(1) When carrying out processing of personal data which is the subject of a document issued under section 192(3) which is for the time being in force, a person must have regard to the document.
(2) A failure to act in accordance with a provision of such a document does not of itself make a person liable to legal proceedings in a court or tribunal.
(3) A document issued under section 192(3), including an amendment or replacement document, is admissible in evidence in legal proceedings.
(4) In any legal proceedings before a court or tribunal, the court or tribunal must take into account a provision of any document issued under section 192(3) in determining a question arising in the proceedings if—
(a) the question relates to a time when the provision was in force, and
(b) the provision appears to the court or tribunal to be relevant to the question.
(5) In determining a question arising in connection with the carrying out of any of the Commission's functions, the Commission must take into account a provision of a document issued under section 192(3) if—
(a) the question relates to a time when the provision was in force, and
(b) the provision appears to the Commission to be relevant to the question.
(1) The Reserve Forces Act 1996 is amended as follows.
(2) After section 125 insert—
Supply of contact details by HMRC
125A (1) This subsection applies to contact details for—
(a) a member of an ex-regular reserve force, or
(b) a person to whom section 66 (officers and former servicemen liable to recall) applies,
which are held by HMRC in connection with a function of HMRC.
(2) HMRC may supply contact details to which subsection (1) applies to the Secretary of State for the purpose of enabling the Secretary of State—
(a) to contact a member of an ex-regular reserve force in connection with the person's liability, or potential liability, to be called out for service under Part 6;
(b) to contact a person to whom section 66 applies in connection with the person's liability, or potential liability, to be recalled for service under Part 7.
(3) Where a person's contact details are supplied under subsection (2) for a purpose described in that subsection, they may also be used for defence purposes connected with the person's service (whether past, present or future) in the reserve forces or regular services.
(4) In this section, “HMRC” means Her Majesty's Revenue and Customs.
Prohibition on disclosure of contact details supplied under section 125A
125B (1) A person who receives information supplied under section 125A may not disclose it except with the consent of the Commissioners for Her Majesty's Revenue and Customs (which may be general or specific).
(2) A person who contravenes subsection (1) is guilty of an offence.
(3) It is a defence for a person charged with an offence under this section to prove that the person reasonably believed—
(a) that the disclosure was lawful, or
(b) that the information had already lawfully been made available to the public.
(4) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under this section as they apply to an offence under that section.
(5) Nothing in section 107 or 108 (institution of proceedings and evidence) applies in relation to an offence under this section.
Data protection
125C (1) Nothing in section 125A or 125B authorises the making of a disclosure which contravenes the data protection legislation.
(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).
(1) A person who commits an offence under section 119 or 173 or paragraph 15 of Schedule 15 is liable—
(a) on summary conviction in England and Wales, to a fine;
(b) on summary conviction in Scotland or Northern Ireland, to a fine not exceeding level 5 on the standard scale.
(2) A person who commits an offence under section 132, 144, 148, 148C, 170, 171 or 184 is liable—
(a) on summary conviction in England and Wales, to a fine;
(b) on summary conviction in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum;
(c) on conviction on indictment, to a fine.
(3) Subsections (4) and (5) apply where a person is convicted of an offence under section 170 or 184.
(4) The court by or before which the person is convicted may order a document or other material to be forfeited, destroyed or erased if—
(a) it has been used in connection with the processing of personal data, and
(b) it appears to the court to be connected with the commission of the offence,
subject to subsection (5).
(5) If a person, other than the offender, who claims to be the owner of the material, or to be otherwise interested in the material, applies to be heard by the court, the court must not make an order under subsection (4) without giving the person an opportunity to show why the order should not be made.
(1) In England and Wales, proceedings for an offence under this Act may be instituted only—
(a) by the Commission, or
(b) by or with the consent of the Director of Public Prosecutions.
(2) In Northern Ireland, proceedings for an offence under this Act may be instituted only—
(a) by the Commission, or
(b) by or with the consent of the Director of Public Prosecutions for Northern Ireland.
(3) Subject to subsection (4), summary proceedings for an offence under section 173 (alteration etc of personal data to prevent disclosure) may be brought within the period of 6 months beginning with the day on which the prosecutor first knew of evidence that, in the prosecutor's opinion, was sufficient to bring the proceedings.
(4) Such proceedings may not be brought after the end of the period of 3 years beginning with the day on which the offence was committed.
(5) A certificate signed by or on behalf of the prosecutor and stating the day on which the 6 month period described in subsection (3) began is conclusive evidence of that fact.
(6) A certificate purporting to be signed as described in subsection (5) is to be treated as so signed unless the contrary is proved.
(7) In relation to proceedings in Scotland, section 136(3) of the Criminal Procedure (Scotland) Act 1995 (deemed date of commencement of proceedings) applies for the purposes of this section as it applies for the purposes of that section.
(1) Subsection (2) applies where—
(a) an offence under this Act has been committed by a body corporate, and
(b) it is proved to have been committed with the consent or connivance of or to be attributable to neglect on the part of—
(i) a director, manager, secretary or similar officer of the body corporate, or
(ii) a person who was purporting to act in such a capacity.
(2) The director, manager, secretary, officer or person, as well as the body corporate, is guilty of the offence and liable to be proceeded against and punished accordingly.
(3) Where the affairs of a body corporate are managed by its members, subsections (1) and (2) apply in relation to the acts and omissions of a member in connection with the member's management functions in relation to the body as if the member were a director of the body corporate.
(4) Subsection (5) applies where—
(a) an offence under this Act has been committed by a Scottish partnership, and
(b) the contravention in question is proved to have occurred with the consent or connivance of, or to be attributable to any neglect on the part of, a partner.
(5) The partner, as well as the partnership, is guilty of the offence and liable to be proceeded against and punished accordingly.
(1) The Commission must produce and publish guidance about how the Commission proposes to perform the duty under section 67(9) of the Police and Criminal Evidence Act 1984 (duty to have regard to codes of practice under that Act when investigating offences and charging offenders) in connection with offences under this Act.
(2) The Commission—
(a) may alter or replace the guidance, and
(b) must publish any altered or replacement guidance.
(3) The Commission must consult the Secretary of State before publishing guidance under this section (including any altered or replacement guidance).
(4) The Commission must arrange for guidance under this section (including any altered or replacement guidance) to be laid before Parliament.
(1) No enactment or rule of law prohibiting or restricting the disclosure of information precludes a person from providing the First-tier Tribunal or the Upper Tribunal with information necessary for the discharge of—
(a) its functions under the data protection legislation, or
(b) its other functions relating to the Commission's acts and omissions.
(2) But this section does not authorise the making of a disclosure which is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
(3) Until the repeal of Part 1 of the Regulation of Investigatory Powers Act 2000 by paragraphs 45 and 54 of Schedule 10 to the Investigatory Powers Act 2016 is fully in force, subsection (2) has effect as if it included a reference to that Part.
202 Proceedings in the First-tier Tribunal: contempt
(1) This section applies where—
(a) a person does something, or fails to do something, in relation to proceedings before the First-tier Tribunal—
(i) on an appeal under section 27, 79, 82E, 111 or 162, or
(ii) for an order under section 166, and
(b) if those proceedings were proceedings before a court having power to commit for contempt, the act or omission would constitute contempt of court.
(2) The First-tier Tribunal may certify the offence to the Upper Tribunal.
(3) Where an offence is certified under subsection (2), the Upper Tribunal may—
(a) inquire into the matter, and
(b) deal with the person charged with the offence in any manner in which it could deal with the person if the offence had been committed in relation to the Upper Tribunal.
(4) Before exercising the power under subsection (3)(b), the Upper Tribunal must—
(a) hear any witness who may be produced against or on behalf of the person charged with the offence, and
(b) hear any statement that may be offered in defence.
(1) Tribunal Procedure Rules may make provision for regulating—
(a) the exercise of the rights of appeal conferred by section 27, 79, 82E, 111 or 162, and
(b) the exercise of the rights of data subjects under section 166, including their exercise by a representative body.
(2) In relation to proceedings involving the exercise of those rights, Tribunal Procedure Rules may make provision about—
(a) securing the production of material used for the processing of personal data, and
(b) the inspection, examination, operation and testing of equipment or material used in connection with the processing of personal data.
204 Meaning of “health professional” and “social work professional”
(1) In this Act, “health professional” means any of the following—
(a) a registered medical practitioner;
(b) a registered nurse or midwife;
(c) a registered dentist within the meaning of the Dentists Act 1984 (see section 53 of that Act);
(d) a registered dispensing optician or a registered optometrist within the meaning of the Opticians Act 1989 (see section 36 of that Act);
(e) a registered osteopath with the meaning of the Osteopaths Act 1993 (see section 41 of that Act);
(f) a registered chiropractor within the meaning of the Chiropractors Act 1994 (see section 43 of that Act);
(g) a person registered as a member of a profession to which the Health ... Professions Order 2001 (S.I. 2002/254) for the time being extends; ...
(h) a registered pharmacist or a registered pharmacy technician within the meaning of the Pharmacy Order 2010 (S.I. 2010/231) (see article 3 of that Order);
(i) a registered person within the meaning of the Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22)) (see Article 2 of that Order);
(j) a child psychotherapist;
(k) a scientist employed by a health service body as head of a department.
(l) a person registered under the Anaesthesia Associates and Physician Associates Order 2024.
(2) In this Act, “social work professional” means any of the following—
(a) a person registered as a social worker in the register maintained by Social Work England under section 39(1) of the Children and Social Work Act 2017;
(b) a person registered as a social worker in the register maintained by Social Care Wales under section 80 of the Regulation and Inspection of Social Care (Wales) Act 2016 (anaw 2);
(c) a person registered as a social worker in the register maintained by the Scottish Social Services Council under section 44 of the Regulation of Care (Scotland) Act 2001 (asp 8);
(d) a person registered as a social worker in the register maintained by the Northern Ireland Social Care Council under section 3 of the Health and Personal Social Services Act (Northern Ireland) 2001 (c. 3 (N.I.)).
(3) In subsection (1)(a) “registered medical practitioner” includes a person who is provisionally registered under section 15 or 21 of the Medical Act 1983 and is engaged in such employment as is mentioned in subsection (3) of that section.
(4) In subsection (1)(k) “health service body” means any of the following—
(a) the Secretary of State in relation to the exercise of functions under section 2A or 2B of, or paragraph 7C, 8 or 12 of Schedule 1 to, the National Health Service Act 2006;
(b) a local authority in relation to the exercise of functions under section 2B or 111 of, or any of paragraphs 1 to 7B or 13 of Schedule 1 to, the National Health Service Act 2006;
(c) a National Health Service trust first established under section 25 of the National Health Service Act 2006;
(d) a Special Health Authority established under section 28 of the National Health Service Act 2006;
(e) an NHS foundation trust;
(f) the National Institute for Health and Care Excellence;
(g) NHS England;
(h) a National Health Service trust first established under section 5 of the National Health Service and Community Care Act 1990;
(i) a Local Health Board established under section 11 of the National Health Service (Wales) Act 2006;
(j) a National Health Service trust first established under section 18 of the National Health Service (Wales) Act 2006;
(k) a Special Health Authority established under section 22 of the National Health Service (Wales) Act 2006;
(l) a Health Board within the meaning of the National Health Service (Scotland) Act 1978;
(m) a Special Health Board within the meaning of the National Health Service (Scotland) Act 1978;
(n) a National Health Service trust first established under section 12A of the National Health Service (Scotland) Act 1978;
(o) the managers of a State Hospital provided under section 102 of the National Health Service (Scotland) Act 1978;
(p) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(q) a special health and social care agency established under the Health and Personal Social Services (Special Agencies) (Northern Ireland) Order 1990 (S.I. 1990/247 (N.I. 3));
(r) a Health and Social Care trust established under Article 10 of the Health and Personal Social Services (Northern Ireland) Order 1991 (S.I. 1991/194 (N.I. 1)).
(1) In this Act—
“biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic data;
“data concerning health” means personal data relating to the physical or mental health of an individual, including the provision of health care services, which reveals information about his or her health status;
“enactment” includes—
an enactment passed or made after this Act,
an enactment comprised in subordinate legislation,
an enactment comprised in, or in an instrument made under, a Measure or Act of the National Assembly for Wales,
an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament, ...
an enactment comprised in, or in an instrument made under, Northern Ireland legislation; and
any assimilated direct legislation;
“genetic data” means personal data relating to the inherited or acquired genetic characteristics of an individual which gives unique information about the physiology or the health of that individual and which results, in particular, from an analysis of a biological sample from the individual in question;
“government department” includes the following (except in the expression “United Kingdom government department”)—
a part of the Scottish Administration;
a Northern Ireland department;
the Welsh Government;
a body or authority exercising statutory functions on behalf of the Crown;
“health record” means a record which—
consists of data concerning health, and
has been made by or on behalf of a health professional in connection with the diagnosis, care or treatment of the individual to whom the data relates;
“inaccurate”, in relation to personal data, means incorrect or misleading as to any matter of fact;
“international obligation of the United Kingdom” includes—
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
an obligation that arises under an international agreement or arrangement to which the United Kingdom is a party;
“international organisation” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;
“Minister of the Crown” has the same meaning as in the Ministers of the Crown Act 1975;
“publish” means make available to the public or a section of the public (and related expressions are to be read accordingly);
“subordinate legislation” has the meaning given in the Interpretation Act 1978;
“tribunal” means any tribunal in which legal proceedings may be brought;
“the Tribunal”, in relation to an application or appeal under this Act, means—
the Upper Tribunal, in any case where it is determined by or under Tribunal Procedure Rules that the Upper Tribunal is to hear the application or appeal, or
the First-tier Tribunal, in any other case.
(1A) In this Act, references to fundamental rights or fundamental freedoms (however expressed) are to the Convention rights within the meaning of the Human Rights Act 1998.
(2) References in this Act to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits, except in—
(za) section 119A(10) and (11);
(a) section 125(4), (7) and (8);
(b) section 161(3), (5) and (6);
(c) section 176(2);
(d) section 178(2);
(e) section 182(8) ...;
(f) section 183(4);
(g) section 192(3), (5) and (6);
(h) section 197(3) and (4);
(i) paragraph 23(4) and (5) of Schedule 1;
(j) paragraphs 5(4) and 6(4) of Schedule 3;
(k) Schedule 5;
(l) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(la) paragraph 22(6) of Schedule 12A;
(m) Schedule 15;
(and the references in section 5 to terms used in ... Part 2 do not include references to a period expressed in hours, days, weeks, months or years).
(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) In the definition of “the UK GDPR” in section 3(10)—
(a) the reference to Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 is to be treated as a reference to that Regulation as modified by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (“the 2019 Regulations”), but
(b) nothing in the definition or in paragraph (a) determines whether, where Regulation (EU) 2016/679 is modified on or after IP completion day by the law of England and Wales, Scotland or Northern Ireland (other than by Schedule 1 to the 2019 Regulations), the reference to Regulation (EU) 2016/679 is then to be read as a reference to that Regulation as modified.
(5) Subsection (4) is not to be read as implying anything about how other references to Regulation (EU) 2016/679 or references to other assimilated law are to be interpreted.
The Table below lists provisions which define or otherwise explain terms defined for this Act, for a Part of this Act or for Chapter 2 or 3 of Part 2 of this Act.
the affirmative resolution procedure | section 182
. . . | . . .
. . . | . . .
assessment notice (in Part 6) | section 181
biometric data | section 205
certification provider (in Part 6) | section 181
the Commission | section 3
. . . | . . .
competent authority (in Parts 3 and 4) | sections 30 and 82
consent (to processing of personal data) (in Parts 3 and 4) | sections 33, 40A and 84
controller | section 3
data concerning health | section 205
the Data Protection Convention | section 3
the data protection legislation | section 3
data subject | section 3
designation notice (in Part 4) | section 84
employee (in Parts 3 and 4) | sections 33 and 84
enactment | section 205
enforcement notice (in Part 6) | section 181
the EU GDPR | section 3
filing system | section 3
FOI public authority (in Chapter 3 of Part 2) | section 21
. . . | . . .
genetic data | section 205
government department | section 205
health professional | section 204
health record | section 205
identifiable living individual | section 3
inaccurate | section 205
information notice (in Part 6) | section 181
intelligence service (in Part 4) | section 82
international obligation of the United Kingdom | section 205
international organisation | section 205
interview notice (in Part 6) | section 181
the Law Enforcement Directive | section 3
the law enforcement purposes (in Part 3) | section 31
the made affirmative resolution procedure | section 182
Minister of the Crown | section 205
the negative resolution procedure | section 182
penalty notice (in Part 6) | section 181
penalty variation notice (in Part 6) | section 181
personal data | section 3
personal data breach (in Parts 3 and 4) | sections 33 and 84
processing | section 3
processor | section 3
profiling (in Part 3) | section 33
public authority (in the UK GDPR and Part 2) | section 7
public body (in the UK GDPR and Part 2) | section 7
publish | section 205
qualifying competent authority (in Part 4) | section 82
recipient (in Parts 3 and 4) | sections 33 and 84
. . . | . . .
representative body (in relation to a right of a data subject) | section 187
restriction of processing (in Parts 3 and 4) | sections 33 and 84
sensitive processing (in Parts 3 and 4) | sections 35 and 86
social work professional | section 204
the special purposes (in Part 6) | section 174
special purposes proceedings (in Part 6) | section 174
subordinate legislation | section 205
third country (in Part 3) | section 33
tribunal | section 205
the Tribunal | section 205
the UK GDPR | section 3
withdrawal notice (in Part 4) | section 84
(1) This Act applies only to processing of personal data described in subsections (1A) and (2).
(1A) In the case of the processing of personal data to which Part 2 (the UK GDPR) applies, it applies to the types of such processing to which the UK GDPR applies by virtue of Article 3 of the UK GDPR.
(2) In the case of the processing of personal data to which Part 2 does not apply, it applies where such processing is carried out in the context of the activities of an establishment of a controller or processor in the United Kingdom, whether or not the processing takes place in the United Kingdom.
(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) Subsections (1), (1A) and (2) have effect subject to any provision in or made under section 120 providing for the Commission to carry out functions in relation to other processing of personal data.
(5) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (2).
(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(7) In this section, references to a person who has an establishment in the United Kingdom include the following—
(a) an individual who is ordinarily resident in the United Kingdom,
(b) a body incorporated under the law of the United Kingdom or a part of the United Kingdom,
(c) a partnership or other unincorporated association formed under the law of the United Kingdom or a part of the United Kingdom, and
(d) a person not within paragraph (a), (b) or (c) who maintains, and carries on activities through, an office, branch or agency or other stable arrangements in the United Kingdom,
....
(1) Subsections (2) and (3) apply where a question falls to be determined in Scotland as to the legal capacity of a person aged under 16 to—
(a) exercise a right conferred by the data protection legislation, or
(b) give consent for the purposes of the data protection legislation.
(2) The person is to be taken to have that capacity where the person has a general understanding of what it means to exercise the right or give such consent.
(3) A person aged 12 or over is to be presumed to be of sufficient age and maturity to have such understanding, unless the contrary is shown.
(1) This Act binds the Crown.
(2) For the purposes of the UK GDPR and this Act, each government department is to be treated as a person separate from the other government departments (to the extent that is not already the case).
(3) Where government departments are not able to enter into contracts with each other, a provision of the UK GDPR or this Act that would require relations between them to be governed by a contract (or other binding legal act) in writing is to be treated as satisfied if the relations are the subject of a memorandum of understanding between them.
(4) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by a person acting on behalf of the Royal Household, the Duchy of Lancaster or the Duchy of Cornwall, the controller in respect of that data for the purposes of the UK GDPR and this Act is—
(a) in relation to the Royal Household, the Keeper of the Privy Purse,
(b) in relation to the Duchy of Lancaster, such person as the Chancellor of the Duchy appoints, and
(c) in relation to the Duchy of Cornwall, such person as the Duke of Cornwall, or the possessor for the time being of the Duchy of Cornwall, appoints.
(5) Different persons may be appointed under subsection (4)(b) or (c) for different purposes.
(6) As regards criminal liability—
(a) a government department is not liable to prosecution under this Act;
(b) nothing in subsection (4) makes a person who is a controller by virtue of that subsection liable to prosecution under this Act;
(c) a person in the service of the Crown is liable to prosecution under the provisions of this Act listed in subsection (7).
