Data (Use and Access) Act 2025
This Part confers powers on the Secretary of State and the Treasury to make provision in connection with access to customer data and business data.
In this Part—
“business data”, in relation to a trader, means—
“prescribed” means prescribed in FCA interface rules;
The 2018 Act is amended as follows.
In section 26(2)(f) (national security and defence exemption), omit sub-paragraph (ai) (inserted by section 88 of this Act).
Section 44 (information: controller’s general duties) is amended as follows. In subsection (1)— In subsection (5)—
Section 45 (right of access by the data subject) is amended as follows. In subsection (2)— In subsection (5)—
In section 45A (exemption from sections 44 and 45: legal professional privilege) (inserted by section 79 of this Act), in subsection (2), after paragraph (c) insert—.
Section 48 (rights to rectification, to erasure or to restriction of processing: supplementary) is amended as follows. In subsection (1)(b)— In subsection (4)—
In section 93(1)(e) (right to information), after “Commissioner”, in the first place it occurs, insert “under section 165”.
In section 94(2)(f) (right of access), after “Commissioner”, in the first place it occurs, insert “under section 165”.
Section 149 (enforcement notices) is amended as follows. In subsection (1), for “or (5)” substitute “, (5) or (5A)”. After subsection (5) insert— In subsection (6), for “or (5)” substitute “, (5) or (5A)”.
In section 155 (penalty notices), in subsection (1)(a), for “or (5)” substitute “, (5) or (5A)”.
In section 157 (maximum amount of penalty), after subsection (4) insert—
In section 165 (complaints by data subjects), in the heading, at the end insert “to the Commissioner”.
Section 166 (orders to progress complaints) is amended as follows. In the heading, at the end insert “to the Commissioner”. In subsection (1), omit “or Article 77 of the UK GDPR”.
Section 187 (representation of data subjects with their authority) is amended as follows. In subsection (1)(a)— In subsection (2)—
an enactment comprised in, or in an instrument made under, a Measure or Act of Senedd Cymru,
the trader, or
Chapter 5 of Part 3 of the 2018 Act (transfers of personal data to third countries etc) is amended as follows.
Omit section 74A (transfers based on adequacy regulations). After that section insert—
Section 76 (transfers on the basis of special circumstances) is amended as follows. In the heading, for “on the basis of” substitute “based on”. Before subsection (1) insert— In subsection (1)— In subsection (2), for “But subsection (1)(d) and (e) do not apply” substitute “But a transfer of personal data is not necessary for a special purpose by virtue of subsection (1)(d) or (e)”. After subsection (2) insert— In subsection (3), for “subsection (1)” substitute “this section”.
“specified” means specified, or of a description specified, by regulations under this Part, or in exercise of a power conferred by such regulations, except to the extent otherwise provided in this Part;
Regulations made under section 18(1) of the 2018 Act (transfers necessary for important reasons of public interest) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49(4A) of the UK GDPR (inserted by Schedule 7 to this Act). In this paragraph, “the relevant day” means the day on which paragraph 9(5) of Schedule 7 to this Act comes into force.
For the purposes of section 73(3) of the 2018 Act (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is a transfer made subject to appropriate safeguards where— Sub-paragraph (1) has effect in addition to section 75(1A) of the 2018 Act. For the purposes of sub-paragraph (1), a legal instrument is an “appropriate pre-commencement legal instrument”, in relation to a transfer of personal data, if— In this paragraph—
The following provisions (inserted by section 31 of the Victims and Prisoners Act 2024) extend to Scotland and Northern Ireland (as well as to England and Wales)—
Article 17(1)(g), (4) and (5) of the UK GDPR (right to erasure), and
section 13A of the 2018 Act (meaning of “relevant offence” for purpose of right to erasure).
“develop” an AI system means carry on an activity involved in producing the system, such as (for example) designing, programming, training or testing the system (and related terms are to be interpreted accordingly);
In the Data Protection Act 2018, after Schedule 12 insert—
This paragraph is about the requirement under paragraph 25 of Schedule 12A to the Data Protection Act 2018 (transitional provision: interim chief executive) for the chair of the Information Commission to consult the Secretary of State before appointing the first chief executive of the Information Commission. The requirement may be satisfied by consultation carried out, before this Schedule comes into force, by the person who holds the office of Information Commissioner.
“copyright work” has the same meaning as in Part 1 of the Copyright, Designs and Patents Act 1988;
The Registration Service Act 1953 is amended as follows.
Section 564 of the Education Act 1996 (certificates of birth and registrars’ returns) is amended as follows. In subsection (1), for “the registrar having the custody of the register of births and deaths” substitute “the relevant registrar for the register”. In subsection (3)— In subsection (4)—
In section 10 (district register offices), in subsection (1), omit the words from “, and shall provide” to the end.
In section 12 (provision of register boxes), omit “registrar of births and deaths and”.
In section 13 (local schemes of organisation), in subsection (2), after paragraph (b) insert—.
“processing” has the same meaning as in the Data Protection Act 2018 (see section 3(4) of that Act) and related terms are to be interpreted accordingly;
“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);
In section 124 of the Social Security Administration Act 1992 (provisions relating to age, death and marriage), after subsection (5) insert—
The Gender Recognition Act 2004 is amended as follows.
The UK GDPR is amended as follows.
For the purposes of Article 44A(1)(a) and (2)(b) of the UK GDPR (general principles for transfers of personal data), a transfer of personal data to a third country or an international organisation made on or after the relevant day is made subject to appropriate safeguards where— Sub-paragraph (1) has effect in addition to Article 46(1A) of the UK GDPR. In this paragraph—
Regulations made under section 18(2) of the 2018 Act (restrictions on transfers of personal data to third countries and international organisations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 49A of the UK GDPR (inserted by Schedule 7 to this Act). In this paragraph, “the relevant day” means the day on which paragraph 10 of Schedule 7 to this Act comes into force.
Section 10 (registration) is amended as follows. In subsection (2), omit the “or” after paragraph (a) and after paragraph (b) insert , or. For subsection (3) substitute—
In Article 13(1)(f) (information to be provided where personal data is collected from the data subject)—
for “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”, and
for “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”.
In Part 1 of Schedule 3 (registration: England and Wales), in paragraphs 5(3) and 8(2), for “or (b)” substitute “, (b) or (c)”.
In Article 14(1)(f) (information to be provided where personal data is not obtained from the data subject)—
for “adequacy regulations under section 17A of the 2018 Act” substitute “regulations under Article 45A”, and
for “reference to the appropriate or suitable safeguards” substitute “the safeguards relied on”.
In Article 15(2) (right of access by the data subject)—
after “organisation” insert “in reliance on Article 46”, and
for “appropriate safeguards pursuant to Article 46 relating to” substitute “safeguards provided in accordance with Article 46(1A)(a)(i) or (b)(i) for the purposes of”.
Article 40 (codes of conduct) is amended as follows. In paragraph 3 omit “appropriate” in both places. In paragraph 5, for “provides sufficient appropriate safeguards” substitute “is capable of providing safeguards for the purposes of Article 46”.
In Article 42(2) (certification) omit “appropriate” in both places.
In Article 46(2)(d) (transfers subject to appropriate safeguards: standard data protection clauses), after “Commissioner” insert “for the purposes of this Article”.
In Article 57(1) (Commissioner’s tasks)—
in point (m) omit “which provide sufficient safeguards,”, and
after point (s) insert—.
In Article 58(3) (authorisation and advisory powers of the Commissioner), after point (j) insert—.
In Article 83(5)(c) (general conditions for imposing administrative fines), for “44” substitute “44A”.
“data regulations” means regulations under section 2 or 4 (and see section 23);
The 2018 Act is amended as follows.
The UK GDPR is amended as follows.
Omit section 14 (automated decision-making authorised by law: safeguards).
In Article 12(4) (transparent information, communication and modalities for the exercise of the rights of the data subject), for “lodging a complaint with the Commissioner” substitute “making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commissioner under section 165 of that Act”.
In section 43(1)(d) (overview and scope of provisions in Part 3 about rights of the data subject), for “sections 49 and 50” substitute “sections 50A to 50D”.
Article 13(2) (information to be provided where personal data is collected from the data subject) is amended as follows. After point (c) insert—. In point (d), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.
Section 52 (form of provision of information etc) is amended as follows. In subsection (1), after “by” insert “or under”. In subsection (3), for “by the data subject under section 45, 46, 47 or 50” substitute “made by the data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D”. In subsection (4), for “under section 45, 46 or 47” substitute “under or by virtue of any of sections 45, 46, 47, 50C or 50D”. In subsection (5), after “by” insert “or under”. In subsection (6), for “under sections 45 to 50” substitute “arising under or by virtue of sections 45 to 50D”.
Article 14(2) (information to be provided where personal data is not obtained from the data subject) is amended as follows. After point (d) insert—. In point (e), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.
Section 53 (manifestly unfounded or excessive requests by the data subject) is amended as follows. In subsection (1), for “from a data subject under section 45, 46, 47 or 50” substitute “made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D”. In subsection (3), for “under section 45, 46, 47 or 50” substitute “described in subsection (1)”.
Article 15(1) (right of access by the data subject) is amended as follows. After point (e) insert—. In point (f), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.
In section 149(2)(b) (enforcement notices)—
after “provision of” insert “or made under”, and
for “22” substitute “22D”.
In Article 47 (binding corporate rules), in paragraph 2(e), for “lodge a complaint with the Commissioner and” substitute “make a complaint to the controller under section 164A of the 2018 Act, the right to make a complaint to the Commissioner under section 165 of the 2018 Act, the right to lodge a complaint”.
In section 157(2)(a) (maximum amount of penalty), for “49,” substitute “50B, 50C,”.
Article 80 (representation of data subjects) is amended as follows. In paragraph 1— In paragraph 2, for “lodge a complaint with the Commissioner” substitute “make a complaint under section 164A or 165 of the 2018 Act”.
For the purposes of this Part, a person (“C”) is a customer of a trader (“T”) if C has at any time—
purchased goods, services or digital content supplied or provided by T (whether for use by C or another person),
been supplied or provided by T with goods, services or digital content purchased from T by another person, or
otherwise received goods, services or digital content free of charge from T.
In subsection (3), the references to purchase, supply, provision or receipt of goods, services or digital content at any time include purchase, supply, provision or receipt before this section comes into force.
In subsections (3) and (4), references to purchasing goods, services or digital content include entering into an agreement to do so.
In this Part—
a reference to providing customer data or business data to a person (however expressed) includes a reference to providing the person with access to such data or with the ability to provide other persons with access to such data, and
a reference to a person receiving customer data or business data (however expressed) includes a reference to a person obtaining access to such data or the ability to provide other persons with access to such data.
The Secretary of State or the Treasury may by regulations make provision requiring a data holder to provide customer data—
to the customer, at the customer’s request, or
to a person of a specified description who is authorised by the customer to receive the data (an “authorised person”), at the customer’s request or at the authorised person’s request.
In this Part, in relation to customer data, “third party recipient” means a person of a description specified by provision made under subsection (1)(b) (and see section 25(1)).
The Secretary of State or the Treasury may by regulations make provision enabling or requiring a data holder—
to produce, collect or retain, or arrange for the production, collection or retention of, customer data;
to make changes to customer data, including to require rectification of inaccurate customer data, at the request of a customer or authorised person.
The Secretary of State or the Treasury may by regulations make provision for a person who is an authorised person in relation to customer data to take, on the customer’s behalf, action that the customer could take in relation to goods, services or digital content supplied or provided by a person who is, or has been, a data holder in relation to the customer data.
In deciding whether to make regulations under this section, the Secretary of State or the Treasury must have regard to (among other things)—
the likely effects for existing and future customers,
the likely effects for data holders,
the likely effect on small businesses and micro businesses,
the likely effect on innovation in the supply or provision of goods, services and digital content affected by the regulations or other goods, services and digital content, and
the likely effect on competition in markets for goods, services and digital content affected by the regulations or other markets.
This section is about provision that regulations under section 2 may (among other things) contain.
The regulations may include—
provision about the procedure by which customers authorise persons to receive customer data or to do other things;
provision restricting the persons that may be authorised to persons that comply with specified conditions;
provision for a specified person to decide whether a person satisfies the conditions for authorisation (and see section 6 for further provision about decision-makers).
The regulations may make provision about requests relating to customer data, including provision about the circumstances in which a data holder may or must refuse to act on a request.
The regulations may make provision about the providing of customer data and the taking of action described in section 2(4), including—
provision requiring a data holder to provide customer data on one or more occasions, for a specified period or at specified intervals;
provision requiring a data holder, customer or third party recipient to use specified facilities or services, including dashboard services, other electronic communications services or application programming interfaces;
provision requiring a data holder or third party recipient to comply with specified standards, or participate in specified arrangements, relating to, or to the use of, such facilities or services;
provision requiring a data holder or third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;
provision about interface bodies (see section 7).
The regulations may include—
provision enabling or requiring a data holder to produce, collect or retain, or arrange for the production, collection or retention of, records of customer data provided in accordance with the regulations;
provision enabling or requiring a third party recipient to produce or retain, or arrange for the production or retention of, records of customer data received in accordance with the regulations.
The regulations may make provision requiring a person who, in the course of a business, processes customer data of a trader to assist, or take specified steps to assist, the trader in complying with regulations under this Part.
The regulations may make provision about the processing of customer data provided to a third party recipient in accordance with the regulations, including—
provision requiring a third party recipient to use specified facilities or services, including dashboard services, other electronic communications services or application programming interfaces;
provision requiring a third party recipient to comply with specified standards, or participate in specified arrangements, relating to, or to the use of, such facilities or services;
provision requiring a third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;
provision about interface bodies (see section 7);
provision about further disclosure of the data, including provision for a person to whom customer data is further disclosed to be subject to—
some or all of the obligations imposed on a third party recipient by the regulations in relation to the customer data;
conditions imposed by the third party recipient.
The regulations may make provision enabling or requiring a data holder or a third party recipient to publish specified information relating to the rights and obligations of persons under the regulations, including—
information about the rights of customers in relation to customer data processed by the data holder or a third party recipient;
information about the activities carried out by the data holder or a third party recipient in performance of their obligations under the regulations.
The regulations may make provision about complaints, including provision requiring data holders or third party recipients to implement procedures for the handling of complaints.
The regulations may make provision about procedures for the resolution of disputes, including—
provision appointing, or providing for the appointment of, a person to determine disputes;
provision about the person’s powers when determining disputes;
provision about the effect of decisions relating to disputes;
provision about the review of decisions relating to disputes;
provision about appeals to a court or tribunal.
In subsections (4)(d) and (7)(c), references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
The Secretary of State or the Treasury may by regulations make provision requiring a data holder to publish business data or to provide business data—
to a customer of the trader to whom the business data relates, or
to another person of a specified description.
In this Part, in relation to business data, “third party recipient” means a person of a description specified by provision made under subsection (1)(b) (and see section 25(1)).
The Secretary of State or the Treasury may by regulations make provision enabling or requiring a data holder to produce, collect or retain, or arrange for the production, collection or retention of, business data.
The Secretary of State or the Treasury may by regulations—
make provision requiring a public authority that is a third party recipient in relation to business data (whether by virtue of those regulations or other data regulations), or a person appointed by such a public authority to do something with the business data, to publish business data or to provide business data—
to a customer of the trader to whom the business data relates, or
to another person of a specified description,
make provision requiring a person who is a third party recipient in relation to business data (whether by virtue of those regulations or other data regulations), and who is appointed by a public authority to do something with the business data, to publish or provide business data as described in paragraph (a)(i) or (ii),
in relation to the public authority, or the appointed person referred to in paragraph (a) or (b), make any provision that could be made in relation to a data holder, in connection with business data, in reliance on subsection (3) or sections 5 to 21, other than provision imposing a levy on the public authority or person, and
in relation to a person to whom the public authority or appointed person is required to provide business data by virtue of provision made under paragraph (a) or (b), other than a customer described in paragraph (a)(i), make any provision that could be made in relation to a third party recipient in reliance on sections 5 to 21.
In deciding whether to make regulations under this section, the Secretary of State or the Treasury must have regard to (among other things)—
the likely effects for existing and future customers,
the likely effects for data holders,
the likely effect on small businesses and micro businesses,
the likely effect on innovation in the supply or provision of goods, services and digital content affected by the regulations or other goods, services and digital content, and
the likely effect on competition in markets for goods, services and digital content affected by the regulations or other markets.
This section is about provision that regulations under section 4 may (among other things) contain.
The regulations may require business data to be provided on request and make provision about requests, including—
provision for requests to be made by a customer, a third party recipient or another person;
provision about the circumstances in which a data holder may or must refuse to act on a request.
The regulations may make provision requiring business data to be provided to customers, or third party recipients, who are approved to receive it, including—
provision restricting the persons that may be approved to persons that comply with specified conditions;
provision for a specified person to decide whether a person satisfies the conditions for approval (and see section 6 for further provision about decision-makers).
The regulations may make provision about the providing or publishing of business data, including—
provision requiring a data holder to provide or publish business data on one or more occasions, for a specified period or at specified intervals;
provision requiring a data holder, customer or third party recipient to use specified facilities or services, including dashboard services, other electronic communications services or application programming interfaces;
provision requiring a data holder or third party recipient to comply with specified standards, or participate in specified arrangements, relating to, or to the use of, such facilities or services;
provision requiring a data holder or third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;
provision about interface bodies (see section 7).
The regulations may include—
provision enabling or requiring a data holder to produce, collect or retain, or arrange for the production, collection or retention of, records of business data provided in accordance with the regulations;
provision enabling or requiring a third party recipient to produce or retain, or arrange for the production or retention of, records of business data received in accordance with the regulations.
The regulations may make provision requiring a person who, in the course of a business, processes business data of a trader to assist, or take specified steps to assist, the trader in complying with regulations under this Part.
The regulations may make provision about the processing of business data provided to a third party recipient in accordance with the regulations, including—
provision requiring a third party recipient to use specified facilities or services, including dashboard services, other electronic communications services or application programming interfaces;
provision requiring a third party recipient to comply with specified standards, or participate in specified arrangements, relating to, or to the use of, such facilities or services;
provision requiring a third party recipient to provide, or arrange for, specified assistance in connection with the establishment, maintenance or management of such facilities or services;
provision about interface bodies (see section 7);
provision about further disclosure of the data, including provision for a person to whom business data is further disclosed to be subject to some or all of the obligations imposed on customers or third party recipients by the regulations in relation to the business data.
The regulations may make provision enabling or requiring a data holder or a third party recipient to publish specified information relating to the rights and obligations of persons under the regulations, including information about the activities carried out by the data holder or third party recipient in performance of their obligations under the regulations.
The regulations may make provision about complaints, including provision requiring data holders or third party recipients to implement procedures for the handling of complaints.
The regulations may make provision about procedures for the resolution of disputes, including—
provision appointing, or providing for the appointment of, a person to determine disputes;
provision about the person’s powers when determining disputes;
provision about the effect of decisions relating to disputes;
provision about the review of decisions relating to disputes;
provision about appeals to a court or tribunal.
In subsections (4)(d) and (7)(c), references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
This section is about the provision about decision-makers that regulations under section 2 or 4 may or must (among other things) contain.
In this Part, “decision-maker” means a person who is authorised or required to take a decision described in section 3(2)(c) (authorisation) or 5(3)(b) (approval).
The regulations may make provision about the appointment of a decision-maker.
The regulations may make provision enabling or requiring a decision-maker to suspend or revoke a decision.
The regulations may confer powers on a decision-maker for the purpose of monitoring compliance with conditions for authorisation or approval (“monitoring powers”) (and see section 8 for provision about enforcement of requirements imposed in exercise of those powers).
