) After point (c) insert— (ca) the right to make a complaint to the controller under section 164A of the 2018 Act; . (3) In point (d), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”. 4 (1) Article 14(2) (information to be provided where personal data is not obtained from the data subject) is amended as follows. (2) After point (d) insert— (da) the right to make a complaint to the controller (see section 164A of the 2018 Act); . (3) In point (e), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”. 5 (1) Article 15(1) (right of access by the data subject) is amended as follows. (2) After point (e) insert— (ea) the right to make a complaint to the controller under section 164A of the 2018 Act; . (3) In point (f), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”. 6 In Article 47 (binding corporate rules), in paragraph 2(e), for “lodge a complaint with the Commissioner and” substitute “make a complaint to the controller under section 164A of the 2018 Act, the right to make a complaint to the Commissioner under section 165 of the 2018 Act, the right to lodge a complaint”. 7 (1) Article 80 (representation of data subjects) is amended as follows. (2) In paragraph 1— (a) for “lodge the complaint” substitute “make a complaint under section 164A or 165 of the 2018 Act”, and (b) omit “77,”. (3) In paragraph 2, for “lodge a complaint with the Commissioner” substitute “make a complaint under section 164A or 165 of the 2018 Act”. The 2018 Act 8 The 2018 Act is amended as follows. 9 In section 26(2)(f) (national security and defence exemption), omit sub-paragraph (ai) (inserted by section 88 of this Act). 10 (1) Section 44 (information: controller’s general duties) is amended as follows. (2) In subsection (1)— (a) after paragraph (d) insert— (da) the existence of the right to make a complaint to the controller (see section 164A); , and (b) in paragraph (e), after “Commissioner”, in the first place it occurs, insert “(see section 165)”. (3) In subsection (5)— (a) after paragraph (c) insert— (ca) of the data subject’s right to make a complaint to the controller under section 164A, , and (b) in paragraph (d), after “Commissioner” insert “under section 165”. 11 (1) Section 45 (right of access by the data subject) is amended as follows. (2) In subsection (2)— (a) after paragraph (e) insert— (ea) the existence of the data subject’s right to make a complaint to the controller (see section 164A); , and (b) in paragraph (f), after “the Commissioner”, in the first place it occurs, insert “(see section 165)”. (3) In subsection (5)— (a) after paragraph (c) insert— (ca) of the data subject’s right to make a complaint to the controller under section 164A, , and (b) in paragraph (d), at the end insert “under section 165”. 12 In section 45A (exemption from sections 44 and 45: legal professional privilege) (inserted by section 79 of this Act), in subsection (2), after paragraph (c) insert— (ca) the data subject’s right to make a complaint to the controller under section 164A, . 13 (1) Section 48 (rights to rectification, to erasure or to restriction of processing: supplementary) is amended as follows. (2) In subsection (1)(b)— (a) after sub-paragraph (ii) insert— (iia) of the data subject’s right to make a complaint to the controller under section 164A, , and (b) in sub-paragraph (iii), after “Commissioner” insert “under section 165”. (3) In subsection (4)— (a) after paragraph (b) insert— (ba) of the data subject’s right to make a complaint to the controller under section 164A, , and (b) in paragraph (c), after “Commissioner” insert “under section 165”. 14 In section 93(1)(e) (right to information), after “Commissioner”, in the first place it occurs, insert “under section 165”. 15 In section 94(2)(f) (right of access), after “Commissioner”, in the first place it occurs, insert “under section 165”. 16 (1) Section 149 (enforcement notices) is amended as follows. (2) In subsection (1), for “or (5)” substitute “, (5) or (5A)”. (3) After subsection (5) insert— (5A) The fifth type of failure is where a controller has failed, or is failing, to comply with section 164A or with regulations under section 164B. (4) In subsection (6), for “or (5)” substitute “, (5) or (5A)”. 17 In section 155 (penalty notices), in subsection (1)(a), for “or (5)” substitute “, (5) or (5A)”. 18 In section 157 (maximum amount of penalty), after subsection (4) insert— (4A) In relation to an infringement of section 164A or of regulations under section 164B, the maximum amount of the penalty that may be imposed by a penalty notice is the standard maximum amount. 19 In section 165 (complaints by data subjects), in the heading, at the end insert “to the Commissioner”. 20 (1) Section 166 (orders to progress complaints) is amended as follows. (2) In the heading, at the end insert “to the Commissioner”. (3) In subsection (1), omit “or Article 77 of the UK GDPR”. 21 (1) Section 187 (representation of data subjects with their authority) is amended as follows. (2) In subsection (1)(a)— (a) for “Articles 77,” substitute “sections 164A and 165 (complaints) and Articles”, and (b) omit “to lodge complaints and”. (3) In subsection (2)— (a) before paragraph (a) insert— (za) the right under section 164A (complaints to the controller); , and (b) in paragraph (a), for “165(2) and (4)(d)” substitute “165”.
Propose a changeSection 108 The UK GDPR 1 The UK GDPR is amended as follows. 2 (1) Article 4(1) (interpretation) is amended as follows. (2) After point (15) insert— (15A) “direct marketing” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals; . (3) After point (28) insert— (29) “enactment” has the same meaning as in the 2018 Act (see section 205 of that Act); (30) “tribunal” means any tribunal in which legal proceedings may be brought. 3 After Article 4 insert— Periods of time Article 4A 1. References in this Regulation to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of the Periods of Time Regulation, except in Article 91A(8) and (9). 2. In this Article, “the Periods of Time Regulation” means Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits. 4 In Article 9 (processing of special categories of personal data)— (a) in paragraph 2, after “apply if” insert “the processing is based on Article 6(1) and”, (b) in paragraph 2(f), after “courts” insert “or tribunals”, and (c) in paragraph 3, for the words from the beginning to “data are” substitute “Paragraph 1 is only disapplied by point (h) of paragraph 2 if the personal data is”. 5 In Article 12(5) (information etc to be provided free of charge), at the beginning insert “Subject to Article 15(3),”. 6 In Article 23(1)(h) (restrictions), for “(a)” substitute “(c)”. 7 In Article 24(3) (responsibility of the controller), for “an element by which to demonstrate” substitute “a means of demonstrating”. 8 In Article 25(3) (data protection by design and by default), for “an element to demonstrate” substitute “a means of demonstrating”. 9 In Article 28(5) (processors), for “an element by which to demonstrate” substitute “a means of demonstrating”. 10 In Article 32(3) (security of processing), for “an element by which to demonstrate” substitute “a means of demonstrating”. 11 In Article 37(1)(a), after “courts” insert “and tribunals”. 12 Omit Article 59 (activity reports). The 2018 Act 13 The 2018 Act is amended as follows. 14 In section 3(9) (definition of “the data protection legislation”)— (a) insert “and” at the end of paragraph (c), and (b) omit paragraph (e) (regulations under section 2(2) of the European Communities Act 1972 which relate to the EU GDPR or the Law Enforcement Directive) and the “and” before it. 15 Omit section 20 (meaning of “court” in Part 2). 16 In section 94 (data subject’s right of access under Part 4), in subsection (10), for “subsection (6)” substitute “subsections (3), (5) and (6)”. 17 In section 119A(11) (standard clauses for transfers to third countries etc), after “any” insert “whole days that fall within a”. 18 In section 124(5) (data protection and journalism code), in the definition of “good practice in the processing of personal data for the purposes of journalism”— (a) in paragraph (a), omit “, including compliance with the requirements of the data protection legislation”, and (b) after paragraph (b) insert— and includes compliance with the requirements of the data protection legislation; . 19 (1) Section 125 (approval of codes of practice prepared by the Commissioner) is amended as follows. (2) Omit subsection (2). (3) In subsection (8), after “any” insert “whole days that fall within a”. (4) In subsection (9), for “subsections (2) and (5)” substitute “subsection (5)”. 20 In section 139 (reporting to Parliament), omit subsection (2). 