(7) Those provisions are—
(a) section 119;
(b) section 170;
(c) section 171;
(d) section 173;
(e) paragraph 15 of Schedule 15.
(1) Parts 1, 2 and 5 to 7 of this Act apply to the processing of personal data by or on behalf of either House of Parliament.
(2) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by or on behalf of the House of Commons, the controller in respect of that data for the purposes of the UK GDPR and this Act is the Corporate Officer of that House.
(3) Where the purposes for which and the manner in which personal data is, or is to be, processed are determined by or on behalf of the House of Lords, the controller in respect of that data for the purposes of the UK GDPR and this Act is the Corporate Officer of that House.
(4) Subsections (2) and (3) do not apply where the purposes for which and the manner in which the personal data is, or is to be, processed are determined by or on behalf of the Intelligence and Security Committee of Parliament.
(5) As regards criminal liability—
(a) nothing in subsection (2) or (3) makes the Corporate Officer of the House of Commons or the Corporate Officer of the House of Lords liable to prosecution under this Act;
(b) a person acting on behalf of either House of Parliament is liable to prosecution under the provisions of this Act listed in subsection (6).
(6) Those provisions are—
(a) section 170;
(b) section 171;
(c) section 173;
(d) paragraph 15 of Schedule 15.
(1) In Schedule 19—
(a) Part 1 contains minor and consequential amendments of primary legislation;
(b) Part 2 contains minor and consequential amendments of other legislation;
(c) Part 3 contains consequential modifications of legislation;
(d) Part 4 contains supplementary provision.
(2) The Secretary of State may by regulations make provision that is consequential on any provision made by this Act.
(3) Regulations under subsection (2)—
(a) may include transitional, transitory or saving provision;
(b) may amend, repeal or revoke an enactment.
(4) The reference to an enactment in subsection (3)(b) does not include an enactment passed or made after the end of the Session in which this Act is passed.
(5) Regulations under this section that amend, repeal or revoke primary legislation are subject to the affirmative resolution procedure.
(6) Any other regulations under this section are subject to the negative resolution procedure.
(7) In this section, “primary legislation” means—
(a) an Act;
(b) an Act of the Scottish Parliament;
(c) a Measure or Act of the National Assembly for Wales;
(d) Northern Ireland legislation.
(1) Except as provided by subsections (2) and (3), this Act comes into force on such day as the Secretary of State may by regulations appoint.
(2) This section and the following provisions come into force on the day on which this Act is passed—
(a) sections 1 and 3;
(b) section 182;
(c) sections 204, 205 and 206;
(d) sections 209 and 210;
(e) sections 213(2), 214 and 215;
(f) any other provision of this Act so far as it confers power to make regulations or Tribunal Procedure Rules or is otherwise necessary for enabling the exercise of such a power on or after the day on which this Act is passed.
(3) The following provisions come into force at the end of the period of 2 months beginning when this Act is passed—
(a) section 124;
(b) sections 125, 126 and 127, so far as they relate to a code prepared under section 124;
(c) section 177;
(d) section 178 and Schedule 17;
(e) section 179.
(4) Regulations under this section may make different provision for different areas.
(1) Schedule 20 contains transitional, transitory and saving provision.
(2) The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act or with the EU GDPR beginning to apply, including provision amending or repealing a provision of Schedule 20.
(3) Regulations under this section that amend or repeal a provision of Schedule 20 are subject to the negative resolution procedure.
(4) Schedule 21 contains further transitional, transitory and saving provision made in connection with the amendment of this Act and the UK GDPR by regulations under section 8 of the European Union (Withdrawal) Act 2018.
(1) This Act extends to England and Wales, Scotland and Northern Ireland, subject to—
(a) subsections (2) to (5), ...
(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(2) Section 199 extends to England and Wales only.
(3) Sections 188, 189 and 190 extend to England and Wales and Northern Ireland only.
(4) An amendment, repeal or revocation made by this Act has the same extent in the United Kingdom as the enactment amended, repealed or revoked.
(5) This subsection and the following provisions also extend to the Isle of Man—
(a) paragraphs 332 and 434 of Schedule 19;
(b) sections 211(1), 212(1) and 213(2), so far as relating to those paragraphs.
(6) Where there is a power to extend a part of an Act by Order in Council to any of the Channel Islands, the Isle of Man or any of the British overseas territories, the power may be exercised in relation to an amendment or repeal of that part which is made by or under this Act.
Schedule A1 Processing in reliance on relevant international law
Section 9A
This condition is met where the processing is necessary for the purposes of responding to a request made in accordance with the Agreement between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the United States of America on Access to Electronic Data for the Purpose of Countering Serious Crime, signed on 3 October 2019.
SCHEDULE 1 Special categories of personal data and criminal convictions etc data
Section 10
PART 1 Conditions relating to employment, health and research etc
Employment, social security and social protection
1 (1) This condition is met if—
(a) the processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection, and
(b) when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule).
(2) See also the additional safeguards in Part 4 of this Schedule.
(3) In this paragraph—
“social security” includes any of the branches of social security listed in Article 3(1) of Regulation (EC) No. 883/2004 of the European Parliament and of the Council on the co-ordination of social security systems (as amended from time to time);
“social protection” includes an intervention described in Article 2(b) of Regulation (EC) 458/2007 of the European Parliament and of the Council of 25 April 2007 on the European system of integrated social protection statistics (ESSPROS) as it had effect in EU law immediately before IP completion day.
Health or social care purposes
2 (1) This condition is met if the processing is necessary for health or social care purposes.
(2) In this paragraph “health or social care purposes” means the purposes of—
(a) preventive or occupational medicine,
(b) the assessment of the working capacity of an employee,
(c) medical diagnosis,
(d) the provision of health care or treatment,
(e) the provision of social care, or
(f) the management of health care systems or services or social care systems or services.
(3) See also the conditions and safeguards in Article 9(3) of the UK GDPR (obligations of secrecy) and section 11(1).
Public health
3 This condition is met if the processing—
(a) is necessary for reasons of public interest in the area of public health, and
(b) is carried out—
(i) by or under the responsibility of a health professional, or
(ii) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.
Research etc
4 This condition is met if the processing—
(a) is necessary for archiving purposes, scientific or historical research purposes or statistical purposes,
(b) is carried out in accordance with Article 84B of the UK GDPR, and
(c) is in the public interest.
PART 2 Substantial public interest conditions
Requirement for an appropriate policy document when relying on conditions in this Part
5 (1) Except as otherwise provided, a condition in this Part of this Schedule is met only if, when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule).
(2) See also the additional safeguards in Part 4 of this Schedule.
Statutory etc and government purposes
6 (1) This condition is met if the processing—
(a) is necessary for a purpose listed in sub-paragraph (2), and
(b) is necessary for reasons of substantial public interest.
(2) Those purposes are—
(a) the exercise of a function conferred on a person by an enactment or rule of law;
(b) the exercise of a function of the Crown, a Minister of the Crown or a government department.
Administration of justice and parliamentary purposes
7 This condition is met if the processing is necessary—
(a) for the administration of justice, or
(b) for the exercise of a function of either House of Parliament.
Equality of opportunity or treatment
8 (1) This condition is met if the processing—
(a) is of a specified category of personal data, and
(b) is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained,
subject to the exceptions in sub-paragraphs (3) to (5).
(2) In sub-paragraph (1), “specified” means specified in the following table—
Category of personal data | Groups of people (in relation to a category of personal data)
Personal data revealing racial or ethnic origin | People of different racial or ethnic origins
Personal data revealing religious or philosophical beliefs | People holding different religious or philosophical beliefs
Data concerning health | People with different states of physical or mental health
Personal data concerning an individual's sexual orientation | People of different sexual orientation
(3) Processing does not meet the condition in sub-paragraph (1) if it is carried out for the purposes of measures or decisions with respect to a particular data subject.
(4) Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to an individual.
(5) Processing does not meet the condition in sub-paragraph (1) if—
(a) an individual who is the data subject (or one of the data subjects) has given notice in writing to the controller requiring the controller not to process personal data in respect of which the individual is the data subject (and has not given notice in writing withdrawing that requirement),
(b) the notice gave the controller a reasonable period in which to stop processing such data, and
(c) that period has ended.
Racial and ethnic diversity at senior levels of organisations
9 (1) This condition is met if the processing—
(a) is of personal data revealing racial or ethnic origin,
(b) is carried out as part of a process of identifying suitable individuals to hold senior positions in a particular organisation, a type of organisation or organisations generally,
(c) is necessary for the purposes of promoting or maintaining diversity in the racial and ethnic origins of individuals who hold senior positions in the organisation or organisations, and
(d) can reasonably be carried out without the consent of the data subject,
subject to the exception in sub-paragraph (3).
(2) For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where—
(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and
(b) the controller is not aware of the data subject withholding consent.
(3) Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to an individual.
(4) For the purposes of this paragraph, an individual holds a senior position in an organisation if the individual—
(a) holds a position listed in sub-paragraph (5), or
(b) does not hold such a position but is a senior manager of the organisation.
(5) Those positions are—
(a) a director, secretary or other similar officer of a body corporate;
(b) a member of a limited liability partnership;
(c) a partner in a partnership within the Partnership Act 1890, a limited partnership registered under the Limited Partnerships Act 1907 or an entity of a similar character formed under the law of a country or territory outside the United Kingdom.
(6) In this paragraph, “senior manager”, in relation to an organisation, means a person who plays a significant role in—
(a) the making of decisions about how the whole or a substantial part of the organisation's activities are to be managed or organised, or
(b) the actual managing or organising of the whole or a substantial part of those activities.
(7) The reference in sub-paragraph (2)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.
Preventing etc unlawful acts
10 (1) This condition is met if the processing—
(a) is necessary for the purposes of the prevention , investigation or detection of an unlawful act,
(b) must be carried out without the consent of the data subject so as not to prejudice those purposes, and
(c) is necessary for reasons of substantial public interest.
(2) If the processing consists of the disclosure of personal data to a competent authority, or is carried out in preparation for such disclosure, the condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).
(3) In this paragraph—
“act” includes a failure to act;
“competent authority” has the same meaning as in Part 3 of this Act (see section 30).
Protecting the public against dishonesty etc
11 (1) This condition is met if the processing—
(a) is necessary for the exercise of a protective function,
(b) must be carried out without the consent of the data subject so as not to prejudice the exercise of that function, and
(c) is necessary for reasons of substantial public interest.
(2) In this paragraph, “protective function” means a function which is intended to protect members of the public against—
(a) dishonesty, malpractice or other seriously improper conduct,
(b) unfitness or incompetence,
(c) mismanagement in the administration of a body or association, or
(d) failures in services provided by a body or association.
Regulatory requirements relating to unlawful acts and dishonesty etc
12 (1) This condition is met if—
(a) the processing is necessary for the purposes of complying with, or assisting other persons to comply with, a regulatory requirement which involves a person taking steps to establish whether another person has—
(i) committed an unlawful act, or
(ii) been involved in dishonesty, malpractice or other seriously improper conduct,
(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing, and
(c) the processing is necessary for reasons of substantial public interest.
(2) In this paragraph—
“act” includes a failure to act;
“regulatory requirement” means—
a requirement imposed by legislation or by a person in exercise of a function conferred by legislation, or
a requirement forming part of generally accepted principles of good practice relating to a type of body or an activity.
Journalism etc in connection with unlawful acts and dishonesty etc
13 (1) This condition is met if—
(a) the processing consists of , or is carried out in preparation for, the disclosure of personal data for the special purposes,
(b) it is carried out in connection with a matter described in sub-paragraph (2),
(c) it is necessary for reasons of substantial public interest,
(d) it is carried out with a view to the publication of the personal data by any person, and
(e) the controller reasonably believes that publication of the personal data would be in the public interest.
(2) The matters mentioned in sub-paragraph (1)(b) are any of the following (whether alleged or established)—
(a) the commission of an unlawful act by a person;
(b) dishonesty, malpractice or other seriously improper conduct of a person;
(c) unfitness or incompetence of a person;
(d) mismanagement in the administration of a body or association;
(e) a failure in services provided by a body or association.
(3) The condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).
(4) In this paragraph—
“act” includes a failure to act;
“the special purposes” means—
the purposes of journalism;
academic purposes;
artistic purposes;
literary purposes.
Preventing fraud
14 (1) This condition is met if the processing—
(a) is necessary for the purposes of preventing fraud or a particular kind of fraud, and
(b) consists of—
(i) the disclosure of personal data by a person as a member of an anti-fraud organisation,
(ii) the disclosure of personal data in accordance with arrangements made by an anti-fraud organisation,
(iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii), or
(iii) the processing of personal data disclosed as described in sub-paragraph (i) or (ii).
(2) In this paragraph, “anti-fraud organisation” has the same meaning as in section 68 of the Serious Crime Act 2007.
Suspicion of terrorist financing or money laundering
15 This condition is met if the processing is necessary for the purposes of making a disclosure in good faith under either of the following—
(a) section 21CA of the Terrorism Act 2000 (disclosures between certain entities within regulated sector in relation to suspicion of commission of terrorist financing offence or for purposes of identifying terrorist property);
(b) section 339ZB of the Proceeds of Crime Act 2002 (disclosures within regulated sector in relation to suspicion of money laundering).
Support for individuals with a particular disability or medical condition
16 (1) This condition is met if the processing—
(a) is carried out by a not-for-profit body which provides support to individuals with a particular disability or medical condition,
(b) is of a type of personal data falling within sub-paragraph (2) which relates to an individual falling within sub-paragraph (3),
(c) is necessary for the purposes of—
(i) raising awareness of the disability or medical condition, or
(ii) providing support to individuals falling within sub-paragraph (3) or enabling such individuals to provide support to each other,
(d) can reasonably be carried out without the consent of the data subject, and
(e) is necessary for reasons of substantial public interest.
(2) The following types of personal data fall within this sub-paragraph—
(a) personal data revealing racial or ethnic origin;
(b) genetic data or biometric data;
(c) data concerning health;
(d) personal data concerning an individual's sex life or sexual orientation.
(3) An individual falls within this sub-paragraph if the individual is or has been a member of the body mentioned in sub-paragraph (1)(a) and—
(a) has the disability or condition mentioned there, has had that disability or condition or has a significant risk of developing that disability or condition, or
(b) is a relative or carer of an individual who satisfies paragraph (a) of this sub-paragraph.
(4) For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where—
(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and
(b) the controller is not aware of the data subject withholding consent.
(5) In this paragraph—
“carer” means an individual who provides or intends to provide care for another individual other than—
under or by virtue of a contract, or
as voluntary work;
“disability” has the same meaning as in the Equality Act 2010 (see section 6 of, and Schedule 1 to, that Act).
(6) The reference in sub-paragraph (4)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.
Counselling etc
17 (1) This condition is met if the processing—
(a) is necessary for the provision of confidential counselling, advice or support or of another similar service provided confidentially,
(b) is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and
(c) is necessary for reasons of substantial public interest.
(2) The reasons mentioned in sub-paragraph (1)(b) are—
(a) in the circumstances, consent to the processing cannot be given by the data subject;
(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;
(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the service mentioned in sub-paragraph (1)(a).
Safeguarding of children and of individuals at risk
18 (1) This condition is met if—
(a) the processing is necessary for the purposes of—
(i) protecting an individual from neglect or physical, mental or emotional harm, or
(ii) protecting the physical, mental or emotional well-being of an individual,
(b) the individual is—
(i) aged under 18, or
(ii) aged 18 or over and at risk,
(c) the processing is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and
(d) the processing is necessary for reasons of substantial public interest.
(2) The reasons mentioned in sub-paragraph (1)(c) are—
(a) in the circumstances, consent to the processing cannot be given by the data subject;
(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;
(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).
(3) For the purposes of this paragraph, an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—
(a) has needs for care and support,
(b) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and
(c) as a result of those needs is unable to protect himself or herself against the neglect or harm or the risk of it.
(4) In sub-paragraph (1)(a), the reference to the protection of an individual or of the well-being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.
Safeguarding of economic well-being of certain individuals
19 (1) This condition is met if the processing—
(a) is necessary for the purposes of protecting the economic well-being of an individual at economic risk who is aged 18 or over,
(b) is of data concerning health,
(c) is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and
(d) is necessary for reasons of substantial public interest.
(2) The reasons mentioned in sub-paragraph (1)(c) are—
(a) in the circumstances, consent to the processing cannot be given by the data subject;
(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;
(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).
(3) In this paragraph, “individual at economic risk” means an individual who is less able to protect his or her economic well-being by reason of physical or mental injury, illness or disability.
Insurance
20 (1) This condition is met if the processing—
(a) is necessary for an insurance purpose,
(b) is of personal data revealing racial or ethnic origin, religious or philosophical beliefs or trade union membership, genetic data or data concerning health, and
(c) is necessary for reasons of substantial public interest,
subject to sub-paragraphs (2) and (3).
(2) Sub-paragraph (3) applies where—
(a) the processing is not carried out for the purposes of measures or decisions with respect to the data subject, and
(b) the data subject does not have and is not expected to acquire—
(i) rights against, or obligations in relation to, a person who is an insured person under an insurance contract to which the insurance purpose mentioned in sub-paragraph (1)(a) relates, or
(ii) other rights or obligations in connection with such a contract.
(3) Where this sub-paragraph applies, the processing does not meet the condition in sub-paragraph (1) unless, in addition to meeting the requirements in that sub-paragraph, it can reasonably be carried out without the consent of the data subject.
(4) For the purposes of sub-paragraph (3), processing can reasonably be carried out without the consent of the data subject only where—
(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and
(b) the controller is not aware of the data subject withholding consent.
(5) In this paragraph—
“insurance contract” means a contract of general insurance or long-term insurance;
“insurance purpose” means—
advising on, arranging, underwriting or administering an insurance contract,
administering a claim under an insurance contract, or
exercising a right, or complying with an obligation, arising in connection with an insurance contract, including a right or obligation arising under an enactment or rule of law.
(6) The reference in sub-paragraph (4)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.
(7) Terms used in the definition of “insurance contract” in sub-paragraph (5) and also in an order made under section 22 of the Financial Services and Markets Act 2000 (regulated activities) have the same meaning in that definition as they have in that order.
Occupational pensions
21 (1) This condition is met if the processing—
(a) is necessary for the purpose of making a determination in connection with eligibility for, or benefits payable under, an occupational pension scheme,
(b) is of data concerning health which relates to a data subject who is the parent, grandparent, great-grandparent or sibling of a member of the scheme,
(c) is not carried out for the purposes of measures or decisions with respect to the data subject, and
(d) can reasonably be carried out without the consent of the data subject.
(2) For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where—
(a) the controller cannot reasonably be expected to obtain the consent of the data subject, and
(b) the controller is not aware of the data subject withholding consent.
(3) In this paragraph—
“occupational pension scheme” has the meaning given in section 1 of the Pension Schemes Act 1993;
“member”, in relation to a scheme, includes an individual who is seeking to become a member of the scheme.
(4) The reference in sub-paragraph (2)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.
Political parties
22 (1) This condition is met if the processing—
(a) is of personal data revealing political opinions,
(b) is carried out by a person or organisation included in the register maintained under section 23 of the Political Parties, Elections and Referendums Act 2000, and
(c) is necessary for the purposes of the person's or organisation's political activities,
subject to the exceptions in sub-paragraphs (2) and (3).
(2) Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to a person.
(3) Processing does not meet the condition in sub-paragraph (1) if—
(a) an individual who is the data subject (or one of the data subjects) has given notice in writing to the controller requiring the controller not to process personal data in respect of which the individual is the data subject (and has not given notice in writing withdrawing that requirement),
(b) the notice gave the controller a reasonable period in which to stop processing such data, and
(c) that period has ended.
(4) In this paragraph, “political activities” include campaigning, fund-raising, political surveys and case-work.
Elected representatives responding to requests
23 (1) This condition is met if—
(a) the processing is carried out—
(i) by an elected representative or a person acting with the authority of such a representative,
(ii) in connection with the discharge of the elected representative's functions, and
(iii) in response to a request by an individual that the elected representative take action on behalf of the individual, and
(b) the processing is necessary for the purposes of, or in connection with, the action reasonably taken by the elected representative in response to that request,
subject to sub-paragraph (2).