The monitoring powers that may be conferred on a decision-maker include powers to require the provision of documents or information (but such powers are subject to the restrictions in section 9 as well as any restrictions included in the regulations).
The regulations must make provision about the rights of persons affected by the exercise of a decision-maker’s functions under the regulations and such provision may include (among other things)—
provision about the review of decision-makers’ decisions;
provision about appeals to a court or tribunal.
The regulations may make provision about complaints, including provision requiring a decision-maker to implement procedures for the handling of complaints.
The regulations may make provision enabling or requiring a decision-maker to publish, or provide to a specified person, specified documents or information relating to the exercise of the decision-maker’s functions.
The regulations may make provision for a decision-maker to arrange for its monitoring powers to be exercised by another person.
The regulations may—
provide for functions under the regulations to be exercisable by more than one decision-maker (whether jointly or concurrently);
where functions of decision-makers are exercisable concurrently—
provide for one of the decision-makers to be the lead decision-maker;
require the other decision-makers to consult the lead decision-maker before exercising the functions in a particular case;
provide for the lead decision-maker to give directions as to which decision-maker is to exercise a function in a particular case.
The regulations may make provision enabling or requiring a decision-maker—
to produce guidance about how it proposes to exercise its functions under the regulations (including provision enabling or requiring decision-makers with functions exercisable jointly or concurrently to produce joint guidance),
to publish the guidance, and
to provide copies to specified persons.
This section is about the provision that regulations under section 2 or 4 may (among other things) contain about bodies with one or more of the following tasks—
establishing a facility or service used, or capable of being used, for providing, publishing or otherwise processing customer data or business data or for taking action described in section 2(4) (referred to in this Part as an “interface”);
setting standards, or making other arrangements, relating to, or to the use of, an interface (referred to in this Part as “interface standards” and “interface arrangements”);
maintaining or managing an interface, interface standards or interface arrangements.
Such bodies are referred to in this Part as “interface bodies”.
The regulations may—
require a data holder or a third party recipient to set up an interface body;
make provision about the type of body to be set up.
In relation to an interface body (whether or not it is required to be set up by regulations under section 2 or 4), the regulations may—
make provision about the body’s composition and governance;
make provision requiring a data holder or a third party recipient to provide, or arrange for, assistance for the body;
impose other requirements relating to the body on a person who is required to set it up or to provide, or arrange for, assistance for the body;
make provision requiring the body to carry on all or part of a task described in subsection (1);
make provision requiring the body to do other things in connection with its interface, interface standards or interface arrangements;
make provision about how the body carries out its functions (such as, for example, provision about the body’s objectives or matters to be taken into account by the body);
confer powers on the body for the purpose of monitoring use of its interface, interface standards or interface arrangements (“monitoring powers”) (and see section 8 for provision about enforcement of requirements imposed in exercise of those powers);
make provision for the body to arrange for its monitoring powers to be exercised by another person;
make provision about the rights of persons affected by the exercise of the body’s functions under the regulations, including (among other things)—
provision about the review of decisions made in exercise of those functions;
provision about appeals to a court or tribunal;
make provision about complaints, including provision requiring the body to implement procedures for the handling of complaints;
make provision enabling or requiring the body to publish, or provide to a specified person, specified documents or information relating to its interface, interface standards or interface arrangements;
make provision enabling or requiring the body to produce guidance about how it proposes to exercise its functions under the regulations, to publish the guidance and to provide copies to specified persons.
The monitoring powers that may be conferred on an interface body include power to require the provision of documents or information (but such powers are subject to the restrictions in section 9 as well as any restrictions included in the regulations).
Examples of facilities or services referred to in subsection (1) include dashboard services, other electronic communications services and application programming interfaces.
In subsection (4)(b) and (c), the references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).
The Secretary of State or the Treasury may by regulations make provision— including provision for monitoring or enforcement by a specified public authority.
for the purpose of monitoring compliance with regulations under this Part or requirements imposed in exercise of a power conferred by such regulations, and
for the enforcement of such regulations or requirements,
In this Part, “enforcer” means a public authority that is authorised or required to carry out monitoring or enforcement described in subsection (1).
The following subsections make provision about what regulations under subsection (1) may or must (among other things) contain (and see sections 9 and 10).
The regulations may confer powers of investigation on an enforcer, including— but such powers are subject to the restrictions in section 9 (as well as any restrictions included in the regulations).
powers to require the provision of documents or information,
powers to require an individual to attend at a place and answer questions, and
powers of entry, inspection, search and seizure,
The regulations may—
make provision enabling an enforcer to issue a notice (“a compliance notice”) requiring compliance with—
regulations under this Part;
a condition for authorisation or approval (referred to in sections 3(2) and 5(3));
any other requirement imposed in exercise of a power conferred by regulations under this Part;
make provision for the enforcement of compliance notices, including provision for their enforcement as if they were orders of a court or tribunal;
make provision enabling an enforcer to publish a statement to the effect that the enforcer considers that a person is not complying with—
a requirement imposed by regulations under this Part,
a requirement imposed by a compliance notice, or
any other requirement imposed in exercise of a power conferred by regulations under this Part.
The regulations may make provision creating offences punishable with an unlimited fine, or a fine not exceeding a specified amount, in respect of—
the provision of false or misleading information in response to a request made in accordance with regulations under this Part;
an act or omission (including falsification) which prevents an enforcer, an interface body or a decision-maker from accessing information, documents, equipment or other material.
The regulations may make provision enabling a financial penalty to be imposed by an enforcer in respect of— and see section 10 for further provision about financial penalties.
the provision of false or misleading information in response to a request made in accordance with regulations under this Part;
a failure to comply with a requirement imposed by regulations under this Part;
a failure to comply with a requirement imposed by a compliance notice;
a failure to comply with any other requirement imposed in exercise of a power conferred by regulations under this Part;
The regulations may make provision about the rights of persons affected by the exercise of an enforcer’s functions under the regulations, including—
provision about the review of a decision made in exercise of those functions;
provision about appeals to a court or tribunal.
The regulations may make provision about complaints, including provision requiring an enforcer to implement procedures for the handling of complaints.
The regulations may make provision enabling or requiring an enforcer to publish, or to provide to a specified person, specified documents or information relating to monitoring or enforcement described in subsection (1), including—
documents or information relating to the exercise of the enforcer’s functions, and
documents or information relating to convictions for offences.
The regulations may make provision for an enforcer to arrange for its powers of investigation under the regulations to be exercised by another person.
The regulations may—
provide for functions under the regulations to be exercisable by more than one enforcer (whether jointly or concurrently);
where functions of enforcers are exercisable concurrently—
provide for one of the enforcers to be the lead enforcer;
require the other enforcers to consult the lead enforcer before exercising the functions in a particular case;
provide for the lead enforcer to give directions as to which enforcer is to exercise a function in a particular case.
The regulations may make provision enabling or requiring an enforcer—
to produce guidance about how it proposes to exercise its functions under the regulations (including provision enabling or requiring enforcers with functions exercisable jointly or concurrently to produce joint guidance),
to publish the guidance, and
to provide copies to specified persons.
Regulations under this Part may not—
authorise entry to a private dwelling without a warrant issued by a justice, or
require a person to provide information within subsections (2) to (7) to a decision-maker, an interface body or an enforcer.
Information is within this subsection if requiring a person to provide the information would involve an infringement of the privileges of either House of Parliament.
Information is within this subsection if it is information in respect of a communication which is made—
between a professional legal adviser and the adviser’s client, and
in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights imposed or conferred by or under regulations made under this Part.
Information is within this subsection if it is information in respect of a communication which is made—
between a professional legal adviser and the adviser’s client or between such an adviser or client and another person,
in connection with, or in contemplation of, proceedings under or arising out of regulations made under this Part (including proceedings arising out of the exercise of powers conferred by such regulations), and
for the purposes of such proceedings.
In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
Information is within this subsection if requiring a person to provide the information would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.
The reference to an offence in subsection (6) does not include an offence under—
regulations made under this Part;
section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);
Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).
An oral or written statement provided by a person in response to a request for information made by a decision-maker, an interface body or an enforcer in accordance with regulations under this Part may not be used in evidence against that person on a prosecution for an offence (other than an offence under regulations made under this Part) unless in the proceedings—
in giving evidence the person provides information inconsistent with the statement, and
evidence relating to the statement is adduced, or a question relating to it is asked, by that person or on that person’s behalf.
In this section, “justice” means—
in England and Wales, a justice of the peace,
in Scotland, a sheriff or summary sheriff, and
in Northern Ireland, a lay magistrate.
This section is about provision that regulations under this Part conferring power on an enforcer to impose a financial penalty may or must (among other things) contain.
The regulations must provide for the amount of a financial penalty to be— unless section 16 confers power to provide otherwise.
a specified amount or an amount determined in accordance with the regulations, or
an amount not exceeding such an amount,
The regulations must include provision—
requiring an enforcer to produce guidance about how the enforcer proposes to exercise any discretion to determine the amount of a financial penalty and to have regard to such guidance in exercising its discretion;
requiring an enforcer to publish the guidance;
requiring an enforcer, before imposing a financial penalty on a person, to give the person written notice (a “notice of intent”) of the proposed financial penalty;
ensuring that the person is given an opportunity to make representations about the proposed financial penalty;
requiring the enforcer, after the period for making representations, to decide whether to impose the financial penalty;
requiring the enforcer, if they decide to impose the financial penalty, to give the person notice in writing (a “final notice”) imposing the penalty;
enabling a person on whom a financial penalty is imposed to appeal to a court or tribunal in accordance with the regulations;
as to the powers of the court or tribunal on such an appeal.
The regulations may include provision—
requiring or enabling an enforcer to provide copies of guidance described in subsection (3)(a) to specified persons;
enabling a notice of intent or final notice to be withdrawn or amended;
requiring an enforcer to withdraw a final notice in specified circumstances;
for a financial penalty to be increased in the event of late payment by—
a specified amount or an amount determined in accordance with the regulations, or
an amount not exceeding such an amount;
as to how financial penalties are recoverable;
about what must or may be done with amounts paid as penalties.
The Secretary of State or the Treasury may by regulations—
make provision enabling a person listed in subsection (2), or a person acting on their behalf, to require other persons to pay fees in connection with activities described in subsection (3), and
make provision about what must or may be done with amounts paid as fees.
Those persons are—
data holders;
decision-makers;
interface bodies;
enforcers;
other persons on whom duties are imposed, or powers are conferred, by or under regulations made under this Part.
Those activities are performing duties, or exercising powers, imposed or conferred on the person listed in subsection (2) by or under regulations made under this Part.
Regulations under subsection (1)—
may only provide for a fee to be payable by persons that appear to the Secretary of State or the Treasury to be capable of being directly affected by the performance of duties, or the exercise of powers, imposed or conferred by or under regulations made under this Part;
may provide for the amount of a fee to be an amount which is intended to exceed the cost of the things in connection with which the fee is charged (and for the total amount of fees payable in connection with things to exceed the total cost).
Regulations under subsection (1) must provide for the amount of a fee to be— unless section 15 confers power to provide otherwise.
a specified amount or an amount determined in accordance with the regulations, or
an amount not exceeding such an amount,
Regulations under subsection (1) may provide for the amount, or maximum amount, of a fee to increase at specified times and by—
a specified amount or an amount determined in accordance with the regulations, or
an amount not exceeding such an amount.
Regulations under subsection (1) enabling a person to determine the amount of a fee must require the person to publish information about the amount and how it is determined.
Regulations under subsection (1) may (among other things) make provision about—
interest on any unpaid amounts;
the recovery of unpaid amounts.
The Secretary of State or the Treasury may by regulations make provision about whether a person listed in subsection (2), or a person acting on their behalf, who could require payment in connection with an activity described in subsection (3) otherwise than in reliance on regulations under subsection (1) may do so.
Where duties or powers are imposed or conferred— nothing in this section, or in regulations under subsection (1) or (9), prevents the person, or a person acting on their behalf, from requiring payment in connection with the performance or exercise of those duties or powers, or restricts their ability to do so, where the person could do so otherwise than in reliance on regulations under subsection (1).
on a person in their capacity as a third party recipient by or under regulations made under this Part, other than regulations made in reliance on section 4(4)(a), (b) or (c), or
on a person in their capacity as a person described in section 4(4)(d) by or under regulations made under this Part,
Examples of requiring payment otherwise than in reliance on regulations under subsection (1) include doing so in reliance on other legislation or a contract or other arrangement (whenever entered into).
The Secretary of State or the Treasury may by regulations—
impose, or provide for a specified public authority to impose, a levy on data holders or third party recipients for the purpose of meeting expenses described in subsection (2), and
make provision about what must or may be done with funds raised by means of the levy.
Those expenses are expenses incurred, or to be incurred, during a period by a person listed in subsection (3), or a person acting on their behalf, in performing duties, or exercising powers, imposed or conferred on the person listed in subsection (3) by or under regulations made under this Part.
Those persons are—
decision-makers;
interface bodies;
enforcers;
public authorities subject to requirements imposed by regulations made in reliance on section 4(4).
Regulations under subsection (1) may only provide for a levy in respect of expenses of a person to be imposed on data holders or third party recipients that appear to the Secretary of State or the Treasury to be capable of being directly affected by the exercise of some or all of the functions conferred on the person by or under regulations made under this Part.
Regulations under subsection (1) providing for a specified public authority to impose a levy must—
make provision about how the rate of the levy is to be determined;
make provision about how the period in respect of which the levy is payable is to be determined;
require the public authority to publish information about the rate, the period and how they are determined.
Regulations under subsection (1) may (among other things) make provision about—
interest on any unpaid amounts payable by way of a levy;
the recovery of such unpaid amounts.
The Secretary of State or the Treasury may give financial assistance to a person for the purpose of—
meeting expenses incurred, or to be incurred, by the person in performing duties, or exercising powers, imposed or conferred by or under regulations made under this Part, or
exercising other functions in connection with such regulations.
But subsection (1) does not enable financial assistance to be provided to a person listed in subsection (3) or to a person acting on their behalf.
Those persons are—
data holders,
customers, or
third party recipients, other than a third party recipient that is a public authority subject to requirements imposed by regulations made in reliance on section 4(4).
The financial assistance may be given on such terms and conditions as the Secretary of State or the Treasury considers appropriate.
In this section, “financial assistance” means any kind of financial assistance whether actual or contingent, including a grant, loan, guarantee or indemnity, but does not include buying a company’s share capital.
The Treasury may by regulations make provision enabling or requiring the Financial Conduct Authority (referred to in this Part as “the FCA”) to make rules—
requiring financial services providers described in the regulations to use a prescribed interface, comply with prescribed interface standards or participate in prescribed interface arrangements, when providing or receiving customer data or business data which is required to be provided by or to the financial services provider by data regulations;
requiring persons described in the regulations to use a prescribed interface, comply with prescribed interface standards or participate in prescribed interface arrangements, when the person, in the course of a business, receives, from a financial services provider, customer data or business data which is required to be provided to the person by data regulations;
requiring section 2(4) actors described in the regulations to use a prescribed interface, comply with prescribed interface standards or participate in prescribed interface arrangements when taking, facilitating or doing other things in connection with relevant financial services action;
imposing interface-related requirements on a description of person falling within subsection (3).
Such rules are referred to in this Part as “FCA interface rules”.
The following persons fall within this subsection—
an interface body linked to the financial services sector;
a person required by regulations made in reliance on section 7 to set up an interface body linked to the financial services sector;
a person who uses an interface, complies with interface standards or participates in interface arrangements linked to the financial services sector or who is required to do so by data regulations or rules made by virtue of regulations under subsection (1)(a), (b) or (c).
For the purposes of this section, requirements are interface-related if they relate to—
the composition, governance or activities of an interface body linked to the financial services sector,
an interface, interface standards or interface arrangements linked to the financial services sector, or
the use of such an interface, compliance with such interface standards or participation in such interface arrangements.
For the purposes of this section—
an interface body is linked to the financial services sector to the extent that its interface, interface standards or interface arrangements are linked to the financial services sector;
interfaces, interface standards and interface arrangements are linked to the financial services sector to the extent that they are used, or intended to be used, by financial services providers (whether or not they are used, or intended to be used, by other persons).
The Treasury may by regulations make provision enabling or requiring the FCA to impose requirements on a person to whom FCA interface rules apply (referred to in this Part as “FCA additional requirements”) where the FCA considers it appropriate to impose the requirement—
in response to a failure, or likely failure, by the person to comply with an FCA interface rule or FCA additional requirement, or
in order to advance a purpose which the FCA is required to advance when exercising functions conferred by regulations under this section (see section 15(3)(a)).
Regulations under subsection (6) may, for example, provide for the FCA to impose requirements by giving a notice or direction.
The restrictions in section 9 apply in connection with FCA interface rules and FCA additional requirements as they apply in connection with regulations under this Part.
In section 9 as so applied—
the references in subsections (1)(b) and (8) to an enforcer include the FCA, and
the references in subsections (3) and (4) to regulations made under this Part include FCA interface rules and FCA additional requirements.
In this section—
generate predictions, digital content, recommendations, decisions or other similar outputs, or
In Schedule 1 to the Public Records Act 1958 (definition of public records), in paragraph 2(2)(b), after “adoptions,” insert “or to any other records held by the Registrar General of information entered in any register of births or deaths kept under any such enactment,”.
In section 78 of the Adoption and Children Act 2002 (Adopted Children Register: searches and copies), in subsection (4)—
in paragraph (a), omit “certified copies of”;
in paragraph (b), for “certified copies”, in the second place it occurs, substitute “registers”.
Omit Article 45 (transfers on the basis of an adequacy decision).
After that Article insert—
“instituted”, in relation to proceedings, has the meaning given in section 126(15).
Chapter 5 of the UK GDPR (transfers of personal data to third countries or international organisations) is amended as follows.
Article 49 (derogations for specific situations) is amended as follows. In paragraph 1, in the first subparagraph— In paragraph 1, in the second subparagraph, for “a provision in Article 45” substitute “Article 45A”. In paragraph 4, for “section 18(1) of the 2018 Act” substitute “paragraph 4A”. The Secretary of State may by regulations specify for the purposes of point (d) of paragraph 1— Omit paragraph 5A. After paragraph 6 insert—
In section 72 (overview and interpretation), in subsection (1)(b)—
for “the special conditions that apply” substitute “additional conditions that apply in certain cases”, and
after “organisation” insert “(see section 73(4)(b))”.
Section 74B (transfers based on adequacy regulations: review etc) is amended as follows. For the heading substitute “Transfers approved by regulations: monitoring”. Omit subsections (1) and (2). In subsection (3), for “under section 74A” substitute “giving approval under section 74AA”. In subsection (4), for the words from the beginning to “otherwise,” substitute “Where the Secretary of State becomes aware that the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA,”. In subsection (5)— In subsection (6)(a)— In subsection (6)(b)— In subsection (7)—
For the italic heading before section 77 substitute “Additional conditions”.
Section 77 (conditions for transfers of personal data to persons other than relevant authorities) is amended as follows. For the heading substitute “Additional conditions for transfers in reliance on section 73(4)(b)”. In subsection (6), for “other than a relevant authority” substitute “in reliance on section 73(4)(b)”. In subsection (7)(a), for “other than a relevant authority” substitute “that takes place in reliance on section 73(4)(b)”.
“in a pseudonymised form” has the meaning given by section 18A(4) of the Counter-Terrorism Act 2008 (as amended by this section);
This section is about provision that regulations under section 14 may or must (among other things) contain.
The regulations—
may require or enable the FCA to impose interface-related requirements that could be imposed by regulations made in reliance on section 7(4) or (5), but
may not require or enable the FCA to require a person to set up an interface body.
