Data Protection Act 2018

Schedule 5 to the Courts Act 2003 (collection of fines) is amended as follows.

The National Health Service (Wales) Act 2006 is amended as follows.

Section 72 of the Justice Act (Northern Ireland) 2015 (supply of information to relevant Northern Ireland departments or Secretary of State) is amended as follows. In subsection (5), for “the Data Protection Act 1998” substitute “the data protection legislation”. In subsection (7), at the appropriate place insert—.

Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002 (exclusions) is amended as follows.

The Data Protection (Processing of Sensitive Personal Data) Order 2006 is revoked.

For article 5 of the National Assembly for Wales Commission (Crown Status) Order 2007 substitute—

In regulation 5 of the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (conditions on the use, supply and disclosure of documents open to public inspection)—

In paragraph 1(c) of the Schedule to the Companies Act 2006 (Extension of Takeover Panel Provisions) (Isle of Man) Order 2008 (modifications with which Chapter 1 of Part 28 of the Companies Act 2006 extends to the Isle of Man), for “the Data Protection Act 1998 (c 29)” substitute “the data protection legislation”.

Paragraph 6 of Schedule 2 to the Companies (Disclosure of Address) Regulations 2009 (conditions for permitted disclosure to a credit reference agency) is amended as follows. The existing text becomes sub-paragraph (1). In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—. In paragraph (c) of that sub-paragraph— After paragraph (c) of that sub-paragraph insert— In this paragraph, “data protection obligations”, in relation to a credit reference agency, means—

In regulation 25 of the Provision of Services Regulations 2009 (derogations from the freedom to provide services), for paragraph (d) substitute—.

The Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 are amended as follows.

The Data Protection (Monetary Penalties) Order 2010 is revoked.

Regulation 5 of the Pupil Information (Wales) Regulations 2011 (duties of head teacher - educational records) is amended as follows. In paragraph (5)— After paragraph (5)—

The Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 are amended as follows.

This condition is met if the processing—

This condition is met if the processing— Those purposes are—

This condition is met if the processing— subject to the exception in sub-paragraph (3). For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where— Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to an individual. For the purposes of this paragraph, an individual holds a senior position in an organisation if the individual— Those positions are— In this paragraph, “senior manager”, in relation to an organisation, means a person who plays a significant role in— The reference in sub-paragraph (2)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.

This condition is met if— In this paragraph—

This condition is met if the processing is necessary for the purposes of making a disclosure in good faith under either of the following—

This condition is met if— The reasons mentioned in sub-paragraph (1)(c) are— For the purposes of this paragraph, an individual aged 18 or over is “at risk” if the controller has reasonable cause to suspect that the individual— In sub-paragraph (1)(a), the reference to the protection of an individual or of the well-being of an individual includes both protection relating to a particular individual and protection relating to a type of individual.

This condition is met if the processing— For the purposes of sub-paragraph (1)(d), processing can reasonably be carried out without the consent of the data subject only where— In this paragraph— The reference in sub-paragraph (2)(b) to a data subject withholding consent does not include a data subject merely failing to respond to a request for consent.

This condition is met if— subject to sub-paragraph (2). Where the request to the elected representative came from an individual other than the data subject, the condition in sub-paragraph (1) is met only if the disclosure must be made without the consent of the data subject for one of the following reasons— In this paragraph, “elected representative” has the same meaning as in paragraph 23.

This condition is met if the processing is necessary— The reference in sub-paragraph (1)(a) to measures designed to eliminate doping includes measures designed to identify or prevent doping. If the processing consists of the disclosure of personal data to a body or association described in sub-paragraph (1)(a), or is carried out in preparation for such disclosure, the condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).

This condition is met if—

This condition is met if the processing—

This condition is met if the processing would meet a condition in Part 2 of this Schedule but for an express requirement for the processing to be necessary for reasons of substantial public interest.