21 In section 161(6) (approval of first guidance about regulatory action), after “any” insert “whole days that fall within a”. 22 In section 170(2)(a) (unlawful obtaining etc of personal data), after “preventing” insert “, investigating”. 23 (1) Section 171 (re-identification of de-identified personal data) is amended as follows. (2) In subsection (3)(a), after “preventing” insert “, investigating”. (3) In subsection (6)(a), after “preventing” insert “, investigating”. 24 In section 181 (interpretation of Part 6) omit the definition of “representative”. 25 In section 184(4) (prohibition of requirement to produce relevant records), after “prevention” insert “, investigation”. 26 In section 192(6) (approval of the Framework), after “any” insert “whole days that fall within a”. 27 In section 206 (index of defined expressions), in the Table, omit the entry for “representative (in Part 6)”. 28 (1) Schedule 1 (special categories of personal data and criminal convictions etc data) is amended as follows. (2) In the heading before paragraph 10, for “or detecting” substitute “etc”. (3) In paragraph 10(1)(a) (preventing etc unlawful acts), after “prevention” insert “, investigation”. (4) In paragraph 13(1)(a) (journalism etc in connection with unlawful acts and dishonesty etc), after “consists of” insert “, or is carried out in preparation for,”. (5) In paragraph 14(1)(b) (preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert— (iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii), . (6) In paragraph 24(1)(a) (disclosure to elected representatives), after “consists of” insert “, or is carried out in preparation for,”. 29 (1) Schedule 2 (exemptions etc from the UK GDPR) is amended as follows. (2) In paragraph 2(1)(a) (crime), after “prevention” insert “, investigation”. (3) In paragraph 3(2)(b)(ii) (crime: risk assessment systems), after “prevention” insert “, investigation”. 30 In paragraph 8(1)(b) of Schedule 8 (conditions for sensitive processing under Part 3: preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert— (iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii), . 31 In paragraph 2(a) of Schedule 11 (other exemptions under Part 4: crime), after “prevention” insert “, investigation”. Victims and Prisoners Act 2024 32 The following provisions (inserted by section 31 of the Victims and Prisoners Act 2024) extend to Scotland and Northern Ireland (as well as to England and Wales)— (a) Article 17(1)(g), (4) and (5) of the UK GDPR (right to erasure), and (b) section 13A of the 2018 Act (meaning of “relevant offence” for purpose of right to erasure).
Propose a changeSection 112 In the PEC Regulations, before Schedule 1 insert— Schedule A1 Storing information in the terminal equipment of a subscriber or user Regulation 6 Interpretation 1. (1) In this Schedule, “website” includes a mobile application and any other platform by means of which an information society service is provided. (2) For further provision about the interpretation of this Schedule, see regulation 6(2). Consent 2. (1) Regulation 6(1) does not prevent a person storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user if the subscriber or user— (a) is provided with clear and comprehensive information about the purpose of the storage or access, and (b) gives consent to the storage or access. (2) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user for the same purpose on more than one occasion, it is sufficient that the requirements of sub-paragraph (1) are met in respect of the initial use. (3) For the purposes of sub-paragraph (1)(b), the means by which the subscriber or user may signify consent include— (a) amending or setting controls on the internet browser which the subscriber or user uses; (b) using another application or programme. Transmission of a communication over an electronic communications network 3. Regulation 6(1) does not apply to— (a) technical storage of information in the terminal equipment of a subscriber or user, or (b) technical access to information stored in such equipment, for the sole purpose of carrying out the transmission of a communication over an electronic communications network. Storage or access strictly necessary to provide an information society service 4. (1) Regulation 6(1) does not apply to— (a) technical storage of information in the terminal equipment of a subscriber or user, or (b) technical access to information stored in such equipment, where the storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user. (2) For the purposes of this paragraph, the technical storage of, or technical access to, information is strictly necessary for the provision of an information society service requested by the subscriber or user if, for example, the storage or access is strictly necessary— (a) to protect information provided in connection with, or relating to, the provision of the service requested, (b) to ensure that the security of the terminal equipment of the subscriber or user is not adversely affected by the provision of the service requested, (c) to prevent or detect fraud in connection with the provision of the service requested, (d) to prevent or detect technical faults in connection with the provision of the service requested, or (e) to enable either of the following things to be done where necessary for the provision of the service requested— (i) automatically authenticating the identity of the subscriber or user, or (ii) maintaining a record of selections made on a website, or information put into a website, by the subscriber or user. Collecting information for statistical purposes 5. (1) Regulation 6(1) does not prevent a person storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user if— (a) the person provides an information society service, (b) the sole purpose of the storage or access is to enable the person— (i) to collect information for statistical purposes about how the service is used with a view to making improvements to the service, or (ii) to collect information for statistical purposes about how a website by means of which the service is provided is used with a view to making improvements to the website, (c) any information that the storage or access enables the person to collect is not shared with any other person except for the purpose of enabling that other person to assist with making improvements to the service or website, (d) the subscriber or user is provided with clear and comprehensive information about the purpose of the storage or access, and (e) the subscriber or user is given a simple means of objecting, free of charge, to the storage or access and does not object. (2) In sub-paragraph (1), the reference to gaining access to information stored in the terminal equipment of a subscriber or user does not include a reference to collecting or monitoring information automatically emitted by the terminal equipment. (3) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user for the same purpose on more than one occasion, it is sufficient that the requirements of sub-paragraph (1)(d) and (e) are met in respect of the initial use. Website appearance etc 6. (1) Regulation 6(1) does not prevent a person storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user if— (a) the person provides an information society service by means of a website, (b) the sole purpose of the storage or access is— (i) to enable the way the website appears or functions when displayed on, or accessed by, the terminal equipment to adapt to the preferences of the subscriber or user, or (ii) to otherwise enable an enhancement of the appearance or functionality of the website when displayed on, or accessed by, the terminal equipment, (c) the subscriber or user is provided with clear and comprehensive information about the purpose of the storage or access, and (d) the subscriber or user is given a simple means of objecting, free of charge, to the storage or access and does not object. (2) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user for the same purpose on more than one occasion, it is sufficient that the requirements of sub-paragraph (1)(c) and (d) are met in respect of the initial use. Emergency assistance 7. Regulation 6(1) does not prevent a person storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user if— (a) the person receives a communication from the terminal equipment, (b) the communication is a request from the subscriber or user for emergency assistance or otherwise indicates that the subscriber or user is in need of emergency assistance, and (c) the sole purpose of the storage or access is to enable the geographical position of the subscriber or user to be ascertained with a view to the emergency assistance being provided.