The regulations must—
require the FCA, so far as is reasonably possible, to exercise functions conferred by the regulations in a manner which is compatible with, or which advances, one or more specified purposes;
specify one or more matters to which the FCA must have regard when exercising functions conferred by the regulations;
if they require or enable the FCA to make rules, make provision about the procedure for making rules, including provision requiring such consultation with persons likely to be affected by the rules or representatives of such persons as the FCA considers appropriate.
The regulations may—
require the FCA to carry out an analysis of the costs and benefits that will arise if proposed rules are made or proposed changes are made to rules and make provision about what the analysis must include;
require the FCA to publish rules or changes to rules and to provide copies to specified persons;
make provision about the effect of rules, including provision about circumstances in which rules are void and circumstances in which a person is not to be taken to have contravened a rule;
make provision enabling or requiring the FCA to modify or waive rules as they apply to a particular case;
make provision about the procedure for imposing FCA additional requirements;
make provision enabling or requiring the FCA to produce guidance about how it proposes to exercise its functions under the regulations, to publish the guidance and to provide copies to specified persons.
The regulations may require or enable the FCA to impose the following types of requirement on a person as FCA additional requirements—
a requirement to review the person’s conduct;
a requirement to take remedial action;
a requirement to make redress for loss or damage suffered by others as a result of the person’s conduct.
The regulations may require or enable FCA interface rules to require a person listed in subsection (7) to pay fees to an interface body or another person listed in that subsection, or to a person acting on behalf of such a body or person, in connection with activities described in subsection (8).
Those persons are—
persons falling within section 14(3)(b) or (c);
financial services providers.
Those activities are performing or exercising—
duties or powers imposed or conferred on the interface body or person listed in subsection (7) by FCA interface rules, and
other duties or powers imposed or conferred on that body or person by or under regulations made under this Part.
Regulations made in reliance on subsection (6)—
may enable rules to provide for the amount of a fee to be an amount which is intended to exceed the cost of the things in connection with which the fee is charged (and for the total amount of fees payable in connection with things to exceed the total cost);
may require or enable rules to make provision about the amount, or maximum amount, of a fee, including provision about how a fee is to be determined;
may require or enable rules to make provision about the amount, or maximum amount, by which the amount, or maximum amount, of a fee must or may increase and the times at which it must or may increase;
must require rules, where relevant, to require a person who determines an amount referred to in paragraph (b) or (c) to publish information about the amount and how it is determined;
may require or enable rules to make provision about what must or may be done with amounts paid as fees;
may require or enable rules to make provision about—
interest on any unpaid amounts;
the recovery of unpaid amounts.
Regulations under section 14 may enable FCA interface rules to make provision about whether an interface body or a person listed in subsection (7), or a person acting on behalf of such a body or person, who could require payment in connection with an activity described in subsection (8) otherwise than in reliance on FCA interface rules may do so.
Examples of requiring payment otherwise than in reliance on FCA interface rules include doing so in reliance on other legislation or a contract or other arrangement (whenever entered into).
Regulations under section 14 may provide that powers to make FCA interface rules include powers to do things described in section 21(1)(a) to (h) (supplementary powers) (ignoring the restriction in relation to fees in section 21(3)).
In this section, “financial services provider” and “interface-related” have the meaning given in section 14.
The reference in subsection (5)(c) to making redress includes—
paying interest, and
providing redress in the form of a remedy or relief which could not be awarded in legal proceedings.
Subsections (2) and (3) are about the provision that regulations made by the Treasury under this Part providing for the FCA to enforce requirements under FCA interface rules may (among other things) contain in relation to financial penalties.
The regulations may require or enable the FCA—
to set the amount or maximum amount of, or of an increase in, a penalty imposed in respect of failure to comply with a requirement imposed by the FCA in exercise of a power conferred by regulations under section 14 (whether imposed by means of FCA interface rules or an FCA additional requirement), or
to set the method for determining such an amount.
Regulations made in reliance on subsection (2)—
must require the FCA to produce and publish a statement of its policy with respect to the amount of the penalties;
may require the policy to include specified matters;
may make provision about the procedure for producing the statement;
may require copies of the statement to be provided to specified persons;
may require the FCA to have regard to a statement published in accordance with the regulations.
The Treasury may by regulations—
impose, or provide for the FCA to impose, a levy on data holders or third party recipients for the purpose of meeting expenses incurred, or to be incurred, during a period by the FCA, or by a person acting on the FCA’s behalf, in performing duties, or exercising powers, imposed or conferred on the FCA by regulations under section 14, and
make provision about what must or may be done with funds raised by means of the levy.
Regulations under subsection (4) may only provide for a levy in respect of expenses of the FCA to be imposed on persons that appear to the Treasury to be capable of being directly affected by the exercise of some or all of the functions conferred on the FCA by regulations under section 14.
Regulations under subsection (4) providing for the FCA to impose a levy must—
make provision about how the rate of the levy is to be determined;
make provision about how the period in respect of which the levy is payable is to be determined;
require the FCA to publish information about the rate, the period and how they are determined.
Regulations under subsection (4) may (among other things) make provision about—
interest on any unpaid amounts payable by way of a levy;
the recovery of such unpaid amounts.
The Treasury may by regulations amend section 98 of the Financial Services (Banking Reform) Act 2013 (payment systems: duty of the FCA and other regulators to ensure co-ordinated exercise of relevant functions) by—
amending the definition of “relevant functions” so as to add or remove a function conferred on the FCA by regulations under this Part, and
amending the definition of “objectives” so as to add or remove an objective of the FCA relevant to such a function.
The Secretary of State or the Treasury may by regulations provide that a person listed in subsection (2) is not liable in damages for anything done or omitted to be done in the exercise of functions conferred by or under regulations made under this Part.
Those persons are—
a public authority;
a member, officer or member of staff of a public authority;
a person who could be held vicariously liable for things done or omitted to be done by a public authority.
Regulations under this section may not—
make provision removing liability for an act or omission which is shown to have been in bad faith, or
make provision so as to prevent an award of damages made in respect of an act or omission on the ground that the act or omission was unlawful as a result of section 6(1) of the Human Rights Act 1998.
The relevant person must, by regulations, provide for the review of provision made by the relevant person in exercise of powers to make regulations under other sections in this Part (“Part 1 provision”) (but see the exceptions in subsection (8)).
In this section, “the relevant person” means—
in relation to Part 1 provision made by the Secretary of State, the Secretary of State, and
in relation to Part 1 provision made by the Treasury, the Treasury.
Regulations under subsection (1) must require the relevant person—
to review the Part 1 provision,
to prepare and publish a report setting out the findings of each review, and
to lay a copy of the report before Parliament.
The regulations must require the relevant person—
to publish the report setting out the findings of the first review of the Part 1 provision before the end of the period of 5 years beginning with the day on which the provision comes into force, and
to publish reports setting out the findings of subsequent reviews at intervals of not more than 5 years.
The regulations must require that, in carrying out a review, the relevant person must consider whether the Part 1 provision remains appropriate, having regard to (among other things)—
the objectives it is intended to achieve, and
to the extent that it is part of data regulations, the matters to which the relevant person was required to have regard in deciding whether to make the provision (see sections 2(5) and 4(5)).
The regulations must provide that the relevant person may omit material from a report before publication if the relevant person thinks that the publication of that material might harm the commercial interests of any person.
The regulations may (whether made by the Secretary of State or the Treasury) provide for the Secretary of State and the Treasury to carry out a joint review, and to produce a joint report, in respect of Part 1 provision made by the Secretary of State and Part 1 provision made by the Treasury.
Subsection (1) does not apply in relation to— nor does it require the relevant person to provide for the review of Part 1 provision that has been revoked.
Part 1 provision that is required to be reviewed by the relevant person by virtue of existing regulations under this section, or
Part 1 provision that makes, amends or revokes provision described in paragraph (a),
Section 28 of the Small Business, Enterprise and Employment Act 2015 (duty to review regulatory provisions in secondary legislation) does not apply in relation to a power to make regulations under this Part.
Except as provided by subsection (2), regulations under this Part may provide for the processing of information in accordance with the regulations not to be in breach of—
any obligation of confidence owed by the person processing the information, or
any other restriction on the processing of information (however imposed).
Regulations under this Part are not to be read as authorising or requiring processing of personal data that would contravene the data protection legislation (but in determining whether particular processing of data would do so, take into account the power conferred or duty imposed by the provision of the regulations in question).
In this section—
a Measure or Act of Senedd Cymru;
Regulations made under section 17C of the 2018 Act (standard data protection clauses) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 47A(1) of the UK GDPR (inserted by Schedule 7 to this Act). In this paragraph, “the relevant day” means the day on which paragraph 8 of Schedule 7 to this Act comes into force.
Regulations made under section 74A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under section 74AA of that Act (inserted by Schedule 8 to this Act). In this paragraph, “the relevant day” means the day on which paragraph 4 of Schedule 8 to this Act comes into force.
This paragraph applies to a requirement for safeguards to be provided under— The requirement may be satisfied on and after the relevant day by a version of pre-commencement standard clauses incorporating changes where— Changing a reference to regulations under section 17A of the 2018 Act into a reference to regulations made under Article 45A of the UK GDPR is to be treated as a change falling within sub-paragraph (2). Sub-paragraphs (2) and (3) cease to apply in relation to pre-commencement standard clauses if— Sub-paragraph (2) has effect in addition to Article 46(2) and (3) of the UK GDPR. In this paragraph—
Regulations under this Part may (among other things)—
make provision generally or in relation to particular cases;
make different provision for different purposes or areas;
make provision about the form and manner in which things must or may be done;
make provision about the content of requests, notices or other documents;
make provision about the time by which, or period within which, things must or may be done;
make provision by reference to standards, arrangements, specifications or technical requirements as published from time to time;
confer functions on a person, including functions involving the exercise of a discretion, and make provision in connection with the procedure for exercising the functions;
make consequential, supplementary, incidental, transitional, transitory or saving provision.
Regulations under this Part may not require or enable a person to set the maximum amount of a fine for an offence, except that such regulations may make provision about the maximum amount referring to the standard scale, the statutory maximum or a similar amount.
Regulations under this Part may not require or enable a person to set the amount or maximum amount of, or of an increase in, a penalty or fee or to set the method for determining such an amount, except as provided by subsection (4) and sections 11(9), 15 and 16.
Regulations under this Part—
may make provision about the amount or method described in subsection (3) referring to a published index, and
may require or enable a person to make decisions, in accordance with a maximum amount or method set out in the regulations, about the amount of, or of an increase or reduction in, a penalty or fee payable in a particular case.
Regulations under this Part making the following types of provision may amend, repeal or revoke primary legislation—
provision about the handling of complaints;
provision about the resolution of disputes;
provision about appeals;
provision described in subsection (1)(h).
The following regulations under this Part are subject to the affirmative resolution procedure—
the first regulations under each of section 2(1), (3) and (4) making provision about a particular description of customer data,
the first regulations under each of section 4(1), (3) and (4) making provision about a particular description of business data,
regulations under section 2 or 4 which make the requirements of regulations under this Part more onerous for data holders or interface bodies,
regulations under section 6(5), 7, 8, 11, 12, 14, 16, 17 or 18, and
regulations described in section 21(5) which amend, repeal or revoke primary legislation.
Other regulations under this Part are subject to the negative resolution procedure.
Before making regulations described in subsection (1), the Secretary of State or the Treasury (as the case may be) must consult such of the following as the Secretary of State or the Treasury considers appropriate—
persons likely to be affected by the regulations or representatives of such persons;
sectoral regulators with functions in relation to data holders likely to be affected by the regulations.
The requirement in subsection (3) may be satisfied by consultation undertaken before the day on which this Act is passed.
This section is about cases in which subordinate legislation, other than regulations under this Part, contains provision described in section 2(1) to (4) or 4(1) to (4) (and such provision is referred to in this section as “related subordinate legislation”).
The regulation-making powers under this Part may be exercised so as to make, in connection with the related subordinate legislation, any provision that they could be exercised to make as part of, or in connection with, provision made under section 2(1) to (4) or, as appropriate, section 4(1) to (4).
In this Part, references to “data regulations” include regulations made in reliance on subsection (2) to the extent that they make provision described in sections 2 to 7.
For the purposes of determining whether subordinate legislation contains provision described in sections 2(1) to (4) or 4(1) to (4), references in those sections to something specified are to be read as including something specified by or under any subordinate legislation.
In this section, “subordinate legislation” has the same meaning as in the Interpretation Act 1978 (see section 21 of that Act).
Omit sections 89 to 91 of the Enterprise and Regulatory Reform Act 2013 (supply of customer data).
In this Part—
“the Accreditation Regulation” means Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93;
“small business” has the meaning given by section 33 of the Small Business, Enterprise and Employment Act 2015, read with any regulations under that section;
In this Part, references to doing something “in the course of a business” include doing something in the course of—
a trade, craft or profession, or
any other undertaking carried on for gain or reward.
In this Part—
references to making arrangements include producing model arrangements,
references to managing a facility (or an interface that is a facility) include operating, or overseeing the operation, of a facility,
references to managing a service (or an interface that is a service) include providing, or overseeing the provision of, a service, and
references to managing standards or arrangements include assisting people to use them or overseeing how they are used.
In this Part, references to regulations made under subsection (3) of section 4 or any of sections 5 to 21 (and references which include such regulations) include regulations made under section 4(4)(c) or (d) which make provision that could be made under the other subsection or section.
The Table below lists provisions that define or otherwise explain terms defined for the purposes of this Part. Term Provision application programming interface section 25 (1) business, in the course of a section 25 (2) business data section 1 (2) customer section 1 (3) customer data section 1 (2) dashboard service section 25 (1) data holder section 1 (2) data regulations sections 1 (2) and 23 (3) decision-maker section 6 (2) digital content section 25 (1) electronic communications service section 25 (1) enforcer section 8 (2) the FCA section 14 (1) FCA additional requirement section 14 (6) FCA interface rules section 14 (2) goods section 25 (1) interface section 7 (1) interface arrangements section 7 (1) interface body section 7 (2) interface standards section 7 (1) making arrangements section 25 (3) managing (facilities, services, standards or arrangements) section 25 (3) micro business section 25 (1) monitoring powers (in sections 6 and 7) section 6 (5) or 7 (4) (g) (as appropriate) primary legislation section 25 (1) processing section 25 (1) providing customer data or business data section 1 (6) (a) public authority section 25 (1) receiving customer data or business data section 1 (6) (b) small business section 25 (1) specified section 25 (1) third party recipient section 25 (1) trader section 1 (2)
This Part contains provision to secure the reliability of digital verification services by means of—
a trust framework (see section 28),
supplementary codes (see section 29),
a register (see section 32),
an information gateway (see section 45), and
a trust mark (see section 50).
In this Part, “digital verification services” means verification services provided to any extent by means of the internet.
In subsection (2), “verification services” means services that are provided at the request of an individual and consist in—
ascertaining or verifying a fact about the individual from information provided otherwise than by the individual, and
confirming to another person that the fact about the individual has been ascertained or verified from information so provided.
The Secretary of State must prepare and publish a document (“the DVS trust framework”) setting out rules concerning the provision of digital verification services.
Those rules may include (among other things) rules relating to, and to the conduct of, a person who provides such services; and references in this Part to a person providing services in accordance with the DVS trust framework (however expressed) include a person complying with such rules.
In preparing the DVS trust framework, the Secretary of State must consult—
the Information Commissioner, and
such other persons as the Secretary of State considers appropriate.
The requirement in subsection (3) may be satisfied by consultation undertaken before the coming into force of this section.
The Secretary of State may revise and republish the DVS trust framework (whether following a review under section 31 or otherwise).
The DVS trust framework, and any revised version of the framework, must specify the time it comes into force (which must not be a time earlier than the time it is published).
The DVS trust framework, and any revised version of the framework, may—
set out different rules for different digital verification services,
specify that provisions come into force at different times for different purposes, and
make transitional or saving provision.
Where the Secretary of State revises and republishes the DVS trust framework, the DVS trust framework (as revised) may provide that from a date, or from the end of a period, specified in the framework a pre-revision certificate is required to be ignored for the purposes of sections 33(1)(a), 35(1)(c), 40(1)(c) and 42(1)(c).
In subsection (8), a “pre-revision certificate” means a certificate which—
certifies that digital verification services provided by the holder of the certificate are provided in accordance with the DVS trust framework, and
was issued before the time the relevant revision to the DVS trust framework comes into force.
Provision included in the DVS trust framework in reliance on subsection (8) may make different provision in relation to different descriptions of pre-revision certificate.
The Secretary of State may prepare and publish one or more sets of rules concerning the provision of digital verification services which supplement the DVS trust framework.
In this Part, a set of rules published under subsection (1) is referred to as a supplementary code.
Those rules may include (among other things) rules relating to, and to the conduct of, a person who provides such services; and in this Part references to a person providing services in accordance with a supplementary code (however expressed) include a person complying with such rules.
In preparing a set of rules, the Secretary of State must consult—
the Information Commissioner, and
such other persons as the Secretary of State considers appropriate.
The requirement in subsection (4) may be satisfied by consultation undertaken before the coming into force of this section.
The Secretary of State may revise and republish a supplementary code (whether following a review under section 31 or otherwise).
A supplementary code, and any revised version of a supplementary code, must specify the time it comes into force (which must not be a time earlier than the time it is published).
A supplementary code, and any revised version of a supplementary code, may—
set out different rules for different digital verification services,
specify that provisions come into force at different times for different purposes, and
make transitional or saving provision.
Where the Secretary of State revises and republishes a supplementary code, the supplementary code (as revised) may provide that from a date, or from the end of a period, specified in the code a pre-revision certificate is required to be ignored for the purposes of sections 36(1)(a), 37(1)(c), 43(1)(c)and 44(1)(c).
In subsection (9), a “pre-revision certificate” means a certificate which—
certifies that digital verification services provided by the holder of the certificate are provided in accordance with the supplementary code, and
was issued before the time the relevant revision to the supplementary code comes into force.
Provision included in a supplementary code in reliance on subsection (9) may make different provision in relation to different descriptions of pre-revision certificate.
The Secretary of State may determine to withdraw a supplementary code.
A determination must—
be published, and
specify when the code is withdrawn, which must be a time after the end of the period of 21 days beginning with the day on which the determination is published.
At least every 12 months, the Secretary of State must—
carry out a review of the DVS trust framework, and
at the same time, carry out a review of each supplementary code which has not been withdrawn.
In carrying out a review under subsection (1), the Secretary of State must consult—
the Information Commissioner, and
such other persons as the Secretary of State considers appropriate.
The Secretary of State must establish and maintain a register of persons providing digital verification services.
The register is referred to in this Part as the DVS register.
The Secretary of State must make the DVS register publicly available.
The Secretary of State must register a person providing digital verification services in the DVS register if—
the person holds a certificate from an accredited conformity assessment body certifying that digital verification services provided by the person are provided in accordance with the DVS trust framework,
the person applies to be registered in the DVS register in respect of one or more of the digital verification services to which the certificate relates,
the application complies with any requirements imposed by a determination under section 38, and
the person complies with any regulations under section 39(1) requiring a fee to be paid.
But subsection (1) is subject to—
the power to refuse registration under section 34(1), and
the duties to refuse registration under sections 34(10) and 41(10).
If the conditions in paragraphs (a) to (d) of subsection (1) are not met, the Secretary of State may not register a person in the DVS register.
The register must record the digital verification services in respect of which a person is, from time to time, registered.
For the purposes of subsection (1)(a), a certificate is to be ignored if—
it has expired in accordance with its terms,
it has been withdrawn by the body that issued it, or
it is required to be ignored by reason of provision included in the DVS trust framework under section 28(8).