The controller has an appropriate policy document in place in relation to the processing of personal data in reliance on a condition described in paragraph 38 if the controller has produced a document which—

The GDPR provisions listed in sub-paragraph (3) do not apply to personal data which consists of a classification applied to the data subject as part of a risk assessment system falling within sub-paragraph (2) to the extent that the application of those provisions would prevent the system from operating effectively. A risk assessment system falls within this sub-paragraph if— The GDPR provisions referred to in sub-paragraph (1) are the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—

The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function. The functions are any function that is conferred by an enactment on—

The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that— to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function. Person on whom function is conferred How function is conferred 1. The Commissioner. By or under— the data protection legislation; the Freedom of Information Act 2000; section 244 of the Investigatory Powers Act 2016; the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426); the Environmental Information Regulations 2004 (S.I. 2004/3391); the INSPIRE Regulations 2009 (S.I. 2009/3157); Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC; the Re-use of Public Sector Information Regulations 2015 (S.I. 2015/1415); the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696). 2. The Scottish Information Commissioner. By or under— the Freedom of Information (Scotland) Act 2002 (asp 13); the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520); the INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440). 3. The Pensions Ombudsman. By or under Part 10 of the Pension Schemes Act 1993 or any corresponding legislation having equivalent effect in Northern Ireland. 4. The Board of the Pension Protection Fund. By or under sections 206 to 208 of the Pensions Act 2004 or any corresponding legislation having equivalent effect in Northern Ireland. 5. The Ombudsman for the Board of the Pension Protection Fund. By or under any of sections 209 to 218 or 286(1) of the Pensions Act 2004 or any corresponding legislation having equivalent effect in Northern Ireland. 6. The Pensions Regulator. By an enactment. 7. The Financial Conduct Authority. By or under the Financial Services and Markets Act 2000 or by another enactment. 8. The Financial Ombudsman. By or under Part 16 of the Financial Services and Markets Act 2000. 9. The investigator of complaints against the financial regulators. By or under Part 6 of the Financial Services Act 2012. 10. A consumer protection enforcer, other than the Competition and Markets Authority. By or under the CPC Regulation. 11. The monitoring officer of a relevant authority. By or under the Local Government and Housing Act 1989. 12. The monitoring officer of a relevant Welsh authority. By or under the Local Government Act 2000. 13. The Public Services Ombudsman for Wales. By or under the Local Government Act 2000. 14. The Charity Commission. By or under— the Charities Act 1992; the Charities Act 2006; the Charities Act 2011.

The listed GDPR provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity. The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person’s suitability for any of the following offices— The Secretary of State may by regulations amend the list in sub-paragraph (2) to— Regulations under sub-paragraph (3) are subject to the affirmative resolution procedure.

In this Part of this Schedule— For the purposes of this Part of this Schedule, the “serious harm test” is met with respect to social work data if the application of Article 15 of the GDPR to the data would be likely to prejudice carrying out social work, because it would be likely to cause serious harm to the physical or mental health of the data subject or another individual. In sub-paragraph (2), “carrying out social work” is to be taken to include doing any of the following— In this Part of this Schedule, a reference to a local authority, in relation to data processed or formerly processed by it, includes a reference to the Council of the Isles of Scilly, in relation to data processed or formerly processed by the Council in connection with any functions mentioned in paragraph 8(1)(a)(ii) which are or have been conferred on the Council by an enactment.

Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers) do not apply to social work data to the extent that the serious harm test is met with respect to the data.

In this Schedule, “the listed provisions” means—

The listed provisions do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.

The listed provisions do not apply to personal data to the extent that the application of the listed provisions would be likely to prejudice the combat effectiveness of any of the armed forces of the Crown.

The listed provisions do not apply to personal data that consists of records of the intentions of the controller in relation to any negotiations with the data subject to the extent that the application of the listed provisions would be likely to prejudice the negotiations.

The listed provisions do not apply to personal data processed for— to the extent that the application of those provisions would prevent or seriously impair the achievement of the purposes in question. The exemption in sub-paragraph (1) is available only where—

The Commissioner is to be appointed by Her Majesty by Letters Patent. No recommendation may be made to Her Majesty for the appointment of a person as the Commissioner unless the person concerned has been selected on merit on the basis of fair and open competition. The Commissioner is to hold office for such term not exceeding 7 years as may be determined at the time of the Commissioner’s appointment, subject to paragraph 3. A person cannot be appointed as the Commissioner more than once.

The Commissioner— The Commissioner is to determine the remuneration and other conditions of service of people appointed under this paragraph. The Commissioner may pay pensions, allowances or gratuities to, or in respect of, people appointed under this paragraph, including pensions, allowances or gratuities paid by way of compensation in respect of loss of office or employment. The references in sub-paragraph (3) to paying pensions, allowances or gratuities includes making payments towards the provision of pensions, allowances or gratuities. In making appointments under this paragraph, the Commissioner must have regard to the principle of selection on merit on the basis of fair and open competition. The Employers’ Liability (Compulsory Insurance) Act 1969 does not require insurance to be effected by the Commissioner.