(2) Where the request is made by an individual other than the data subject, the condition in sub-paragraph (1) is met only if the processing must be carried out without the consent of the data subject for one of the following reasons—
(a) in the circumstances, consent to the processing cannot be given by the data subject;
(b) in the circumstances, the elected representative cannot reasonably be expected to obtain the consent of the data subject to the processing;
(c) obtaining the consent of the data subject would prejudice the action taken by the elected representative;
(d) the processing is necessary in the interests of another individual and the data subject has withheld consent unreasonably.
(3) In this paragraph, “elected representative” means—
(a) a member of the House of Commons;
(b) a member of the National Assembly for Wales;
(c) a member of the Scottish Parliament;
(d) a member of the Northern Ireland Assembly;
(e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(f) an elected member of a local authority within the meaning of section 270(1) of the Local Government Act 1972, namely—
(i) in England, a county council, a district council, a London borough council or a parish council;
(ii) in Wales, a county council, a county borough council or a community council;
(g) an elected mayor of a local authority within the meaning of Part 1A or 2 of the Local Government Act 2000;
(h) a mayor for the area of a combined authority established under section 103 of the Local Democracy, Economic Development and Construction Act 2009;
(ha) a mayor for the area of a combined county authority established under section 9(1) of the Levelling-up and Regeneration Act 2023;
(i) the Mayor of London or an elected member of the London Assembly;
(j) an elected member of—
(i) the Common Council of the City of London, or
(ii) the Council of the Isles of Scilly;
(k) an elected member of a council constituted under section 2 of the Local Government etc (Scotland) Act 1994;
(l) an elected member of a district council within the meaning of the Local Government Act (Northern Ireland) 1972 (c. 9 (N.I.));
(m) a police and crime commissioner.
(4) For the purposes of sub-paragraph (3), a person who is—
(a) a member of the House of Commons immediately before Parliament is dissolved,
(b) a member of the National Assembly for Wales immediately before that Assembly is dissolved,
(c) a member of the Scottish Parliament immediately before that Parliament is dissolved, or
(d) a member of the Northern Ireland Assembly immediately before that Assembly is dissolved,
is to be treated as if the person were such a member until the end of the period of 30 days beginning with the day after the day on which the subsequent general election in relation to that Parliament or Assembly is held.
(5) For the purposes of sub-paragraph (3), a person who is an elected member of the Common Council of the City of London and whose term of office comes to an end at the end of the day preceding the annual Wardmotes is to be treated as if he or she were such a member until the end of the fourth day after the day on which those Wardmotes are held.
Disclosure to elected representatives
24 (1) This condition is met if—
(a) the processing consists of , or is carried out in preparation for, the disclosure of personal data—
(i) to an elected representative or a person acting with the authority of such a representative, and
(ii) in response to a communication to the controller from that representative or person which was made in response to a request from an individual,
(b) the personal data is relevant to the subject matter of that communication, and
(c) the disclosure is necessary for the purpose of responding to that communication,
subject to sub-paragraph (2).
(2) Where the request to the elected representative came from an individual other than the data subject, the condition in sub-paragraph (1) is met only if the disclosure must be made without the consent of the data subject for one of the following reasons—
(a) in the circumstances, consent to the processing cannot be given by the data subject;
(b) in the circumstances, the elected representative cannot reasonably be expected to obtain the consent of the data subject to the processing;
(c) obtaining the consent of the data subject would prejudice the action taken by the elected representative;
(d) the processing is necessary in the interests of another individual and the data subject has withheld consent unreasonably.
(3) In this paragraph, “elected representative” has the same meaning as in paragraph 23.
Informing elected representatives about prisoners
25 (1) This condition is met if—
(a) the processing consists of the processing of personal data about a prisoner for the purpose of informing a member of the House of Commons, a member of the National Assembly for Wales or a member of the Scottish Parliament about the prisoner, and
(b) the member is under an obligation not to further disclose the personal data.
(2) The references in sub-paragraph (1) to personal data about, and to informing someone about, a prisoner include personal data about, and informing someone about, arrangements for the prisoner's release.
(3) In this paragraph—
“prison” includes a young offender institution, a remand centre, a secure training centre or a secure college;
“prisoner” means a person detained in a prison.
Publication of legal judgments
26 This condition is met if the processing—
(a) consists of the publication of a judgment or other decision of a court or tribunal, or
(b) is necessary for the purposes of publishing such a judgment or decision.
Anti-doping in sport
27 (1) This condition is met if the processing is necessary—
(a) for the purposes of measures designed to eliminate doping which are undertaken by or under the responsibility of a body or association that is responsible for eliminating doping in a sport, at a sporting event or in sport generally, or
(b) for the purposes of providing information about doping, or suspected doping, to such a body or association.
(2) The reference in sub-paragraph (1)(a) to measures designed to eliminate doping includes measures designed to identify or prevent doping.
(3) If the processing consists of the disclosure of personal data to a body or association described in sub-paragraph (1)(a), or is carried out in preparation for such disclosure, the condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).
Standards of behaviour in sport
28 (1) This condition is met if the processing—
(a) is necessary for the purposes of measures designed to protect the integrity of a sport or a sporting event,
(b) must be carried out without the consent of the data subject so as not to prejudice those purposes, and
(c) is necessary for reasons of substantial public interest.
(2) In sub-paragraph (1)(a), the reference to measures designed to protect the integrity of a sport or a sporting event is a reference to measures designed to protect a sport or a sporting event against—
(a) dishonesty, malpractice or other seriously improper conduct, or
(b) failure by a person participating in the sport or event in any capacity to comply with standards of behaviour set by a body or association with responsibility for the sport or event.
PART 3 Additional conditions relating to criminal convictions etc
Consent
29 This condition is met if the data subject has given consent to the processing.
Protecting individual's vital interests
30 This condition is met if—
(a) the processing is necessary to protect the vital interests of an individual, and
(b) the data subject is physically or legally incapable of giving consent.
Processing by not-for-profit bodies
31 This condition is met if the processing is carried out—
(a) in the course of its legitimate activities with appropriate safeguards by a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim, and
(b) on condition that—
(i) the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes, and
(ii) the personal data is not disclosed outside that body without the consent of the data subjects.
Personal data in the public domain
32 This condition is met if the processing relates to personal data which is manifestly made public by the data subject.
Legal claims
33 This condition is met if the processing—
(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),
(b) is necessary for the purpose of obtaining legal advice, or
(c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.
Judicial acts
34 This condition is met if the processing is necessary when a court or tribunal is acting in its judicial capacity.
Administration of accounts used in commission of indecency offences involving children
35 (1) This condition is met if—
(a) the processing is of personal data about a conviction or caution for an offence listed in sub-paragraph (2),
(b) the processing is necessary for the purpose of administering an account relating to the payment card used in the commission of the offence or cancelling that payment card, and
(c) when the processing is carried out, the controller has an appropriate policy document in place (see paragraph 39 in Part 4 of this Schedule).
(2) Those offences are an offence under—
(a) section 1 of the Protection of Children Act 1978 (indecent photographs of children),
(b) Article 3 of the Protection of Children (Northern Ireland) Order 1978 (S.I. 1978/1047 (N.I. 17)) (indecent photographs of children),
(c) section 52 of the Civic Government (Scotland) Act 1982 (indecent photographs etc of children),
(d) section 160 of the Criminal Justice Act 1988 (possession of indecent photograph of child),
(e) Article 15 of the Criminal Justice (Evidence etc) (Northern Ireland) Order 1988 (S.I. 1988/1847 (N.I. 17)) (possession of indecent photograph of child), or
(f) section 62 of the Coroners and Justice Act 2009 (possession of prohibited images of children),
or incitement to commit an offence under any of those provisions.
(3) See also the additional safeguards in Part 4 of this Schedule.
(4) In this paragraph—
“caution” means a caution given to a person in England and Wales or Northern Ireland in respect of an offence which, at the time when the caution is given, is admitted;
“conviction” has the same meaning as in the Rehabilitation of Offenders Act 1974 or the Rehabilitation of Offenders (Northern Ireland) Order 1978 (S.I. 1978/1908 (N.I. 27));
“payment card” includes a credit card, a charge card and a debit card.
Extension of conditions in Part 2 of this Schedule referring to substantial public interest
36 This condition is met if the processing would meet a condition in Part 2 of this Schedule but for an express requirement for the processing to be necessary for reasons of substantial public interest.
Extension of insurance conditions
37 This condition is met if the processing—
(a) would meet the condition in paragraph 20 in Part 2 of this Schedule (the “insurance condition”), or
(b) would meet the condition in paragraph 36 by virtue of the insurance condition,
but for the requirement for the processing to be processing of a category of personal data specified in paragraph 20(1)(b).
PART 4 Appropriate policy document and additional safeguards
Application of this Part of this Schedule
38 This Part of this Schedule makes provision about the processing of personal data carried out in reliance on a condition in Part 1, 2 or 3 of this Schedule which requires the controller to have an appropriate policy document in place when the processing is carried out.
Requirement to have an appropriate policy document in place
39 The controller has an appropriate policy document in place in relation to the processing of personal data in reliance on a condition described in paragraph 38 if the controller has produced a document which—
(a) explains the controller's procedures for securing compliance with the principles in Article 5 of the UK GDPR (principles relating to processing of personal data) in connection with the processing of personal data in reliance on the condition in question, and
(b) explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the condition, giving an indication of how long such personal data is likely to be retained.
Additional safeguard: retention of appropriate policy document
40 (1) Where personal data is processed in reliance on a condition described in paragraph 38, the controller must during the relevant period—
(a) retain the appropriate policy document,
(b) review and (if appropriate) update it from time to time, and
(c) make it available to the Commission, on request, without charge.
(2) “Relevant period”, in relation to the processing of personal data in reliance on a condition described in paragraph 38, means a period which—
(a) begins when the controller starts to carry out processing of personal data in reliance on that condition, and
(b) ends at the end of the period of 6 months beginning when the controller ceases to carry out such processing.
Additional safeguard: record of processing
41 A record maintained by the controller, or the controller's representative, under Article 30 of the UK GDPR in respect of the processing of personal data in reliance on a condition described in paragraph 38 must include the following information—
(a) which condition is relied on,
(b) how the processing satisfies Article 6 of the UK GDPR (lawfulness of processing), and
(c) whether the personal data is retained and erased in accordance with the policies described in paragraph 39(b) and, if it is not, the reasons for not following those policies.
Section 15
PART 1 Adaptations and restrictions as described in Articles 6(3) and 23(1)
UK GDPR provisions to be adapted or restricted: “the listed GDPR provisions”
1 In this Part of this Schedule, “the listed GDPR provisions” means—
(a) the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
(iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(iv) Article 16 (right to rectification);
(v) Article 17(1) and (2) (right to erasure);
(vi) Article 18(1) (restriction of processing);
(vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);
(viii) Article 20(1) and (2) (right to data portability);
(ix) Article 21(1) (objections to processing);
(x) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and
(b) the following provisions of the UK GDPR (the application of which may be adapted by virtue of Article 6(3) of the UK GDPR)—
(i) Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6;
(ii) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Crime and taxation: general
2 (1) The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal data processed for any of the following purposes—
(a) the prevention , investigation or detection of crime,
(b) the apprehension or prosecution of offenders, or
(c) the assessment or collection of a tax or duty or an imposition of a similar nature,
to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) to (c).
(2) Sub-paragraph (3) applies where—
(a) personal data is processed by a person (“Controller 1”) for any of the purposes mentioned in sub-paragraph (1)(a) to (c), and
(b) another person (“Controller 2”) obtains the data from Controller 1 for the purpose of discharging statutory functions and processes it for the purpose of discharging statutory functions.
(3) Controller 2 is exempt from the obligations in the following provisions of the UK GDPR—
(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided),
(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),
(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers), and
(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in paragraphs (a) to (c),
to the same extent that Controller 1 is exempt from those obligations by virtue of sub-paragraph (1).
Crime and taxation: risk assessment systems
3 (1) The UK GDPR provisions listed in sub-paragraph (3) do not apply to personal data which consists of a classification applied to the data subject as part of a risk assessment system falling within sub-paragraph (2) to the extent that the application of those provisions would prevent the system from operating effectively.
(2) A risk assessment system falls within this sub-paragraph if—
(a) it is operated by a government department, a local authority or another authority administering housing benefit, and
(b) it is operated for the purposes of—
(i) the assessment or collection of a tax or duty or an imposition of a similar nature, or
(ii) the prevention , investigation or detection of crime or apprehension or prosecution of offenders, where the offence concerned involves the unlawful use of public money or an unlawful claim for payment out of public money.
(3) The UK GDPR provisions referred to in sub-paragraph (1) are the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in paragraphs (a) to (c).
Immigration
4 (1) The relevant UK GDPR provisions do not apply to personal data processed by the Secretary of State for any of the following purposes—
(a) the maintenance of effective immigration control, or
(b) the investigation or detection of activities that would undermine the maintenance of effective immigration control,
to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) and (b).
(1A) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(1B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(1C) Paragraphs 4A and 4B make provision about ... safeguards in connection with the exemption in sub-paragraph (1).
(2) In sub-paragraph (1) and paragraph 4A, the “relevant UK GDPR provisions” are the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(d) Article 17(1) and (2) (right to erasure);
(e) Article 18(1) (restriction of processing);
(f) Article 21(1) (objections to processing);
(g) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (f).
(That is, the listed GDPR provisions other than Article 16 (right to rectification), Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing) and Article 20(1) and (2) (right to data portability) and, subject to sub-paragraph (2)(g) of this paragraph, the provisions of Article 5 listed in paragraph 1(b).)
(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Immigration: safeguards: immigration exemption decisions
4A. (1) A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) (referred to in this paragraph as “an immigration exemption decision”) must be made in accordance with this paragraph.
(2) An immigration exemption decision must be made—
(a) on a case by case basis,
(b) separately in respect of each of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) which relates to the data subject, and
(c) afresh on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) in relation to the data subject.
(3) When making an immigration exemption decision, the Secretary of State must take into account all the circumstances of the case, including at least the following—
(a) any potential vulnerability of the data subject that is relevant to the decision,
(b) all the rights and freedoms of the data subject including the data subject’s Convention rights, and
(c) any relevant duties or obligations of the United Kingdom, the Secretary of State or any other person, including—
(i) the United Kingdom’s obligations under the Refugee Convention and the Trafficking Convention,
(ii) any duty under section 55 of the Borders, Citizenship and Immigration Act 2009 (duty regarding the welfare of children), and
(iii) the need to ensure compliance with the UK GDPR.
(4) A decision that the application of a particular relevant UK GDPR provision mentioned in paragraph 4(2)(a) to (f) (or that provision in combination with the provision mentioned in paragraph 4(2)(g), so far as it applies) would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) may be made only if—
(a) the application of that provision or those provisions would give rise to a substantial risk of prejudice to any of the matters mentioned in paragraph 4(1)(a) and (b),
(b) that risk outweighs the risk of prejudice to the interests of the data subject concerned that would arise if the exemption in paragraph 4(1) were to apply in relation to that provision or those provisions, and
(c) the application of the exemption in relation to that provision or those provisions is necessary and proportionate to the risks in the particular case.
(5) In this paragraph—
“Convention rights” has the same meaning as in the Human Rights Act 1998 (see section 1(1) of that Act);
“the Refugee Convention” means the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol;
“the Trafficking Convention” means the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005.
Immigration: safeguard: record of decision that exemption applies
4B. (1) Where the Secretary of State makes a decision mentioned in paragraph 4A(4), the Secretary of State must keep a record of it and the reasons for it.
(2) Where sub-paragraph (1) applies, the Secretary of State must also inform the data subject of the decision unless, in the particular circumstances of the case, the Secretary of State considers that doing so may be prejudicial to any of the matters mentioned in paragraph 4(1)(a) and (b).
Information required to be disclosed by law etc or in connection with legal proceedings
5 (1) The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation.
(2) The listed GDPR provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure.
(3) The listed GDPR provisions do not apply to personal data where disclosure of the data—
(a) is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings),
(b) is necessary for the purpose of obtaining legal advice, or
(c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights,
to the extent that the application of those provisions would prevent the controller from making the disclosure.
PART 2 Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 21 and 34
UK GDPR provisions to be restricted: “the listed GDPR provisions”
6 In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(d) Article 16 (right to rectification);
(e) Article 17(1) and (2) (right to erasure);
(f) Article 18(1) (restriction of processing);
(g) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);
(h) Article 20(1) and (2) (right to data portability);
(i) Article 21(1) (objections to processing);
(j) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (i).
Functions designed to protect the public etc
7 The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—
(a) is designed as described in column 1 of the Table, and
(b) meets the condition relating to the function specified in column 2 of the Table,
to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.
TABLE
Description of function design | Condition
1. The function is designed to protect members of the public against— financial loss due to dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate, or financial loss due to the conduct of discharged or undischarged bankrupts. | The function is— conferred on a person by an enactment, a function of the Crown, a Minister of the Crown or a government department, or of a public nature, and is exercised in the public interest.
2. The function is designed to protect members of the public against— dishonesty, malpractice or other seriously improper conduct, or unfitness or incompetence. | The function is— conferred on a person by an enactment, a function of the Crown, a Minister of the Crown or a government department, or of a public nature, and is exercised in the public interest.
3. The function is designed— to protect charities or community interest companies against misconduct or mismanagement (whether by trustees, directors or other persons) in their administration, to protect the property of charities or community interest companies from loss or misapplication, or to recover the property of charities or community interest companies. | The function is— conferred on a person by an enactment, a function of the Crown, a Minister of the Crown or a government department, or of a public nature, and is exercised in the public interest.
4. The function is designed— to secure the health, safety and welfare of persons at work, or to protect persons other than those at work against risk to health or safety arising out of or in connection with the action of persons at work. | The function is— conferred on a person by an enactment, a function of the Crown, a Minister of the Crown or a government department, or of a public nature, and is exercised in the public interest.
5. The function is designed to protect members of the public against— maladministration by public bodies, failures in services provided by public bodies, or a failure of a public body to provide a service which it is a function of the body to provide. | The function is conferred by any enactment on— the Parliamentary Commissioner for Administration, the Commissioner for Local Administration in England, the Health Service Commissioner for England, the Public Services Ombudsman for Wales, the Northern Ireland Public Services Ombudsman, the Prison Ombudsman for Northern Ireland, or the Scottish Public Services Ombudsman.
6. The function is designed— to protect members of the public against conduct which may adversely affect their interests by persons carrying on a business, to regulate agreements or conduct which have as their object or effect the prevention, restriction or distortion of competition in connection with any commercial activity, or to regulate conduct on the part of one or more undertakings which amounts to the abuse of a dominant position in a market. | The function is conferred on the Competition and Markets Authority by an enactment.
Audit functions
8 (1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.
(2) The functions are any function that is conferred by an enactment on—
(a) the Comptroller and Auditor General;
(b) the Auditor General for Scotland;
(c) the Auditor General for Wales;
(d) the Comptroller and Auditor General for Northern Ireland.
Functions of the Bank of England
9 (1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a relevant function of the Bank of England to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.
(2) “Relevant function of the Bank of England” means—
(a) a function discharged by the Bank acting in its capacity as a monetary authority (as defined in section 244(2)(c) and (2A) of the Banking Act 2009);
(b) a public function of the Bank within the meaning of section 349 of the Financial Services and Markets Act 2000;
(c) a function conferred on the Prudential Regulation Authority by or under the Financial Services and Markets Act 2000 or by another enactment.
Regulatory functions relating to legal services, the health service and children's services
10 (1) The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.
(2) The functions are—
(a) a function of the Legal Services Board;
(b) the function of considering a complaint under the scheme established under Part 6 of the Legal Services Act 2007 (legal complaints);
(c) the function of considering a complaint under—
(i) section 14 of the NHS Redress Act 2006,
(ii) section 113(1) or (2) or section 114(1) or (3) of the Health and Social Care (Community Health and Standards) Act 2003,
(iii) section 24D or 26 of the Children Act 1989, or
(iv) Part 2A of the Public Services Ombudsman (Wales) Act 2005 or Part 5 of the Public Services Ombudsman (Wales) Act 2019;
(d) the function of considering a complaint or representations under Chapter 1 of Part 10 of the Social Services and Well-being (Wales) Act 2014 (anaw 4).
Regulatory functions of certain other persons
11 The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—
(a) is a function of a person described in column 1 of the Table, and
(b) is conferred on that person as described in column 2 of the Table,
to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.