In this Part, “accredited conformity assessment body” means a conformity assessment body that is accredited by the UK national accreditation body in accordance with Article 5 of the Accreditation Regulation as competent to carry out assessments of whether digital verification services are provided in accordance with the DVS trust framework.
In subsection (6)—
“personal information” means information relating to a person whose identity—
Regulations made under section 17A of the 2018 Act (transfers based on adequacy regulations) and in force immediately before the relevant day are to be treated, on and after that day, as if made under Article 45A of the UK GDPR (inserted by Schedule 7 to this Act). In this paragraph, “the relevant day” means the day on which paragraph 4 of Schedule 7 to this Act comes into force.
The Gas Act 1986 is amended as follows. In section 7B (licences: general)— In section 41HC (competitive tenders for licences for new licensable activities), in subsection (1), after “activities” insert “, other than a smart meter communication licence,”.
“conformity assessment body” has the same meaning as in the Accreditation Regulation (see Article 2(13) of that Regulation);
“Consultation Paper responses” means responses to the Copyright and AI Consultation Paper received by the Secretary of State on or before 25 February 2025;
The Electricity and Gas (Competitive Tenders for Smart Meter Communication Licences) Regulations 2012 (S.I. 2012/2414) are revoked.
The Secretary of State may refuse to register a person providing digital verification services in the DVS register if the Secretary of State—
considers that it is necessary to do so in the interests of national security, or
is satisfied that the person is failing to comply with the DVS trust framework in respect of one or more of the digital verification services in respect of which the person applies to be registered.
Before refusing to register a person under this section the Secretary of State must, by written notice, inform the person that the Secretary of State intends to do so.
The notice must—
state the name and address of the person,
state the reason why the Secretary of State—
considers that it is necessary to refuse to register the person in the interests of national security, or
is satisfied that the person is failing as mentioned in subsection (1)(b),
state whether the Secretary of State intends to specify a period in the notice under subsection (8) and, if so, what period is intended to be specified,
state that the person may make written representations to the Secretary of State about—
the Secretary of State’s intention to refuse to register the person in the DVS register, and
where relevant, the period the Secretary of State intends to specify in the notice under subsection (8), and
specify the period within which such representations may be made.
Where the Secretary of State intends to refuse to register a person in reliance on subsection (1)(a), the requirement in subsection (3)(b) does not apply if, or to the extent that, the Secretary of State considers that stating the reason described in subsection (3)(b)(i) would be contrary to the interests of national security.
The period specified for making written representations must be a period of not less than 21 days beginning with the day on which the notice is given.
If the Secretary of State considers that it is appropriate for the person to have an opportunity to make oral representations about the matters mentioned in subsection (3)(d), the notice must also—
state that the person may make such representations, and
specify the arrangements for making such representations and the time at which, or the period within which, they may be made.
When deciding whether to refuse to register the person in the DVS register under this section, the Secretary of State must consider any oral or written representations made by the person in accordance with the notice.
Where the Secretary of State refuses to register the person in the DVS register under this section, the Secretary of State must by written notice inform the person that the person’s application for registration has been refused.
The Secretary of State may, in the notice given under subsection (8), state that any further application for registration made by the person during a period specified in the notice will be refused.
If the person applies to be registered in the DVS register during the period specified in the notice in reliance on subsection (9), the Secretary of State must refuse the application.
The period specified in the notice in reliance on subsection (9) must begin with the day on which the notice is given and must not exceed two years.
Subsection (2) applies if—
a person is registered in the DVS register,
the person applies for their entry in the register to be amended to record additional digital verification services that the person provides in accordance with the DVS trust framework,
the person holds a certificate from an accredited conformity assessment body certifying that the person provides the additional services in accordance with the DVS trust framework,
the application complies with any requirements imposed by a determination under section 38, and
the person complies with any regulations under section 39(1) requiring a fee to be paid.
The Secretary of State must amend the DVS register to record that the person is also registered in respect of the additional services referred to in subsection (1).
If the conditions in paragraphs (a) to (e) of subsection (1) are not met, the Secretary of State may not amend the DVS register as described in subsection (2).
For the purposes of subsection (1)(c), a certificate is to be ignored if—
it has expired in accordance with its terms,
it has been withdrawn by the body that issued it, or
it is required to be ignored by reason of provision included in the DVS trust framework under section 28(8).
Subsection (2) applies if—
a person holds a certificate from an accredited conformity assessment body certifying that digital verification services provided by the person are provided in accordance with a supplementary code,
the person applies for a note about one or more of the services to which the certificate relates to be included in the entry relating to that person in the DVS register,
the application complies with any requirements imposed by a determination under section 38, and
the person complies with any regulations under section 39(1) requiring a fee to be paid.
The Secretary of State must include a note in the entry relating to the person in the DVS register recording that the person provides, in accordance with the supplementary code referred to in subsection (1), the services in respect of which the person made the application referred to in that subsection.
But subsection (2) does not apply if the supplementary code referred to in subsection (1) has been withdrawn.
If the conditions in paragraphs (a) to (d) of subsection (1) are not met, the Secretary of State may not include a note described in subsection (2) in the DVS register.
For the purposes of subsection (1)(a), a certificate is to be ignored if—
it has expired in accordance with its terms,
it has been withdrawn by the body that issued it, or
it is required to be ignored by reason of provision included in the supplementary code as a result of section 29(9).
In this Part, a note included in the DVS register in accordance with subsection (2) is referred to as a supplementary note.
Subsection (2) applies if—
a person has a supplementary note included in the DVS register relating to a supplementary code,
the person applies for the note to be amended to record additional digital verification services that the person provides in accordance with that code,
the person holds a certificate from an accredited conformity assessment body certifying that the person provides the additional services in accordance with that code,
the application complies with any requirements imposed by a determination under section 38, and
the person complies with any regulations under section 39(1) requiring a fee to be paid.
The Secretary of State must amend the note to record that the person also provides the additional services referred to in subsection (1) in accordance with the supplementary code to which the note relates.
But subsection (2) does not apply if the supplementary code to which the note relates has been withdrawn.
If the conditions in paragraphs (a) to (e) of subsection (1) are not met, the Secretary of State may not amend the note as described in subsection (2).
For the purposes of subsection (1)(c), a certificate is to be ignored if—
it has expired in accordance with its terms,
it has been withdrawn by the body that issued it, or
it is required to be ignored by reason of provision included in the supplementary code as a result of section 29(9).
The Secretary of State may determine—
the form of an application under section 33, 35, 36 or 37,
the information to be contained in or provided with the application,
the documents to be provided with the application, and
the manner in which the application is to be submitted.
A determination may make different provision for different purposes.
The Secretary of State must publish a determination.
The Secretary of State may revise a determination.
If the Secretary of State revises a determination the Secretary of State must publish the determination as revised.
The Secretary of State may by regulations make provision for or in connection with—
the payment of fees for applications under sections 33, 35, 36 and 37, and
the payment of fees in connection with continued registration in the DVS register.
The regulations may not provide for payment of fees to anyone other than the Secretary of State.
The regulations must—
specify the amount, or the maximum amount of a fee, or
provide for a fee, or the maximum amount of a fee, to be determined in accordance with regulations.
The regulations may provide for the amount of a fee to exceed the administrative costs of determining the application or the administrative costs associated with the continued registration (as the case may be).
Regulations under subsection (1) may (among other things) make provision about the following— including provision conferring functions on the Secretary of State in relation to the matters in paragraphs (a) to (e).
when fees are to be paid;
the manner in which fees are to be paid;
the payment of discounted fees;
exceptions to requirements to pay fees;
the refund of fees (in whole or in part);
interest on any unpaid amounts,
A fee payable under regulations made under subsection (1)(b), and any interest payable in respect of it, is recoverable summarily (or, in Scotland, recoverable) as a civil debt.
The regulations may—
make different provision for different purposes;
make transitional, transitory or saving provision.
Regulations under this section are subject to the negative resolution procedure.
The Secretary of State must remove a person from the DVS register if the person—
asks to be removed from the register,
ceases to provide all of the digital verification services in respect of which the person is registered in the register, or
no longer holds a certificate from an accredited conformity assessment body certifying that at least one of those digital verification services is provided in accordance with the DVS trust framework.
For the purposes of subsection (1)(c), a certificate is to be ignored if—
it has expired in accordance with its terms,
it has been withdrawn by the body that issued it, or
it is required to be ignored by reason of provision included in the DVS trust framework under section 28(8).
The Secretary of State may remove a person from the DVS register if—
the Secretary of State is satisfied that the person is failing to comply with the DVS trust framework when providing one or more of the digital verification services in respect of which the person is registered,
the person has a supplementary note included in the DVS register and the Secretary of State is satisfied that the person is failing to comply with the supplementary code to which the note relates when providing one or more of the digital verification services recorded in the note,
the Secretary of State is satisfied that the person has failed to provide the Secretary of State with information in accordance with a notice under section 51, or
the Secretary of State considers that it is necessary to do so in the interests of national security.
Before removing a person from the DVS register under this section the Secretary of State must, by written notice, inform the person that the Secretary of State intends to do so.
The notice must—
state the name and address of the person,
state the reason why the Secretary of State—
is satisfied that the person is failing or has failed as mentioned in subsection (1)(a) to (c), or
considers that it is necessary to remove the person from the DVS register in the interests of national security,
state whether the Secretary of State intends to specify a period in the notice under subsection (8) and, if so, what period is intended to be specified,
state that the person may make written representations to the Secretary of State about—
the Secretary of State’s intention to remove the person from the DVS register, and
where relevant, the period the Secretary of State intends to specify in the notice under subsection (8), and
specify the period within which such representations may be made.
The requirement in subsection (3)(b) does not apply if, or to the extent that, the Secretary of State considers that stating the reason described in subsection (3)(b)(ii) would be contrary to the interests of national security.
The period specified for making written representations must be a period of not less than 21 days beginning with the day on which the notice is given.
If the Secretary of State considers that it is appropriate for the person to have an opportunity to make oral representations about the matters mentioned in subsection (3)(d), the notice must also—
state that the person may make such representations, and
specify the arrangements for making such representations and the time at which, or the period within which, they may be made.
When deciding whether to remove the person from the DVS register under this section, the Secretary of State must consider any oral or written representations made by the person in accordance with the notice.
Where the Secretary of State removes the person from the DVS register under this section, the Secretary of State must by written notice inform the person of that.
The Secretary of State may, in the notice given under subsection (8), state that any application for re-registration made by the person during a period specified in the notice will be refused.
If the person applies to be re-registered during the period specified in the notice in reliance on subsection (9), the Secretary of State must refuse the application.
The period specified in the notice in reliance on subsection (9) must begin with the day on which the notice is given and must not exceed two years.
Where a person is registered in the DVS register in respect of digital verification services, subsection (2) applies if the person—
asks for the register to be amended so that the person is no longer registered in respect of one or more of those services,
ceases to provide one or more of those services (but not all of them), or
no longer holds a certificate from an accredited conformity assessment body certifying that all of those services are provided in accordance with the DVS trust framework.
The Secretary of State must amend the register to record that the person is no longer registered in respect of (as the case may be)—
the service or services mentioned in a request described in subsection (1)(a),
the service or services which the person has ceased to provide, or
the service or services for which there is no longer a certificate as described in subsection (1)(c).
For the purposes of subsection (1)(c), a certificate is to be ignored if—
it has expired in accordance with its terms,
it has been withdrawn by the body that issued it, or
it is required to be ignored by reason of provision included in the DVS trust framework under section 28(8).
The Secretary of State must remove a supplementary note included in the entry in the DVS register relating to a person if—
the person asks for the note to be removed,
the person ceases to provide all of the digital verification services to which the note relates,
the person no longer holds a certificate from an accredited conformity assessment body certifying that at least one of those digital verification services is provided in accordance with the supplementary code to which the note relates, or
the supplementary code to which the note relates has been withdrawn.
For the purposes of subsection (1)(c), a certificate is to be ignored if—
it has expired in accordance with its terms,
it has been withdrawn by the body that issued it, or
it is required to be ignored by reason of provision included in the supplementary code as a result of section 29(9).
Where a person has a supplementary note included in their entry in the DVS register in respect of digital verification services, subsection (2) applies if the person—
asks for the note to be amended so that it no longer records one or more of those services,
ceases to provide one or more of the services recorded in the note (but not all of them), or
no longer holds a certificate from an accredited conformity assessment body certifying that all of the services included in the note are provided in accordance with a supplementary code.
The Secretary of State must amend the supplementary note so it no longer records (as the case may be)—
the service or services mentioned in a request described in subsection (1)(a),
the service or services which the person has ceased to provide, or
the service or services for which there is no longer a certificate as described in subsection (1)(c).
For the purposes of subsection (1)(c), a certificate is to be ignored if—
it has expired in accordance with its terms,
it has been withdrawn by the body that issued it, or
it is required to be ignored by reason of provision included in the supplementary code as a result of section 29(9).
This section applies where—
a person is registered in the DVS register, and
an individual makes a request to the person for the provision of digital verification services in respect of which the person is registered.
A public authority may disclose to the person information relating to the individual for the purpose of enabling the person to provide the digital verification services for the individual.
A disclosure of information under this section does not breach—
any obligation of confidence owed by the public authority making the disclosure, or
any other restriction on the disclosure of information (however imposed).
But this section does not authorise a disclosure of information which—
would contravene the data protection legislation (but in determining whether a disclosure would do so, the power conferred by this section is to be taken into account), or
is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
This section does not authorise a public authority to disclose information obtained by the authority otherwise than in connection with the exercise by the authority of functions of a public nature.
This section does not affect a power to disclose information that exists apart from this section.
A public authority may charge a person fees in respect of the disclosure to the person of information under this section.
In this section—
This section applies where the Revenue and Customs disclose personal information to a person under section 45 for the purpose of enabling the person to provide digital verification services for an individual.
The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of the Commissioners for His Majesty’s Revenue and Customs.
Any other person who receives the information, whether directly or indirectly from the person to whom the Revenue and Customs disclose the information, must not further disclose the information, except with the consent of the Commissioners for His Majesty’s Revenue and Customs.
If a person discloses information in contravention of this section, section 19 of the Commissioners for Revenue and Customs Act 2005 (offence of wrongful disclosure) applies in relation to that disclosure as it applies in relation to a disclosure of information in contravention of section 20(9) of that Act.
In this section—
This section applies where the Welsh Revenue Authority discloses personal information to a person under section 45 for the purpose of enabling the person to provide digital verification services for an individual.
The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of the Welsh Revenue Authority.
Any other person who receives the information, whether directly or indirectly from the person to whom the Welsh Revenue Authority discloses the information, must not further disclose the information, except with the consent of the Welsh Revenue Authority.
A person who discloses information in contravention of subsection (2) or (3) commits an offence.
It is a defence for a person charged with an offence under subsection (4) to prove that the person reasonably believed—
that the disclosure was lawful, or
that the information had already lawfully been made available to the public.
A person who commits an offence under subsection (4) is liable—
on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);
on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).
In this section, “personal information” means information relating to a person whose identity—
is specified in the information, or
can be deduced from it.
This section applies where Revenue Scotland discloses personal information to a person under section 45 for the purpose of enabling the person to provide digital verification services for an individual.
The person must not further disclose the information otherwise than for the purpose of providing digital verification services for the individual, except with the consent of Revenue Scotland.
Any other person who receives the information, whether directly or indirectly from the person to whom Revenue Scotland discloses the information, must not further disclose the information, except with the consent of Revenue Scotland.
A person who discloses information in contravention of subsection (2) or (3) commits an offence.
It is a defence for a person charged with an offence under subsection (4) to prove that the person reasonably believed—
that the disclosure was lawful, or
that the information had already lawfully been made available to the public.
A person who commits an offence under subsection (4) is liable—
on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court or a fine (or both);
on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months or a fine not exceeding the statutory maximum (or both);
on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months or a fine not exceeding the statutory maximum (or both);
on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both).
In this section, “personal information” means information relating to a person whose identity—
is specified in the information, or
can be deduced from it.
The Secretary of State must prepare and publish a code of practice about the disclosure of information under section 45.
The code of practice must be consistent with the code of practice prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act (as altered or replaced from time to time).
A public authority must have regard to the code of practice in disclosing information under section 45.
The Secretary of State may from time to time revise and republish the code of practice.
In preparing or revising the code of practice, the Secretary of State must consult—
the Information Commissioner,
the Welsh Ministers,
the Scottish Ministers,
the Department of Finance in Northern Ireland, and
such other persons as the Secretary of State considers appropriate.
The requirement in subsection (5) may be satisfied by consultation undertaken before the coming into force of this section.
The Secretary of State may not publish the first version of the code of practice unless a draft of the code has been laid before, and approved by a resolution of, each House of Parliament.
The Secretary of State may not republish the code of practice following its revision unless—
a draft of the code as revised has been laid before each House of Parliament, and
the 40-day period has expired without either House of Parliament resolving not to approve the draft.
“The 40-day period” means—
the period of 40 days beginning with the day on which the draft is laid before Parliament, or
if the draft is not laid before each House on the same day, the period of 40 days beginning with the later of the days on which it is laid before Parliament.
In calculating the 40-day period, no account is to be taken of any whole days that fall within a period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.
In this section, “public authority” means a person whose functions—
are of a public nature, or
include functions of that nature.
The Secretary of State may designate a mark for use in the course of providing, or offering to provide, digital verification services.
A mark designated under this section must be published by the Secretary of State.
A mark designated under this section may not be used by a person in the course of providing, or offering to provide, digital verification services unless the person is registered in the DVS register in respect of those digital verification services.
The Secretary of State may enforce subsection (3) in civil proceedings for an injunction or, in Scotland, an interdict.
The Secretary of State may by written notice require— to provide the Secretary of State with information that the Secretary of State reasonably requires for the purposes of the exercise of the Secretary of State’s functions under this Part.
an accredited conformity assessment body, or
a person registered in the DVS register,
A notice under this section must state why the information is required for the purposes of the exercise of those functions.
A notice under this section—
may specify or describe particular information or a category of information;
may specify the form in which the information must be provided;
may specify the time at which, or the period within which, the information must be provided;
may specify the place where the information must be provided.
A notice under this section that is given to a person registered in the DVS register must provide information about the consequences under section 41 of failure to comply with the notice.
The Secretary of State may cancel a notice under this section by notice to the person to whom it was given.
A disclosure of information required by a notice under this section does not breach—
any obligation of confidence owed by the person making the disclosure, or
any other restriction on the disclosure of information (however imposed).
But a notice under this section does not require a disclosure of information if the disclosure—
would contravene section 46, 47 or 48,
would contravene the data protection legislation (but in determining whether a disclosure would do so, the duty imposed by the notice is to be taken into account), or
is prohibited by any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
A notice under this section does not require a person to provide the Secretary of State with information in respect of a communication which is made—
between a professional legal adviser and the adviser’s client, and
in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under this Part.
In subsection (8), references to the client of a professional legal adviser include references to a person acting on behalf of the client.
A notice under this section does not require a person to provide the Secretary of State with information if doing so would, by revealing evidence of the commission of an offence, expose the person to proceedings for that offence.
The reference to an offence in subsection (10) does not include an offence under—
section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);
Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).
In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act).
The Secretary of State may make arrangements for a person prescribed by regulations under this section to exercise a relevant function of the Secretary of State (and, where arrangements are made, references in this Part, or in regulations made under this Part, to the Secretary of State are to be read accordingly).
Arrangements under this section may—
provide for the Secretary of State to make payments to the person, and
make provision as to the circumstances in which any such payments are to be repaid to the Secretary of State.
Regulations under this section are subject to the affirmative resolution procedure.
In this section, “relevant function” means a function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under regulations under section 39) other than a power to make regulations.