Propose a changeSection 115 This is the Schedule to be substituted for Schedule 1 to the PEC Regulations— Schedule 1 Information Commissioner’s enforcement powers Regulation 31 Provisions applied for enforcement purposes 1. For the purposes of enforcing these Regulations, the following provisions of Parts 5 to 7 of the Data Protection Act 2018 apply with the modifications set out in paragraphs 2 to 29— section 140 (publication by the Commissioner); section 141A (notices from the Commissioner); section 142 (information notices); section 143 (information notices: restrictions); section 144 (false statements made in response to an information notice); section 145 (information orders); section 146 (assessment notices); section 146A (assessment notices: approval of person to prepare report); section 147 (assessment notices: restrictions); section 148 (destroying or falsifying information and documents etc); section 148A (interview notices); section 148B (interview notices: restrictions); section 148C (false statements made in response to interview notices); section 149 (enforcement notices); section 150 (enforcement notices: supplementary); section 152 (enforcement notices: restrictions); section 153 (enforcement notices: cancellation and variation); section 154 and Schedule 15 (powers of entry and inspection); section 155 and Schedule 16 (penalty notices); section 156 (penalty notices: restrictions); section 157 (maximum amount of penalty); section 159 (amount of penalties: supplementary); section 160 (guidance about regulatory action); section 161 (approval of first guidance about regulatory action); section 162 (rights of appeal); section 163 (determination of appeals); section 164 (applications in respect of urgent notices); section 180 (jurisdiction); section 181 (interpretation of Part 6); section 182 (regulations and consultation); section 196 (penalties for offences); section 197(1) and (2) (prosecution); section 198 (liability of directors etc); section 200 (guidance about PACE codes of practice); section 202 (proceedings in the First-tier Tribunal: contempt); section 203 (Tribunal Procedure Rules). General modification of references to the Data Protection Act 2018 2. The provisions listed in paragraph 1 have effect as if— (a) references to the Data Protection Act 2018 or to a Part of that Act were references to the provisions of that Act or that Part as applied by these Regulations; (b) references to a particular provision of that Act were references to that provision as applied by these Regulations. Modification of section 142 (information notices) 3. Section 142 has effect as if— (a) in subsection (1), for paragraphs (a) and (b) there were substituted— (a) require any person to provide the Commissioner with information or documents that the Commissioner reasonably requires for the purposes of determining whether that person has complied or is complying with the requirements of the PEC Regulations, (b) require a communications provider to provide the Commissioner with information or documents relating to another person’s use of an electronic communications network or electronic communications service for the purposes of determining whether that other person has complied or is complying with the requirements of the PEC Regulations, or (c) require any person to provide the Commissioner with information or documents that the Commissioner reasonably requires for the purposes of investigating a suspected failure by another person to comply with the requirements of the PEC Regulations. ; (b) in subsection (2)(a), for “(b)(i) or (b)(ii)” there were substituted “(b) or (c)”; (c) after subsection (8) there were inserted— (8A) Subsections (8B) and (8C) apply if an information notice given to a person under subsection (1)(b) or (c) contains— (a) a statement that a duty of confidentiality applies in relation to the notice, and (b) an explanation of the effects of subsections (8B) and (8C). (8B) The person to whom the information notice is given, and any person employed or engaged for the purpose of that person’s business, must not disclose the existence of the notice without reasonable excuse. (8C) Subsection (8B) does not prevent— (a) a disclosure to a person employed or engaged for the purpose of the business of the person to whom the notice is given, (b) a disclosure made with the permission of the Commissioner (whether the permission is contained in the information notice or otherwise), or (c) a disclosure made for the purpose of obtaining legal advice. ; (d) subsections (9) and (10) were omitted. Modification of section 143 (information notices: restrictions) 4. (1) Section 143 has effect as if subsections (1) and (9) were omitted. (2) In that section— (a) subsections (3)(b) and (4)(b) have effect as if for “the data protection legislation” there were substituted “the PEC Regulations”; (b) subsection (7)(a) has effect as if for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”; (c) subsection (8) has effect as if for “this Act (other than an offence under section 144)” there were substituted “section 148 or 148C or paragraph 15 of Schedule 15”. Modification of section 145 (information orders) 5. Section 145(2)(b) has effect as if for “section 142(2)(b)” there were substituted “section 142(2)”. Modification of section 146 (assessment notices) 6. Section 146 has effect as if— (a) in subsection (1)— (i) for “a controller or processor” there were substituted “a person within subsection (1A)”; (ii) for “the controller or processor” there were substituted “the person”; (iii) for “the data protection legislation” there were substituted “the requirements of the PEC Regulations”; (b) after subsection (1) there were inserted— (1A) A person is within this subsection if the person— (a) is a communications provider, or (b) is engaged in any activity regulated by the PEC Regulations. ; (c) in subsection (2)— (i) for “controller or processor” there were substituted “person to whom it is given”; (ii) in paragraph (h), for “the processing of personal data” there were substituted “any activity regulated by the PEC Regulations”; (iii) in paragraph (i), for “process personal data on behalf of the controller” there were substituted “are involved in any such activity on behalf of the person to whom the notice is given”; (d) in subsection (3A), for “controller or processor” there were substituted “person”; (e) in subsection (7), for “controller or processor” there were substituted “person to whom the notice is given”; (f) in subsection (8)— (i) in paragraph (a), for “controller or processor” there were substituted “person to whom the notice is given”; (ii) in the words after paragraph (c), for “controller or processor” there were substituted “person”; (g) in subsection (9)— (i) in paragraph (a), for the words from “a controller” to “this Act” there were substituted “the person to whom the notice is given has failed or is failing to comply with the requirements of the PEC Regulations or that an offence under section 144, 148 or 148C or paragraph 15 of Schedule 15”; (ii) in paragraph (d), for “controller or processor” there were substituted “person”; (h) in subsection (10), for “controller or processor” there were substituted “person”; (i) subsection (11) were omitted; (j) in subsection (11A)— (i) for “controller or processor”, in the first place it occurs, there were substituted “person to whom it is given”; (ii) for “controller or processor”, in the second place it occurs, there were substituted “the person”. Modification of section 146A (assessment notices: approval of person to prepare report) 7. Section 146A has effect as if— (a) in subsection (1), for “a controller or processor” there were substituted “a person (“P”)”; (b) in subsection (2), for “The controller or processor” there were substituted “P”; (c) in subsections (3) to (6), for “the controller or processor” (in each place) there were substituted “P”. Modification of section 147 (assessment notices: restrictions) 8. (1) Section 147 has effect as if subsection (5) were omitted. (2) In that section, subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “the PEC Regulations”. Modification of section 148A (interview notices) 9. Section 148A has effect as if— (a) in subsection (1)— (i) for “a controller or processor” there were substituted “a person”; (ii) in paragraph (a), for “as described in section 149(2)” there were substituted “to comply with a requirement of the PEC Regulations”; (iii) in paragraph (b), for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”; (b) in subsection (3)— (i) in paragraph (a), for “the controller or processor” there were substituted “the person mentioned in subsection (1)”; (ii) in paragraph (b), for “the controller or processor” there were substituted “that person”; (iii) in paragraph (c), for “the controller or processor” there were substituted “that person”. Modification of section 148B (interview notices: restrictions) 10. (1) Section 148B has effect as if subsections (8) and (9) were omitted. (2) In that section— (a) subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “the PEC Regulations”; (b) subsection (6)(a) has effect as if for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”; (c) subsection (7) has effect as if for “this Act (other than an offence under section 148C)” there were substituted “section 144 or 148 or paragraph 15 of Schedule 15”. Modification of section 149 (enforcement notices) 11. (1) Section 149 has effect as if subsections (2) to (5A) and (7) to (9) were omitted. (2) In that section— (a) subsection (1) has effect as if— (i) for “as described in subsections (2), (3), (4), (5) or (5A)” there were substituted “to comply with a requirement of the PEC Regulations”; (ii) for “sections 150 and 151” there were substituted “section 150”; (b) subsection (6) has effect as if the words “given in reliance on subsection (2), (3), (5) or (5A)” were omitted. Modification of section 150 (enforcement notices: supplementary) 12. (1) Section 150 has effect as if subsection (3) were omitted. (2) In that section, subsection (2) has effect as if the words “in reliance on section 149(2)” were omitted. Modification of section 152 (enforcement notices: restrictions) 13. Section 152 has effect as if subsections (1), (2) and (4) were omitted. Modification of Schedule 15 (powers of entry and inspection) 14. (1) Schedule 15 has effect as if paragraph 3 were omitted. (2) Paragraph 1(1) of that Schedule (issue of warrants in connection with non-compliance and offences) has effect as if for paragraph (a) (but not the final “and”) there were substituted— (a) there are reasonable grounds for suspecting that— (i) a person has failed or is failing to comply with a requirement of the PEC Regulations, or (ii) an offence under section 144, 148, or 148C or paragraph 15 of this Schedule has been or is being committed, . (3) Paragraph 2 of that Schedule (issue of warrants in connection with assessment notices) has effect as if— (a) in sub-paragraphs (1) and (2), for “controller or processor” there were substituted “person”; (b) in sub-paragraph (2), for “the data protection legislation” there were substituted “the PEC Regulations”. (4) Paragraph 5 of that Schedule (content of warrants) has effect as if— (a) in sub-paragraph (1)(c), for “the processing of personal data” there were substituted “an activity regulated by the PEC Regulations”; (b) in sub-paragraph (2)(d), for the words from “controller or processor” to the end there were substituted “person mentioned in paragraph 1(1)(a) has failed or is failing to comply with a requirement of the PEC Regulations”; (c) in sub-paragraph (3)(a) and (d)— (i) for “controller or processor” there were substituted “person mentioned in paragraph 2(1)”; (ii) for “the data protection legislation” there were substituted “the requirements of the PEC Regulations”. (5) Paragraph 11 of that Schedule (privileged communications) has effect as if, in sub-paragraphs (1)(b) and (2)(b), for “the data protection legislation” there were substituted “the PEC Regulations”. Modification of section 155 (penalty notices) 15. Section 155 has effect as if— (a) in subsection (1)— (i) in paragraph (a), for “as described in section 149(2), (3), (4), (5) or (5A)” there were substituted “to comply with a requirement of the PEC Regulations”; (ii) after paragraph (c), there were inserted , or (d) has failed to comply with the prohibition in section 142(8B), ; (b) after subsection (1) there were inserted— (1A) But the Commissioner may not give a penalty notice to a person in respect of a failure to comply with regulation 5A of the PEC Regulations. ; (c) for subsection (2) there were substituted— (2) When deciding whether to give a penalty notice to a person and determining the amount of the penalty, the Commission must have regard to the matters listed in subsection (3), so far as relevant. ; (d) in subsection (3)— (i) for “the controller or processor” (in each place) there were substituted “the person”; (ii) in paragraph (c), for the words from “data subjects” to the end there were substituted “subscribers or users”; (iii) in paragraph (d), for the words “in accordance with section 57, 66, 103 or 107” there were substituted “with a view to securing compliance with the requirements of the PEC Regulations”; (iv) paragraph (g) were omitted; (v) in paragraph (j), the words “or certification mechanism” were omitted; (e) subsection (4) were omitted; (f) after subsection (4) there were inserted— (4A) If a penalty notice is given to a body in respect of a failure to comply with any of regulations 19 to 24 of the PEC Regulations, the Commissioner may also give a penalty notice to an officer of the body if the Commissioner is satisfied that the failure— (a) took place with the consent or connivance of the officer, or (b) was attributable to any neglect on the part of the officer. (4B) In subsection (4A)— “body” means a body corporate or a Scottish partnership; “officer”, in relation to a body, means— in relation to a body corporate— a director, manager, secretary or other similar officer of the body or any person purporting to act in such capacity, and where the affairs of the body are managed by its members, a member; or in relation to a Scottish partnership, a partner or any person purporting to act as a partner. ; (g) subsections (6) to (8) were omitted. Modification of Schedule 16 (penalties) 16. Schedule 16 has effect as if paragraphs 3(2)(b) and 5(2)(b) were omitted. Modification of section 156 (penalty notices: restrictions) 17. (1) Section 156 has effect as if subsections (1), (2), (4)(b) and (5) were omitted. (2) In that section, subsection (3) has effect as if for the words from “controller” to “determined by or” there were substituted “penalty notice to a person who acts”. Modification of section 157 (maximum amount of penalty) 18. Section 157 has effect as if— (a) subsection (1) were omitted; (b) in subsection (2)— (i) for “Part 3 of this Act” there were substituted “the PEC Regulations”; (ii) in paragraph (a), for the words from “section 35” to “or 78” there were substituted “regulation 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23 or 24”; (c) subsections (3) and (4A) were omitted; (d) after subsection (4A) there were inserted— (4B) In relation to an infringement of section 142(8B) of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is the higher maximum amount. Modification of section 159 (amount of penalties: supplementary) 19. Section 159 has effect as if— (a) in subsection (1), the words “Article 83 of the UK GDPR and” were omitted; (b) in subsection (2), the words “Article 83 of the UK GDPR,” and “and section 158” were omitted. Modification of section 160 (guidance) 20. Section 160 has effect as if, in subsection (4)(f), for “controllers and processors” there were substituted “persons”. Modification of section 162 (rights of appeal) 21. Section 162 has effect as if subsection (4) were omitted. Modification of section 163 (determination of appeals) 22. Section 163 has effect as if subsection (6) were omitted. Modification of section 180 (jurisdiction) 23. (1) Section 180 has effect as if subsections (2)(b), (c), (d) and (e) and (3) were omitted. (2) Subsection (1) of that section has effect as if for “subsections (3) and (4)” there were substituted “subsection (4)”. Modification of section 181 (interpretation of Part 6) 24. Section 181 has effect as if the definition of “certification provider” were omitted. Modification of section 182 (regulations and consultation) 25. (1) Section 182 has effect as if subsections (3), (6), (8), (11), (12) and (14) were omitted. (2) Subsection (13) of that section has effect as if for “provision comes into force” there were substituted “coming into force of section 115 of the Data (Use and Access) Act 2025”. Modification of section 196 (penalties for offences) 26. (1) Section 196 has effect as if subsections (3) to (5) were omitted. (2) In that section— (a) subsection (1) has effect as if the words “section 119 or 173 or” were omitted; (b) subsection (2) has effect as if for “section 132, 144, 148, 148C, 170, 171 or 184” there were substituted “section 144, 148 or 148C”. Modification of section 200 (guidance about PACE codes of practice) 27. Section 200 has effect as if, in subsection (1), for “this Act” there were substituted “section 144, 148 and 148C and paragraph 15 of Schedule 15”. Modification of section 202 (proceedings in the First-tier Tribunal: contempt) 28. Section 202 has effect as if, in subsection (1)(a), for sub-paragraphs (i) and (ii) there were substituted “on an appeal under section 162”. Modification of section 203 (tribunal procedure rules) 29. Section 203 has effect as if— (a) in subsection (1), for paragraphs (a) and (b) there were substituted “the exercise of the rights of appeal conferred by section 162”; (b) in subsection (2)— (i) in paragraph (a), for “the processing of personal data” there were substituted “any activity regulated by the PEC Regulations”; (ii) in paragraph (b), for “the processing of personal data” there were substituted “any such activity”. Interpretation 30. In this Schedule, “the PEC Regulations” means these Regulations.