TABLE
Person on whom function is conferred | How function is conferred
1. The Commission . | By or under— the data protection legislation; the Freedom of Information Act 2000; section 244 of the Investigatory Powers Act 2016; the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426); the Environmental Information Regulations 2004 (S.I. 2004/3391); the INSPIRE Regulations 2009 (S.I. 2009/3157); Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC; the Re-use of Public Sector Information Regulations 2015 (S.I. 2015/1415); the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696).
2. The Scottish Information Commissioner. | By or under— the Freedom of Information (Scotland) Act 2002 (asp 13); the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520); the INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440).
3. The Pensions Ombudsman. | By or under Part 10 of the Pension Schemes Act 1993 or any corresponding legislation having equivalent effect in Northern Ireland.
4. The Board of the Pension Protection Fund. | By or under sections 206 to 208 of the Pensions Act 2004 or any corresponding legislation having equivalent effect in Northern Ireland.
5. The Ombudsman for the Board of the Pension Protection Fund. | By or under any of sections 209 to 218 or 286(1) of the Pensions Act 2004 or any corresponding legislation having equivalent effect in Northern Ireland.
6. The Pensions Regulator. | By an enactment.
7. The Financial Conduct Authority. | By or under the Financial Services and Markets Act 2000 or by another enactment.
8. The Financial Ombudsman. | By or under Part 16 of the Financial Services and Markets Act 2000.
9. The investigator of complaints against the financial regulators. | By or under Part 6 of the Financial Services Act 2012.
. . . | . . .
11. The monitoring officer of a relevant authority. | By or under the Local Government and Housing Act 1989.
12. The monitoring officer of a relevant Welsh authority. | By or under the Local Government Act 2000.
13. The Public Services Ombudsman for Wales. | By or under the Local Government Act 2000.
14. The Charity Commission. | By or under— the Charities Act 1992; the Charities Act 2006; the Charities Act 2011.
12 In the Table in paragraph 11—
...
...
the “Financial Ombudsman” means the scheme operator within the meaning of Part 16 of the Financial Services and Markets Act 2000 (see section 225 of that Act);
the “investigator of complaints against the financial regulators” means the person appointed under section 84(1)(b) of the Financial Services Act 2012;
“relevant authority” has the same meaning as in section 5 of the Local Government and Housing Act 1989, and “monitoring officer”, in relation to such an authority, means a person designated as such under that section;
“relevant Welsh authority” has the same meaning as “relevant authority” in section 49(6) of the Local Government Act 2000, and “monitoring officer”, in relation to such an authority, has the same meaning as in Part 3 of that Act.
Parliamentary privilege
13 The listed GDPR provisions and Article 34(1) and (4) of the UK GDPR (communication of personal data breach to the data subject) do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.
Judicial appointments, judicial independence and judicial proceedings
14 (1) The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for judicial office or the office of Queen's Counsel.
(2) The listed GDPR provisions do not apply to personal data processed by—
(a) an individual acting in a judicial capacity, or
(b) a court or tribunal acting in its judicial capacity.
(3) As regards personal data not falling within sub-paragraph (1) or (2), the listed GDPR provisions do not apply to the extent that the application of those provisions would be likely to prejudice judicial independence or judicial proceedings.
Crown honours, dignities and appointments
15 (1) The listed GDPR provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity.
(2) The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for any of the following offices—
(a) archbishops and diocesan and suffragan bishops in the Church of England;
(b) deans of cathedrals of the Church of England;
(c) deans and canons of the two Royal Peculiars;
(d) the First and Second Church Estates Commissioners;
(e) lord-lieutenants;
(f) Masters of Trinity College and Churchill College, Cambridge;
(g) the Provost of Eton;
(h) the Poet Laureate;
(i) the Astronomer Royal.
(3) The Secretary of State may by regulations amend the list in sub-paragraph (2) to—
(a) remove an office, or
(b) add an office to which appointments are made by Her Majesty.
(4) Regulations under sub-paragraph (3) are subject to the affirmative resolution procedure.
PART 3 Restriction for the protection of rights of others
Protection of the rights of others: general
16 (1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the UK GDPR so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3), do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information.
(2) Sub-paragraph (1) does not remove the controller's obligation where—
(a) the other individual has consented to the disclosure of the information to the data subject, or
(b) it is reasonable to disclose the information to the data subject without the consent of the other individual.
(3) In determining whether it is reasonable to disclose the information without consent, the controller must have regard to all the relevant circumstances, including—
(a) the type of information that would be disclosed,
(b) any duty of confidentiality owed to the other individual,
(c) any steps taken by the controller with a view to seeking the consent of the other individual,
(d) whether the other individual is capable of giving consent, and
(e) any express refusal of consent by the other individual.
(4) For the purposes of this paragraph—
(a) “information relating to another individual” includes information identifying the other individual as the source of information;
(b) an individual can be identified from information to be provided to a data subject by a controller if the individual can be identified from—
(i) that information, or
(ii) that information and any other information that the controller reasonably believes the data subject is likely to possess or obtain.
Assumption of reasonableness for health workers, social workers and education workers
17 (1) For the purposes of paragraph 16(2)(b), it is to be considered reasonable for a controller to disclose information to a data subject without the consent of the other individual where—
(a) the health data test is met,
(b) the social work data test is met, or
(c) the education data test is met.
(2) The health data test is met if—
(a) the information in question is contained in a health record, and
(b) the other individual is a health professional who has compiled or contributed to the health record or who, in his or her capacity as a health professional, has been involved in the diagnosis, care or treatment of the data subject.
(3) The social work data test is met if—
(a) the other individual is—
(i) a children's court officer,
(ii) a person who is or has been employed by a person or body referred to in paragraph 8 of Schedule 3 in connection with functions exercised in relation to the information, or
(iii) a person who has provided for reward a service that is similar to a service provided in the exercise of any relevant social services functions, and
(b) the information relates to the other individual in an official capacity or the other individual supplied the information—
(i) in an official capacity, or
(ii) in a case within paragraph (a)(iii), in connection with providing the service mentioned in paragraph (a)(iii).
(4) The education data test is met if—
(a) the other individual is an education-related worker, or
(b) the other individual is employed by an education authority (within the meaning of the Education (Scotland) Act 1980) in pursuance of its functions relating to education and—
(i) the information relates to the other individual in his or her capacity as such an employee, or
(ii) the other individual supplied the information in his or her capacity as such an employee.
(5) In this paragraph—
“children's court officer” means a person referred to in paragraph 8(1)(q), (r), (s), (t) or (u) of Schedule 3;
“education-related worker” means a person referred to in paragraph 14(4)(a) or (b) or 16(4)(a), (b) or (c) of Schedule 3 (educational records);
“relevant social services functions” means functions specified in paragraph 8(1)(a), (b), (c) or (d) of Schedule 3.
PART 4 Restrictions as described in Article 23(1): restrictions of rules in Articles 13 to 15
UK GDPR provisions to be restricted: “the listed GDPR provisions”
18 In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(d) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (c).
Legal professional privilege
19 The listed GDPR provisions do not apply to personal data that consists of—
(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications, could be maintained in legal proceedings, or
(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.
Self incrimination
20 (1) A person need not comply with the listed GDPR provisions to the extent that compliance would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.
(2) The reference to an offence in sub-paragraph (1) does not include an offence under—
(a) this Act,
(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath),
(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath), or
(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).
(3) Information disclosed by any person in compliance with Article 15 of the UK GDPR is not admissible against the person in proceedings for an offence under this Act.
Corporate finance
21 (1) The listed GDPR provisions do not apply to personal data processed for the purposes of or in connection with a corporate finance service provided by a relevant person to the extent that either Condition A or Condition B is met.
(2) Condition A is that the application of the listed GDPR provisions would be likely to affect the price of an instrument.
(3) Condition B is that—
(a) the relevant person reasonably believes that the application of the listed GDPR provisions to the personal data in question could affect a decision of a person—
(i) whether to deal in, subscribe for or issue an instrument, or
(ii) whether to act in a way likely to have an effect on a business activity (such as an effect on the industrial strategy of a person, the capital structure of an undertaking or the legal or beneficial ownership of a business or asset), and
(b) the application of the listed GDPR provisions to that personal data would have a prejudicial effect on the orderly functioning of financial markets or the efficient allocation of capital within the economy.
(4) In this paragraph—
“corporate finance service” means a service consisting in—
underwriting in respect of issues of, or the placing of issues of, any instrument,
services relating to such underwriting, or
advice to undertakings on capital structure, industrial strategy and related matters and advice and service relating to mergers and the purchase of undertakings;
“instrument” means an instrument listed in section C of Annex 1 to Directive 2004/39/EC of the European Parliament and of the Council of 21 April 2004 on markets in financial instruments, and references to an instrument include an instrument not yet in existence but which is to be or may be created;
“price” includes value;
“relevant person” means—
a person who, by reason of a permission under Part 4A of the Financial Services and Markets Act 2000, is able to carry on a corporate finance service without contravening the general prohibition;
an EEA firm of the kind mentioned in paragraph 5(a) or (b) of Schedule 3 to that Act which has qualified for authorisation under paragraph 12 of that Schedule, and may lawfully carry on a corporate finance service;
a person who is exempt from the general prohibition in respect of any corporate finance service—
as a result of an exemption order made under section 38(1) of that Act, or
by reason of section 39(1) of that Act (appointed representatives);
a person, not falling within paragraph (a), (b) or (c), who may lawfully carry on a corporate finance service without contravening the general prohibition;
a person who, in the course of employment, provides to their employer a service falling within paragraph (b) or (c) of the definition of “corporate finance service”;
a partner who provides to other partners in the partnership a service falling within either of those paragraphs.
(5) In the definition of “relevant person” in sub-paragraph (4), references to “the general prohibition” are to the general prohibition within the meaning of section 19 of the Financial Services and Markets Act 2000.
Management forecasts
22 The listed GDPR provisions do not apply to personal data processed for the purposes of management forecasting or management planning in relation to a business or other activity to the extent that the application of those provisions would be likely to prejudice the conduct of the business or activity concerned.
Negotiations
23 The listed GDPR provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the data subject to the extent that the application of those provisions would be likely to prejudice those negotiations.
Confidential references
24 The listed GDPR provisions do not apply to personal data consisting of a reference given (or to be given) in confidence for the purposes of—
(a) the education, training or employment (or prospective education, training or employment) of the data subject,
(b) the placement (or prospective placement) of the data subject as a volunteer,
(c) the appointment (or prospective appointment) of the data subject to any office, or
(d) the provision (or prospective provision) by the data subject of any service.
Exam scripts and exam marks
25 (1) The listed GDPR provisions do not apply to personal data consisting of information recorded by candidates during an exam.
(2) Where personal data consists of marks or other information processed by a controller—
(a) for the purposes of determining the results of an exam, or
(b) in consequence of the determination of the results of an exam,
the duty in Article 12(3) or (4) of the UK GDPR for the controller to provide information requested by the data subject within a certain time period, as it applies to Article 15 of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers), is modified as set out in sub-paragraph (3).
(3) Where a question arises as to whether the controller is obliged by Article 15 of the UK GDPR to disclose personal data, and the question arises before the day on which the exam results are announced, the controller must provide the information mentioned in Article 12(3) or (4)—
(a) before the end of the period of 5 months beginning when the question arises, or
(b) if earlier, before the end of the period of 40 days beginning with the announcement of the results.
(4) In this paragraph, “exam” means an academic, professional or other examination used for determining the knowledge, intelligence, skill or ability of a candidate and may include an exam consisting of an assessment of the candidate's performance while undertaking work or any other activity.
(5) For the purposes of this paragraph, the results of an exam are treated as announced when they are first published or, if not published, first communicated to the candidate.
PART 5 Exemptions etc ... for reasons of freedom of expression and information
Journalistic, academic, artistic and literary purposes
26 (1) In this paragraph, “the special purposes” means one or more of the following—
(a) the purposes of journalism;
(b) academic purposes;
(c) artistic purposes;
(d) literary purposes.
(2) Sub-paragraph (3) applies to the processing of personal data carried out for the special purposes if—
(a) the processing is being carried out with a view to the publication by a person of journalistic, academic, artistic or literary material, and
(b) the controller reasonably believes that the publication of the material would be in the public interest.
(3) The listed GDPR provisions do not apply to the extent that the controller reasonably believes that the application of those provisions would be incompatible with the special purposes.
(4) In determining whether publication would be in the public interest the controller must take into account the special importance of the public interest in the freedom of expression and information.
(5) In determining whether it is reasonable to believe that publication would be in the public interest, the controller must have regard to any of the codes of practice or guidelines listed in sub-paragraph (6) that is relevant to the publication in question.
(6) The codes of practice and guidelines are—
(a) BBC Editorial Guidelines;
(b) Ofcom Broadcasting Code;
(c) Editors' Code of Practice.
(7) The Secretary of State may by regulations amend the list in sub-paragraph (6).
(8) Regulations under sub-paragraph (7) are subject to the affirmative resolution procedure.
(9) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR (which may be exempted or derogated from by virtue of Article 85(2) of the UK GDPR)—
(a) in Chapter II of the UK GDPR (principles)—
(i) Article 5(1)(a) to (e) (principles relating to processing);
(ii) Article 6 (lawfulness);
(iii) Article 7 (conditions for consent);
(iv) Article 8(1) and (2) (child's consent);
(v) Article 9 (processing of special categories of data);
(vi) Article 10 (data relating to criminal convictions etc);
(vii) Article 11(2) (processing not requiring identification);
(b) in Chapter III of the UK GDPR (rights of the data subject)—
(i) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
(ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
(iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(iv) Article 16 (right to rectification);
(v) Article 17(1) and (2) (right to erasure);
(vi) Article 18(1)(a), (b) and (d) (restriction of processing);
(vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);
(viii) Article 20(1) and (2) (right to data portability);
(ix) Article 21(1) (objections to processing);
(c) in Chapter IV of the UK GDPR (controller and processor)—
(i) Article 34(1) and (4) (communication of personal data breach to the data subject);
(ii) Article 36 (requirement for controller to consult Commission prior to high risk processing);
(d) in Chapter V of the UK GDPR (transfers of data to third countries etc), Article 44A (general principles for transfers);
(e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PART 6 Derogations etc ... for research, statistics and archiving
Research and statistics
27 (1) The listed GDPR provisions do not apply to personal data processed for—
(a) scientific or historical research purposes, or
(b) statistical purposes,
to the extent that the application of those provisions would prevent or seriously impair the achievement of the purposes in question.
This is subject to sub-paragraphs (3) and (4).
(2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR—
(a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(b) Article 16 (right to rectification);
(c) Article 18(1) (restriction of processing);
(d) Article 21(1) (objections to processing).
(3) The exemption in sub-paragraph (1) is available only where—
(a) the personal data is processed in accordance with Article 84B of the UK GDPR, and
(b) as regards the disapplication of Article 15(1) to (3), the results of the research or any resulting statistics are not made available in a form which identifies a data subject.
(4) Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.
Archiving in the public interest
28 (1) The listed GDPR provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of those provisions would prevent or seriously impair the achievement of those purposes.
This is subject to sub-paragraphs (3) and (4).
(2) For the purposes of this paragraph, the listed GDPR provisions are the following provisions of the UK GDPR—
(a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(b) Article 16 (right to rectification);
(c) Article 18(1) (restriction of processing);
(d) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);
(e) Article 20(1) (right to data portability);
(f) Article 21(1) (objections to processing).
(3) The exemption in sub-paragraph (1) is available only where the personal data is processed in accordance with Article 84B of the UK GDPR.
(4) Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.
SCHEDULE 3 Exemptions etc from the UK GDPR: health, social work, education and child abuse data
Section 15
PART 1 UK GDPR provisions to be restricted
1 In this Schedule “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(d) Article 16 (right to rectification);
(e) Article 17(1) and (2) (right to erasure);
(f) Article 18(1) (restriction of processing);
(g) Article 20(1) and (2) (right to data portability);
(h) Article 21(1) (objections to processing);
(i) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (h).
PART 2 Health data
Definitions
2 (1) In this Part of this Schedule—
“the appropriate health professional”, in relation to a question as to whether the serious harm test is met with respect to data concerning health, means—
the health professional who is currently or was most recently responsible for the diagnosis, care or treatment of the data subject in connection with the matters to which the data relates,
where there is more than one such health professional, the health professional who is the most suitable to provide an opinion on the question, or
a health professional who has the necessary experience and qualifications to provide an opinion on the question, where—
there is no health professional available falling within paragraph (a) or (b), or
the controller is the Secretary of State and data is processed in connection with the exercise of the functions conferred on the Secretary of State by or under the Child Support Act 1991 and the Child Support Act 1995, or the Secretary of State's functions in relation to social security or war pensions, or
the controller is the Department for Communities in Northern Ireland and data is processed in connection with the exercise of the functions conferred on the Department by or under the Child Support (Northern Ireland) Order 1991 (S.I. 1991/2628 (N.I. 23)) and the Child Support (Northern Ireland) Order 1995 (S.I. 1995/2702 (N.I. 13));
“war pension” has the same meaning as in section 25 of the Social Security Act 1989 (establishment and functions of war pensions committees).
(2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to data concerning health if the application of Article 15 of the UK GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
Exemption from the listed GDPR provisions: data processed by a court
3 (1) The listed GDPR provisions do not apply to data concerning health if—
(a) it is processed by a court,
(b) it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and
(c) in accordance with those rules, the data may be withheld by the court in whole or in part from the data subject.
(2) Those rules are—
(a) the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);
(b) the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));
(c) the Family Proceedings Rules (Northern Ireland) 1996 (S.R. (N.I.) 1996 No. 322);
(d) the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);
(e) the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));
(f) the Sheriff Court Adoption Rules 2009;
(g) the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));
(h) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).
Exemption from the listed GDPR provisions: data subject's expectations and wishes
4 (1) This paragraph applies where a request for data concerning health is made in exercise of a power conferred by an enactment or rule of law and—
(a) in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,
(b) in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or
(c) the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.
(2) The listed GDPR provisions do not apply to data concerning health to the extent that complying with the request would disclose information—
(a) which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,
(b) which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or
(c) which the data subject has expressly indicated should not be so disclosed.
(3) The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.
Exemption from Article 15 of the UK GDPR: serious harm
5 (1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to data concerning health to the extent that the serious harm test is met with respect to the data.
(2) A controller who is not a health professional may not rely on sub-paragraph (1) to withhold data concerning health unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is met with respect to the data.
(3) An opinion does not count for the purposes of sub-paragraph (2) if—
(a) it was obtained before the beginning of the relevant period, or
(b) it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.
(4) In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.
Restriction of Article 15 of the UK GDPR: prior opinion of appropriate health professional
6 (1) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the disclosure of data concerning health by a controller who is not a health professional unless the controller has obtained an opinion from the person who appears to the controller to be the appropriate health professional to the effect that the serious harm test is not met with respect to the data.
(2) Sub-paragraph (1) does not apply to the extent that the controller is satisfied that the data concerning health has already been seen by, or is within the knowledge of, the data subject.
(3) An opinion does not count for the purposes of sub-paragraph (1) if—
(a) it was obtained before the beginning of the relevant period, or
(b) it was obtained during that period but it is reasonable in all the circumstances to re-consult the appropriate health professional.
(4) In this paragraph, “the relevant period” means the period of 6 months ending with the day on which the opinion would be relied on.
PART 3 Social work data
Definitions
7 (1) In this Part of this Schedule—
“education data” has the meaning given by paragraph 17 of this Schedule;
“Health and Social Care trust” means a Health and Social Care trust established under the Health and Personal Social Services (Northern Ireland) Order 1991 (S.I. 1991/194 (N.I. 1));
“Principal Reporter” means the Principal Reporter appointed under the Children's Hearings (Scotland) Act 2011 (asp 1), or an officer of the Scottish Children's Reporter Administration to whom there is delegated under paragraph 10(1) of Schedule 3 to that Act any function of the Principal Reporter;
“social work data” means personal data which—
is data to which paragraph 8 applies, but
is not education data or data concerning health.
(2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to social work data if the application of Article 15 of the UK GDPR to the data would be likely to prejudice carrying out social work, because it would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
(3) In sub-paragraph (2), “carrying out social work” is to be taken to include doing any of the following—
(a) the exercise of any functions mentioned in paragraph 8(1)(a), (d), (f) to (j), (m), (p), (s), (t), (u), (v) or (w);
(b) the provision of any service mentioned in paragraph 8(1)(b), (c) or (k);
(c) the exercise of the functions of a body mentioned in paragraph 8(1)(e) or a person mentioned in paragraph 8(1)(q) or (r).