If a person exercises the function of charging or recovering fees by virtue of arrangements under this section, the person must pay the fees to the Secretary of State, except to the extent that the Secretary of State directs otherwise.
The Secretary of State must prepare and publish reports on the operation of this Part.
The first report must be published within the period of 12 months beginning with the day on which section 28 comes into force.
The reports must be published not more than 12 months apart.
The Table below lists provisions that define or otherwise explain terms defined for the purposes of this Part. Term Provision accredited conformity assessment body section 33 (6) digital verification services section 27 (2) the DVS register section 32 (2) the DVS trust framework section 28 (1) supplementary code section 29 (2) supplementary note section 36 (6)
In section 15 of the Immigration, Asylum and Nationality Act 2006 (penalty for employing a person subject to immigration control), after subsection (7) insert—
In section 34 of the Immigration Act 2014 (requirements which may be prescribed for the purposes of provisions about occupying premises under a residential tenancy agreement)—
in subsection (1)—
in paragraph (a), after “occupiers” insert “, a DVS-registered person or a DVS-registered person of a prescribed description”,
in paragraph (b), after “occupiers” insert “, a DVS-registered person or a DVS-registered person of a prescribed description”, and
in paragraph (c), at the end insert “, including steps involving the use of services provided by a DVS-registered person or a DVS-registered person of a prescribed description”, and
after that subsection insert—
In Schedule 6 to the Immigration Act 2016 (illegal working compliance orders etc), after paragraph 5 insert—
After section 106 of the New Roads and Street Works Act 1991 insert—
Section 166 of the New Roads and Street Works Act 1991, so far as relating to Part 3A of that Act (inserted by subsection (1)), extends to England and Wales.
In section 167 of that Act (Crown application), after subsection (5) insert—
Schedule 1 to this Act inserts Schedule 5A into the New Roads and Street Works Act 1991 (monetary penalties).
The New Roads and Street Works Act 1991 is amended in accordance with subsections (2) to (6).
For the italic heading before section 79 (records of location of apparatus) substitute “Duties in relation to recording and sharing of information about apparatus”.
In section 79—
for the heading substitute “Information in relation to apparatus”;
in subsection (1), for paragraph (c) substitute—;
after subsection (1A) (as inserted by section 46(2) of the Traffic Management Act 2004) insert—;
omit subsection (3);
in subsection (3A) (as inserted by section 46(4) of the Traffic Management Act 2004)—
for “to (3)” substitute “and (2A)”;
for “subsection (1)” substitute “this section”;
after subsection (3A) insert—;
in subsection (4)(a), omit “not exceeding level 5 on the standard scale”;
after subsection (6) insert—
For section 80 (duty to inform undertakers of location of apparatus) substitute—
Before section 81 (duty to maintain apparatus) insert—.
In section 104 (regulations)—
in subsection (1)—
after “Part” insert “, except in section 79,”;
omit from “, which” to the end;
after subsection (1) insert—;
in subsection (2), after “Regulations” insert “made by the Secretary of State”;
after subsection (2) insert—
In consequence of the provision made by subsection (4), omit section 47 of the Traffic Management Act 2004.
In Schedule 7B to the Government of Wales Act 2006 (general restriction on competence of Senedd Cymru), in paragraph 11(6)(b) (exceptions to restrictions relating to Ministers of the Crown), before sub-paragraph (i) insert—.
The Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) is amended in accordance with subsections (2) to (4).
In Article 2 (interpretation), in paragraph (2)—
after the definition of “in” insert—;
in the definition of “prescribed”—
for “means” substitute “means—”;
the words from “prescribed by” to the end become paragraph (a);
at the beginning of that paragraph insert “except in Articles 39 and 40 and a NUAR provision,”;
in Article 40 and a NUAR provision, prescribed by regulations made by the Secretary of State;
After Article 45 insert—
In Article 59 (regulations)—
before paragraph (1) insert—;
in paragraph (1), after “Order” insert “, other than regulations made by the Secretary of State,”;
before paragraph (2) insert—
Article 59(A2) of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (inserted by subsection (4)(a)) is revoked on the coming into operation of Article 59(1A) of that Order (as inserted by Article 28(3) of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1))).
Schedule 2 to this Act inserts Schedule 2ZA into the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (monetary penalties).
The Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) is amended in accordance with subsections (2) to (5).
For the italic heading before Article 39 (records of location of apparatus) substitute “Duties in relation to recording and sharing of information about apparatus”.
In Article 39—
for the heading substitute “Information in relation to apparatus”;
in paragraph (1), for sub-paragraph (c) substitute—;
after paragraph (1A) (as inserted by Article 22(2) of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1))) insert—;
omit paragraph (3);
in paragraph (3A) (as inserted by Article 22(4) of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1)))—
for “to (3)” substitute “and (2A)”;
for “paragraph (1)” substitute “this Article”;
after paragraph (3A) insert—;
after paragraph (5) insert—
For Article 40 (duty to inform undertakers of location of apparatus) substitute—
Before Article 41 (duty to maintain apparatus) insert—.
As a consequence of the provision made by subsection (4), omit Article 23 of the Street Works (Amendment) (Northern Ireland) Order 2007 (S.I. 2007/287 (N.I. 1)).
A power of the Secretary of State to make regulations under paragraph (1) or (2) of Article 39 of the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) (by virtue of subsection (3)(g)) includes power to amend or revoke any provision of the Street Works (Records) Regulations (Northern Ireland) 2004 (S.R. (N.I.) 2004 No. 276) made under the paragraph concerned.
A requirement to consult under a provision inserted into the New Roads and Street Works Act 1991 by section 56 or 57 may be satisfied by consultation undertaken before the day on which this Act is passed.
A requirement to consult under a provision inserted into the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)) by section 58 or 59 may be satisfied by consultation undertaken before the day on which this Act is passed.
The Births and Deaths Registration Act 1953 is amended as follows.
For section 25 (provision of registers, etc, by Registrar General) substitute—
Omit the following provisions—
section 26 (quarterly returns to be made by registrar to superintendent registrar);
section 27 (quarterly returns by superintendent registrar to Registrar General);
section 28 (custody of registers, etc).
In the Registration Service Act 1953, after section 11 insert—
The Births and Deaths Registration Act 1953 is amended as follows.
After section 38A insert—
In section 39A (regulations made by the Minister: further provisions), after subsection (5) insert—
The repeal of section 28 of the Births and Deaths Registration Act 1953 by section 61 above does not affect—
the requirement under section 28(2) of that Act for every superintendent registrar (“S”) to keep with the records of S’s office any registers of live-births or of deaths which are in S’s custody immediately before the coming into force of that repeal, or
the requirement under section 28(4) of that Act for the Registrar General to keep in the General Register Office—
any certified copies or information sent or provided under section 27 of that Act (quarterly returns by superintendent registrar to Registrar General), or
any registers of still-births that were forwarded to the Registrar General before the coming into force of that repeal.
Any register of live-births or of deaths which, immediately before the coming into force of this section, is in the custody of a registrar and is unfilled is, as soon as is reasonably practicable after the coming into force of this section, to be delivered to the superintendent registrar (“S”) to be kept by S with the records of S’s office.
Any register of still-births which, immediately before the coming into force of this section, is in the custody of a registrar and is unfilled is, as soon as is reasonably practicable after the coming into force of this section, to be forwarded to the Registrar General to be kept in the General Register Office in such order and manner as the Registrar General thinks fit.
The Registrar General may dispose of—
any certified copies held by the Registrar General of entries in any register of still-births forwarded to the Registrar General under section 28(3) of the Births and Deaths Registration Act 1953 or subsection (3) above, or
any information contained in those entries which is held by the Registrar General in electronic form by virtue of section 27 of that Act.
Where, at any time during the period mentioned in subsection (6), a copy has been kept otherwise than in hard copy form of any register of births or register of deaths kept for a sub-district under the Births and Deaths Registration Act 1953—
that copy is to be treated, on and after the day on which section 61 of this Act comes into force, as the register kept for the sub-district for the purposes of that Act,
on and after that day, the register is to be treated for the purposes of section 25(3) of that Act as having been kept in the form in which the copy was kept,
where before that day a person signed any entry in the register, the entry is to continue, on and after that day, to be regarded for the purposes of that Act as having been signed by the person, and
the Registrar General may dispose of—
any certified copies held by the Registrar General of entries in the register, or
any information contained in those entries which is held by the Registrar General in electronic form by virtue of section 27 of that Act.
The period referred to in subsection (5) is the period—
beginning with 1 July 2009, and
ending immediately before the day on which section 61 comes into force.
Expressions used in this section and in the Births and Deaths Registration Act 1953 have the same meaning in this section as in that Act.
Schedule 3 contains minor and consequential amendments.
In this Chapter—
“the 2018 Act” means the Data Protection Act 2018;
can be deduced from it;
In Article 4 of the UK GDPR (definitions)—
the existing text becomes paragraph 1, and
after that paragraph insert—
In consequence of the amendment made by subsection (1)(a), in section 6 of the 2018 Act (meaning of “controller”), for “4(7)” substitute “4(1)(7)”.
Article 4 of the UK GDPR (definitions) is amended as follows.
In point (11) of paragraph 1 (definition of “consent”), at the end insert “(and see paragraphs 6 and 7 of this Article)”.
After paragraph 5 (inserted by section 67 of this Act) insert—
The 2018 Act is amended as follows.
In section 33 (definitions), after subsection (1) insert—
In section 34(2) (overview of Chapter 2 of Part 3), after paragraph (a) (but before the “and” at the end of that paragraph) insert—.
After section 40 insert—
In section 206 (index of defined expressions), in the Table, in the entry for “consent”—
after “consent” insert “(to processing of personal data)”,
for “Part” substitute “Parts 3 and”, and
for “section” substitute “sections 33, 40A and”.
The UK GDPR is amended in accordance with subsections (2) to (5).
In Article 6(1) (lawful processing)—
in point (e)—
after “task” insert “of the controller”, and
after “or” insert “a task carried out”,
after that point insert—, and
in the words after point (f), for “Point (f)” substitute “Points (ea) and (f)”.
In Article 6(3) (basis for processing etc), in the last subparagraph, in the first sentence—
after “task” insert “of the controller”, and
after “interest or” insert “a task carried out”.
In Article 6, at the end insert—
In Article 21(1) (right to object), after “point (e)” insert “, (ea)”.
Schedule 4 to this Act inserts Annex 1 to the UK GDPR.
In section 8 of the 2018 Act (lawfulness of processing: public interest etc), omit “the controller’s”.
In the provisions listed in subsection (9)—
for “gateway” substitute “gateways”, and
for “were omitted” substitute “disapplied only the gateway in point (ea) (recognised legitimate interests)”.
The provisions are—
section 40(8) of the Freedom of Information Act 2000 (personal data which is exempt information);
section 38(5A) of the Freedom of Information (Scotland) Act 2002 (asp 13) (personal data which is exempt information);
regulation 13(6) of the Environmental Information Regulations 2004 (S.I. 2004/3391) (restriction on disclosure of personal data);
regulation 11(7) of the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520) (restriction on disclosure of personal data);
regulation 45(1E) of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042) (personal data which is sensitive information);
regulation 39(1E) of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494) (personal data which is sensitive information);
regulation 9(9) of the INSPIRE Regulations 2009 (S.I. 2009/3157) (limitation of public access to personal data included in a spatial data set);
regulation 10(8) of the INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440) (limitation of public access to personal data included in a spatial data set).
The UK GDPR is amended in accordance with subsections (2) to (5).
In Article 5(1)(b) (purpose limitation)—
after “collected” insert “(whether from the data subject or otherwise)”,
after “further processed” insert “by or on behalf of a controller”, and
for the words from “those purposes;” to “initial purposes” substitute “the purposes for which the controller collected the data”.
In Article 5, at the end insert—
In Article 6 (lawfulness of processing), omit paragraph 4.
After Article 8 insert—
Schedule 5 to this Act inserts Annex 2 to the UK GDPR.
The 2018 Act is amended in accordance with subsections (8) to (10).
In section 36(1) (the second data protection principle)—
in paragraph (a), for “on any occasion” substitute “(whether from the data subject or otherwise)”, and
in paragraph (b)—
after “processed” insert “by or on behalf of a controller”, and
for “it was collected” substitute “the controller collected it”.
In section 87(1) (the second data protection principle)—
in paragraph (a), for “on any occasion” substitute “(whether from the data subject or otherwise)”, and
in paragraph (b)—
after “processed” insert “by or on behalf of a controller”, and
for “it was collected” substitute “the controller collected it”.
In paragraph 1 of Schedule 2 (exemptions etc from the UK GDPR: provisions to be adapted or restricted), omit sub-paragraph (b)(ii).
The UK GDPR is amended in accordance with subsections (2) to (5).
In Article 6(3) (lawfulness of processing: basis in domestic law)—
in the first subparagraph, omit “and (e)”,
The basis for the processing referred to in point (e) of paragraph 1 must be laid down by domestic law or relevant international law (see section 9A of the 2018 Act).
in the last subparagraph, in the last sentence, after “domestic law” insert “or relevant international law”.
In Article 8A(3)(e) (purpose limitation: further processing necessary to safeguard an objective listed in Article 23(1)) (inserted by section 71 of this Act), at the end insert “or by relevant international law (see section 9A of the 2018 Act)”.
In Article 9 (processing of special categories of personal data)—
in paragraph 2(g) (substantial public interest), after “domestic law” insert “, or relevant international law,”, and
in paragraph 5, before point (a) insert—.
In Article 10 (processing of personal data relating to criminal convictions and offences)—
in paragraph 1, after “domestic law” insert “, or relevant international law,”, and
in paragraph 2, before point (a) insert—.
The 2018 Act is amended in accordance with subsections (7) and (8).
Before section 10 (and the italic heading before that section) insert—
Before Schedule 1 insert—
In paragraph 23 of Schedule 1 to the 2018 Act (processing of special categories of personal data: elected representatives responding to requests), in sub-paragraph (4), for “fourth day after” substitute “period of 30 days beginning with the day after”.
In Chapter 2 of the UK GDPR, after Article 11 insert—
The 2018 Act is amended in accordance with subsections (3) to (9).
In section 33 (definitions of expressions used in Part 3), after subsection (6) insert—
In section 35 (the first data protection principle)—
in subsection (6)(b) (power to omit conditions added to Schedule 8 by regulations), after “by”, in the first place it occurs, insert “varying or”, and
in subsection (8) (definition of “sensitive processing”), for “section” substitute “Part”.
After section 42 insert—
In section 84 (definitions of expressions used in Part 4), after subsection (6) insert—
In section 86 (the first data protection principle)—
in subsection (3)(b) (power to omit conditions added to Schedule 10 by regulations), after “by”, in the first place it occurs, insert “varying or”, and
in subsection (7) (definition of “sensitive processing”), for “section” substitute “Part”.
After section 91 insert—
In section 206 (index of defined expressions), in the Table, at the appropriate place insert— “sensitive processing (in Parts 3 and 4) sections 35 and 86”.
The Investigatory Powers Act 2016 is amended in accordance with subsections (11) to (13).
In section 202(4) (restrictions on use of class BPD warrants: definitions), omit the definition of “sensitive personal data” and insert—
After that section insert—
In section 267(3) (regulations subject to the affirmative procedure), after paragraph (e) insert—.
The 2018 Act is amended as follows.
In section 53 (manifestly unfounded or excessive requests by the data subject under Part 3)—
after subsection (4) insert—,
in subsection (5), for “subsection (4)” substitute “this section”, and
after subsection (5) insert—
In section 54(1) (meaning of “applicable time period”), for “and 48(2)(b)” substitute “, 48(2)(b) and 53(7)”.
The UK GDPR is amended in accordance with subsections (2) and (3).
In Article 12 (transparent information, communication and modalities for the exercise of rights of the data subject)—
in paragraph 3—
for “within one month of receipt of the request” substitute “before the end of the applicable time period (see Article 12A)”, and
omit the second and third sentences,
in paragraph 4, for “without delay and at the latest within one month of receipt of the request” substitute “without undue delay, and in any event before the end of the applicable time period (see Article 12A),”, and
in paragraph 6—
after “may” insert —, and
at the end insert , and
After Article 12 insert—
The 2018 Act is amended in accordance with subsections (5) to (7).
In section 45(5) (right of access by the data subject), after “delay” insert “and in any event before the end of the applicable time period (as to which see section 54)”.
In section 54 (meaning of “applicable time period” for responding to data subjects’ requests)—
in subsection (1), after “45(3)(b)” insert “and (5)”,
in subsection (2)—
for “1 month, or such longer period as may be specified in regulations,” substitute “one month”, and
at the end insert “, subject to subsection (3A)”,
after subsection (3) insert—, and
omit subsections (4) to (6).
In section 94 (right of access under Part 4)—
in subsection (14), for the definition of “the applicable time period” substitute—, and
after subsection (14) insert—
In Article 13 of the UK GDPR (information to be provided where personal data is collected from the data subject)—
in paragraph 4, for “shall not apply where and insofar as” substitute “do not apply to the extent that”, and
at the end insert—
In Article 14 of the UK GDPR (information to be provided where personal data is not obtained from the data subject)—
in paragraph 5—
for “shall not apply where and insofar as” substitute “do not apply to the extent that”,
omit point (b),
omit the “or” at the end of point (c),
in point (d), omit “where”, and
after that point insert—, and
at the end insert—
In Article 15 of the UK GDPR (right of access by the data subject)—
after paragraph 1 insert—, and
in paragraph 3, after “processing” insert “to which the data subject is entitled under paragraph 1”.
The 2018 Act is amended in accordance with subsections (3) and (4).
In section 45 (law enforcement processing: right of access by the data subject), after subsection (2) insert—
In section 94 (intelligence services processing: right of access by the data subject), after subsection (2) insert—
The amendments made by this section are to be treated as having come into force on 1 January 2024.
The 2018 Act is amended as follows.
In section 43 (overview and scope of Chapter 3 of Part 3: rights of the data subject in connection with law enforcement processing)—
in subsection (1)(a), for “section 44” substitute “sections 44 and 45A”, and
in subsection (1)(b), for “section 45” substitute “sections 45 and 45A”.
For the italic heading before section 44 substitute—.
In the heading of section 44, omit “Information:”.
Omit the italic heading before section 45.
After that section insert—
In section 51 (exercise of rights through the Commissioner)—
in subsection (1), after paragraph (b) (but before the “or” at the end of that paragraph) insert—,
in subsection (2), after paragraph (a) insert—,
in subsection (4), after paragraph (a) insert—, and
in subsection (6), after “(a)” insert “, (aa)”.
For Article 22 of the UK GDPR (automated individual decision-making, including profiling) substitute—
The 2018 Act is amended in accordance with subsections (3) to (5).
For sections 49 and 50 (law enforcement processing: automated individual decision-making) substitute—
In section 96 (intelligence services processing: right not to be subject to automated decision-making)—
in subsection (1), for “solely on” substitute “on entirely”,
in subsection (3), after “section” insert “and section 97”, and
at the end insert—
In section 97 (intelligence services processing: right to intervene in automated decision-making)—
in subsection (1)(a), for “solely on” substitute “on entirely”,
in subsection (4)(b), for “solely on” substitute “on entirely”, and
omit subsection (6).
Schedule 6 to this Act contains minor and consequential amendments.
Article 25 of the UK GDPR (data protection by design and by default) is amended as follows.
After paragraph 1 insert—
In paragraph 3, for “1 and 2” substitute “1 to 2”.
At the end insert—
In section 62 of the 2018 Act (logging of law enforcement processing)—
in subsection (2)(a), omit “justification for, and”, and
in subsection (3)(a), omit “justification for, and”.