Propose a changeSection 117 Schedule 12A to the Data Protection Act 2018 1 In the Data Protection Act 2018, after Schedule 12 insert— Schedule 12A The Information Commission Section 114A Status 1 (1) The Commission is not to be regarded— (a) as a servant or agent of the Crown, or (b) as enjoying any status, immunity or privilege of the Crown. (2) The Commission’s property is not to be regarded— (a) as property of the Crown, or (b) as property held on behalf of the Crown. Number of members 2 (1) The number of members of the Commission is to be determined by the Secretary of State. (2) That number must not be— (a) less than 3, or (b) more than 14. (3) The Secretary of State may by regulations substitute a different number for the number for the time being specified in sub-paragraph (2)(b). (4) Regulations under this paragraph are subject to the negative resolution procedure. Membership: general 3 (1) The Commission is to consist of— (a) the non-executive members, and (b) the executive members. (2) The non-executive members are— (a) a chair appointed by His Majesty by Letters Patent on the recommendation of the Secretary of State, and (b) such other members as the Secretary of State may appoint. (3) The executive members are— (a) a chief executive appointed by the non-executive members or in accordance with paragraph 25, and (b) such other members, if any, as the non-executive members may appoint. (4) The Secretary of State must consult the chair of the Commission before appointing a non-executive member. (5) The non-executive members must consult the Secretary of State before appointing the chief executive. (6) The non-executive members must consult the chief executive about whether there should be any executive members within sub-paragraph (3)(b) and, if so, how many there should be. (7) The Secretary of State may by direction set a maximum and a minimum number of executive members. (8) The Commission may appoint one of the non-executive members as a deputy to the chair. Membership: non-executive members to outnumber executive members 4 The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs 2 and 3 so as to secure that the number of non-executive members of the Commission is, so far as practicable, at all times greater than the number of executive members. Membership: selection on merit etc 5 (1) The Secretary of State may not recommend a person for appointment as the chair of the Commission unless the person has been selected on merit on the basis of fair and open competition. (2) A person may not be appointed as a member of the Commission unless the person has been selected on merit on the basis of fair and open competition. Membership: conflicts of interests 6 (1) Before— (a) recommending a person for appointment as the chair of the Commission, or (b) appointing a person as a non-executive member of the Commission, the Secretary of State must be satisfied that the person does not have a conflict of interest. (2) The Secretary of State must check from time to time that none of the non-executive members has a conflict of interest. (3) The Secretary of State may require a non-executive member to provide whatever information the Secretary of State considers necessary for the purpose of checking that the member does not have a conflict of interest. (4) A non-executive member who is required to provide information under sub-paragraph (3) must provide it within such period as may be specified by the Secretary of State. (5) In this Schedule, “conflict of interest”, in relation to a person, means a financial or other interest which is likely to affect prejudicially the discharge by the person of the person’s functions as a member of the Commission. Tenure of the chair 7 (1) The chair of the Commission holds and vacates office in accordance with the terms of the chair’s appointment, subject to the provisions of this paragraph. (2) The chair must be appointed for a term of not more than 7 years. (3) On the recommendation of the Secretary of State, His Majesty may by Letters Patent extend the term of the chair’s appointment but not so the term as extended is more than 7 years. (4) A person cannot be appointed as the chair more than once. (5) The chair may be relieved from office by His Majesty at the chair’s own request. (6) The chair may be removed from office by His Majesty on an Address from both Houses of Parliament. (7) No motion is to be made in either House of Parliament for such an Address unless the Secretary of State has presented a report to that House stating that the Secretary of State is satisfied that— (a) the chair is guilty of serious misconduct, (b) the chair has a conflict of interest (see paragraph 6(5)), (c) the chair has failed to comply with paragraph 6(4), or (d) the chair is unable, unfit or unwilling to carry out the chair’s functions. Tenure of deputy chair 8 (1) A deputy chair of the Commission may resign that office by giving written notice to the Commission. (2) A deputy chair of the Commission ceases to hold that office on ceasing to be a non-executive member of the Commission. (3) A deputy chair of the Commission may be removed from that office by the Commission. Tenure of the other non-executive members 9 (1) This paragraph applies to a non-executive member of the Commission appointed by the Secretary of State. (2) The member holds and vacates office in accordance with the terms of their appointment, subject to the provisions of this paragraph. (3) The member must be appointed for a term of not more than 7 years. (4) The Secretary of State may extend the term of the member’s appointment but not so that the term as extended is more than 7 years. (5) The Secretary of State may not appoint the member as a non-executive member of the Commission on a subsequent occasion. (6) The member may resign from office by giving written notice to the Secretary of State and the Commission. (7) The Secretary of State may remove the member from office by written notice if satisfied that— (a) the member is guilty of serious misconduct, (b) the member has a conflict of interest (see paragraph 6(5)), (c) the member has failed to comply with paragraph 6(4), or (d) the member is unable, unfit or unwilling to carry out the member’s functions. (8) At the time of removing the member from office the Secretary of State must make public the decision to do so. (9) The Secretary of State must— (a) give the member a statement of reasons for the removal, and (b) if asked to do so by the member, publish the statement. Remuneration and pensions of non-executive members 10 (1) The Commission may pay to the non-executive members of the Commission such remuneration and allowances as the Secretary of State may determine. (2) The Commission may pay, or make provision for paying, to or in respect of the non-executive members of the Commission, such sums by way of pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the Secretary of State may determine. (3) The Commission may make a payment to a person of such amount as the Secretary of State may determine where— (a) the person ceases to be a non-executive member of the Commission otherwise than on the expiry of the person’s term of office, and (b) it appears to the Secretary of State that there are special circumstances which make it appropriate for the person to receive compensation. Executive members: terms and conditions 11 (1) The executive members of the Commission are to be employees of the Commission. (2) The executive members are to be employed by the Commission on such terms and conditions, including those as to remuneration, as the non-executive members of the Commission may determine. (3) The Commission must— (a) pay to or in respect of the executive members of the Commission such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the non-executive members of the Commission may determine, and (b) provide and maintain for them such pension schemes (whether contributory or not) as the non-executive members of the Commission may determine. Other staff: appointment, terms and conditions 12 (1) The Commission may— (a) appoint other employees, and (b) make such other arrangements for the staffing of the Commission as it considers appropriate. (2) In appointing an employee, the Commission must have regard to the principle of selection on merit on the basis of fair and open competition. (3) Employees appointed by the Commission are to be appointed on such terms and conditions, including those as to remuneration, as the Commission may determine. (4) The Commission may— (a) pay to or in respect of those employees such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of employment) as the Commission may determine, and (b) provide and maintain for them such pension schemes (whether contributory or not) as the Commission may determine. Committees 13 (1) The Commission may establish committees. (2) A committee of the Commission may consist of or include persons who are neither members nor employees of the Commission. (3) But a committee of the Commission to which functions are delegated under paragraph 14(1)(c) must include at least one person who is either a member or an employee of the Commission. (4) Where a person who is neither a member nor an employee of the Commission is a member of a committee of the Commission, the Commission may pay to that person such remuneration and expenses as it may determine. Delegation of functions 14 (1) The Commission may delegate any of its functions to— (a) a member of the Commission, (b) an employee of the Commission, or (c) a committee of the Commission. (2) A function is delegated under sub-paragraph (1) to the extent and on the