(4) In this Part of this Schedule, a reference to a local authority, in relation to data processed or formerly processed by it, includes a reference to the Council of the Isles of Scilly, in relation to data processed or formerly processed by the Council in connection with any functions mentioned in paragraph 8(1)(a)(ii) which are or have been conferred on the Council by an enactment.
8 (1) This paragraph applies to personal data falling within any of the following descriptions—
(a) data processed by a local authority—
(i) in connection with its social services functions (within the meaning of the Local Authority Social Services Act 1970 or the Social Services and Well-being (Wales) Act 2014 (anaw 4)) or any functions exercised by local authorities under the Social Work (Scotland) Act 1968 or referred to in section 5(1B) of that Act, or
(ii) in the exercise of other functions but obtained or consisting of information obtained in connection with any of the functions mentioned in sub-paragraph (i);
(b) data processed by the Department of Health in Northern Ireland or any person or body exercising functions by virtue of paragraph 22A of Schedule 3 to the Health and Personal Social Services (Northern Ireland) Order 1991—
(i) in connection with the provision of social care within the meaning of section 2(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)), or
(ii) in the exercise of other functions but obtained or consisting of information obtained in connection with the provision of that care;
(c) data processed by a Health and Social Care trust—
(i) in the exercise of social care and children functions within the meaning of Article 10A of the Health and Personal Social Services (Northern Ireland) Order 1991,
(ia) in connection with the provision of social care within the meaning of section 2(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)) by virtue of a delegation direction under Article 10B of the Health and Personal Social Services (Northern Ireland) Order 1991, or
(ii) in the exercise of other functions but obtained or consisting of information obtained in connection with the provision of that care;
(d) data processed by a council in the exercise of its functions under Part 2 of Schedule 9 to the Health and Social Services and Social Security Adjudications Act 1983;
(e) data processed by—
(i) a probation trust established under section 5 of the Offender Management Act 2007, or
(ii) the Probation Board for Northern Ireland established by the Probation Board (Northern Ireland) Order 1982 (S.I. 1982/713 (N.I. 10));
(f) data processed by a local authority in the exercise of its functions under section 36 of the Children Act 1989 or Chapter 2 of Part 6 of the Education Act 1996, so far as those functions relate to ensuring that children of compulsory school age (within the meaning of section 8 of the Education Act 1996) receive suitable education whether by attendance at school or otherwise;
(g) data processed by the Education Authority in the exercise of its functions under Article 55 of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2)) or Article 45 of, and Schedule 13 to, the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)), so far as those functions relate to ensuring that children of compulsory school age (within the meaning of Article 46 of the Education and Libraries (Northern Ireland) Order 1986) receive efficient full-time education suitable to their age, ability and aptitude and to any special educational needs they may have, either by regular attendance at school or otherwise;
(h) data processed by an education authority in the exercise of its functions under sections 35 to 42 of the Education (Scotland) Act 1980 so far as those functions relate to ensuring that children of school age (within the meaning of section 31 of the Education (Scotland) Act 1980) receive efficient education suitable to their age, ability and aptitude, whether by attendance at school or otherwise;
(i) data relating to persons detained in a hospital at which high security psychiatric services are provided under section 4 of the National Health Service Act 2006 and processed by a Special Health Authority established under section 28 of that Act in the exercise of any functions similar to any social services functions of a local authority;
(j) data relating to persons detained in special accommodation provided under Article 110 of the Mental Health (Northern Ireland) Order 1986 (S.I. 1986/595 (N.I. 4)) and processed by a Health and Social Care trust in the exercise of any functions similar to any social services functions of a local authority;
(k) data which—
(i) is processed by the National Society for the Prevention of Cruelty to Children, or by any other voluntary organisation or other body designated under this paragraph by the Secretary of State or the Department of Health in Northern Ireland, and
(ii) appears to the Secretary of State or the Department, as the case may be, to be processed for the purposes of the provision of any service similar to a service provided in the exercise of any functions specified in paragraph (a), (b), (c) or (d);
(l) data processed by a body mentioned in sub-paragraph (2)—
(i) which was obtained, or consists of information which was obtained, from an authority or body mentioned in any of paragraphs (a) to (k) or from a government department, and
(ii) in the case of data obtained, or consisting of information obtained, from an authority or body mentioned in any of paragraphs (a) to (k), fell within any of those paragraphs while processed by the authority or body;
(m) data processed by a National Health Service trust first established under section 25 of the National Health Service Act 2006, section 18 of the National Health Service (Wales) Act 2006 or section 5 of the National Health Service and Community Care Act 1990 in the exercise of any functions similar to any social services functions of a local authority;
(n) data processed by an NHS foundation trust in the exercise of any functions similar to any social services functions of a local authority;
(o) data processed by a government department—
(i) which was obtained, or consists of information which was obtained, from an authority or body mentioned in any of paragraphs (a) to (n), and
(ii) which fell within any of those paragraphs while processed by that authority or body;
(p) data processed for the purposes of the functions of the Secretary of State pursuant to section 82(5) of the Children Act 1989;
(q) data processed by—
(i) a children's guardian appointed under Part 16 of the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17)),
(ii) a guardian ad litem appointed under Article 60 of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2)) or Article 66 of the Adoption (Northern Ireland) Order 1987 (S.I. 1987/2203 (N.I. 22)), or
(iii) a safeguarder appointed under section 30(2) or 31(3) of the Children's Hearings (Scotland) Act 2011 (asp 1);
(r) data processed by the Principal Reporter;
(s) data processed by an officer of the Children and Family Court Advisory and Support Service for the purpose of the officer's functions under section 7 of the Children Act 1989 or Part 16 of the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));
(t) data processed by the Welsh family proceedings officer for the purposes of the functions under section 7 of the Children Act 1989 or Part 16 of the Family Procedure Rules 2010;
(u) data processed by an officer of the service appointed as guardian ad litem under Part 16 of the Family Procedure Rules 2010;
(v) data processed by the Children and Family Court Advisory and Support Service for the purpose of its functions under section 12(1) and (2) and section 13(1), (2) and (4) of the Criminal Justice and Court Services Act 2000;
(w) data processed by the Welsh Ministers for the purposes of their functions under section 35(1) and (2) and section 36(1), (2), (4), (5) and (6) of the Children Act 2004;
(x) data processed for the purposes of the functions of the appropriate Minister pursuant to section 12 of the Adoption and Children Act 2002 (independent review of determinations).
(2) The bodies referred to in sub-paragraph (1)(l) are—
(a) a National Health Service trust first established under section 25 of the National Health Service Act 2006 or section 18 of the National Health Service (Wales) Act 2006;
(b) a National Health Service trust first established under section 5 of the National Health Service and Community Care Act 1990;
(c) an NHS foundation trust;
(d) an integrated care board established under section 14Z25 of the National Health Service Act 2006;
(e) NHS England;
(f) a Local Health Board established under section 11 of the National Health Service (Wales) Act 2006;
(g) a Health Board established under section 2 of the National Health Service (Scotland) Act 1978.
Exemption from the listed GDPR provisions: data processed by a court
9 (1) The listed GDPR provisions do not apply to data that is not education data or data concerning health if—
(a) it is processed by a court,
(b) it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and
(c) in accordance with any of those rules, the data may be withheld by the court in whole or in part from the data subject.
(2) Those rules are—
(a) the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);
(b) the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));
(c) the Family Proceedings Rules (Northern Ireland) 1996 (S.R. (N.I.) 1996 No. 322);
(d) the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);
(e) the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));
(f) the Sheriff Court Adoption Rules 2009;
(g) the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));
(h) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).
Exemption from the listed GDPR provisions: data subject's expectations and wishes
10 (1) This paragraph applies where a request for social work data is made in exercise of a power conferred by an enactment or rule of law and—
(a) in relation to England and Wales or Northern Ireland, the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject,
(b) in relation to Scotland, the data subject is an individual aged under 16 and the person making the request has parental responsibilities for the data subject, or
(c) the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.
(2) The listed GDPR provisions do not apply to social work data to the extent that complying with the request would disclose information—
(a) which was provided by the data subject in the expectation that it would not be disclosed to the person making the request,
(b) which was obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed, or
(c) which the data subject has expressly indicated should not be so disclosed.
(3) The exemptions under sub-paragraph (2)(a) and (b) do not apply if the data subject has expressly indicated that he or she no longer has the expectation mentioned there.
Exemption from Article 15 of the UK GDPR: serious harm
11 Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to social work data to the extent that the serious harm test is met with respect to the data.
Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter
12 (1) This paragraph applies where—
(a) a question arises as to whether a controller who is a social work authority is obliged by Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) to disclose social work data, and
(b) the data—
(i) originated from or was supplied by the Principal Reporter acting in pursuance of the Principal Reporter's statutory duties, and
(ii) is not data which the data subject is entitled to receive from the Principal Reporter.
(2) The controller must inform the Principal Reporter of the fact that the question has arisen before the end of the period of 14 days beginning when the question arises.
(3) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.
(4) In this paragraph “social work authority” means a local authority for the purposes of the Social Work (Scotland) Act 1968.
PART 4 Education data
Educational records
13 In this Part of this Schedule “educational record” means a record to which paragraph 14, 15 or 16 applies.
14 (1) This paragraph applies to a record of information which—
(a) is processed by or on behalf of the proprietor of, or a teacher at, a school in England and Wales specified in sub-paragraph (3),
(b) relates to an individual who is or has been a pupil at the school, and
(c) originated from, or was supplied by or on behalf of, any of the persons specified in sub-paragraph (4).
(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.
(3) The schools referred to in sub-paragraph (1)(a) are—
(a) a school maintained by a local authority;
(b) an Academy school;
(c) an alternative provision Academy;
(d) an independent school that is not an Academy school or an alternative provision Academy;
(e) a non-maintained special school.
(4) The persons referred to in sub-paragraph (1)(c) are—
(a) an employee of the local authority which maintains the school;
(b) in the case of—
(i) a voluntary aided, foundation or foundation special school (within the meaning of the School Standards and Framework Act 1998),
(ii) an Academy school,
(iii) an alternative provision Academy,
(iv) an independent school that is not an Academy school or an alternative provision Academy, or
(v) a non-maintained special school,
a teacher or other employee at the school (including an educational psychologist engaged by the proprietor under a contract for services);
(c) the pupil to whom the record relates;
(d) a parent, as defined by section 576(1) of the Education Act 1996, of that pupil.
(5) In this paragraph—
“independent school” has the meaning given by section 463 of the Education Act 1996;
“local authority” has the same meaning as in that Act (see sections 579(1) and 581 of that Act);
“non-maintained special school” has the meaning given by section 337A of that Act;
“proprietor” has the meaning given by section 579(1) of that Act.
15 (1) This paragraph applies to a record of information which is processed—
(a) by an education authority in Scotland, and
(b) for the purpose of the relevant function of the authority.
(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.
(3) For the purposes of this paragraph, information processed by an education authority is processed for the purpose of the relevant function of the authority if the processing relates to the discharge of that function in respect of a person—
(a) who is or has been a pupil in a school provided by the authority, or
(b) who receives, or has received, further education provided by the authority.
(4) In this paragraph “the relevant function” means, in relation to each education authority, its function under section 1 of the Education (Scotland) Act 1980 and section 7(1) of the Self-Governing Schools etc. (Scotland) Act 1989.
16 (1) This paragraph applies to a record of information which—
(a) is processed by or on behalf of the Board of Governors, proprietor or trustees of, or a teacher at, a school in Northern Ireland specified in sub-paragraph (3),
(b) relates to an individual who is or has been a pupil at the school, and
(c) originated from, or was supplied by or on behalf of, any of the persons specified in sub-paragraph (4).
(2) But this paragraph does not apply to information which is processed by a teacher solely for the teacher's own use.
(3) The schools referred to in sub-paragraph (1)(a) are—
(a) a grant-aided school;
(b) an independent school.
(4) The persons referred to in sub-paragraph (1)(c) are—
(a) a teacher at the school;
(b) an employee of the Education Authority, other than a teacher at the school;
(c) an employee of the Council for Catholic Maintained Schools, other than a teacher at the school;
(d) the pupil to whom the record relates;
(e) a parent, as defined by Article 2(2) of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)).
(5) In this paragraph, “grant-aided school”, “independent school”, “proprietor” and “trustees” have the same meaning as in the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3)).
Other definitions
17 (1) In this Part of this Schedule—
“education authority” and “further education” have the same meaning as in the Education (Scotland) Act 1980;
“education data” means personal data consisting of information which—
constitutes an educational record, but
is not data concerning health;
“Principal Reporter” means the Principal Reporter appointed under the Children's Hearings (Scotland) Act 2011 (asp 1), or an officer of the Scottish Children's Reporter Administration to whom there is delegated under paragraph 10(1) of Schedule 3 to that Act any function of the Principal Reporter;
“pupil” means—
in relation to a school in England and Wales, a registered pupil within the meaning of the Education Act 1996,
in relation to a school in Scotland, a pupil within the meaning of the Education (Scotland) Act 1980, and
in relation to a school in Northern Ireland, a registered pupil within the meaning of the Education and Libraries (Northern Ireland) Order 1986 (S.I. 1986/594 (N.I. 3));
“school”—
in relation to England and Wales, has the same meaning as in the Education Act 1996,
in relation to Scotland, has the same meaning as in the Education (Scotland) Act 1980, and
in relation to Northern Ireland, has the same meaning as in the Education and Libraries (Northern Ireland) Order 1986;
“teacher” includes—
in Great Britain, head teacher, and
in Northern Ireland, the principal of a school.
(2) For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to education data if the application of Article 15 of the UK GDPR to the data would be likely to cause serious harm to the physical or mental health of the data subject or another individual.
Exemption from the listed GDPR provisions: data processed by a court
18 (1) The listed GDPR provisions do not apply to education data if—
(a) it is processed by a court,
(b) it consists of information supplied in a report or other evidence given to the court in the course of proceedings to which rules listed in subparagraph (2) apply, and
(c) in accordance with those rules, the data may be withheld by the court in whole or in part from the data subject.
(2) Those rules are—
(a) the Magistrates' Courts (Children and Young Persons) Rules (Northern Ireland) 1969 (S.R. (N.I.) 1969 No. 221);
(b) the Magistrates' Courts (Children and Young Persons) Rules 1992 (S.I. 1992/2071 (L. 17));
(c) the Family Proceedings Rules (Northern Ireland) 1996 (S.R. (N.I.) 1996 No. 322);
(d) the Magistrates' Courts (Children (Northern Ireland) Order 1995) Rules (Northern Ireland) 1996 (S.R. (N. I.) 1996 No. 323);
(e) the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));
(f) the Sheriff Court Adoption Rules 2009;
(g) the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17));
(h) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).
Exemption from Article 15 of the UK GDPR: serious harm
19 Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to education data to the extent that the serious harm test is met with respect to the data.
Restriction of Article 15 of the UK GDPR: prior opinion of Principal Reporter
20 (1) This paragraph applies where—
(a) a question arises as to whether a controller who is an education authority is obliged by Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) to disclose education data, and
(b) the controller believes that the data—
(i) originated from or was supplied by or on behalf of the Principal Reporter acting in pursuance of the Principal Reporter's statutory duties, and
(ii) is not data which the data subject is entitled to receive from the Principal Reporter.
(2) The controller must inform the Principal Reporter of the fact that the question has arisen before the end of the period of 14 days beginning when the question arises.
(3) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not permit the controller to disclose the data to the data subject unless the Principal Reporter has informed the controller that, in the opinion of the Principal Reporter, the serious harm test is not met with respect to the data.
PART 5 Child abuse data
Exemption from Article 15 of the UK GDPR: child abuse data
21 (1) This paragraph applies where a request for child abuse data is made in exercise of a power conferred by an enactment or rule of law and—
(a) the data subject is an individual aged under 18 and the person making the request has parental responsibility for the data subject, or
(b) the data subject is incapable of managing his or her own affairs and the person making the request has been appointed by a court to manage those affairs.
(2) Article 15(1) to (3) of the UK GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to child abuse data to the extent that the application of that provision would not be in the best interests of the data subject.
(3) “Child abuse data” is personal data consisting of information as to whether the data subject is or has been the subject of, or may be at risk of, child abuse.
(4) For this purpose, “child abuse” includes physical injury (other than accidental injury) to, and physical and emotional neglect, ill-treatment and sexual abuse of, an individual aged under 18.
(5) This paragraph does not apply in relation to Scotland.
SCHEDULE 4 Exemptions etc from the UK GDPR: disclosure prohibited or restricted by an enactment
Section 15
UK GDPR provisions to be restricted: “the listed GDPR provisions”
1 In this Schedule “the listed GDPR provisions” means the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—
(a) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(b) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3).
Human fertilisation and embryology information
2 The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by any of sections 31, 31ZA to 31ZE and 33A to 33D of the Human Fertilisation and Embryology Act 1990.
Adoption records and reports
3 (1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment listed in sub-paragraph (2), (3) or (4).
(2) The enactments extending to England and Wales are—
(a) regulation 14 of the Adoption Agencies Regulations 1983 (S.I. 1983/1964);
(b) regulation 41 of the Adoption Agencies Regulations 2005 (S.I. 2005/389);
(c) regulation 42 of the Adoption Agencies (Wales) Regulations 2005 (S.I. 2005/1313 (W. 95));
(d) rules 5, 6, 9, 17, 18, 21, 22 and 53 of the Adoption Rules 1984 (S.I. 1984/265);
(e) rules 24, 29, 30, 65, 72, 73, 77, 78 and 83 of the Family Procedure (Adoption) Rules 2005 (S.I. 2005/2795 (L. 22));
(f) in the Family Procedure Rules 2010 (S.I. 2010/2955 (L. 17)), rules 14.6, 14.11, 14.12, 14.13, 14.14, 14.24, 16.20 (so far as it applies to a children's guardian appointed in proceedings to which Part 14 of those Rules applies), 16.32 and 16.33 (so far as it applies to a children and family reporter in proceedings to which Part 14 of those Rules applies).
(3) The enactments extending to Scotland are—
(a) regulation 23 of the Adoption Agencies (Scotland) Regulations 1996 (S.I. 1996/3266 (S. 254));
(b) rule 67.3 of the Act of Sederunt (Rules of the Court of Session 1994) 1994 (S.I. 1994/1443 (S. 69));
(c) rules 10.3, 17.2, 21, 25, 39, 43.3, 46.2 and 47 of the Act of Sederunt (Sheriff Court Rules Amendment) (Adoption and Children (Scotland) Act 2007) 2009 (S.S.I. 2009/284);
(d) sections 53 and 55 of the Adoption and Children (Scotland) Act 2007 (asp 4);
(e) regulation 28 of the Adoption Agencies (Scotland) Regulations 2009 (S.S.I. 2009/154);
(f) regulation 3 of the Adoption (Disclosure of Information and Medical Information about Natural Parents) (Scotland) Regulations 2009 (S.S.I. 2009/268).
(4) The enactments extending to Northern Ireland are—
(a) Articles 50 and 54 of the Adoption (Northern Ireland) Order 1987 (S.I. 1987/2203 (N.I. 22));
(b) rule 53 of Order 84 of the Rules of the Court of Judicature (Northern Ireland) 1980 (S.R. (N.I.) 1980 No. 346);
(c) rules 4A.4(5), 4A.5(1), 4A.6(6), 4A.22(5) and 4C.7 of Part IVA of the Family Proceedings Rules (Northern Ireland) 1996 (S.R. (N.I.) 1996 No. 322).
Statements of special educational needs
4 (1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment listed in sub-paragraph (2).
(2) The enactments are—
(a) regulation 17 of the Special Educational Needs and Disability Regulations 2014 (S.I. 2014/1530);
(b) regulation 10 of the Additional Support for Learning (Co-ordinated Support Plan) (Scotland) Amendment Regulations 2005 (S.S.I. 2005/518);
(c) regulation 22 of the Education (Special Educational Needs) Regulations (Northern Ireland) 2005 (S.R. (N.I.) 2005 No. 384).
Parental order records and reports
5 (1) The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by an enactment listed in sub-paragraph (2), (3) or (4).