In Article 41 of the UK GDPR (monitoring of approved codes of conduct)—
in paragraph 4, omit the words from “, including suspension” to the end, and
after that paragraph insert—
The 2018 Act is amended as follows.
In section 55(1) (overview and scope of provisions about controllers and processors), at the end insert—
In section 56 (general obligations of the controller), at the end insert—
In section 59 (processors), after subsection (7) insert—
In section 66 (security of processing), at the end insert—
After section 71 insert—
Schedule 7 amends Chapter 5 of the UK GDPR (general processing and transfers of personal data to third countries and international organisations).
Schedule 8 amends Chapter 5 of Part 3 of the 2018 Act (law enforcement processing and transfers of personal data to third countries and international organisations).
In Schedule 9—
Part 1 contains minor and consequential amendments, and
Part 2 contains transitional provision.
The UK GDPR is amended in accordance with subsections (2) to (4).
After Chapter 8 insert—
In the heading of Chapter 9, after “relating to” insert “other”.
Omit Article 89 (safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes).
The 2018 Act is amended in accordance with subsections (6) and (7).
Omit section 19 (processing for archiving, research and statistical purposes: safeguards) and the italic heading before it.
In section 41(1) (safeguards: archiving), for “necessary” substitute “carried out”.
In the UK GDPR—
in Article 5(1)(e) (storage limitation), for “Article 89(1)” to “data subject” substitute “Article 84B”,
in Article 9(2)(j) (processing of special categories of personal data), for “in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act)” substitute “, is carried out in accordance with Article 84B and is”,
in Article 17(3)(d) (right to erasure), for “Article 89(1)” substitute “Article 84B”, and
in Article 21(6) (right to object), omit “pursuant to Article 89(1)”.
In the 2018 Act—
in section 24(4) (manual unstructured data held by FOI public authorities), after paragraph (b) insert—,
in paragraph 4(b) of Schedule 1 (special categories of personal data and criminal convictions etc data: research etc), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”, and
in Schedule 2 (exemptions etc from the UK GDPR)—
in paragraph 27(3)(a) (research and statistics), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”, and
in paragraph 28(3) (archiving), for “Article 89(1) of the UK GDPR (as supplemented by section 19)” substitute “Article 84B of the UK GDPR”.
In section 279(2) of the Mental Health (Care and Treatment) (Scotland) Act 2003 (asp 13) (information for research), for “Article 89(1) of the UK GDPR (archiving in the public interest, scientific or historical research and statistics)” substitute “Article 84A of the UK GDPR (research, archives and statistics)”.
The 2018 Act is amended in accordance with subsections (2) to (10).
In section 26(2)(f) (national security and defence exemption), before sub-paragraph (i) insert—.
In section 44 (controller’s general duties to provide information to data subject)—
in subsection (4), omit paragraph (d) (grounds for restricting information provided: national security),
in subsection (5), after “restricted” insert “under subsection (4)”, and
in subsection (7)(a), after “subsection (2)” insert “in reliance on subsection (4)”.
In section 45 (right of access by the data subject)—
in subsection (4), omit paragraph (d) (grounds for restricting information provided: national security),
in subsection (5), after “restricted” insert “under subsection (4)”, and
in subsection (7)(a), after “subsection (1)” insert “in reliance on subsection (4)”.
In section 48 (requests by data subject for rectification or erasure of personal data)—
in subsection (3), omit paragraph (d) (grounds for restricting information provided: national security),
in subsection (4)—
for “(1)” substitute “(1)(b)(i)”, and
after “restricted” insert “under subsection (3)”, and
in subsection (6)(a), after “subsection (1)(b)(i)” insert “in reliance on subsection (3)”.
In section 68(7) (communication of a personal data breach to the data subject: grounds for restricting information provided), omit paragraph (d) (national security).
In Chapter 6 of Part 3 (law enforcement processing: supplementary), before section 79 insert—
In section 79 (national security: certificate)—
omit subsections (1) to (3),
after subsection (3) insert—,
in subsection (4), for “subsection (1)” substitute “subsection (3A)—,
in subsection (5), for “subsection (1)” substitute “subsection (3A)”,
in subsection (7)—
for “a restriction falls within a general description in a certificate issued under subsection (1)” substitute “a certificate under subsection (3A) which identifies the personal data to which it applies by means of a general description applies to any personal data”, and
for “the restriction does not fall within that description” substitute “the certificate does not apply to the personal data in question”,
in subsection (8)—
for “the restriction” substitute “the certificate”, and
for “to fall within the general description” substitute “so to apply”,
in subsection (10), for “subsection (1)” substitute “subsection (3A)”,
in subsection (11), for “subsection (1)” substitute “subsection (3A)”,
in subsection (12), for “subsection (1)” substitute “subsection (3A)”, and
omit subsection (13).
In section 110(2) (intelligence services processing: national security)—
in paragraph (a), after “Chapter 2” insert “of this Part”,
in paragraph (b), after “Chapter 3” insert “of this Part”, and
in paragraph (c), after “Chapter 4” insert “of this Part”.
In section 186(3) (data subject’s rights etc: exceptions), after paragraph (c) insert—.
In the provisions listed in subsection (12), for “subsection (4) of that section” substitute “section 45(4) or 78A of that Act”.
The provisions are—
section 40(4A)(b) and (5B)(d) of the Freedom of Information Act 2000 (personal data which is exempt information);
section 38(3A)(b) of the Freedom of Information (Scotland) Act 2002 (asp 13) (personal data which is exempt information);
regulation 13(3A)(b) and (5B)(d) of the Environmental Information Regulations 2004 (S.I. 2004/3391) (restriction on disclosure of personal data);
regulation 11(4A)(b) of the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520) (restriction on disclosure of personal data);
regulation 45(1C)(b) of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (S.I. 2005/2042) (personal data which is sensitive information);
regulation 39(1C)(b) of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (S.S.I. 2005/494) (personal data which is sensitive information).
Part 4 of the 2018 Act (intelligence services processing) is amended as follows.
In section 82 (processing to which Part 4 applies)—
before subsection (1) insert—,
in subsection (1)—
after “applies” insert “only”,
in paragraph (a), for “the processing by an intelligence service” substitute “processing”, and
in paragraph (b), for “the processing by an intelligence service” substitute “processing”,
after subsection (2) insert—, and
after subsection (3) insert—
After section 82 insert—
The 2018 Act is amended in accordance with subsections (2) to (9).
In section 1(5) (overview: Part 4), at the end insert “(and certain processing carried out by competent authorities jointly with the intelligence services)”.
In section 29 (processing to which Part 3 applies), after subsection (1) insert—
In section 83 (meaning of “controller” and “processor” in Part 4)—
before subsection (1) insert—,
in subsection (1), for the words before paragraph (a) substitute “This subsection is satisfied by a person who—”, and
in subsection (2), for “intelligence service on which” substitute “person on whom”.
In section 84 (other definitions)—
after subsection (2) insert—, and
before subsection (7) insert—
In section 104(1) (joint controllers), for “intelligence services” substitute “controllers”.
In section 202(1)(a)(i) (proceedings in the First-tier Tribunal: contempt) after “79,” insert “82E,”.
In section 203(1) (Tribunal Procedure Rules), after “79,” insert “82E,”.
In section 206 (index of defined expressions), in the Table—
in the entry for “competent authority”—
for “Part 3” substitute “Parts 3 and 4”, and
for “section 30” substitute “sections 30 and 82”, and
designation notice (in Part 4) section 84 qualifying competent authority (in Part 4) section 82 withdrawal notice (in Part 4) section 84
In section 199(2)(a) of the Investigatory Powers Act 2016 (bulk personal datasets: meaning of “personal data”), after “section 82(1) of that Act” insert “by an intelligence service”.
The 2018 Act is amended in accordance with subsections (2) to (4).
Omit section 2(2) (duty of Commissioner when carrying out functions).
After section 120 insert—
In section 139 (reporting to Parliament), after subsection (1) insert—
The Information Commissioner must prepare and publish a strategy in accordance with section 120C of the 2018 Act before the end of the period of 18 months beginning with the day on which this section comes into force.
The 2018 Act is amended in accordance with subsections (2) to (6).
After section 124 insert—
In section 125 (approval of codes prepared under sections 121 to 124)—
in the heading, for “124” substitute “124A”,
in subsection (1), for “or 124” substitute “, 124 or 124A”,
in subsection (3), for “or 124” substitute “, 124 or 124A”,
for subsection (5) substitute—, and
in subsection (9), for “or 124” substitute “, 124 or 124A”.
In section 126 (publication and review of codes issued under section 125(4)), in subsection (4), for “or 124(2)” substitute “, 124(2) or 124A(3)”.
Omit section 128 (other codes of practice).
In section 129 (consensual audits), in subsection (3), for “128” substitute “124A”.
In section 19AC of the Registration Service Act 1953 (code of practice), in subsection (11), for “128” substitute “124A”.
In the Statistics and Registration Service Act 2007—
in section 45 (information held by HMRC), in subsection (4A), for “128” substitute “124A”,
in section 45A (information held by other public authorities), in subsection (8), for “128” substitute “124A”,
in section 45E (further provisions about powers in sections 45B, 45C and 45D), in subsection (16), for “128” substitute “124A”, and
in section 53A (disclosure by the Board to devolved administrations), in subsection (9), for “128” substitute “124A”.
In the Digital Economy Act 2017—
in section 43 (code of practice), in subsection (13), for “128” substitute “124A”,
in section 52 (code of practice), in subsection (13), for “128” substitute “124A”,
in section 60 (code of practice), in subsection (13), for “128” substitute “124A”, and
in section 70 (code of practice), in subsection (15), for “128” substitute “124A”.
In the 2018 Act, after section 124A (inserted by section 92 of this Act) insert—
The 2018 Act is amended in accordance with subsections (2) and (3).
In section 135 (manifestly unfounded or excessive requests made to the Commissioner)—
before subsection (1) insert—,
in subsection (1) omit the words from the beginning to “excessive,”,
after subsection (1) insert—,
in subsection (3), for “(1)” substitute “(A1)”,
omit subsection (4), and
after that subsection insert—
In section 136(1) (guidance about fees), omit paragraph (b) and the “or” before it.
In Article 57 of the UK GDPR (Commissioner’s tasks), omit paragraph 4.
In the 2018 Act, after section 139 insert—.
The 2018 Act is amended in accordance with subsections (2) and (3).
Omit section 141 (notices from the Commissioner).
After that section insert—
In Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) (Commissioner’s enforcement powers), in paragraph 1(b), for “141” substitute “141A”.
The 2018 Act is amended as follows.
In section 142 (information notices)—
in subsection (1)—
in paragraph (a), after “information” insert “or documents”, and
in paragraph (b), after “information” insert “or documents”,
in subsection (2)(b), after “information” insert “or documents”,
in subsection (3)—
in paragraph (a), after “information”, in both places it occurs, insert “or documents”,
in paragraph (b), after “information” insert “or documents”,
in paragraph (c), after “information” insert “or documents”, and
in paragraph (d), after “information” insert “or documents”,
in subsection (5), after “information”, in the second place it occurs, insert “or documents”,
in subsection (6), after “information”, in the second place it occurs, insert “or documents”, and
in subsection (7)—
in paragraph (a), for “is” substitute “or documents are”, and
in the words after paragraph (b), after “information” insert “or documents”.
In section 143 (information notices: restrictions)—
in subsection (1)(b)(ii), for “is” substitute “or documents are”,
in subsection (2), after “information”, in the second place it occurs, insert “or documents”,
in subsection (3), for “in respect” substitute “or documents to the extent that requiring the person to do so would result in the disclosure”,
in subsection (4), for “in respect” substitute “or documents to the extent that requiring the person to do so would result in the disclosure”, and
in subsection (6), after “information”, in the second place it occurs, insert “or documents”.
In section 145 (information orders)—
in subsection (2)—
in paragraph (a), after “information”, in the first place it occurs, insert “or documents”, and
in paragraph (b), after “information” insert “or documents”, and
in subsection (3)—
in paragraph (a), after “information” insert “or documents”,
in paragraph (b), after “information” insert “or documents”, and
in paragraph (c), after “information” insert “or documents”.
In section 148(1) (destroying or falsifying information and documents etc), in paragraph (a), after “information”, in the second place it occurs, insert “or a document”.
In section 160 (guidance about regulatory action), in subsection (3)(a), for “is” substitute “or documents are”.
In Schedule 17 (review of processing of personal data for the purposes of journalism), in paragraph 2(2) (information notices)—
in paragraph (a), for “is” substitute “or documents are”, and
in the words after paragraph (b), after “information” insert “or documents”.
The 2018 Act is amended as follows.
In section 146 (assessment notices)—
in subsection (2), after paragraph (i), insert—,
after subsection (3) insert—,
after subsection (11) insert—, and
in subsection (12), before the definition of “domestic premises” insert—.
After section 146 insert—
In section 155 (penalty notices), in subsection (1)—
omit the “or” at the end of paragraph (a), and
at the end of paragraph (b) insert , or
In section 160 (guidance about regulatory action), in subsection (4), after paragraph (a) insert—.
In section 147 of the 2018 Act (assessment notices: restrictions), in subsection (6), omit paragraph (b) and the “or” before it.
The 2018 Act is amended as follows.
After section 148 insert—
In section 149 (enforcement notices), in subsection (9)(b)—
after “an assessment notice” insert “, an interview notice”, and
after “147” insert “, 148A, 148B”.
In section 155 (penalty notices), in subsection (1)(b), after “assessment notice” insert “, an interview notice”.
In section 157 (maximum amount of penalty), in subsection (4), after “assessment notice” insert “, an interview notice”.
In section 160 (guidance about regulatory action)—
in subsection (1), after paragraph (b) insert—, and
after subsection (5) insert—
In section 162 (rights of appeal), in subsection (1), after paragraph (b) insert—.
In section 164 (applications in respect of urgent notices)—
in subsection (1), after “assessment notice” insert “, an interview notice”, and
in subsection (5), after paragraph (b) (but before the “and” at the end of that paragraph) insert—.
In section 181 (interpretation of Part 6), at the appropriate place, insert—
““interview notice” has the meaning given in section 148A;”.
In section 196 (penalties for offences), in subsection (2), after “148,” insert “148C,”.
interview notice (in Part 6) section 181
In Schedule 17 (review of processing of personal data for the purposes of journalism)—
after paragraph 3 insert—, and
in paragraph 4 (applications in respect of urgent notices)—
for “or assessment notice” substitute “, assessment notice or interview notice”,
for “or 3(2)(a)” substitute “, 3(2)(a) or 3A(2)(a)”, and
for “or 146(8)(a)” substitute “, 146(8)(a) or 148A(8)(a)”.
The 2018 Act is amended as follows.
In paragraph 2 of Schedule 16 (notice of intent to impose penalty), omit sub-paragraphs (2) and (3).
In paragraph 4 of that Schedule (giving a penalty notice)—
This paragraph applies where the Commissioner gives a notice of intent to a person. Within the period of 6 months beginning when the notice is given, or as soon as reasonably practicable thereafter, the Commission must give to the person—
in sub-paragraph (1)—
at the beginning, insert “But”, and
after “penalty notice” insert “to the person”, and
in sub-paragraph (2), for “a person” substitute “the person”.
In section 160 (guidance about regulatory action), in subsection (7), after paragraph (d) insert—
The 2018 Act is amended as follows.
In section 139 (reporting to Parliament), before subsection (3) insert—
In the italic heading before section 160, at the end insert “and report”.
After section 161 insert—
The 2018 Act is amended in accordance with subsections (2) and (3).
Before section 165 (but after the italic heading before it) insert—
In section 165 (complaints by data subjects to the Commissioner)—
omit subsection (1), and
in subsection (2), after “infringement of” insert “the UK GDPR or”.
The UK GDPR is amended in accordance with subsections (5) and (6).
In Article 57 (Commissioner’s tasks)—
in paragraph 1, omit point (f), and
omit paragraph 2.
Omit Article 77 (right to lodge a complaint with the Commissioner).
Schedule 10 to this Act contains minor and consequential amendments.
The 2018 Act is amended as follows.
For the italic heading before section 180 substitute—.
After section 180 insert—
Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) (Commissioner’s enforcement powers) is amended as follows.
In paragraph 1 (provisions of the 2018 Act applied for enforcement purposes)—
after paragraph (g) insert—, and
after paragraph (i) insert—.
In paragraph 4(2) (modification of section 143 (information notices: restrictions))—
in paragraph (b), for “or 148” substitute “, 148 or 148C”, and
in paragraph (c), after “148” insert “or 148C”.
In paragraph 6 (modification of section 146 (assessment notices)), in sub-paragraph (2)—
for paragraph (b) substitute—,
in paragraph (c), for “subsections (7), (8), (9) and (10)” substitute “subsections (3A), (7), (8), (9), (10) and (11A)”, and
in paragraph (d), for “or 148” substitute “, 148 or 148C”.
After paragraph 6 insert—
After paragraph 7 insert—
In paragraph 12 (modification of Schedule 15 (powers of entry and inspection)), in sub-paragraph (2), in the substituted paragraph (a), for “or 148” substitute “, 148 or 148C”.
In paragraph 13 (modification of section 155 (penalty notices)), in sub-paragraph (3)(c), for “for “data subjects”” there were substituted “for the words from “data subjects” to the end”.
Omit paragraph 21 (modification of section 182 (regulations and consultation)) and the heading before it.
In paragraph 22 (modification of section 196 (penalties for offences)), in sub-paragraph (2)(b)—
after “148”, in the first place it occurs, insert “, 148C”, and
for “or 148” substitute “, 148 or 148C”.
The 2018 Act is amended in accordance with subsections (2) to (5).
After section 183 insert—
Before section 184 (and the italic heading before it) insert—
In section 186 (data subject’s rights and other prohibitions and restrictions)—
for the heading substitute “Protection of data subject’s rights”,
in subsection (1) omit “, except as provided by or under the provisions listed in subsection (3)”,
after subsection (2) insert—, and
in subsection (3)—
for “provisions providing exceptions” substitute “provisions referred to in subsection (2A)(b)”, and
omit paragraph (c) (and the “and” after it).
After section 186 insert—
In section 5 of the European Union (Withdrawal) Act 2018 (exceptions to savings and incorporation), in subsection (A3)(a)—
for “section” substitute “sections 183A and”,
for “(data subject’s rights and other prohibitions and restrictions)” substitute “(protection of prohibitions, restrictions and data subject’s rights)”, and
at the end insert “(and see also section 183B(3) of that Act)”.
Subsections (3), (5) and (6)(c) are to be treated as having come into force on 1 January 2024.
In the UK GDPR, after Chapter 9 insert—
In section 3(9) of the 2018 Act (definition of “data protection legislation”), in paragraph (d), after “Act” insert “or the UK GDPR”.
Schedule 11 contains further minor provision about data protection.
In this Chapter, “the PEC Regulations” means the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426).
Regulation 2 of the PEC Regulations (interpretation) is amended as follows.
In paragraph (1)—
in the definition of “call”, at the end insert “, and a reference to making a call includes a reference to attempting to establish such a connection”,
in the definition of “communication”—
for “exchanged or conveyed between” substitute “transmitted to”, and
for “conveyed”, in the second place it occurs, substitute “transmitted”, and
at the appropriate place insert—.
After paragraph (1) insert—
In paragraph (4) omit “, without prejudice to paragraph (3),”.
After that paragraph insert—
In regulation 5A of the PEC Regulations (personal data breach)—
in paragraph (2), after “delay” insert “and, where feasible, not later than 72 hours after having become aware of it”, and
after paragraph (3) insert—
In regulation 5C of the PEC Regulations (personal data breach: fixed monetary penalty)—
in paragraph (4)(f), for “from the service of the notice of intent” substitute “beginning when the notice of intent is served”, and
in paragraph (5), for “21 days of receipt of the notice of intent” substitute “the period of 21 days beginning when the notice of intent is received”.