terms that the Commission determines. (3) A committee of the Commission may delegate any function delegated to it to a member of the committee. (4) A function is delegated under sub-paragraph (3) to the extent and on the terms that the committee determines. (5) The power of a committee of the Commission to delegate a function, and to determine the extent and terms of the delegation, is subject to the Commission’s power to direct what a committee established by it may and may not do. (6) The delegation of a function by the Commission or a committee of the Commission under this paragraph does not prevent the Commission or the committee from exercising that function. Advice from committees 15 The Commission may require a committee of the Commission to give the Commission advice about matters relating to the discharge of the Commission’s functions. Proceedings 16 (1) The Commission may make arrangements for regulating— (a) its own procedure, and (b) the procedure of a committee of the Commission. (2) The non-executive members of the Commission may by majority make arrangements for regulating the procedure for the carrying out of the separate functions which are conferred on them under this Schedule. (3) Arrangements under this paragraph may include arrangements as to quorum and the making of decisions by a majority. (4) The Commission must publish arrangements which it makes under this paragraph. (5) This paragraph is subject to paragraph 18. Records of proceedings 17 The Commission must make arrangements for the keeping of proper records of— (a) its proceedings, (b) the proceedings of a committee of the Commission, (c) the proceedings at a meeting of the non-executive members of the Commission, (d) anything done by a member or employee of the Commission under paragraph 14(1), and (e) anything done by a member of a committee of the Commission under paragraph 14(3). Disqualification for acting in relation to certain matters 18 (1) This paragraph applies if— (a) a member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the Commission, (b) a non-executive member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the non-executive members, or (c) a member of a committee of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the committee. (2) The member with the interest must declare it. (3) The declaration must be recorded in the minutes of the meeting. (4) The member with the interest may not take part in a discussion or decision at the meeting relating to the matter, unless— (a) in the case of a meeting of the Commission, the other members of the Commission who are present have resolved unanimously that the interest is to be disregarded, (b) in the case of a meeting of the non-executive members, the other non-executive members who are present have resolved unanimously that the interest is to be disregarded, or (c) in the case of a meeting of a committee, the other members of the committee who are present have, in the manner authorised by the Commission, resolved that the interest is to be disregarded. (5) In giving authorisation for the purposes of sub-paragraph (4)(c), the Commission must secure that a resolution for those purposes does not allow a member to take part in a discussion or decision at a meeting of a committee to which functions are delegated under paragraph 14(1)(c) unless the number of other members of the committee in favour of the resolution— (a) is not less than two thirds of those who are both present and entitled to vote on the resolution, and (b) is not less than its quorum. (6) For the purposes of this paragraph, a notification given at or sent to a meeting of the Commission that a person— (a) is a member of a company or firm, and (b) is to be regarded as interested in any matter involving that company or firm, is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the Commission, of the non-executive members or of a committee. (7) For the purposes of this paragraph, a notification given at or sent to a meeting of the non-executive members of the Commission or of a committee of the Commission that— (a) a person is a member of a company or firm, and (b) is to be regarded as interested in any matter involving that company or firm, is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the non-executive members or (as the case may be) of the committee. (8) A notification described in sub-paragraph (6) or (7) remains in force until it is withdrawn. (9) A person required to make a declaration for the purposes of this paragraph in relation to any meeting— (a) is not required to attend the meeting, but (b) is to be taken to have complied with the requirements of this paragraph if the person takes reasonable steps to secure that notice of the person’s interest is read out, and taken into consideration, at the meeting in question. Validity of proceedings 19 (1) The validity of proceedings of the Commission, of the non-executive members of the Commission or of a committee of the Commission is not affected by— (a) a vacancy in the membership of the Commission or of the committee, (b) a defect in the appointment of a member of the Commission, (c) a failure of the Secretary of State to comply with the requirements of paragraph 4, or (d) a failure to comply with arrangements under paragraph 16 or with a requirement under paragraph 18. (2) Nothing in sub-paragraph (1)(d) validates proceedings of a meeting which is inquorate unless it is inquorate by reason only of a matter within sub-paragraph (1)(b) or (c). Money 20 The Secretary of State may make payments to the Commission. Fees etc and other sums 21 (1) All fees, charges, penalties and other sums received by the Commission in carrying out its functions are to be paid to the Secretary of State. (2) Sub-paragraph (1) does not apply where the Secretary of State otherwise directs. (3) Any sums received by the Secretary of State under this paragraph are to be paid into the Consolidated Fund. Accounts 22 (1) The Commission must keep proper accounts and proper records in relation to them. (2) The Commission must prepare a statement of accounts in respect of each financial year in the form specified by the Secretary of State. (3) The Commission must send a copy of each statement of accounts to the Secretary of State and the Comptroller and Auditor General before the end of August next following the financial year to which the statement relates. (4) The Comptroller and Auditor General must— (a) examine, certify and report on the statement of accounts, and (b) send a copy of the certified statement and the report to the Secretary of State. (5) The Secretary of State must lay before Parliament each document received under sub-paragraph (4)(b). (6) In this paragraph “financial year” means— (a) the period beginning with the date on which the Commission is established and ending with the 31 March following that date, and (b) each successive period of 12 months. Authentication of seal and presumption of authenticity of documents 23 (1) The application of the Commission’s seal must be authenticated by the signature of— (a) the chair of the Commission, or (b) another person authorised for that purpose by the Commission. (2) A document purporting to be duly executed under the Commission’s seal or signed on its behalf— (a) is to be received in evidence, and (b) is to be taken to be executed or signed in that way, unless the contrary is shown. (3) This paragraph does not extend to Scotland. Supplementary powers 24 The Commission may do anything it thinks appropriate for the purposes of, or in connection with, its functions. Transitional provision: interim chief executive 25 (1) The first chief executive of the Commission is to be appointed by the chair of the Commission. (2) Before making the appointment the chair must consult the Secretary of State. (3) The appointment must be for a term of not more than 2 years. (4) The chair may extend the term of the appointment but not so the term as extended is more than 2 years. (5) For the term of appointment, the person appointed under sub-paragraph (1) is “the interim chief executive”. (6) Until the expiry of the term of appointment, the powers conferred on the non-executive members by paragraph 11(2) and (3) are exercisable in respect of the interim chief executive by the chair (instead of by the non-executive members). (7) In sub-paragraphs (5) and (6), the references to the term of appointment are to the term of appointment described in sub-paragraph (3), including any extension of the term under sub-paragraph (4). Interpretation 26 In this Schedule— (a) references to pensions, allowances or gratuities include references to any similar benefits provided on death or retirement, and (b) references to the payment of pensions, allowances or gratuities to or in respect of a person include references to the making of payments towards the provision of pensions, allowances or gratuities to be paid to or in respect of a person. Transitional provision: first chair 2 (1) This paragraph applies to the person who holds the office of Information Commissioner immediately before the day on which this Schedule comes into force. (2) The person is to be treated as having been appointed as the chair of the Information Commission for a term that expires at the time the person would cease to hold the office of Information Commissioner but for the abolition of that office by section 118. (3) For the purposes of paragraph 7(3) of Schedule 12A to the Data Protection Act 2018 (extension of chair’s term), the term of the person’s appointment as chair of the Information Commission is to be treated as a term beginning when the person began to hold the office of Information Commissioner. Transitional provision: consultation about non-executive members 3 (1) This paragraph is about the requirement under paragraph 3(4) of Schedule 12A to the Data Protection Act 2018 for the Secretary of State to consult the chair of the Information Commission before appointing a non-executive member of the Information Commission. (2) The requirement may be satisfied by consultation, before this Schedule comes into force, with the person who holds the office of Information Commissioner. Transitional provision: consultation about interim chief executive 4 (1) This paragraph is about the requirement under paragraph 25 of Schedule 12A to the Data Protection Act 2018 (transitional provision: interim chief executive) for the chair of the Information Commission to consult the Secretary of State before appointing the first chief executive of the Information Commission. (2) The requirement may be satisfied by consultation carried out, before this Schedule comes into force, by the person who holds the office of Information Commissioner.