A document purporting to be an instrument issued by the Commissioner and to be— is to be received in evidence and is to be deemed to be such an instrument unless the contrary is shown.

The Commissioner must— The Commissioner must send a copy of the statement to the Comptroller and Auditor General— The Comptroller and Auditor General must examine, certify and report on the statement. The Commissioner must arrange for copies of the statement and the Comptroller and Auditor General’s report to be laid before Parliament. In this paragraph, “financial year” means a period of 12 months beginning with 1 April.

The Commissioner has the following investigative, corrective, authorisation and advisory powers in relation to processing of personal data to which Part 3 or 4 of this Act applies—

The Commissioner must, at the request of a foreign designated authority— The Commissioner may ask a foreign designated authority—

Where the Commissioner receives information from a foreign designated authority as a result of— the Commissioner may use the information only for the purposes specified in the request.

In the Table in paragraph 11—

This paragraph applies to personal data falling within any of the following descriptions— The bodies referred to in sub-paragraph (1)(l) are—

Paragraph 9C (disclosure of information in connection with making of attachment of earnings orders or applications for benefit deductions: supplementary) is amended as follows. In sub-paragraph (5), for “the Data Protection Act 1998” substitute “the data protection legislation”. In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Section 201C (provision of information about medical supplies: supplementary) is amended as follows. In subsection (2), for “the Data Protection Act 1998” substitute “the data protection legislation”. After subsection (3) insert—

In paragraph (1)(b) for “the Data Protection Directive and the Telecommunications Data Protection Directive” substitute “the GDPR”.

In regulation 2(2) (interpretation), at the appropriate place insert—.”

In regulation 2(1) (interpretation), omit the definition of “the 1998 Act”.

Paragraph 10A (attachment of earnings orders (Justice Act (Northern Ireland) 2016): disclosure of information) is amended as follows. In sub-paragraph (7), for “the Data Protection Act 1998” substitute “the data protection legislation”. In sub-paragraph (8), at the appropriate place insert—.

In paragraph 7B(3) of Schedule 1 (further provision about the Welsh Ministers and services under the Act), for “has the same meaning as in the Data Protection Act 1998” substitute “has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act)”.

In paragraph (3)—

Regulation 25 (duty to co-operate by disclosing information as regards relevant persons) is amended as follows. In paragraph (7), at the end insert “or the GDPR”. For paragraph (8) substitute—

In regulation 3(3) (supervision), omit “under the 1998 Act”.

Regulation 26 (responsible bodies requesting additional information be disclosed about relevant persons) is amended as follows. In paragraph (6), at the end insert “or the GDPR”. For paragraph (7) substitute—

For Schedule 2 substitute—

Regulation 29 (occurrence reports) is amended as follows. In paragraph (3), at the end insert “or the GDPR”. For paragraph (4) substitute—

In Article 12 (transparent information etc for the exercise of the rights of the data subject), omit paragraph 8.

The Dentists Act 1984 is amended as follows.

Section 13B of the Opticians Act 1989 (the Council’s power to require disclosure of information) is amended as follows. In subsection (3), after “enactment” insert “or the GDPR”. For subsection (4) substitute— After subsection (9) insert—

Section 251B of the Trade Union and Labour Relations (Consolidation) Act 1992 (prohibition on disclosure of information) is amended as follows. In subsection (3), for “the Data Protection Act 1998” substitute “the data protection legislation”. After subsection (6) insert—

In section 18A(1) of the Health Service Commissioners Act 1993 (power to disclose information)—

Section 19 of the Food Standards Act 1999 (publication etc by the Food Standards Agency of advice and information) is amended as follows. In subsection (2), for “the Data Protection Act 1998” substitute “the data protection legislation”. In subsection (8), after “section” insert —.

The Anti-terrorism, Crime and Security Act 2001 is amended as follows.

The Proceeds of Crime Act 2002 is amended as follows.

The Freedom of Information (Scotland) Act 2002 is amended as follows.

The Criminal Justice Act 2003 is amended as follows.