In Article 2 of Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications (notification to the Commissioner)—
in paragraph 2—
in the first subparagraph, for the words from “no” to “feasible” substitute “without undue delay and, where feasible, not later than 72 hours after having become aware of it”,
in the second subparagraph, after “shall” insert “, subject to paragraph 3,”, and
This paragraph is to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.
for paragraph 3 substitute—
The PEC Regulations are amended in accordance with subsections (2) and (3).
For regulation 6 (storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user) substitute—
After regulation 6 insert—
Schedule 12 to this Act inserts Schedule A1 to the PEC Regulations.
A requirement to consult under regulation 6A of the PEC Regulations (inserted by subsection (3) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
In regulation 16A of the PEC Regulations (emergency alerts), in paragraph (6), for the words from “7 days” to “paragraph (3)(b)” substitute “the period of 7 days beginning with the day on which the time period specified by the relevant public authority pursuant to paragraph (3)(b) expires”.
Regulation 22 of the PEC Regulations (use of electronic mail for direct marketing purposes) is amended as follows.
In paragraph (2), after “paragraph (3)” insert “or (3A)”.
After paragraph (3) insert—
After paragraph (4) insert—
The PEC Regulations are amended in accordance with subsections (2) to (8).
In regulation 5 (security of public electronic communications services), omit paragraph (6).
Omit regulation 5B (personal data breach: audit).
In regulation 5C (personal data breach: fixed monetary penalty)—
in paragraph (10)—
omit “and Northern Ireland”, and
in paragraph (a), for “a county court” substitute “the county court”, and
after paragraph (11) insert—
For regulation 31 substitute—
Omit regulation 31A (third party information notices).
Omit regulation 31B (appeals against third party information notices).
For Schedule 1 substitute the Schedule set out in Schedule 13 to this Act.
In paragraph 58(1) of Schedule 20 to the Data Protection Act 2018 (transitional provision relating to the PEC Regulations) for “regulations 2, 31 and 31B of, and Schedule 1 to,” substitute “regulation 2 of”.
A requirement to consult under regulation 5C(15) of the PEC Regulations (inserted by subsection (4)(b) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
The PEC Regulations are amended as follows.
After regulation 32 insert—
In regulation 33 (technical advice to the Commissioner)—
omit “, in connection with his enforcement functions,” and
at the end insert where the request is made in connection with—
In Schedule 1 (Commissioner’s enforcement powers) (inserted by Schedule 13 to this Act), in paragraph 18(b)(ii) (maximum amount of penalty), for “or 24” substitute “, 24 or 32B(4) or (5)”.
The Data Protection Act 2018 is amended in accordance with subsections (2) to (5).
After section 114 insert—
In section 3 (terms relating to the processing of personal data), after subsection (8) insert—
In section 205(2) (references to periods of time)—
omit paragraph (l), and
after that paragraph insert—.
the Commission section 3
Schedule 14 to this Act—
inserts Schedule 12A to the Data Protection Act 2018, and
makes transitional provision relating to—
the person who holds the office of Information Commissioner immediately before the day on which Schedule 14 comes into force, and
consultation about certain appointments.
The office of Information Commissioner is abolished.
Accordingly, the Data Protection Act 2018 is amended as follows.
In section 3 (terms relating to the processing of personal data) omit subsection (8).
Omit section 114 (the Information Commissioner) and the italic heading before that section.
In section 206 (index of defined expressions), in the Table, omit the entry for the Commissioner.
In section 214(1) (extent)—
omit “and” at the end of paragraph (a), and
omit paragraph (b).
Omit Schedule 12 (the Information Commissioner).
The functions of the Information Commissioner are transferred to the Information Commission.
So far as is appropriate in consequence of subsection (1), a reference to the Information Commissioner (however expressed) in an enactment or other document whenever passed or made (including this Act) is to be treated as a reference to the Information Commission.
In this section, “enactment” includes—
an enactment comprised in subordinate legislation (as defined in section 21 of the Interpretation Act 1978),
an enactment comprised in, or in an instrument made under, a Measure or Act of Senedd Cymru,
an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament,
an enactment comprised in, or in an instrument made under, Northern Ireland legislation, and
assimilated direct legislation.
The Secretary of State may make a scheme for the transfer of property, rights and liabilities from the Information Commissioner to the Information Commission.
The things that may be transferred under a transfer scheme include—
property, rights and liabilities that could not otherwise be transferred;
property acquired, and rights and liabilities arising, after the making of the scheme.
A transfer scheme may—
make provision about the continuing effect of things done by the Information Commissioner in respect of anything transferred;
make provision about the continuation of things (including legal proceedings) in the process of being done by, on behalf of or in relation to the Information Commissioner in respect of anything transferred;
make provision for references to the Information Commissioner in an instrument or other document in respect of anything transferred under a transfer scheme to be treated as references to the Information Commission;
make provision which is the same as or similar to the Transfer of Undertakings (Protection of Employment) Regulations 2006 (S.I. 2006/246);
make other consequential, supplementary, incidental or transitional provision.
A transfer scheme may provide—
for modifications by agreement;
for modifications to have effect from the date when the original scheme came into effect.
In this section, references to rights and liabilities include rights and liabilities relating to a contract of employment.
Schedule 15 makes provision about information standards for health and adult social care in England (under Part 9 of the Health and Social Care Act 2012) and information technology.
Schedule 16 makes provision in connection with the grant of smart meter communication licences.
Section 35 of the Digital Economy Act 2017 (disclosure of information to improve public service delivery) is amended as follows.
In subsection (9)—
in paragraph (a), for “or households” substitute “, households or undertakings”, and
in paragraph (b), for “or households” substitute “, households or undertakings”.
In subsection (10)—
the words after “its purpose” become paragraph (a), and
at the end of that paragraph, insert , or
After subsection (12) insert—
The Online Safety Act 2023 is amended as follows.
In section 100 (power to require information)—
omit subsection (7);
after subsection (8) insert—
In section 101 (information in connection with investigation into death of child)—
before subsection (1) insert—;
in subsection (3), for “power conferred by subsection (1) includes” substitute “powers conferred by this section include”;
after subsection (5) insert—
In section 102 (information notices)—
in subsection (1), for “101(1)” substitute “101(C1) or (1)”;
in subsection (3)—
after “information notice” insert “under section 100(1) or 101(1)”;
omit the “and” at the end of paragraph (c);
after paragraph (c) insert—;
omit subsection (4);
after subsection (5) insert—;
after subsection (9) insert—;
in subsection (10), after the definition of “information” insert—.
In section 109 (offences in connection with information notices)—
in subsection (2)(b), for “all reasonable steps” substitute “all of the steps that it was reasonable, and reasonably practicable, to take”;
after subsection (6) insert—
In section 110 (senior managers’ liability: information offences)—
after subsection (6) insert—;
in subsection (7), for “or (6)” substitute “, (6) or (6A)”.
In section 113 (penalties for information offences), in subsection (2)—
for “(4) or (5)” substitute “(4), (5) or (6A)”;
for “(5) or (6)” substitute “(5), (6) or (6A)”.
In section 114 (co-operation and disclosure of information: overseas regulators), in subsection (7), omit the definition of “the data protection legislation”.
In section 225 (Parliamentary procedure for regulations), in subsection (10), after paragraph (c) insert—.
In section 236(1) (interpretation)—
after the definition of “country” insert—;
in the definition of “information notice”, for “101(1)” substitute “101(C1) or (1)”.
the data protection legislation section 236
The Online Safety Act 2023 is amended in accordance with subsections (2) to (4).
After section 154 insert—
In section 162 (OFCOM’s report about researchers’ access to information), omit subsections (7) to (10).
In section 225 (Parliamentary procedure for regulations), for subsections (8) and (9) substitute—
The requirement to consult under section 154A(7) of the Online Safety Act 2023 (as inserted by subsection (2) of this section) may be satisfied by consultation undertaken before the day on which this Act is passed.
Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (10).
In section 18A(3) (retention of material: general), after “recordable offence” insert “or recordable-equivalent offence”.
Section 18E (supplementary provision) is amended in accordance with subsections (4) to (10).
In subsection (1), after the definition of “recordable offence” insert—.
In subsection (3), in the words before paragraph (a), after “offence” insert “in England and Wales or Northern Ireland”.
After subsection (5) insert—
In subsection (6)(a)—
after “convicted” insert —, and
after “offence,” insert or.
In subsection (6)(b)—
omit “of a recordable offence”, and
for “a recordable offence, other than a qualifying offence” substitute “an offence, other than a qualifying offence or qualifying-equivalent offence”.
In subsection (7), for “subsection (6)” substitute “this section”.
After subsection (7) insert—
The amendments made by this section apply only in connection with the retention of section 18 material that is or was obtained or acquired by a law enforcement authority—
on or after the commencement day, or
in the period of 3 years ending immediately before the commencement day.
Subsection (13) of this section applies where—
at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day,
at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material, and
at the pre-commencement time, the law enforcement authority could have retained the material under section 18A of the Counter-Terrorism Act 2008, as it has effect taking account of the amendments made by subsections (2) to (10) of this section, if those amendments had been in force.
Where this subsection applies—
the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but
the material may not be used in evidence against the person to whom the material relates—
in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or
in criminal proceedings in any other country or territory.
In this section—
in section 3, a third party in relation to customer data (see section 2(2)),
After Article 45B (inserted by paragraph 4) insert—
After Article 49 insert—
“micro business” means a business with fewer than 10 staff;
For the purposes of this section, proceedings in relation to an offence are instituted—
in England and Wales, when they are instituted for the purposes of Part 1 of the Prosecution of Offences Act 1985 (see section 15(2) of that Act);
in Northern Ireland, when they are instituted for the purposes of Part 2 of the Justice (Northern Ireland) Act 2002 (see section 44(1) and (2) of that Act);
in Scotland, when they are instituted for the purposes of Part 3 of the Proceeds of Crime Act 2002 (see section 151(1) and (2) of that Act).
Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (6).
Section 18A (retention of material: general) is amended in accordance with subsections (3) to (5).
In subsection (1), for “subsection (5)” substitute “subsections (4) to (9)”.
In subsection (4)(a), after “relates” insert “(a “pseudonymised form”)”.
After subsection (6) insert—
In section 18E(1) (supplementary provision)—
in the definition of “law enforcement authority”, for paragraph (d) substitute—, and
after that definition insert—.
The amendments made by this section apply only in connection with the retention of section 18 material that is or was obtained or acquired by a law enforcement authority—
on or after the commencement day, or
in the period of 3 years ending immediately before the commencement day.
Subsections (9) to (12) of this section apply where, at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day.
Where the law enforcement authority holds the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) and (d) of the Counter-Terrorism Act 2008 as having—
taken the steps necessary for it to hold the material in a pseudonymised form as soon as reasonably practicable after obtaining or acquiring the material, and
continued to hold the material in a pseudonymised form until the commencement day.
Where the law enforcement authority does not hold the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) of the Counter-Terrorism Act 2008 as taking the steps necessary for it to hold the material in a pseudonymised form as soon as reasonably practicable after obtaining or acquiring the material if it takes those steps on, or as soon as reasonably practicable after, the commencement day.
Subsection (12) of this section applies where, at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material but—
at the pre-commencement time, the law enforcement authority could have retained the material under section 18A(7) to (9) of the Counter-Terrorism Act 2008 (as inserted by this section) if those provisions had been in force, or
on or after the commencement day, the law enforcement authority may retain the material under those provisions by virtue of subsection (9) or (10) of this section.
Where this subsection applies—
the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but
the material may not be used in evidence against the person to whom the material relates—
in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or
in criminal proceedings in any other country or territory.
In this section—
Northern Ireland legislation;
In Schedule 1 to the Presumption of Death Act 2013 (Register of Presumed Deaths), in paragraph 7 (interpretation)—
after “means” insert —;
at the end insert , or
The 2018 Act is amended as follows.
This paragraph applies to the person who holds the office of Information Commissioner immediately before the day on which this Schedule comes into force. The person is to be treated as having been appointed as the chair of the Information Commission for a term that expires at the time the person would cease to hold the office of Information Commissioner but for the abolition of that office by section 118. For the purposes of paragraph 7(3) of Schedule 12A to the Data Protection Act 2018 (extension of chair’s term), the term of the person’s appointment as chair of the Information Commission is to be treated as a term beginning when the person began to hold the office of Information Commissioner.
In section 3(9) (definition of “the data protection legislation”)—
insert “and” at the end of paragraph (c), and
omit paragraph (e) (regulations under section 2(2) of the European Communities Act 1972 which relate to the EU GDPR or the Law Enforcement Directive) and the “and” before it.
Omit section 20 (meaning of “court” in Part 2).
In section 94 (data subject’s right of access under Part 4), in subsection (10), for “subsection (6)” substitute “subsections (3), (5) and (6)”.
In section 119A(11) (standard clauses for transfers to third countries etc), after “any” insert “whole days that fall within a”.
In section 124(5) (data protection and journalism code), in the definition of “good practice in the processing of personal data for the purposes of journalism”—
in paragraph (a), omit “, including compliance with the requirements of the data protection legislation”, and
and includes compliance with the requirements of the data protection legislation;
Section 125 (approval of codes of practice prepared by the Commissioner) is amended as follows. Omit subsection (2). In subsection (8), after “any” insert “whole days that fall within a”. In subsection (9), for “subsections (2) and (5)” substitute “subsection (5)”.
In section 139 (reporting to Parliament), omit subsection (2).
In section 161(6) (approval of first guidance about regulatory action), after “any” insert “whole days that fall within a”.
In section 170(2)(a) (unlawful obtaining etc of personal data), after “preventing” insert “, investigating”.
Section 171 (re-identification of de-identified personal data) is amended as follows. In subsection (3)(a), after “preventing” insert “, investigating”. In subsection (6)(a), after “preventing” insert “, investigating”.
In section 181 (interpretation of Part 6) omit the definition of “representative”.
In section 184(4) (prohibition of requirement to produce relevant records), after “prevention” insert “, investigation”.
In section 192(6) (approval of the Framework), after “any” insert “whole days that fall within a”.
In section 206 (index of defined expressions), in the Table, omit the entry for “representative (in Part 6)”.
Schedule 1 (special categories of personal data and criminal convictions etc data) is amended as follows. In the heading before paragraph 10, for “or detecting” substitute “etc”. In paragraph 10(1)(a) (preventing etc unlawful acts), after “prevention” insert “, investigation”. In paragraph 13(1)(a) (journalism etc in connection with unlawful acts and dishonesty etc), after “consists of” insert “, or is carried out in preparation for,”. In paragraph 14(1)(b) (preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—. In paragraph 24(1)(a) (disclosure to elected representatives), after “consists of” insert “, or is carried out in preparation for,”.
Schedule 2 (exemptions etc from the UK GDPR) is amended as follows. In paragraph 2(1)(a) (crime), after “prevention” insert “, investigation”. In paragraph 3(2)(b)(ii) (crime: risk assessment systems), after “prevention” insert “, investigation”.
In paragraph 8(1)(b) of Schedule 8 (conditions for sensitive processing under Part 3: preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—.
In paragraph 2(a) of Schedule 11 (other exemptions under Part 4: crime), after “prevention” insert “, investigation”.
Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (4).
In section 18(4) (destruction of national security material not subject to existing statutory restrictions), after “18A” insert “, 18AA”.
After section 18A insert—
In section 18BA(5)(a) (retention of further fingerprints), after “18A” insert “, 18AA”.
Section 18AA of the Counter-Terrorism Act 2008 applies in relation to section 18 material obtained or acquired by a law enforcement authority before the commencement day (as well as material obtained or acquired on or after that day), except where the law enforcement authority was informed, or became aware, as described in subsection (2) or (3) of that section before the commencement day.
Subsection (7) of this section applies where—
at the beginning of the commencement day, a law enforcement authority has section 18 material,
at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material, but
at the pre-commencement time, the law enforcement authority could have retained the material under section 18AA of that Act (as inserted by this section) if it had been in force.
Where this subsection applies—
the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but
the material may not be used in evidence against the person to whom the material relates—
in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or
in criminal proceedings in any other country or territory.
In this section—
The UK GDPR is amended as follows.
Omit Article 44 (transfers of personal data to third countries etc: general principle for transfers). After that Article insert—
Article 46 (transfers subject to appropriate safeguards) is amended as follows. Omit paragraph 1. After that paragraph insert— In paragraph 2— In paragraph 3, in the words before point (a)— At the end insert—
Section 73 (general principles for transfers) is amended as follows. Before subsection (1) insert— In subsection (1)— For subsection (3) substitute— In subsection (4)— In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”.
Section 75 (transfers on the basis of appropriate safeguards) is amended as follows. In the heading, for “on the basis of” substitute “subject to”. Omit subsection (1). After that subsection insert— In subsection (2), for “subsection (1)(b)” substitute “subsection (1A)(b) but not in reliance on section 73(4)(aa) (transfer to processor)”. In subsection (3), for “subsection (1)” substitute “this section but not in reliance on section 73(4)(aa) (transfer to processor)”. At the end insert—
The 2018 Act is amended as follows.
The UK GDPR is amended as follows.
This paragraph is about the requirement under paragraph 3(4) of Schedule 12A to the Data Protection Act 2018 for the Secretary of State to consult the chair of the Information Commission before appointing a non-executive member of the Information Commission. The requirement may be satisfied by consultation, before this Schedule comes into force, with the person who holds the office of Information Commissioner.
Article 12 (transparent information, communication and modalities for the exercise of the rights of the data subject) is amended as follows. In paragraph 1, for “under Articles 15 to 22” substitute “made under or by virtue of Articles 15 to 22D”. In paragraph 2— In paragraph 3, for “under Articles 15 to 22” substitute “made under or by virtue of Articles 15 to 22D”. In paragraph 5, for “under Articles 15 to 22” substitute “under or by virtue of Articles 15 to 22D”. In paragraph 6, for “referred to in Articles 15 to 21” substitute “made under or by virtue of Articles 15 to 22D”.
In the heading of Article 47 (binding corporate rules) at the beginning insert “Transfers subject to appropriate safeguards:”.
Omit section 17A (transfers based on adequacy regulations) and the italic heading before it.
Article 4(1) (interpretation) is amended as follows. After point (15) insert—. After point (28) insert—
In Article 13(2)(f) (information about automated decision-making to be provided where personal data is collected from the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”.
After Article 47 insert—
Omit section 17B (transfers based on adequacy regulations: review etc).
After Article 4 insert—
In Article 14(2)(g) (information about automated decision-making to be provided where personal data is not obtained from the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”.
Omit section 17C (standard data protection clauses).
In Article 9 (processing of special categories of personal data)—
in paragraph 2, after “apply if” insert “the processing is based on Article 6(1) and”,
in paragraph 2(f), after “courts” insert “or tribunals”, and
in paragraph 3, for the words from the beginning to “data are” substitute “Paragraph 1 is only disapplied by point (h) of paragraph 2 if the personal data is”.
In Article 15(1)(h) (right of access by the data subject), for “referred to in Article 22(1) and (4)” substitute “which is subject to the requirement to provide safeguards under Article 22C”.
Omit section 18 (transfers of personal data to third countries etc: public interest).
In Article 12(5) (information etc to be provided free of charge), at the beginning insert “Subject to Article 15(3),”.
In the heading of Section 4 of Chapter 3, omit “and automated decision-making”.
In section 24(2) (manual unstructured data held by FOI public authorities)—
in paragraph (c), for “44 to 49” substitute “44A to 49A”, and
omit paragraph (ca).
In Article 23(1)(h) (restrictions), for “(a)” substitute “(c)”.