Propose a changeSection 121 1 Chapter 1 of Part 9 of the Health and Social Care Act 2012 (health and adult social care services: information standards) is amended as follows. 2 Before section 250 insert— Powers to publish standards . 3 (1) Section 250 (powers to publish information standards) is amended as follows. (2) In subsection (2), at the end insert “and includes, among other things, a standard relating to information technology or IT services used, or intended to be used, in connection with the processing of information (see section 250A)”. (3) In subsection (2B)(c)— (a) after “provision” insert “in, or in relation to, England”, and (b) omit “in England”. (4) In subsection (2B), at the end insert— (e) a relevant IT provider. (5) In subsection (3)— (a) after “provision” insert “in, or in relation to, England”, and (b) omit “in England”. (6) In subsection (7)— (a) in the opening words, for “section” substitute “Chapter”, (b) after the definition of “health care” insert— “information technology” includes— computers, other devices whose uses include the processing of information by electronic means (“IT devices”), parts, accessories and other equipment made or adapted for use in connection with computers or IT devices, software and code made or adapted for use in connection with computers or IT devices, and networks and other infrastructure (whether physical or virtual) used in connection with other information technology; “IT service” means an information technology service, including any service (whether physical or virtual) which consists of, or is provided in connection with, the development, making available, operation or maintenance of information technology; , (c) in the definition of “processing”, omit “and (14)”, and (d) at the end insert— “relevant IT provider” means a person involved in marketing, supplying, providing or otherwise making available— information technology, an IT service, or a service which consists of processing information using information technology, whether for payment or free of charge, but only so far as the technology or service is used, or intended to be used, in connection with the provision in, or in relation to, England of health care or of adult social care. 4 After section 250 insert— Standards relating to information technology 250A (1) An information standard relating to information technology or IT services may, among other things, make provision about— (a) the design, quality, capabilities or other characteristics of such technology or services; (b) contracts or other arrangements under which such technology or services are marketed, supplied, provided or otherwise made available. (2) An information standard may include technical provision about information technology or IT services, including provision about— (a) functionality; (b) connectivity; (c) interoperability; (d) portability; (e) storage of, and access to, information; (f) security of information. (3) An information standard may make provision by reference to open standards or proprietary standards. 5 (1) Section 251 (information standards: procedure etc) is amended as follows. (2) In the heading omit “Information standards:”. (3) For subsection (3) substitute— (3) The power under section 250(1) may be exercised by— (a) adopting an information standard prepared or published by another person, including as it has effect from time to time, or (b) making provision by reference to an international agreement or another document, including as it has effect from time to time. 6 After section 251 insert— Compliance with standards . 7 For the heading of section 251ZA (information standards: compliance) substitute “Monitoring compliance”. 8 After that section insert— Notice requesting compliance by relevant IT providers 251ZB (1) If the Secretary of State has reasonable grounds to suspect that a relevant IT provider is not complying with an information standard which applies to the provider, the Secretary of State may give the provider a written notice which— (a) identifies the standard in question, (b) sets out the Secretary of State’s grounds for suspecting that the provider is not complying with the standard, (c) asks the provider to comply with the standard within a period specified in the notice, (d) asks the provider, within a period specified in the notice, to provide evidence to the Secretary of State’s satisfaction that the provider is complying with the standard, and (e) if the Secretary of State considers it appropriate, sets out the steps that the Secretary of State considers the provider must take, within a period specified in the notice, in order to comply with the standard. (2) A period specified for the purposes of subsection (1)(c), (d) or (e) must be a period of at least 28 days beginning with the day on which the notice is given. (3) The Secretary of State may, by giving the relevant IT provider a further written notice, vary or revoke a notice given under subsection (1). Public censure of relevant IT providers 251ZC (1) If the Secretary of State has reasonable grounds to suspect that a relevant IT provider is not complying with an information standard which applies to the provider, the Secretary of State may publish a statement to that effect. (2) The statement may include the text of a notice given to the provider under section 251ZB. (3) Before publishing a statement under this section, the Secretary of State must give the relevant IT provider— (a) a copy of the terms of the proposed statement, and (b) an opportunity to make representations about the decision to publish a statement and the terms of the statement. (4) If, after considering any representations, the Secretary of State decides to publish the statement, the Secretary of State must inform the relevant IT provider before publishing it. (5) This section does not authorise the processing of information if the processing would contravene the data protection legislation (but in determining whether it would do so, take into account the power conferred by this section). (6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act). Exercise of functions of Secretary of State by other persons 251ZD (1) The Secretary of State may— (a) direct a public body to exercise some or all of the functions listed in subsection (3), and (b) give the public body directions about the exercise of those functions, including directions about the processing of information that the body obtains in exercising those functions. (2) The Secretary of State may make arrangements for a person prescribed by regulations under this subsection to exercise some or all of the functions listed in subsection (3). (3) Those functions are— (a) the Secretary of State’s functions under section 251ZA, so far as they relate to relevant IT providers, and (b) the Secretary of State’s functions under section 251ZB. (4) Arrangements under subsection (2) may— (a) provide for the Secretary of State to make payments to the person, and (b) make provision as to the circumstances in which such payments are to be repaid to the Secretary of State. (5) Section 304(9) applies in relation to the power to make arrangements under subsection (2) as it applies to a power of the Secretary of State to give directions under this Act. Accreditation Accreditation of information technology etc 251ZE (1) Regulations may make provision for the establishment and operation of a scheme for the accreditation of information technology and IT services so far as used, or intended to be used, in connection with the provision in, or in relation to, England of health care or of adult social care. (2) The regulations may provide for the scheme to be established and operated by a person specified in the regulations (“the operator”). (3) The regulations may, among other things, confer power on the operator— (a) to establish the procedure for accreditation under the scheme, (b) to set the criteria for accreditation under the scheme (“the accreditation criteria”), (c) to keep an accreditation under the scheme under review, and (d) to charge a reasonable fee in respect of an application for accreditation. (4) The regulations may, among other things, make provision requiring the operator— (a) to set some or all of the accreditation criteria by reference to information standards, (b) to publish details of the scheme, including the accreditation criteria, (c) to provide for the review of a decision to refuse an application for accreditation, and (d) to provide advice to applicants for accreditation with a view to ensuring that the accreditation criteria are met.