The Companies (Audit, Investigations and Community Enterprise) Act 2004 is amended as follows.

Paragraph 8 of Schedule 2 to the Marine Act (Northern Ireland) 2013 (further provision about fixed monetary penalties under section 35: disclosure of information) is amended as follows. In sub-paragraph (5)(a), for “the Data Protection Act 1998” substitute “the data protection legislation”. In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Paragraph 6 of Schedule 6 to the Immigration Act 2014 (information: limitation on powers) is amended as follows. The existing text becomes sub-paragraph (1). In that sub-paragraph, in paragraph (a)— In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Section 38 of the Counter-Terrorism and Security Act 2015 (support etc for people vulnerable to being drawn into terrorism: co-operation) is amended as follows. In subsection (4)(a), for “the Data Protection Act 1998” substitute “the data protection legislation”. After subsection (4) insert—

The Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 is amended as follows.

The Investigatory Powers Act 2016 is amended as follows.

In section 306(1) of the Mental Capacity Act (Northern Ireland) 2016 (definitions for purposes of Act), for the definition of “health record” substitute—.

In Schedule 5 to the Children and Social Work Act 2017—

The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 is revoked.

Schedule 3 to the Local Elections (Northern Ireland) Order 2010 (access to marked registers and other documents open to public inspection after an election) is amended as follows. In paragraph 1(1) (interpretation and general)— In paragraph 5(3) (restrictions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “Article 89 GDPR purposes”.

The Police and Crime Commissioner Elections Order 2012 is amended as follows.

Regulation 20 of the Controlled Drugs (Supervision of Management and Use) Regulations 2013 (information management) is amended as follows. For paragraph (4) substitute— In paragraph (5), after “enactment” insert “or the GDPR”. After paragraph (6) insert—

The Data Protection (Assessment Notices) (Designation of National Health Service Bodies) Order 2014 is revoked.

Paragraph 6 of Schedule 2 to the Companies (Disclosure of Date of Birth Information) Regulations 2015 (conditions for permitted disclosure to a credit reference agency) is amended as follows. The existing text becomes sub-paragraph (1). In paragraph (b) of that sub-paragraph, for sub-paragraph (ii) substitute—. In paragraph (c) of that sub-paragraph— After paragraph (c) of that sub-paragraph insert— In this paragraph, “data protection obligations”, in relation to a credit reference agency, means—

The Scottish Parliament (Elections etc) Order 2015 is amended as follows.

The National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018 are amended as follows.

Section 19 (disclosure of information held by revenue departments) is amended as follows. In subsection (7), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”. In subsection (9), after “section” insert —.

In section 333C(2)(d) (other permitted disclosures between institutions etc), for “(within the meaning of section 1 of the Data Protection Act 1998)” substitute “(within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act))”.

In section 2(2)(e)(ii) (absolute exemptions), omit “by virtue of subsection (2)(a)(i) or (b) of that section”.

In section 327A(9) (disclosure of information about convictions etc of child sex offenders to members of the public), for “the Data Protection Act 1998” substitute “the data protection legislation”.

Section 15A (disclosure of information by tax authorities) is amended as follows. In subsection (2)— After subsection (7) insert—

In section 13(5) (duty to notify National Crime Agency about suspected victims of certain offences) for “the Data Protection Act 1998” substitute “the data protection legislation”.

In section 1(5)(b), for sub-paragraph (ii) substitute—.

Schedule 2 (absent voting in Police and Crime Commissioner elections) is amended as follows. In paragraph 20 (absent voter lists: supply of copies etc)— In paragraph 24 (restriction on use of absent voter records or lists or the information contained in them)—

Schedule 3 (absent voting) is amended as follows. In paragraph 16 (absent voting lists: supply of copies etc)— In paragraph 20 (restriction on use of absent voting lists)—

Regulation 1 (citation and commencement) is amended as follows. In paragraph (2), omit “Subject to paragraph (3),”. Omit paragraph (3).

Section 33B (the General Dental Council’s power to require disclosure of information: the dental profession) is amended as follows. In subsection (3), after “enactment” insert “or relevant provision of the GDPR”. For subsection (4) substitute— After subsection (10) insert—

In section 36ZA(6) (Directive 2005/36: designation of competent authority etc), after “Schedule 4ZA—” insert—.