In Article 23(1) (restrictions), for “provided for in Articles 12 to 22”, in both places it occurs, substitute “arising under or by virtue of Articles 12 to 22D”.
In section 26(2) (national security and defence exemption), omit paragraph (fa).
In Article 24(3) (responsibility of the controller), for “an element by which to demonstrate” substitute “a means of demonstrating”.
In Article 47(2)(e) (binding corporate rules), for the words from “the right not” to “Article 22” substitute “the right to protection in accordance with, and with regulations made under, Articles 22A to 22D in connection with decisions based solely on automated processing (including decisions reached by means of profiling)”.
In section 75 (transfers on the basis of appropriate safeguards), after subsection (7) (inserted by Schedule 8 to this Act) insert—
In Article 25(3) (data protection by design and by default), for “an element to demonstrate” substitute “a means of demonstrating”.
In Article 83(5) (general conditions for imposing administrative fines)—
in point (b), for “22” substitute “21”, and
after that point insert—.
In section 78A (law enforcement processing: national security exemption) (inserted by section 88 of this Act), in subsection (2)(e), after sub-paragraph (i) insert—.
In Article 28(5) (processors), for “an element by which to demonstrate” substitute “a means of demonstrating”.
Section 119A (power of Commissioner to specify standard clauses for transfers to third countries etc providing appropriate safeguards) is amended as follows. In subsection (1), for the words from “provide” to the end substitute “are capable of securing that the data protection test set out in Article 46 of the UK GDPR or section 75 of this Act (or both) is met in relation to transfers of personal data”. In subsection (3), after paragraph (a) insert—.
In Article 32(3) (security of processing), for “an element by which to demonstrate” substitute “a means of demonstrating”.
In section 149(2)(e) (enforcement notices), for “44 to 49” substitute “44A to 49A”.
In Article 37(1)(a), after “courts” insert “and tribunals”.
Section 182 (regulations and consultation) is amended as follows. Omit subsection (4). In subsection (6), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”. In subsection (7), for “Where regulations under this Act” substitute “For the purposes of this Act, where regulations”. In subsection (8)— Omit subsections (9) and (10). In subsection (11), after “by regulations” insert “made under this Act or another enactment that are”. For subsection (14) substitute—
Omit Article 59 (activity reports).
In section 205(2)(e) (references to periods of time) omit “and (9)”.
In paragraph 26(9)(d) of Schedule 2 (exemptions etc for journalistic, academic, artistic and literary purposes), for “44” substitute “44A”.
Part 3 of Schedule 21 (further transitional provision etc: transfers to third countries and international organisations) is amended as follows. In the heading before paragraph 4, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”. In paragraph 4 (UK GDPR: adequacy decisions and adequacy regulations)— In paragraph 6 (UK GDPR: application of certain provisions referring to regulations made under section 17A of the 2018 Act)— Omit paragraphs 7 and 8 (UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses). In paragraph 9 (UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules)— In the heading before paragraph 10, for “adequacy decisions and adequacy regulations” substitute “transfers approved by regulations”. In paragraph 10 (law enforcement processing: adequacy decisions and adequacy regulations)— In paragraph 12 (Part 3 (law enforcement processing): application of certain provisions referring to regulations made under section 74A)—
In sections 130 to 134, “the eIDAS Regulation” means Regulation (EU) No. 910/2014 of the European Parliament and the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market.
In Chapter 3 of the eIDAS Regulation (trust services), after Article 24A insert—
The Secretary of State may by regulations—
amend Article 24A of the eIDAS Regulation (recognition of EU standards etc for qualified trust services) so as to remove circumstances in which something is to be treated as qualified under that Regulation for the purposes of a provision or measure specified in paragraph 1 of that Article;
revoke that Article;
revoke Article 24B of the eIDAS Regulation (recognition of EU conformity assessment bodies);
revoke Article 51 of the eIDAS Regulation (transitional measures for electronic signatures);
amend a provision listed in subsection (3) so as to remove a reference to a trust service provider established in the EU;
amend a provision listed in subsection (4) so as to remove a reference to European standards or provisions of equivalent EU law.
The power under subsection (1)(a) includes power to amend or remove an assumption in Article 24A(2) of the eIDAS Regulation.
The provisions mentioned in subsection (1)(e) are—
Article 13(1) of the eIDAS Regulation;
Articles 2(1)(a) and 4(1)(a) of the Implementing Decision.
The provisions mentioned in subsection (1)(f) are—
Article 24(2)(b) of the eIDAS Regulation;
Articles 2(2)(c)(7) and 4(2)(c)(7) of the Implementing Decision.
Regulations under this section may—
include transitional provision or savings, and
make different provision for different purposes, including for the purposes of different provisions of the eIDAS Regulation.
Regulations under this section are subject to the negative resolution procedure.
In this section, “the Implementing Decision” means Commission Implementing Decision (EU) 2015/1506 laying down specifications relating to formats of advanced electronic signatures and advanced seals to be recognised by public sector bodies pursuant to Articles 27(5) and 37(5) of the eIDAS Regulation.
The eIDAS Regulation is amended as follows.
In Chapter 3 (trust services), after Article 45 insert—
In Article 3(21) (definition of “product”), at the end insert “(except in the expression “trust product”)”.
Article 18 of the eIDAS Regulation (co-operation with EU authorities) is amended as follows.
In the heading, for “EU” substitute “overseas”.
In paragraph 1, for “public authority in the EU” substitute “designated overseas authority”.
In paragraph 2, for “other than in accordance with the data protection legislation” substitute “if the processing would contravene the data protection legislation (but in determining whether processing would do so, take into account the power conferred by that paragraph)”.
After paragraph 2 insert—
In Chapter 1 of the eIDAS Regulation (general provisions), after Article 3 insert—
The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) are amended as follows.
In regulation 2 (interpretation), at the end insert—
In Schedule 1 (monetary penalties)—
in paragraph 4(f), for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is served”,
in paragraph 5, for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is received”, and
in paragraph 6, for the words from “a period” to the end substitute “the period of 21 days beginning when the notice of intent is served”.
The Secretary of State must, before the end of the period of 9 months beginning with the day on which this Act is passed—
prepare and publish an assessment of the economic impact in the United Kingdom of each of the four policy options described in section B.4 of the Copyright and AI Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and
lay a document containing the assessment before Parliament.
The document may include an assessment of the economic impact in the United Kingdom of policy options which are alternatives to the options described in subsection (1)(a).
An assessment included in the document must, among other things, include assessment of the economic impact of each option on— including the impact on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses.
copyright owners, and
persons who develop or use AI systems,
In this section—
The Secretary of State must, before the end of the period of 9 months beginning with the day on which this Act is passed—
prepare and publish a report on the use of copyright works in the development of AI systems, and
lay the report before Parliament.
The report must consider—
the four policy options described in section B.4 of the Copyright and AI Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and
such alternative options as the Secretary of State considers appropriate.
The report must consider, and make proposals in relation to, each of the following—
technical measures and standards (for example, measures and standards concerned with metadata) that may be used to control—
the use of copyright works to develop AI systems, and
the accessing of copyright works for that purpose (for example, by web crawlers);
the effect of copyright on access to, and use of, data by developers of AI systems (for example, on text and data mining), including the effect on developers who are individuals, micro businesses, small businesses or medium-sized businesses;
the disclosure of information by developers of AI systems about—
their use of copyright works to develop AI systems, and
how they access copyright works for that purpose (for example, by means of web crawlers);
the granting of licences to developers of AI systems to do acts restricted by copyright, including the granting of licences by and to individuals, micro businesses, small businesses and medium-sized businesses;
ways of enforcing requirements and restrictions relating to— including enforcement by a regulator.
the use of copyright works to develop AI systems, and
the accessing of copyright works for that purpose (for example, by web crawlers),
The consideration and proposals under each of paragraphs (a) to (e) of subsection (3) must include consideration of, and proposals relating to, AI systems developed outside the United Kingdom.
In preparing the report, the Secretary of State must consider the likely effect of proposals, in the United Kingdom, on— including the likely effect on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses.
copyright owners, and
persons who develop or use AI systems,
In preparing the report, the Secretary of State must have regard to, among other things, the Consultation Paper responses.
The Secretary of State may comply with this section by preparing and publishing two or more reports which, taken together, satisfy the requirements in this section.
In this section—
“web crawler” means a computer program that obtains data from websites in accordance with instructions and that can autonomously determine which websites to visit.
Section 56 In the New Roads and Street Works Act 1991, after Schedule 5 insert—
Section 58 In the Street Works (Northern Ireland) Order 1995 (S.I. 1995/3210 (N.I. 19)), after Schedule 2 insert—
Section 65
The Births and Deaths Registration Act 1953 is amended as follows.
Section 3A (registration of births of abandoned children) is amended as follows. In subsection (5), for the words from “direct” to the end substitute “enter in the margin of the relevant register of births a reference to the re-registration of the birth or, if the relevant register of births is in hard copy form, shall direct the officer having custody of that register to do so.” After that subsection insert—
Section 13 (registration of name of child or of alteration of name) is amended as follows. In subsection (1), for “the registrar or superintendent registrar having the custody of the register” substitute “the relevant registration officer for the register”. In subsection (1A), for “The registrar or superintendent registrar having custody of the register in question” substitute “The relevant registration officer”. In subsection (1B), for “the registrar or superintendent registrar” substitute “the relevant registration officer”. After subsection (2) insert—
In Part 3 (general), the italic heading before section 25 becomes “Registers, etc”.
Section 29 (correction of errors in registers) is amended as follows. In subsection (3), for “the officer having the custody of the register” substitute “the appropriate registration officer”. In subsection (3A)(b), for “the officer having the custody of the register” substitute “the appropriate registration officer”. In subsection (3B)(b), for “the officer having the custody of the register” substitute “the appropriate registration officer”. In subsection (4), for “the officer having the custody of the register” substitute “the appropriate registration officer for the register”. After subsection (4) insert—
In section 29A (alternative procedure for certain corrections), in subsection (4)—
for “the officer having custody of the register” substitute “the appropriate registration officer”;
at the end insert—
Section 30 (searches of indexes kept by Registrar General) is amended as follows. After subsection (1) insert— In subsection (2), after “certified copies” insert “or in the said registers (as the case may be)”. In subsection (3)—
In section 31 (searches of indexes kept by superintendent registrars), for subsection (1) substitute—
For section 32 (searches in registers kept by registrars) substitute—
Section 33 (short certificate of birth) is amended as follows. In subsection (1), for “the Registrar General, a superintendent registrar or a registrar” substitute “the appropriate registration officer”. After subsection (1) insert— In subsection (2)—
In section 33A (short certificate of death), in subsection (2), for the words from “the records and registers” to “may be” substitute “the register in which the entry relating to the death is made, or, in the case of the Registrar General, from the records in the Registrar General’s custody”.
In section 34 (entry in register as evidence of birth or death), in subsection (5), before “on which” insert “in or”.
Section 34A (searches and records of information: additional provision) is amended as follows. In subsection (1)— In subsection (5), at the end insert “or in a register kept under this Act”.
In section 35 (offences relating to registers), in paragraph (b), after “deaths” insert “kept in hard copy form”.
In section 40 (sending and providing notices, information or other documents), omit “, return”.
In section 41 (interpretation), after subsection (3) insert—
Section 70 In the UK GDPR, at the end insert—
Section 71 In the UK GDPR, after Annex 1 (inserted by Schedule 4 to this Act) insert—
Section 80
Section 85
Section 85
“the UK national accreditation body” means the UK national accreditation body for the purposes of Article 4(1) of the Accreditation Regulation.
Section 78 (subsequent transfers) is amended as follows. Before subsection (1) insert— In subsection (1)— After subsection (1) insert— In subsection (2)— In subsection (3), for “competent authority” substitute “UK authoriser”. In subsection (4), for “an authorisation may not be given under subsection (1)” substitute “the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1)”. In subsection (5)(a), for the words from “either” to “State” substitute “to the public security, national security or essential interests of a third country or the United Kingdom”. In subsection (6)— At the end insert—
Section 85
Section 103
Section 108
Section 112 In the PEC Regulations, before Schedule 1 insert—
Section 115 This is the Schedule to be substituted for Schedule 1 to the PEC Regulations—
Section 117
Section 121
Chapter 1 of Part 9 of the Health and Social Care Act 2012 (health and adult social care services: information standards) is amended as follows.
Before section 250 insert—.
Section 250 (powers to publish information standards) is amended as follows. In subsection (2), at the end insert “and includes, among other things, a standard relating to information technology or IT services used, or intended to be used, in connection with the processing of information (see section 250A)”. In subsection (2B)(c)— In subsection (2B), at the end insert— In subsection (3)— In subsection (7)—
After section 250 insert—
Section 251 (information standards: procedure etc) is amended as follows. In the heading omit “Information standards:”. For subsection (3) substitute—
After section 251 insert—.
For the heading of section 251ZA (information standards: compliance) substitute “Monitoring compliance”.
After that section insert—
Section 122
The Energy Act 2008 is amended as follows.
In the italic heading before section 88, after “meters” insert “: modification of licence conditions etc by Secretary of State”.
After section 91 insert—
In section 104 (subordinate legislation)—
in subsection (1), for “or the Scottish Ministers” substitute “, the Scottish Ministers or the Gas and Electricity Markets Authority”;
in subsection (3), at the end insert , and
information relating to the provision of information described in paragraph (a), or of other information relating to a customer of a trader, to a person in accordance with data regulations;
The Electricity Act 1989 is amended as follows. In section 6A (procedure for licence applications)— In section 56FC (competitive tenders for licences for new licensable activities), in subsection (1), after “activities” insert “, other than a licence under section 6(1)(f) (smart meter communication licence),”.
Terms used in this section and in section 135 have the same meaning in this section as they have in that section.
The Secretary of State must, before the end of the period of 6 months beginning with the day on which this Act is passed, lay before Parliament a statement setting out what progress has been made towards the publication of—
the economic impact assessment required by section 135, and
the report required by section 136.
The duty in subsection (1) does not apply where the economic impact assessment and the report have been published before the end of the period described in that subsection.
The Sexual Offences Act 2003 is amended in accordance with subsections (2) and (3).
After section 66D insert—
In section 79(5) (meaning of references to image of a person), after “a person” insert “(except in sections 66E, 66F and 66G)”.
In the Armed Forces Act 2006, after section 177D insert—
In Part 2 of Schedule 3 to the Serious Crime Act 2007 (offences to be disregarded in reckoning whether an act is capable of encouraging or assisting the commission of an offence: England and Wales), after paragraph 38 insert—
In the Sentencing Code, after section 154 insert—
The Secretary of State may by regulations make provision that is consequential on any provision made by this Act.
Regulations under this section—
may make different provision for different purposes;
may include transitional, transitory or saving provision;
may amend, repeal or revoke any provision made by an enactment.
The reference in subsection (2)(c) to provision made by an enactment is—
where the amendment, repeal or revocation is consequential on section 117, 118 or 119(1) or Schedule 14, a reference to provision made by an enactment whenever passed or made (including this Act), and
in any other case, a reference to provision made by an enactment passed or made before the end of the Session in which this Act is passed.
Regulations under this section made in consequence of section 183A of the Data Protection Act 2018 (inserted by section 106 of this Act) may amend, repeal or revoke provision which refers to the data protection legislation (as defined in section 3 of the Data Protection Act 2018) as they could if the provision referred instead to the main data protection legislation (as defined in section 183A of that Act).
Regulations under this section that amend, repeal or revoke primary legislation are subject to the affirmative resolution procedure.
Any other regulations under this section are subject to the negative resolution procedure.
In this section—
Regulations under this Act are to be made by statutory instrument.
Where regulations under this Act are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.
Where regulations under this Act are subject to “the negative resolution procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.
Any provision that may be included in regulations under this Act made by the Secretary of State or the Treasury subject to the negative resolution procedure may be made by regulations subject to the affirmative resolution procedure.
This Act extends to England and Wales, Scotland and Northern Ireland, subject to subsections (2) to (5).
In Part 3 (National Underground Asset Register)—
sections 56, 57(1) to (7) and 60(1) and Schedule 1 extend to England and Wales only, and
sections 58, 59 and 60(2) and Schedule 2 extend to Northern Ireland only.
In Part 4 (registers of births and deaths)—
sections 61 to 64 extend to England and Wales only, and
an amendment or repeal made by Schedule 3 (minor and consequential amendments) has the same extent as the enactment amended or repealed.
In Part 6 (the Information Commission), paragraph 23 of Schedule 12A to the Data Protection Act 2018 (inserted by Schedule 14 to this Act) extends to England and Wales and Northern Ireland only.
In Part 7—
section 121 and Schedule 15 (information standards for health and adult social care) extend to England and Wales only;
paragraphs 2, 3 and 5 to 7 of Schedule 16 (grant of smart meter communication licences) extend to England and Wales and Scotland only;
section 138(1) to (3) and (6) (creating, or requesting the creation of, purported intimate image of adult) extend to England and Wales only;
section 138(4) (amendment of the Armed Forces Act 2006) extends to—
England and Wales, Scotland and Northern Ireland,
the Isle of Man, and
the British overseas territories, except Gibraltar;
section 138(5) (amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only.
The powers conferred by section 384(1) and (2) of the Armed Forces Act 2006 (powers to extend provisions to the Channel Islands and to make provisions apply with modifications as they extend to the Channel Islands, the Isle of Man and British overseas territories other than Gibraltar) may be exercised in relation to section 177DA of that Act (inserted by section 138(4) of this Act).
The power conferred by section 63(3) of the Immigration, Asylum and Nationality Act 2006 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modification or adaptation).
The power conferred by section 76(6) of the Immigration Act 2014 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modifications).
The power conferred by section 95(5) of the Immigration Act 2016 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment made by section 55 of this Act of any part of that Act (with or without modifications).
The power conferred by section 239(7) of the Online Safety Act 2023 may be exercised so as to extend to the Bailiwick of Guernsey or the Isle of Man any amendment or repeal made by this Act of any part of that Act (with or without modifications).
In this section, “enactment” has the same meaning as in section 139.
Except as provided by subsections (2) to (4), this Act comes into force on such day as the Secretary of State may by regulations appoint.
The following provisions come into force on the day on which this Act is passed—
section 66 (meaning of “the 2018 Act” and “the UK GDPR”);
section 78 (searches in response to data subjects’ requests);
Part 1 of Schedule 16 (grant of smart meter communication licences) and section 122 so far as relating to that Part of that Schedule;
section 126 (retention of biometric data and recordable offences);
section 127 (retention of pseudonymised biometric data);
section 128 (retention of biometric data from INTERPOL);
this Part;
any other provision of this Act (including provision modifying other legislation) so far as it confers power to make regulations or is otherwise necessary for enabling the exercise of such a power on or after the day on which this Act is passed.
The following provisions come into force at the end of the period of two months beginning with the day on which this Act is passed—
section 69 (consent to law enforcement processing);
section 82 (logging of law enforcement processing);
section 96 (notices from the Information Commissioner);
section 97 (power of the Information Commissioner to require documents).
Part 2 of Schedule 16 (grant of smart meter communication licences), and section 122 so far as relating to that Part of that Schedule, come into force on the day on which the first regulations under section 91A(1) of the Energy Act 2008 (inserted by Part 1 of Schedule 16) come into force.
Regulations under this section may make different provision for different purposes.
The Secretary of State may by regulations make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act.
Regulations under this section may amend Schedule 21 to the Data Protection Act 2018 or Part 2 of Schedule 9 to this Act by adding, varying or repealing provision.
Regulations under this section containing provision described in subsection (2) are subject to the negative resolution procedure.
Regulations under this section may make different provision for different purposes.
This Act may be cited as the Data (Use and Access) Act 2025.