(2) The enactments extending to England and Wales are—
(a) sections 60, 77, 78 and 79 of the Adoption and Children Act 2002, as applied with modifications by regulation 2 of and Schedule 1 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 (S.I. 2010/985) in relation to parental orders made under—
(i) section 30 of the Human Fertilisation and Embryology Act 1990, or
(ii) section 54 of the Human Fertilisation and Embryology Act 2008;
(b) rules made under section 144 of the Magistrates' Courts Act 1980 by virtue of section 141(1) of the Adoption and Children Act 2002, as applied with modifications by regulation 2 of and Schedule 1 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010, so far as the rules relate to—
(i) the appointment and duties of the parental order reporter, and
(ii) the keeping of registers and the custody, inspection and disclosure of documents and information relating to parental order proceedings or related proceedings;
(c) rules made under section 75 of the Courts Act 2003 by virtue of section 141(1) of the Adoption and Children Act 2002, as applied with modifications by regulation 2 of Schedule 1 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 (S.I. 2010/985), so far as the rules relate to—
(i) the appointment and duties of the parental order reporter, and
(ii) the keeping of registers and the custody, inspection and disclosure of documents and information relating to parental order proceedings or related proceedings.
(3) The enactments extending to Scotland are—
(a) sections 53 and 55 of the Adoption and Children (Scotland) Act 2007 (asp 4), as applied with modifications by regulation 4 of and Schedule 3 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 (S.I. 2010/985) in relation to parental orders made under—
(i) section 30 of the Human Fertilisation and Embryology Act 1990, or
(ii) section 54 of the Human Fertilisation and Embryology Act 2008;
(b) rules 2.47 and 2.59 of the Act of Sederunt (Child Care and Maintenance Rules) 1997 (S.I. 1997/291 (S. 19));
(c) rules 21 and 25 of the Sheriff Court Adoption Rules 2009.
(4) The enactments extending to Northern Ireland are—
(a) Articles 50 and 54 of the Adoption (Northern Ireland) Order 1987 (S.I. 1987/2203 (N.I. 22)), as applied with modifications by regulation 3 of and Schedule 2 to the Human Fertilisation and Embryology (Parental Orders) Regulations 2010 in respect of parental orders made under—
(i) section 30 of the Human Fertilisation and Embryology Act 1990, or
(ii) section 54 of the Human Fertilisation and Embryology Act 2008;
(b) rules 4, 5 and 16 of Order 84A of the Rules of the Court of Judicature (Northern Ireland) 1980 (S.R. (N.I.) 1980 No. 346);
(c) rules 3, 4 and 15 of Order 50A of the County Court Rules (Northern Ireland) 1981 (S.R. (N.I.) 1981 No. 225).
Information provided by Principal Reporter for children's hearing
6 The listed GDPR provisions do not apply to personal data consisting of information the disclosure of which is prohibited or restricted by any of the following enactments—
(a) section 178 of the Children's Hearings (Scotland) Act 2011 (asp 1);
(b) the Children's Hearings (Scotland) Act 2011 (Rules of Procedure in Children's Hearings) Rules 2013 (S.S.I. 2013/194).
SCHEDULE 5 Accreditation of certification providers: reviews and appeals
Section 17
Introduction
1 (1) This Schedule applies where—
(a) a person (“the applicant”) applies to an accreditation authority for accreditation as a certification provider, and
(b) is dissatisfied with the decision on that application.
(2) In this Schedule—
“accreditation authority” means—
the Commission, or
the UK national accreditation body;
“certification provider” and “UK national accreditation body” have the same meaning as in section 17.
Review
2 (1) The applicant may ask the accreditation authority to review the decision.
(2) The request must be made in writing before the end of the period of 28 days beginning with the day on which the person receives written notice of the accreditation authority's decision.
(3) The request must specify—
(a) the decision to be reviewed, and
(b) the reasons for asking for the review.
(4) The request may be accompanied by additional documents which the applicant wants the accreditation authority to take into account for the purposes of the review.
(5) If the applicant makes a request in accordance with sub-paragraphs (1) to (4), the accreditation authority must—
(a) review the decision, and
(b) inform the applicant of the outcome of the review in writing before the end of the period of 28 days beginning with the day on which the request for a review is received.
Right to appeal
3 (1) If the applicant is dissatisfied with the decision on the review under paragraph 2, the applicant may ask the accreditation authority to refer the decision to an appeal panel constituted in accordance with paragraph 4.
(2) The request must be made in writing before the end of the period of 3 months beginning with the day on which the person receives written notice of the decision on the review.
(3) A request must specify—
(a) the decision to be referred to the appeal panel, and
(b) the reasons for asking for it to be referred.
(4) The request may be accompanied by additional documents which the applicant wants the appeal panel to take into account.
(5) The applicant may discontinue an appeal at any time by giving notice in writing to the accreditation authority.
Appeal panel
4 (1) If the applicant makes a request in accordance with paragraph 3, an appeal panel must be established in accordance with this paragraph.
(2) An appeal panel must consist of a chair and at least two other members.
(3) Where the request relates to a decision of the Commission—
(a) the Secretary of State may appoint one person to be a member of the appeal panel other than the chair, and
(b) subject to paragraph (a), the Commission must appoint the members of the appeal panel.
(4) Where the request relates to a decision of the UK national accreditation body—
(a) the Secretary of State—
(i) may appoint one person to be a member of the appeal panel other than the chair, or
(ii) may direct the Commission to appoint one person to be a member of the appeal panel other than the chair, and
(b) subject to paragraph (a), the chair of the UK national accreditation body must appoint the members of the appeal panel.
(5) A person may not be a member of an appeal panel if the person—
(a) has a commercial interest in the decision referred to the panel,
(b) has had any prior involvement in any matters relating to the decision, or
(c) is an employee or officer of the accreditation authority.
(6) No member of the Commission may be a member of an appeal panel to which a decision of the Commission is referred.
(7) The applicant may object to all or any of the members of the appeal panel appointed under sub-paragraph (3) or (4).
(8) If the applicant objects to a member of the appeal panel under sub-paragraph (7), the person who appointed that member must appoint a replacement.
(9) The applicant may not object to a member of the appeal panel appointed under sub-paragraph (8).
Hearing
5 (1) If the appeal panel considers it necessary, a hearing must be held at which both the applicant and the accreditation authority may be represented.
(2) Any additional documents which the applicant or the accreditation authority want the appeal panel to take into account must be submitted to the chair of the appeal panel at least 5 working days before the hearing.
(3) The appeal panel may allow experts and witnesses to give evidence at a hearing.
Decision following referral to appeal panel
6 (1) The appeal panel must, before the end of the period of 28 days beginning with the day on which the appeal panel is established in accordance with paragraph 4—
(a) make a reasoned recommendation in writing to the accreditation authority, and
(b) give a copy of the recommendation to the applicant.
(2) For the purposes of sub-paragraph (1), where there is an objection under paragraph 4(7), an appeal panel is not to be taken to be established in accordance with paragraph 4 until the replacement member is appointed (or, if there is more than one objection, until the last replacement member is appointed).
(3) The accreditation authority must, before the end of the period of 3 working days beginning with the day on which the authority receives the recommendation—
(a) make a reasoned final decision in writing, and
(b) give a copy of the decision to the applicant.
(4) Where the accreditation authority is the UK national accreditation body, the recommendation must be given to, and the final decision must be made by, the chief executive of that body.
Meaning of “working day”
7 In this Schedule, “working day” means any day other than—
(a) Saturday or Sunday,
(b) Christmas Day or Good Friday, or
(c) a day which is a bank holiday under the Banking and Financial Dealings Act 1971 in any part of the United Kingdom.
Section 30
1 Any United Kingdom government department other than a non-ministerial government department.
2 The Scottish Ministers.
3 Any Northern Ireland department.
4 The Welsh Ministers.
Chief officers of police and other policing bodies
5 The chief constable of a police force maintained under section 2 of the Police Act 1996.
6 The Commissioner of Police of the Metropolis.
7 The Commissioner of Police for the City of London.
8 The Chief Constable of the Police Service of Northern Ireland.
9 The chief constable of the Police Service of Scotland.
10 The chief constable of the British Transport Police.
11 The chief constable of the Civil Nuclear Constabulary.
12 The chief constable of the Ministry of Defence Police.
13 The Provost Marshal of the Royal Navy Police.
14 The Provost Marshal of the Royal Military Police.
15 The Provost Marshal of the Royal Air Force Police.
15A The Provost Marshal for serious crime.
16 The chief officer of—
(a) a body of constables appointed under provision incorporating section 79 of the Harbours, Docks, and Piers Clauses Act 1847;
(b) a body of constables appointed under an order made under section 14 of the Harbours Act 1964;
(c) the body of constables appointed under section 154 of the Port of London Act 1968 (c.xxxii).
17 A body established in accordance with a collaboration agreement under section 22A of the Police Act 1996.
18 The Director General of the Independent Office for Police Conduct.
18A The Service Police Complaints Commissioner.
19 The Police Investigations and Review Commissioner.
20 The Police Ombudsman for Northern Ireland.
Other authorities with investigatory functions
21 The Commissioners for Her Majesty's Revenue and Customs.
22 The Welsh Revenue Authority.
23 Revenue Scotland.
24 The Director General of the National Crime Agency.
25 The Director of the Serious Fraud Office.
26 The Director of Border Revenue.
27 The Financial Conduct Authority.
28 The Health and Safety Executive.
29 The Competition and Markets Authority.
30 The Gas and Electricity Markets Authority.
31 The Food Standards Agency.
32 Food Standards Scotland.
33 Her Majesty's Land Registry.
34 The Criminal Cases Review Commission.
35 The Scottish Criminal Cases Review Commission.
Authorities with functions relating to offender management
36 A provider of probation services (other than the Secretary of State), acting in pursuance of arrangements made under section 3(2) of the Offender Management Act 2007.
37 The Youth Justice Board for England and Wales.
38 The Parole Board for England and Wales.
39 The Parole Board for Scotland.
40 The Parole Commissioners for Northern Ireland.
41 The Probation Board for Northern Ireland.
42 The Prisoner Ombudsman for Northern Ireland.
43 A person who has entered into a contract for the running of, or part of—
(a) a prison or young offender institution under section 84 of the Criminal Justice Act 1991, or
(b) a secure training centre under section 7 of the Criminal Justice and Public Order Act 1994.
44 A person who has entered into a contract with the Secretary of State—
(a) under section 80 of the Criminal Justice Act 1991 for the purposes of prisoner escort arrangements, or
(b) under paragraph 1 of Schedule 1 to the Criminal Justice and Public Order Act 1994 for the purposes of escort arrangements.
45 A person who is, under or by virtue of any enactment, responsible for securing the electronic monitoring of an individual.
46 A youth offending team established under section 39 of the Crime and Disorder Act 1998.
Other authorities
47 The Director of Public Prosecutions.
48 The Director of Public Prosecutions for Northern Ireland.
49 The Lord Advocate.
50 A Procurator Fiscal.
51 The Director of Service Prosecutions.
51A The Information Commission.
52 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
53 The Scottish Information Commissioner.
54 The Scottish Courts and Tribunal Service.
55 The Crown agent.
56 A court or tribunal.
57 The Border Security Commander.
SCHEDULE 8 Conditions for sensitive processing under Part 3
Section 35(5)
Statutory etc purposes
1 This condition is met if the processing—
(a) is necessary for the exercise of a function conferred on a person by an enactment or rule of law, and
(b) is necessary for reasons of substantial public interest.
Administration of justice
2 This condition is met if the processing is necessary for the administration of justice.
Protecting individual's vital interests
3 This condition is met if the processing is necessary to protect the vital interests of the data subject or of another individual.
Safeguarding of children and of individuals at risk
4 (1) This condition is met if—
(a) the processing is necessary for the purposes of—
(i) protecting an individual from neglect or physical, mental or emotional harm, or
(ii) protecting the physical, mental or emotional well-being of an individual,
(b) the individual is—
(i) aged under 18, or
(ii) aged 18 or over and at risk,
(c) the processing is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and
(d) the processing is necessary for reasons of substantial public interest.
(2) The reasons mentioned in sub-paragraph (1)(c) are—
(a) in the circumstances, consent to the processing cannot be given by the data subject;
(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;
(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).
(3) For the purposes of this paragraph, an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—
(a) has needs for care and support,
(b) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and
(c) as a result of those needs is unable to protect himself or herself against the neglect or harm or the risk of it.
(4) In sub-paragraph (1)(a), the reference to the protection of an individual or of the well-being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.
Personal data already in the public domain
5 This condition is met if the processing relates to personal data which is manifestly made public by the data subject.
Legal claims
6 This condition is met if the processing—
(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),
(b) is necessary for the purpose of obtaining legal advice, or
(c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.
Judicial acts
7 This condition is met if the processing is necessary when a court or other judicial authority is acting in its judicial capacity.
Preventing fraud
8 (1) This condition is met if the processing—
(a) is necessary for the purposes of preventing fraud or a particular kind of fraud, and
(b) consists of—
(i) the disclosure of personal data by a competent authority as a member of an anti-fraud organisation,
(ii) the disclosure of personal data by a competent authority in accordance with arrangements made by an anti-fraud organisation,
(iia) the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii), or
(iii) the processing of personal data disclosed as described in sub-paragraph (i) or (ii).
(2) In this paragraph, “anti-fraud organisation” has the same meaning as in section 68 of the Serious Crime Act 2007.
Archiving etc
9 This condition is met if the processing is necessary—
(a) for archiving purposes in the public interest,
(b) for scientific or historical research purposes, or
(c) for statistical purposes.
Section 86
1 The data subject has given consent to the processing.
2 The processing is necessary—
(a) for the performance of a contract to which the data subject is a party, or
(b) in order to take steps at the request of the data subject prior to entering into a contract.
3 The processing is necessary for compliance with a legal obligation to which the controller is subject, other than an obligation imposed by contract.
4 The processing is necessary in order to protect the vital interests of the data subject or of another individual.
5 The processing is necessary—
(a) for the administration of justice,
(b) for the exercise of any functions of either House of Parliament,
(c) for the exercise of any functions conferred on a person by an enactment or rule of law,
(d) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or
(e) for the exercise of any other functions of a public nature exercised in the public interest by a person.
6 (1) The processing is necessary for the purposes of legitimate interests pursued by—
(a) the controller, or
(b) the third party or parties to whom the data is disclosed.
(2) Sub-paragraph (1) does not apply where the processing is unwarranted in any particular case because of prejudice to the rights and freedoms or legitimate interests of the data subject.
(3) In this paragraph, “third party”, in relation to personal data, means a person other than the data subject, the controller or a processor or other person authorised to process personal data for the controller or processor.
SCHEDULE 10 Conditions for sensitive processing under Part 4
Section 86
Consent to particular processing
1 The data subject has given consent to the processing.
Right or obligation relating to employment
2 The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by an enactment or rule of law on the controller in connection with employment.
Vital interests of a person
3 The processing is necessary—
(a) in order to protect the vital interests of the data subject or of another person, in a case where—
(i) consent cannot be given by or on behalf of the data subject, or
(ii) the controller cannot reasonably be expected to obtain the consent of the data subject, or
(b) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.
Safeguarding of children and of individuals at risk
4 (1) This condition is met if—
(a) the processing is necessary for the purposes of—
(i) protecting an individual from neglect or physical, mental or emotional harm, or
(ii) protecting the physical, mental or emotional well-being of an individual,
(b) the individual is—
(i) aged under 18, or
(ii) aged 18 or over and at risk,
(c) the processing is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and
(d) the processing is necessary for reasons of substantial public interest.
(2) The reasons mentioned in sub-paragraph (1)(c) are—
(a) in the circumstances, consent to the processing cannot be given by the data subject;
(b) in the circumstances, the controller cannot reasonably be expected to obtain the consent of the data subject to the processing;
(c) the processing must be carried out without the consent of the data subject because obtaining the consent of the data subject would prejudice the provision of the protection mentioned in sub-paragraph (1)(a).
(3) For the purposes of this paragraph, an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual—
(a) has needs for care and support,
(b) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and
(c) as a result of those needs is unable to protect himself or herself against the neglect or harm or the risk of it.
(4) In sub-paragraph (1)(a), the reference to the protection of an individual or of the well-being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.
Data already published by data subject
5 The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
Legal proceedings etc
6 The processing—
(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),
(b) is necessary for the purpose of obtaining legal advice, or
(c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.
Administration of justice, parliamentary, statutory etc and government purposes
7 The processing is necessary—
(a) for the administration of justice,
(b) for the exercise of any functions of either House of Parliament,
(c) for the exercise of any functions conferred on any person by an enactment or rule of law, or
(d) for the exercise of any functions of the Crown, a Minister of the Crown or a government department.
Medical purposes
8 (1) The processing is necessary for medical purposes and is undertaken by—
(a) a health professional, or
(b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.
(2) In this paragraph, “medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.
Equality
9 (1) The processing—
(a) is of sensitive personal data consisting of information as to racial or ethnic origin,
(b) is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and
(c) is carried out with appropriate safeguards for the rights and freedoms of data subjects.
(2) In this paragraph, “sensitive personal data” means personal data the processing of which constitutes sensitive processing (see section 86(7)).
Section 112
Preliminary
1 In this Schedule, “the listed provisions” means—
(a) Chapter 2 of Part 4 (the data protection principles), except section 86(1)(a) and (2) and Schedules 9 and 10;
(b) Chapter 3 of Part 4 (rights of data subjects);
(c) in Chapter 4 of Part 4 , section 108 (communication of personal data breach to the Commission).
Crime
2 The listed provisions do not apply to personal data processed for any of the following purposes—
(a) the prevention , investigation and detection of crime, or
(b) the apprehension and prosecution of offenders,
to the extent that the application of the listed provisions would be likely to prejudice any of the matters mentioned in paragraph (a) or (b).
Information required to be disclosed by law etc or in connection with legal proceedings
3 (1) The listed provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of the listed provisions would prevent the controller from complying with that obligation.
(2) The listed provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or the order of a court, to the extent that the application of the listed provisions would prevent the controller from making the disclosure.
(3) The listed provisions do not apply to personal data where disclosure of the data—
(a) is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings),
(b) is necessary for the purpose of obtaining legal advice, or
(c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights,
to the extent that the application of the listed provisions would prevent the controller from making the disclosure.
Parliamentary privilege
4 The listed provisions do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.
Judicial proceedings
5 The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice judicial proceedings.
Crown honours and dignities
6 The listed provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity.
Armed forces
7 The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice the combat effectiveness of any of the armed forces of the Crown.
Economic well-being
8 The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice the economic well-being of the United Kingdom.
Legal professional privilege
9 The listed provisions do not apply to personal data that consists of—
(a) information in respect of which a claim to legal professional privilege or, in Scotland, confidentiality of communications, could be maintained in legal proceedings, or
(b) information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser.
Negotiations
10 The listed provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the data subject to the extent that the application of the listed provisions would be likely to prejudice the negotiations.
Confidential references given by the controller
11 The listed provisions do not apply to personal data consisting of a reference given (or to be given) in confidence by the controller for the purposes of—
(a) the education, training or employment (or prospective education, training or employment) of the data subject,
(b) the appointment (or prospective appointment) of the data subject to any office, or
(c) the provision (or prospective provision) by the data subject of any service.
Exam scripts and marks
12 (1) The listed provisions do not apply to personal data consisting of information recorded by candidates during an exam.
(2) Where personal data consists of marks or other information processed by a controller—
(a) for the purposes of determining the results of an exam, or
(b) in consequence of the determination of the results of an exam,
section 94 has effect subject to sub-paragraph (3).
(3) Where the relevant time falls before the results of the exam are announced, the period mentioned in section 94(10)(b) is extended until the earlier of—
(a) the end of the period of 5 months beginning with the relevant time, and
(b) the end of the period of 40 days beginning with the announcement of the results.
(4) In this paragraph—
“exam” means an academic, professional or other examination used for determining the knowledge, intelligence, skill or ability of a candidate and may include an exam consisting of an assessment of the candidate's performance while undertaking work or any other activity;
“the relevant time” has the same meaning as in section 94.
(5) For the purposes of this paragraph, the results of an exam are treated as announced when they are first published or, if not published, first communicated to the candidate.