Part 1 of Schedule 4 (extension of existing disclosure powers) is amended as follows. Omit paragraph 42. After paragraph 53F insert—

In section 436(3)(a) (disclosure of information to certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”.

Section 38 (personal information) is amended as follows. In subsection (1), for paragraph (b) substitute—. For subsection (2) substitute— For subsection (3) substitute— Omit subsection (4). In subsection (5), for the definitions of “the data protection principles” and of “data subject” and “personal data” substitute—. After that subsection insert—

In section 327B (disclosure of information about convictions etc of child sex offenders to members of the public: interpretation), after subsection (4) insert—

Section 15D (permitted disclosure of information obtained under compulsory powers) is amended as follows. In subsection (7), for “the Data Protection Act 1998” substitute “the data protection legislation”. After subsection (7) insert—

In section 25(1) (interpretation of this Act), at the appropriate place insert—.

In section 199 (bulk personal datasets: interpretation), for subsection (2) substitute—

Schedule 10 (access to marked registers and other documents open to public inspection after an election) is amended as follows. In paragraph 1(2) (interpretation), omit paragraphs (c) and (d) (but not the final “and”). In paragraph 5 (restriction on use of documents or of information contained in them)—

Schedule 8 (access to marked registers and other documents open to public inspection after an election) is amended as follows. In paragraph 1(2) (interpretation), omit paragraphs (c) and (d) (but not the final “and”). In paragraph 5 (restriction on use of documents or of information contained in them)—

In regulation 3(1) (interpretation)—

In section 438(8)(a) (disclosure of information by certain Directors), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”.

In paragraph 18(5) of Schedule 3 (supply of information to relevant Northern Ireland departments, Secretary of State, etc) for “the Data Protection Act 1998” substitute “the data protection legislation”.

In section 202(4) (restriction on use of class BPD warrants), in the definition of “sensitive personal data”, for “which is of a kind mentioned in section 2(a) to (f) of the Data Protection Act 1998” substitute “the processing of which would be sensitive processing for the purposes of section 86(7) of the Data Protection Act 2018”.

Schedule 1 (content of agreements) is amended as follows. In paragraph 34 (interpretation)— In paragraph 37(2)(a) (processing and access of data), for “the 1998 Act, and any directly applicable EU instrument relating to data protection;” substitute —. In paragraph 61(3) (variation of agreement: general)—

Section 36Y (the General Dental Council’s power to require disclosure of information: professions complementary to dentistry) is amended as follows. In subsection (3), after “enactment” insert “or relevant provision of the GDPR”. For subsection (4) substitute— After subsection (10) insert—

In section 53(1) (interpretation), omit the definition of “Directive 95/46/EC”.

In section 439(3)(a) (disclosure of information to Lord Advocate and to Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”.

In section 206 (additional safeguards for health records), for subsection (7) substitute—

In section 441(7)(a) (disclosure of information by Lord Advocate and Scottish Ministers), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”.

Section 237 (information gateway) is amended as follows. In subsection (2), for “the Data Protection Act 1998” substitute “the data protection legislation”. After subsection (2) insert—

The table in Schedule 4ZA (Directive 2005/36: functions of the General Dental Council under section 36ZA(3)) is amended as follows. In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “the GDPR”. In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “the GDPR”.

After section 442 insert—

In Article 35 (data protection impact assessment), omit paragraphs 4, 5, 6 and 10.

Section 1A of the Veterinary Surgeons Act 1966 (functions of the Royal College of Veterinary Surgeons as competent authority) is amended as follows. In subsection (8)— In subsection (9), after “section” insert —.

Section 7A of the Health and Personal Social Services Act (Northern Ireland) 2001 (power to obtain information etc) is amended as follows. In subsection (3), after “provision” insert “or the GDPR”. For subsection (5) substitute— After subsection (7) insert—

Section 237 of the Enterprise Act 2002 (general restriction on disclosure) is amended as follows. In subsection (4), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”. After subsection (6) insert—

Section 54 of the Domestic Violence, Crime and Victims Act 2004 (disclosure of information) is amended as follows. In subsection (7), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”. After subsection (8) insert—

In section 64 of the Mental Capacity Act 2005 (interpretation), for the definition of “health record” substitute—.

Section 352 of the Gambling Act 2005 (data protection) is amended as follows. The existing text becomes subsection (1). In that subsection, for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”. After that subsection insert—

The Companies Act 2006 is amended as follows.