Propose a changeSection 122 Part 1 Amendments of the Energy Act 2008 1 The Energy Act 2008 is amended as follows. 2 In the italic heading before section 88, after “meters” insert “: modification of licence conditions etc by Secretary of State”. 3 After section 91 insert— Grant of smart meter communication licences Grant of smart meter communication licences 91A (1) The Gas and Electricity Markets Authority may by regulations make provision about the procedure to be followed in relation to the grant of a smart meter communication licence. (2) Regulations under subsection (1) may provide that the procedure is to consist of either (but not both) of the following— (a) a determination by the Authority, on a competitive basis, of the person to whom a licence is to be granted; (b) the selection by the Authority, on a non-competitive basis, of the person to whom a licence is to be granted. (3) Regulations under subsection (1) may make provision by reference to a determination by the Authority or to the opinion of the Authority as to any matter. (4) The approval of the Secretary of State is required for the making of regulations under subsection (1). (5) In this section and in sections 91B to 91D— “the Authority” means the Gas and Electricity Markets Authority; “smart meter communication licence” means a licence under section 7AB of the Gas Act 1986 or a licence under section 6(1)(f) of the Electricity Act 1989. Regulations under section 91A (1): further provision 91B (1) Regulations under section 91A(1)— (a) must make provision so as to ensure that a smart meter communication licence must not be granted to a person unless the Authority is satisfied that the person would not, if granted the licence, have a financial or other interest likely to prejudice the discharge of their functions as the licence holder; (b) may make provision about the granting of a licence to a person formed by the Authority. (2) Any sums received by the Authority under regulations under section 91A(1) are to be paid into the Consolidated Fund. (3) Regulations made in reliance on section 91A(2)(a) may— (a) provide for the publication of a proposal to grant a smart meter communication licence; (b) provide for the inclusion in such a proposal of an invitation to apply for such a licence; (c) impose conditions in relation to the making of an application for a licence; (d) impose restrictions in relation to persons who may apply for a licence; (e) impose requirements as to the period within which applications must be made; (f) make provision for regulating the manner in which applications are to be considered or determined; (g) confer on the Authority functions in connection with tender exercises. (4) Regulations in reliance on section 91A(2)(a) may also include provision— (a) enabling the Authority to require payments to be made, in the form and manner prescribed, in respect of costs incurred or likely to be incurred by the Authority for the purposes of a tender exercise; (b) about the effect on a person’s participation in a tender exercise of a failure to comply with a requirement imposed by virtue of paragraph (a); (c) about the circumstances in which the tender exercise is to stop as a result of such a failure. (5) In this section— “prescribed” means prescribed in or determined under regulations under section 91A(1); “tender exercise” means the procedure set out in regulations made in reliance on section 91A(2)(a) for determining to whom a particular smart meter communication licence is to be granted. Power of Gas and Electricity Markets Authority to amend licence conditions etc 91C (1) The Authority may modify— (a) a condition of a particular relevant licence; (b) the standard conditions incorporated in relevant licences of a particular type; (c) a document maintained in accordance with the conditions of a relevant licence, or an agreement that gives effect to a document so maintained. (2) The Authority may exercise the power in subsection (1) only if the Authority considers it necessary or expedient to do so for the purposes of, or in preparation for, the grant of a smart meter communication licence. (3) The power conferred by subsection (1)— (a) may be exercised to make different provision for different purposes or different areas; (b) may be exercised generally, only in relation to specified cases or subject to exceptions (including provision for a case to be excepted only so long as specified conditions are satisfied); (c) includes a power to make incidental, supplementary, consequential or transitional modifications. (4) Provision included in a licence in reliance on subsection (1)— (a) need not relate to the activities authorised by the licence; (b) in the case of a licence for the purposes of section 5 of the Gas Act 1986, may do any of the things authorised by section 7B(5) of that Act (which apply to the Authority’s power with respect to licence conditions under section 7B(4)(a)); (c) in the case of a licence for the purposes of section 4 of the Electricity Act 1989, may do any of the things authorised by section 7(2) to (4) of that Act (which apply to the Authority’s power with respect to licence conditions under section 7(1)(a)). (5) A modification under subsection (1) of part of a standard condition of a licence does not prevent any other part of the condition from continuing to be regarded as a standard condition for the purposes of Part 1 of the Gas Act 1986 or Part 1 of the Electricity Act 1989. (6) Where the Authority makes modifications under subsection (1) of the standard conditions of a licence of any type, the Authority must— (a) make (as nearly as may be) the same modifications of those standard conditions for the purposes of their incorporation in licences of that type granted after that time, and (b) publish the modifications. (7) In this section— “relevant licence” means a licence for the purposes of section 5 of the Gas Act 1986 or section 4 of the Electricity Act 1989 (prohibitions on unlicensed activities); “specified” means specified in the modification. Power under section 91C: procedure 91D (1) Before making a modification under section 91C, the Authority must consult— (a) the holder of any licence being modified, (b) the Secretary of State, and (c) such other persons as the Authority considers appropriate. (2) Subsection (1) may be satisfied by consultation undertaken before the passing of the Data (Use and Access) Act 2025. (3) If, after carrying out the consultation, the Authority decides to make the modification, it must publish a notice about the decision which— (a) states that the Authority has decided to make the modification; (b) sets out the modification and its effect; (c) specifies the date from which the modification has effect; (d) states how the Authority has taken account of any representations made during the consultation; (e) states the reason for any differences between the modification consulted on and the proposed modification. (4) The notice must be published in such manner as the Authority considers appropriate for bringing it to the attention of those likely to be affected by the making of the modification. 4 In section 104 (subordinate legislation)— (a) in subsection (1), for “or the Scottish Ministers” substitute “, the Scottish Ministers or the Gas and Electricity Markets Authority”; (b) in subsection (3), at the end insert , and (c) regulations made by the Gas and Electricity Markets Authority under section 91A.
Propose a change