Research and statistics
13 (1) The listed provisions do not apply to personal data processed for—
(a) scientific or historical research purposes, or
(b) statistical purposes,
to the extent that the application of those provisions would prevent or seriously impair the achievement of the purposes in question.
(2) The exemption in sub-paragraph (1) is available only where—
(a) the personal data is processed subject to appropriate safeguards for the rights and freedoms of data subjects, and
(b) the results of the research or any resulting statistics are not made available in a form which identifies a data subject.
Archiving in the public interest
14 (1) The listed provisions do not apply to personal data processed for archiving purposes in the public interest to the extent that the application of those provisions would prevent or seriously impair the achievement of those purposes.
(2) The exemption in sub-paragraph (1) is available only where the personal data is processed subject to appropriate safeguards for the rights and freedoms of data subjects.
Section 114A
Status
1 (1) The Commission is not to be regarded—
(a) as a servant or agent of the Crown, or
(b) as enjoying any status, immunity or privilege of the Crown.
(2) The Commission’s property is not to be regarded—
(a) as property of the Crown, or
(b) as property held on behalf of the Crown.
Number of members
2 (1) The number of members of the Commission is to be determined by the Secretary of State.
(2) That number must not be—
(a) less than 3, or
(b) more than 14.
(3) The Secretary of State may by regulations substitute a different number for the number for the time being specified in sub-paragraph (2)(b).
(4) Regulations under this paragraph are subject to the negative resolution procedure.
Membership: general
3 (1) The Commission is to consist of—
(a) the non-executive members, and
(b) the executive members.
(2) The non-executive members are—
(a) a chair appointed by His Majesty by Letters Patent on the recommendation of the Secretary of State, and
(b) such other members as the Secretary of State may appoint.
(3) The executive members are—
(a) a chief executive appointed by the non-executive members or in accordance with paragraph 25, and
(b) such other members, if any, as the non-executive members may appoint.
(4) The Secretary of State must consult the chair of the Commission before appointing a non-executive member.
(5) The non-executive members must consult the Secretary of State before appointing the chief executive.
(6) The non-executive members must consult the chief executive about whether there should be any executive members within sub-paragraph (3)(b) and, if so, how many there should be.
(7) The Secretary of State may by direction set a maximum and a minimum number of executive members.
(8) The Commission may appoint one of the non-executive members as a deputy to the chair.
Membership: non-executive members to outnumber executive members
4 The Secretary of State must exercise the powers conferred on the Secretary of State by paragraphs 2 and 3 so as to secure that the number of non-executive members of the Commission is, so far as practicable, at all times greater than the number of executive members.
Membership: selection on merit etc
5 (1) The Secretary of State may not recommend a person for appointment as the chair of the Commission unless the person has been selected on merit on the basis of fair and open competition.
(2) A person may not be appointed as a member of the Commission unless the person has been selected on merit on the basis of fair and open competition.
Membership: conflicts of interests
6 (1) Before—
(a) recommending a person for appointment as the chair of the Commission, or
(b) appointing a person as a non-executive member of the Commission,
the Secretary of State must be satisfied that the person does not have a conflict of interest.
(2) The Secretary of State must check from time to time that none of the non-executive members has a conflict of interest.
(3) The Secretary of State may require a non-executive member to provide whatever information the Secretary of State considers necessary for the purpose of checking that the member does not have a conflict of interest.
(4) A non-executive member who is required to provide information under sub-paragraph (3) must provide it within such period as may be specified by the Secretary of State.
(5) In this Schedule, “conflict of interest”, in relation to a person, means a financial or other interest which is likely to affect prejudicially the discharge by the person of the person’s functions as a member of the Commission.
Tenure of the chair
7 (1) The chair of the Commission holds and vacates office in accordance with the terms of the chair’s appointment, subject to the provisions of this paragraph.
(2) The chair must be appointed for a term of not more than 7 years.
(3) On the recommendation of the Secretary of State, His Majesty may by Letters Patent extend the term of the chair’s appointment but not so the term as extended is more than 7 years.
(4) A person cannot be appointed as the chair more than once.
(5) The chair may be relieved from office by His Majesty at the chair’s own request.
(6) The chair may be removed from office by His Majesty on an Address from both Houses of Parliament.
(7) No motion is to be made in either House of Parliament for such an Address unless the Secretary of State has presented a report to that House stating that the Secretary of State is satisfied that—
(a) the chair is guilty of serious misconduct,
(b) the chair has a conflict of interest (see paragraph 6(5)),
(c) the chair has failed to comply with paragraph 6(4), or
(d) the chair is unable, unfit or unwilling to carry out the chair’s functions.
Tenure of deputy chair
8 (1) A deputy chair of the Commission may resign that office by giving written notice to the Commission.
(2) A deputy chair of the Commission ceases to hold that office on ceasing to be a non-executive member of the Commission.
(3) A deputy chair of the Commission may be removed from that office by the Commission.
Tenure of the other non-executive members
9 (1) This paragraph applies to a non-executive member of the Commission appointed by the Secretary of State.
(2) The member holds and vacates office in accordance with the terms of their appointment, subject to the provisions of this paragraph.
(3) The member must be appointed for a term of not more than 7 years.
(4) The Secretary of State may extend the term of the member’s appointment but not so that the term as extended is more than 7 years.
(5) The Secretary of State may not appoint the member as a non-executive member of the Commission on a subsequent occasion.
(6) The member may resign from office by giving written notice to the Secretary of State and the Commission.
(7) The Secretary of State may remove the member from office by written notice if satisfied that—
(a) the member is guilty of serious misconduct,
(b) the member has a conflict of interest (see paragraph 6(5)),
(c) the member has failed to comply with paragraph 6(4), or
(d) the member is unable, unfit or unwilling to carry out the member’s functions.
(8) At the time of removing the member from office the Secretary of State must make public the decision to do so.
(9) The Secretary of State must—
(a) give the member a statement of reasons for the removal, and
(b) if asked to do so by the member, publish the statement.
Remuneration and pensions of non-executive members
10 (1) The Commission may pay to the non-executive members of the Commission such remuneration and allowances as the Secretary of State may determine.
(2) The Commission may pay, or make provision for paying, to or in respect of the non-executive members of the Commission, such sums by way of pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the Secretary of State may determine.
(3) The Commission may make a payment to a person of such amount as the Secretary of State may determine where—
(a) the person ceases to be a non-executive member of the Commission otherwise than on the expiry of the person’s term of office, and
(b) it appears to the Secretary of State that there are special circumstances which make it appropriate for the person to receive compensation.
Executive members: terms and conditions
11 (1) The executive members of the Commission are to be employees of the Commission.
(2) The executive members are to be employed by the Commission on such terms and conditions, including those as to remuneration, as the non-executive members of the Commission may determine.
(3) The Commission must—
(a) pay to or in respect of the executive members of the Commission such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of office) as the non-executive members of the Commission may determine, and
(b) provide and maintain for them such pension schemes (whether contributory or not) as the non-executive members of the Commission may determine.
Other staff: appointment, terms and conditions
12 (1) The Commission may—
(a) appoint other employees, and
(b) make such other arrangements for the staffing of the Commission as it considers appropriate.
(2) In appointing an employee, the Commission must have regard to the principle of selection on merit on the basis of fair and open competition.
(3) Employees appointed by the Commission are to be appointed on such terms and conditions, including those as to remuneration, as the Commission may determine.
(4) The Commission may—
(a) pay to or in respect of those employees such pensions, allowances or gratuities (including pensions, allowances or gratuities paid by way of compensation in respect of loss of employment) as the Commission may determine, and
(b) provide and maintain for them such pension schemes (whether contributory or not) as the Commission may determine.
Committees
13 (1) The Commission may establish committees.
(2) A committee of the Commission may consist of or include persons who are neither members nor employees of the Commission.
(3) But a committee of the Commission to which functions are delegated under paragraph 14(1)(c) must include at least one person who is either a member or an employee of the Commission.
(4) Where a person who is neither a member nor an employee of the Commission is a member of a committee of the Commission, the Commission may pay to that person such remuneration and expenses as it may determine.
Delegation of functions
14 (1) The Commission may delegate any of its functions to—
(a) a member of the Commission,
(b) an employee of the Commission, or
(c) a committee of the Commission.
(2) A function is delegated under sub-paragraph (1) to the extent and on the terms that the Commission determines.
(3) A committee of the Commission may delegate any function delegated to it to a member of the committee.
(4) A function is delegated under sub-paragraph (3) to the extent and on the terms that the committee determines.
(5) The power of a committee of the Commission to delegate a function, and to determine the extent and terms of the delegation, is subject to the Commission’s power to direct what a committee established by it may and may not do.
(6) The delegation of a function by the Commission or a committee of the Commission under this paragraph does not prevent the Commission or the committee from exercising that function.
Advice from committees
15 The Commission may require a committee of the Commission to give the Commission advice about matters relating to the discharge of the Commission’s functions.
Proceedings
16 (1) The Commission may make arrangements for regulating—
(a) its own procedure, and
(b) the procedure of a committee of the Commission.
(2) The non-executive members of the Commission may by majority make arrangements for regulating the procedure for the carrying out of the separate functions which are conferred on them under this Schedule.
(3) Arrangements under this paragraph may include arrangements as to quorum and the making of decisions by a majority.
(4) The Commission must publish arrangements which it makes under this paragraph.
(5) This paragraph is subject to paragraph 18.
Records of proceedings
17 The Commission must make arrangements for the keeping of proper records of—
(a) its proceedings,
(b) the proceedings of a committee of the Commission,
(c) the proceedings at a meeting of the non-executive members of the Commission,
(d) anything done by a member or employee of the Commission under paragraph 14(1), and
(e) anything done by a member of a committee of the Commission under paragraph 14(3).
Disqualification for acting in relation to certain matters
18 (1) This paragraph applies if—
(a) a member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the Commission,
(b) a non-executive member of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the non-executive members, or
(c) a member of a committee of the Commission has a direct or indirect interest in a matter falling to be considered at a meeting of the committee.
(2) The member with the interest must declare it.
(3) The declaration must be recorded in the minutes of the meeting.
(4) The member with the interest may not take part in a discussion or decision at the meeting relating to the matter, unless—
(a) in the case of a meeting of the Commission, the other members of the Commission who are present have resolved unanimously that the interest is to be disregarded,
(b) in the case of a meeting of the non-executive members, the other non-executive members who are present have resolved unanimously that the interest is to be disregarded, or
(c) in the case of a meeting of a committee, the other members of the committee who are present have, in the manner authorised by the Commission, resolved that the interest is to be disregarded.
(5) In giving authorisation for the purposes of sub-paragraph (4)(c), the Commission must secure that a resolution for those purposes does not allow a member to take part in a discussion or decision at a meeting of a committee to which functions are delegated under paragraph 14(1)(c) unless the number of other members of the committee in favour of the resolution—
(a) is not less than two thirds of those who are both present and entitled to vote on the resolution, and
(b) is not less than its quorum.
(6) For the purposes of this paragraph, a notification given at or sent to a meeting of the Commission that a person—
(a) is a member of a company or firm, and
(b) is to be regarded as interested in any matter involving that company or firm,
is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the Commission, of the non-executive members or of a committee.
(7) For the purposes of this paragraph, a notification given at or sent to a meeting of the non-executive members of the Commission or of a committee of the Commission that—
(a) a person is a member of a company or firm, and
(b) is to be regarded as interested in any matter involving that company or firm,
is to be regarded as compliance with sub-paragraph (2) in relation to any such matter for the purposes of that meeting and subsequent meetings of the non-executive members or (as the case may be) of the committee.
(8) A notification described in sub-paragraph (6) or (7) remains in force until it is withdrawn.
(9) A person required to make a declaration for the purposes of this paragraph in relation to any meeting—
(a) is not required to attend the meeting, but
(b) is to be taken to have complied with the requirements of this paragraph if the person takes reasonable steps to secure that notice of the person’s interest is read out, and taken into consideration, at the meeting in question.
Validity of proceedings
19 (1) The validity of proceedings of the Commission, of the non-executive members of the Commission or of a committee of the Commission is not affected by—
(a) a vacancy in the membership of the Commission or of the committee,
(b) a defect in the appointment of a member of the Commission,
(c) a failure of the Secretary of State to comply with the requirements of paragraph 4, or
(d) a failure to comply with arrangements under paragraph 16 or with a requirement under paragraph 18.
(2) Nothing in sub-paragraph (1)(d) validates proceedings of a meeting which is inquorate unless it is inquorate by reason only of a matter within sub-paragraph (1)(b) or (c).
Money
20 The Secretary of State may make payments to the Commission.
Fees etc and other sums
21 (1) All fees, charges, penalties and other sums received by the Commission in carrying out its functions are to be paid to the Secretary of State.
(2) Sub-paragraph (1) does not apply where the Secretary of State otherwise directs.
(3) Any sums received by the Secretary of State under this paragraph are to be paid into the Consolidated Fund.
Accounts
22 (1) The Commission must keep proper accounts and proper records in relation to them.
(2) The Commission must prepare a statement of accounts in respect of each financial year in the form specified by the Secretary of State.
(3) The Commission must send a copy of each statement of accounts to the Secretary of State and the Comptroller and Auditor General before the end of August next following the financial year to which the statement relates.
(4) The Comptroller and Auditor General must—
(a) examine, certify and report on the statement of accounts, and
(b) send a copy of the certified statement and the report to the Secretary of State.
(5) The Secretary of State must lay before Parliament each document received under sub-paragraph (4)(b).
(6) In this paragraph “financial year” means—
(a) the period beginning with the date on which the Commission is established and ending with the 31 March following that date, and
(b) each successive period of 12 months.
Authentication of seal and presumption of authenticity of documents
23 (1) The application of the Commission’s seal must be authenticated by the signature of—
(a) the chair of the Commission, or
(b) another person authorised for that purpose by the Commission.
(2) A document purporting to be duly executed under the Commission’s seal or signed on its behalf—
(a) is to be received in evidence, and
(b) is to be taken to be executed or signed in that way, unless the contrary is shown.
(3) This paragraph does not extend to Scotland.
Supplementary powers
24 The Commission may do anything it thinks appropriate for the purposes of, or in connection with, its functions.
Transitional provision: interim chief executive
25 (1) The first chief executive of the Commission is to be appointed by the chair of the Commission.
(2) Before making the appointment the chair must consult the Secretary of State.
(3) The appointment must be for a term of not more than 2 years.
(4) The chair may extend the term of the appointment but not so the term as extended is more than 2 years.
(5) For the term of appointment, the person appointed under sub-paragraph (1) is “the interim chief executive”.
(6) Until the expiry of the term of appointment, the powers conferred on the non-executive members by paragraph 11(2) and (3) are exercisable in respect of the interim chief executive by the chair (instead of by the non-executive members).
(7) In sub-paragraphs (5) and (6), the references to the term of appointment are to the term of appointment described in sub-paragraph (3), including any extension of the term under sub-paragraph (4).
Interpretation
26 In this Schedule—
(a) references to pensions, allowances or gratuities include references to any similar benefits provided on death or retirement, and
(b) references to the payment of pensions, allowances or gratuities to or in respect of a person include references to the making of payments towards the provision of pensions, allowances or gratuities to be paid to or in respect of a person.
SCHEDULE 13 Other general functions of the Commission
Section 116
General tasks
1 (1) The Commission must—
(a) monitor and enforce Parts 3 and 4 of this Act;
(b) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing of personal data to which those Parts apply;
(c) advise Parliament, the government and other institutions and bodies on legislative and administrative measures relating to the protection of individuals' rights and freedoms with regard to processing of personal data to which those Parts apply;
(d) promote the awareness of controllers and processors of their obligations under Parts 3 and 4 of this Act;
(e) on request, provide information to a data subject concerning the exercise of the data subject's rights under Parts 3 and 4 of this Act and, if appropriate, co-operate with ... foreign designated authorities to provide such information;
(f) co-operate with ... foreign designated authorities with a view to ensuring the consistency of application and enforcement of ... the Data Protection Convention, including by sharing information and providing mutual assistance;
(g) conduct investigations on the application of Parts 3 and 4 of this Act, including on the basis of information received from ... a foreign designated authority or another public authority;
(h) monitor relevant developments to the extent that they have an impact on the protection of personal data, including the development of information and communication technologies;
(i) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(2) Section 3(14)(c) does not apply to the reference to personal data in sub-paragraph (1)(h).
General powers
2 The Commission has the following investigative, corrective, authorisation and advisory powers in relation to processing of personal data to which Part 3 or 4 of this Act applies—
(a) to notify the controller or the processor of an alleged infringement of Part 3 or 4 of this Act;
(b) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of Part 3 or 4 of this Act;
(c) to issue reprimands to a controller or processor where processing operations have infringed provisions of Part 3 or 4 of this Act;
(d) to issue, on the Commission's own initiative or on request, opinions to Parliament, the government or other institutions and bodies as well as to the public on any issue related to the protection of personal data.
Definitions
3 In this Schedule—
“foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Convention;
...
Section 118
PART 2 Data Protection Convention
Co-operation between the Commission and foreign designated authorities
6 (1) The Commission must, at the request of a foreign designated authority—
(a) provide that authority with such information referred to in Article 13(3)(a) of the Data Protection Convention (information on law and administrative practice in the field of data protection) as is the subject of the request, and
(b) take appropriate measures in accordance with Article 13(3)(b) of the Data Protection Convention for providing that authority with information relating to the processing of personal data in the United Kingdom.
(2) The Commission may ask a foreign designated authority—
(a) to provide the Commission with information referred to in Article 13(3) of the Data Protection Convention, or
(b) to take appropriate measures to provide such information.
Assisting persons resident outside the UK with requests under Article 14 of the Convention
7 (1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in the United Kingdom is made by a person resident outside the United Kingdom, including where the request is forwarded to the Commission through the Secretary of State or a foreign designated authority.
(2) The Commission must take appropriate measures to assist the person to exercise those rights.
Assisting UK residents with requests under Article 8 of the Convention
8 (1) This paragraph applies where a request for assistance in exercising any of the rights referred to in Article 8 of the Data Protection Convention in a country or territory (other than the United Kingdom) specified in the request is—
(a) made by a person resident in the United Kingdom, and
(b) submitted through the Commission under Article 14(2) of the Convention.
(2) If the Commission is satisfied that the request contains all necessary particulars referred to in Article 14(3) of the Data Protection Convention, the Commission must send the request to the foreign designated authority in the specified country or territory.
(3) Otherwise, the Commission must, where practicable, notify the person making the request of the reasons why the Commission is not required to assist.
Restrictions on use of information
9 Where the Commission receives information from a foreign designated authority as a result of—
(a) a request made by the Commission under paragraph 6(2), or
(b) a request received by the Commission under paragraph 6(1) or 7,
the Commission may use the information only for the purposes specified in the request.
Foreign designated authority
10 In this Part of this Schedule, “foreign designated authority” means an authority designated for the purposes of Article 13 of the Data Protection Convention by a party, other than the United Kingdom, which is bound by that Data Protection Convention.
Section 154
Issue of warrants in connection with non-compliance and offences
1 (1) This paragraph applies if a judge of the High Court, a circuit judge or a District Judge (Magistrates' Courts) is satisfied by information on oath supplied by the chair of the Commission or another person authorised by the chair of the Commission for that purpose that—
(a) there are reasonable grounds for suspecting that—
(i) a controller or processor has failed or is failing as described in section 149(2), or
(ii) an offence under this Act has been or is being committed, and
(b) there are reasonable grounds for suspecting that evidence of the failure or of the commission of the offence is to be found on premises specified in the information or is capable of being viewed using equipment on such premises.
(2) The judge may grant a warrant to the Commission.
Issue of warrants in connection with assessment notices
2 (1) This paragraph applies if a judge of the High Court, a circuit judge or a District Judge (Magistrates' Courts) is satisfied by information on oath supplied by the chair of the Commission or another person authorised by the chair of the Commission for that purpose that a controller or processor has failed to comply with a requirement imposed by an assessment notice.
(2) The judge may, for the purpose of enabling the Commission to determine whether the controller or processor has complied or is complying with the data protection legislation, grant a warrant to the Commission in relation to premises that were specified in the assessment notice.
Restrictions on issuing warrants: processing for the special purposes
3 A judge must not issue a warrant under this Schedule in respect of personal data processed for the special purposes unless a determination under section 174 with respect to the data or the processing has taken effect.
Restrictions on issuing warrants: procedural requirements
4 (1) A judge must not issue a warrant under this Schedule unless satisfied that—
(a) the conditions in sub-paragraphs (2) to (4) are met,
(b) compliance with those conditions would defeat the object of entry to the premises in question, or
(c) the Commission requires access to the premises in question urgently.
(2) The first condition is that the Commission has given 7 days' notice in writing to the occupier of the premises in question demanding access to the premises.
(3) The second condition is that—
(a) access to the premises was demanded at a reasonable hour and was unreasonably refused, or
(b) entry to the premises was granted but the occupier unreasonably refused to comply with a request by the Commission or the Commission’s officers or staff that the Commission’s officers or staff be allowed to do any of the things referred to in paragraph 5.
(4) The third condition is that, since the refusal, the occupier of the premises—
(a) has been notified by the Commission of the application for the warrant, and
(b) has had an opportunity to be heard by the judge on the question of whether or not the warrant should be issued.
(5) In determining whether the first condition is met, an assessment notice given to the occupier is to be disregarded.
Content of warrants
5 (1) A warrant issued under this Schedule must authorise any of the Commission’s officers or staff—
(a) to enter the premises,
(b) to search the premises, and
(c) to inspect, examine, operate and test any equipment found on the premises which is used or intended to be used for the processing of personal data.
(2) A warrant issued under paragraph 1 must authorise any of the Commission’s officers or staff—
(a) to inspect and seize any documents or other material found on the premises which may be evidence of the failure or offence mentioned in that paragraph,
(b) to require any person on the premises to provide, in an appropriate form, a copy of information capable of being viewed using equipment on the premises which may be evidence of that failure or offence,
(c) to require any person on the premises to provide an explanation of any document or other material found on the premises and of any information capable of being viewed using equipment on the premises, and
(d) to require any person on the premises to provide such other information as may reasonably be required for the purpose of determining whether the controller or processor has failed or is failing as described in section 149(2).
(3) A warrant issued under paragraph 2 must authorise any of the Commission’s officers or staff—
(a) to inspect and seize any documents or other material found on the premises which may enable the Commission to determine whether the controller or processor has complied or is complying with the data protection legislation,
(b) to require any person on the premises to provide, in an appropriate form, a copy of information capable of being viewed using equipment on the premises which may enable the Commission to make such a determination,
(c) to require any person on the premises to provide an explanation of any document or other material found on the premises and of any information capable of being viewed using equipment on the premises, and
(d) to require any person on the premises to provide such other information as may reasonably be required for the purpose of determining whether the controller or processor has complied or is complying with the data protection legislation.
(4) A warrant issued under this Schedule must authorise any of the Commission’s officers or staff to do the things described in sub-paragraphs (1) to (3) at any time in the period of 7 days beginning with the day on which the warrant is issued.
(5) For the purposes of this paragraph, a copy of information is in an “appropriate form” if —
(a) it can be taken away, and
(b) it is visible and legible or it can readily be made visible and legible.
Copies of warrants
6 A judge who issues a warrant under this Schedule must—
(a) issue two copies of it, and
(b) certify them clearly as copies.
Execution of warrants: reasonable force
7 A person executing a warrant issued under this Schedule may use such reasonable force as may be necessary.
Execution of warrants: time when executed
8 A warrant issued under this Schedule may be executed only at a reasonable hour, unless it appears to the person executing it that there are grounds for suspecting that exercising it at a reasonable hour would defeat the object of the warrant.
Execution of warrants: occupier of premises
9 (1) If an occupier of the premises in respect of which a warrant is issued under this Schedule is present when the warrant is executed, the person executing the warrant must—
(a) show the occupier the warrant, and
(b) give the occupier a copy of it.
(2) Otherwise, a copy of the warrant must be left in a prominent place on the premises.
Execution of warrants: seizure of documents etc
10 (1) This paragraph applies where a person executing a warrant under this Schedule seizes something.
(2) The person must, on request—
(a) give a receipt for it, and
(b) give an occupier of the premises a copy of it.
(3) Sub-paragraph (2)(b) does not apply if the person executing the warrant considers that providing a copy would result in undue delay.
(4) Anything seized may be retained for so long as is necessary in all the circumstances.
Matters exempt from inspection and seizure: privileged communications
11 (1) The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable in respect of a communication which is made—
(a) between a professional legal adviser and the adviser's client, and
(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.
(2) The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable in respect of a communication which is made—
(a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,
(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and
(c) for the purposes of such proceedings.
(3) Sub-paragraphs (1) and (2) do not prevent the exercise of powers conferred by a warrant issued under this Schedule in respect of—
(a) anything in the possession of a person other than the professional legal adviser or the adviser's client, or
(b) anything held with the intention of furthering a criminal purpose.
(4) The references to a communication in sub-paragraphs (1) and (2) include—
(a) a copy or other record of the communication, and
(b) anything enclosed with or referred to in the communication if made as described in sub-paragraph (1)(b) or in sub-paragraph (2)(b) and (c).
(5) In sub-paragraphs (1) to (3), the references to the client of a professional legal adviser include a person acting on behalf of such a client.
Matters exempt from inspection and seizure: Parliamentary privilege
12 The powers of inspection and seizure conferred by a warrant issued under this Schedule are not exercisable where their exercise would involve an infringement of the privileges of either House of Parliament.
Partially exempt material
13 (1) This paragraph applies if a person in occupation of premises in respect of which a warrant is issued under this Schedule objects to the inspection or seizure of any material under the warrant on the grounds that it consists partly of matters in respect of which those powers are not exercisable.
(2) The person must, if the person executing the warrant so requests, provide that person with a copy of so much of the material as is not exempt from those powers.
Return of warrants
14 (1) Where a warrant issued under this Schedule is executed—
(a) it must be returned to the court from which it was issued after being executed, and
(b) the person by whom it is executed must write on the warrant a statement of the powers that have been exercised under the warrant.
(2) Where a warrant issued under this Schedule is not executed, it must be returned to the court from which it was issued within the time authorised for its execution.
Offences
15 (1) It is an offence for a person—
(a) intentionally to obstruct a person in the execution of a warrant issued under this Schedule, or
(b) to fail without reasonable excuse to give a person executing such a warrant such assistance as the person may reasonably require for the execution of the warrant.
(2) It is an offence for a person—
(a) to make a statement in response to a requirement under paragraph 5(2)(c) or (d) or (3)(c) or (d) which the person knows to be false in a material respect, or
(b) recklessly to make a statement in response to such a requirement which is false in a material respect.
Self-incrimination
16 (1) An explanation given, or information provided, by a person in response to a requirement under paragraph 5(2)(c) or (d) or (3)(c) or (d) may only be used in evidence against that person—
(a) on a prosecution for an offence under a provision listed in sub-paragraph (2), or
(b) on a prosecution for any other offence where—
(i) in giving evidence that person makes a statement inconsistent with that explanation or information, and
(ii) evidence relating to that explanation or information is adduced, or a question relating to it is asked, by that person or on that person's behalf.
(2) Those provisions are—
(a) paragraph 15,
(b) section 5 of the Perjury Act 1911 (false statements made otherwise than on oath),
(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath), or
(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).
Vessels, vehicles etc
17 In this Schedule—
(a) “premises” includes a vehicle, vessel or other means of transport, and
(b) references to the occupier of premises include the person in charge of a vehicle, vessel or other means of transport.
Scotland
18 In the application of this Schedule to Scotland—
(a) references to a judge of the High Court have effect as if they were references to a judge of the Court of Session,
(b) references to a circuit judge have effect as if they were references to the sheriff or the summary sheriff,
(c) references to information on oath have effect as if they were references to evidence on oath, and
(d) references to the court from which the warrant was issued have effect as if they were references to the sheriff clerk.
Northern Ireland
19 In the application of this Schedule to Northern Ireland—
(a) references to a circuit judge have effect as if they were references to a county court judge, and
(b) references to information on oath have effect as if they were references to a complaint on oath.
Section 155
Meaning of “penalty”
1 In this Schedule, “penalty” means a penalty imposed by a penalty notice.
Notice of intent to impose penalty
2 (1) Before giving a person a penalty notice, the Commission must, by written notice (a “notice of intent”) inform the person that the Commission intends to give a penalty notice.
(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contents of notice of intent
3 (1) A notice of intent must contain the following information—
(a) the name and address of the person to whom the Commission proposes to give a penalty notice;
(b) the reasons why the Commission proposes to give a penalty notice (see sub-paragraph (2));
(c) an indication of the amount of the penalty the Commission proposes to impose, including any aggravating or mitigating factors that the Commission proposes to take into account.
(2) The information required under sub-paragraph (1)(b) includes—
(a) a description of the circumstances of the failure, and
(b) where the notice is given in respect of a failure described in section 149(2), the nature of the personal data involved in the failure.
(3) A notice of intent must also—
(a) state that the person may make written representations about the Commission's intention to give a penalty notice, and
(b) specify the period within which such representations may be made.
(4) The period specified for making written representations must be a period of not less than 21 days beginning when the notice of intent is given.
(5) If the Commission considers that it is appropriate for the person to have an opportunity to make oral representations about the Commission's intention to give a penalty notice, the notice of intent must also—
(a) state that the person may make such representations, and
(b) specify the arrangements for making such representations and the time at which, or the period within which, they may be made.
Giving a penalty notice
4 (A1) This paragraph applies where the Commission gives a notice of intent to a person.
(A2) Within the period of 6 months beginning when the notice is given, or as soon as reasonably practicable thereafter, the Commission must give to the person—
(a) a penalty notice, or
(b) written notice that the Commission has decided not to give a penalty notice to the person.
(1) But the Commission may not give a penalty notice to the person before a time, or before the end of a period, specified in the notice of intent for making oral or written representations.
(2) When deciding whether to give a penalty notice to the person and determining the amount of the penalty, the Commission must consider any oral or written representations made by the person in accordance with the notice of intent.
Contents of penalty notice
5 (1) A penalty notice must contain the following information—
(a) the name and address of the person to whom it is addressed;
(b) details of the notice of intent given to the person;
(c) whether the Commission received oral or written representations in accordance with the notice of intent;
(d) the reasons why the Commission proposes to impose the penalty (see sub-paragraph (2));
(e) the reasons for the amount of the penalty, including any aggravating or mitigating factors that the Commission has taken into account;
(f) details of how the penalty is to be paid;
(g) details of the rights of appeal under section 162;
(h) details of the Commission's enforcement powers under this Schedule.
(2) The information required under sub-paragraph (1)(d) includes—
(a) a description of the circumstances of the failure, and
(b) where the notice is given in respect of a failure described in section 149(2), the nature of the personal data involved in the failure.
Period for payment of penalty
6 (1) A penalty must be paid to the Commission within the period specified in the penalty notice.
(2) The period specified must be a period of not less than 28 days beginning when the penalty notice is given.
Variation of penalty
7 (1) The Commission may vary a penalty notice by giving written notice (a “penalty variation notice”) to the person to whom it was given.
(2) A penalty variation notice must specify—
(a) the penalty notice concerned, and
(b) how it is varied.
(3) A penalty variation notice may not—
(a) reduce the period for payment of the penalty;
(b) increase the amount of the penalty;
(c) otherwise vary the penalty notice to the detriment of the person to whom it was given.
(4) If—
(a) a penalty variation notice reduces the amount of the penalty, and
(b) when that notice is given, an amount has already been paid that exceeds the amount of the reduced penalty,
the Commission must repay the excess.
Cancellation of penalty
8 (1) The Commission may cancel a penalty notice by giving written notice to the person to whom it was given.
(2) If a penalty notice is cancelled, the Commission—
(a) may not take any further action under section 155 or this Schedule in relation to the failure to which that notice relates, and
(b) must repay any amount that has been paid in accordance with that notice.
Enforcement of payment
9 (1) The Commission must not take action to recover a penalty unless—
(a) the period specified in accordance with paragraph 6 has ended,
(b) any appeals against the penalty notice have been decided or otherwise ended,
(c) if the penalty notice has been varied, any appeals against the penalty variation notice have been decided or otherwise ended, and
(d) the period for the person to whom the penalty notice was given to appeal against the penalty, and any variation of it, has ended.
(2) In England and Wales, a penalty is recoverable—
(a) if the county court so orders, as if it were payable under an order of that court;
(b) if the High Court so orders, as if it were payable under an order of that court.
(3) In Scotland, a penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.
(4) In Northern Ireland, a penalty is recoverable—
(a) if a county court so orders, as if it were payable under an order of that court;
(b) if the High Court so orders, as if it were payable under an order of that court.
SCHEDULE 17 Review of processing of personal data for the purposes of journalism
Section 178
Interpretation
1 In this Schedule—
“relevant period” means—
...
the period of 12 months beginning when the Commission starts a ... review under section 178;
“the relevant review”, in relation to a relevant period, means the review under section 178 which the Commission must produce a report about by the end of that period.
Information notices
2 (1) This paragraph applies where the Commission gives an information notice during a relevant period.
(2) If the information notice—
(a) states that, in the Commission's opinion, the information or documents are required for the purposes of the relevant review, and
(b) gives the Commission's reasons for reaching that opinion,
subsections (5) and (6) of section 142 do not apply but the notice must not require the information or documents to be provided before the end of the period of 24 hours beginning when the notice is given.
Assessment notices
3 (1) Sub-paragraph (2) applies where the Commission gives an assessment notice to a person during a relevant period.
(2) If the assessment notice—
(a) states that, in the Commission's opinion, it is necessary for the controller or processor to comply with a requirement in the notice for the purposes of the relevant review, and
(b) gives the Commission's reasons for reaching that opinion,
subsections (6) and (7) of section 146 do not apply but the notice must not require the controller or processor to comply with the requirement before the end of the period of 7 days beginning when the notice is given.
(3) During a relevant period, section 147 has effect as if for subsection (5) there were substituted—
(5) The Commission may not give a controller or processor an assessment notice with respect to the processing of personal data for the special purposes unless a determination under section 174 with respect to the data or the processing has taken effect.
Interview notices
3A (1) Sub-paragraph (2) applies where the Commission gives an interview notice to an individual during a relevant period.
(2) If the interview notice—
(a) states that, in the Commission's opinion, it is necessary for the individual to comply with a requirement in the notice for the purposes of the relevant review, and
(b) gives the Commission's reasons for reaching that opinion,
subsections (6) and (7) of section 148A do not apply but the notice must not require the individual to comply with the requirement before the end of the period of 24 hours beginning when the notice is given.
(3) During a relevant period, section 148B has effect as if for subsection (8) there were substituted—
(8) The Commission may not give an individual an interview notice with respect to the processing of personal data for the special purposes unless a determination under section 174 with respect to the data or the processing has taken effect.
Applications in respect of urgent notices
4 Section 164 applies where an information notice , assessment notice or interview notice contains a statement under paragraph 2(2)(a) , 3(2)(a) or 3A(2)(a) as it applies where such a notice contains a statement under section 142(7)(a) , 146(8)(a) or 148A(8)(a).
Section 184
Relevant records
1 (1) In section 184, “relevant record” means—
(a) a relevant health record (see paragraph 2),
(b) a relevant record relating to a conviction or caution (see paragraph 3), or
(c) a relevant record relating to statutory functions (see paragraph 4).
(2) A record is not a “relevant record” to the extent that it relates, or is to relate, only to personal data which falls within Article 2(1A) of the UK GDPR (manual unstructured personal data held by FOI public authorities).
Relevant health records
2 “Relevant health record” means a health record which has been or is to be obtained by a data subject in the exercise of a data subject access right.
Relevant records relating to a conviction or caution
3 (1) “Relevant record relating to a conviction or caution” means a record which—
(a) has been or is to be obtained by a data subject in the exercise of a data subject access right from a person listed in sub-paragraph (2), and
(b) contains information relating to a conviction or caution.
(2) Those persons are—
(a) the chief constable of a police force maintained under section 2 of the Police Act 1996;
(b) the Commissioner of Police of the Metropolis;
(c) the Commissioner of Police for the City of London;
(d) the Chief Constable of the Police Service of Northern Ireland;
(e) the chief constable of the Police Service of Scotland;
(f) the Director General of the National Crime Agency;
(fa) the Independent Commission for Reconciliation and Information Recovery;
(g) the Secretary of State.
(3) In this paragraph—
“caution” means a caution given to a person in England and Wales or Northern Ireland in respect of an offence which, at the time when the caution is given, is admitted;
“conviction” has the same meaning as in the Rehabilitation of Offenders Act 1974 or the Rehabilitation of Offenders (Northern Ireland) Order 1978 (S.I. 1978/1908 (N.I. 27)).
Relevant records relating to statutory functions
4 (1) “Relevant record relating to statutory functions” means a record which—
(a) has been or is to be obtained by a data subject in the exercise of a data subject access right from a person listed in sub-paragraph (2), and
(b) contains information relating to a relevant function in relation to that person.
(2) Those persons are—
(a) the Secretary of State;
(b) the Department for Communities in Northern Ireland;
(c) the Department of Justice in Northern Ireland;
(d) the Scottish Ministers;
(e) the Disclosure and Barring Service;
(f) the independent reviewer appointed under section 12 of the Age of Criminal Responsibility (Scotland) Act 2019.
(3) In relation to the Secretary of State, the “relevant functions” are—
(a) the Secretary of State's functions in relation to a person sentenced to detention under—
(i) section 92 of the Powers of Criminal Courts (Sentencing) Act 2000,
(ia) section 260 of the Sentencing Code,
(ii) section 205(2) or 208 of the Criminal Procedure (Scotland) Act 1995, or
(iii) Article 45 of the Criminal Justice (Children) (Northern Ireland) Order 1998 (S.I. 1998/1504 (N.I. 9));
(b) the Secretary of State's functions in relation to a person imprisoned or detained under—
(i) the Prison Act 1952,
(ii) the Prisons (Scotland) Act 1989, or
(iii) the Prison Act (Northern Ireland) 1953 (c. 18 (N.I.));
(c) the Secretary of State's functions under—
(i) the Social Security Contributions and Benefits Act 1992,
(ii) the Social Security Administration Act 1992,
(iii) the Jobseekers Act 1995,
(iv) Part 5 of the Police Act 1997,
(v) Part 1 of the Welfare Reform Act 2007, or
(vi) Part 1 of the Welfare Reform Act 2012.
(4) In relation to the Department for Communities in Northern Ireland, the “relevant functions” are its functions under—
(a) the Social Security Contributions and Benefits (Northern Ireland) Act 1992,
(b) the Social Security Administration (Northern Ireland) Act 1992,
(c) the Jobseekers (Northern Ireland) Order 1995 (S.I. 1995/2705 (N.I. 15)), or
(d) Part 1 of the Welfare Reform Act (Northern Ireland) 2007 (c. 2 (N.I.)).
(5) In relation to the Department of Justice in Northern Ireland, the “relevant functions” are its functions under Part 5 of the Police Act 1997.
(6) In relation to the Scottish Ministers, the “relevant functions” are their functions under
(a) Part 1 of the Disclosure (Scotland) Act 2020, or
(b) Parts 1 and 2 of the Protection of Vulnerable Groups (Scotland) Act 2007 (asp 14).
(7) In relation to the Disclosure and Barring Service, the “relevant functions” are its functions under—
(a) Part 5 of the Police Act 1997,
(b) the Safeguarding Vulnerable Groups Act 2006, or
(c) the Safeguarding Vulnerable Groups (Northern Ireland) Order 2007 (S.I. 2007/1351 (N.I. 11)).
(8) In relation to the independent reviewer mentioned in sub-paragraph (2)(f), the “relevant functions” are the reviewer’s functions under Part 2 of the Age of Criminal Responsibility (Scotland) Act 2019.
Data subject access right
5 In this Schedule, “data subject access right” means a right under—
(a) Article 15 of the UK GDPR (right of access by the data subject);
(b) Article 20 of the UK GDPR (right to data portability);
(c) section 45 of this Act (law enforcement processing: right of access by the data subject);
(d) section 94 of this Act (intelligence services processing: right of access by the data subject).
Records stating that personal data is not processed
6 For the purposes of this Schedule, a record which states that a controller is not processing personal data relating to a particular matter is to be taken to be a record containing information relating to that matter.
Power to amend
7 (1) The Secretary of State may by regulations amend this Schedule.
(2) Regulations under this paragraph are subject to the affirmative resolution procedure.