Section 70 of the Regulatory Enforcement and Sanctions Act 2008 (disclosure of information) is amended as follows. In subsection (4)(a), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”. After subsection (5) insert—

Section 117 of the Public Health etc. (Scotland) Act 2008 (disclosure of information) is amended as follows. In subsection (6), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”. After subsection (7) insert—

The Marine and Coastal Access Act 2009 is amended as follows.

Section 13 of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (functions of the Regional Agency) is amended as follows. In subsection (8), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”. After subsection (8) insert—

Section 59 of the Charities Act 2011 (disclosure: supplementary) is amended as follows. The existing text becomes subsection (1). In that subsection, in paragraph (a), for “the Data Protection Act 1998” substitute “the data protection legislation”. After that subsection insert—

The Health and Social Care Act 2012 is amended as follows.

The Crime and Courts Act 2013 is amended as follows.

Paragraph 7 of Schedule 4 to the Anti-social Behaviour, Crime and Policing Act 2014 (anti-social behaviour case reviews: information) is amended as follows. In sub-paragraph (4)— In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

In section 18(10)(b) of the Social Services and Well-being (Wales) Act 2014 (registers of sight-impaired, hearing-impaired and other disabled people)—

Section 54A of the Modern Slavery Act 2015 (Gangmasters and Labour Abuse Authority: information gateways) is amended as follows. In subsection (5)(a), for “the Data Protection Act 1998” substitute “the data protection legislation”. In subsection (9), after “section” insert —.

Section 7 of the Immigration Act 2016 (information gateways: supplementary) is amended as follows. In subsection (2)(a), for “the Data Protection Act 1998” substitute “the data protection legislation”. In subsection (11), at the appropriate place insert—.

Section 1 of the Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (control of information of a relevant person) is amended as follows. In subsection (8), for “made by or under the Data Protection Act 1998” substitute “of the data protection legislation”. After subsection (12) insert—

The Environmental Information (Scotland) Regulations 2004 are amended as follows.

The European Union (Recognition of Professional Qualifications) Regulations 2015 are amended as follows.

Schedule 4 to the Register of People with Significant Control Regulations 2016 (conditions for permitted disclosure) is amended as follows.

Paragraph 6 of Schedule 5 to the Scottish Partnerships (Register of People with Significant Control) Regulations 2017 (conditions for permitted disclosure to a credit institution or a financial institution) is amended as follows. The existing text becomes sub-paragraph (1). For paragraph (b) of that sub-paragraph substitute— In this paragraph, “data protection obligations”, in relation to a relevant institution, means—

In section 458(2) (disclosure of information by tax authorities)—

Paragraph 13 of Schedule 7 (further provision about civil sanctions under Part 4: disclosure of information) is amended as follows. In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”. In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

In section 250(7) (power to publish information standards), for the definition of “processing” substitute—.

Section 42 (other interpretive provisions) is amended as follows. In subsection (5)(a), for “section 13 of the Data Protection Act 1998 (damage or distress suffered as a result of a contravention of a requirement of that Act)” substitute “Article 82 of the GDPR or section 168 or 169 of the Data Protection Act 2018 (compensation for contravention of the data protection legislation)”. After subsection (5) insert—

Regulation 2 (interpretation) is amended as follows. In paragraph (1), at the appropriate places, insert—; ; ; . For paragraph (3) substitute—

Regulation 2(1) (interpretation) is amended as follows. Omit the definition of “Directive 95/46/EC”. At the appropriate place insert—.

Paragraph 6 (disclosure to a credit reference agency) is amended as follows. In sub-paragraph (b), for paragraph (ii) (together with the final “; and”) substitute—. In sub-paragraph (c)— After sub-paragraph (c) insert—

In Article 36 (prior consultation)—

In section 461(7) (permitted disclosure of information obtained under compulsory powers), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”.

Paragraph 9 of Schedule 10 (further provision about fixed monetary penalties: disclosure of information) is amended as follows. In sub-paragraph (5)(a), for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”. In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Section 251A (consistent identifiers) is amended as follows. In subsection (7)(a), for “made by or under the Data Protection Act 1998” substitute “of the data protection legislation”. After subsection (8) insert—

Paragraph 1 of Schedule 7 (statutory restrictions on disclosure) is amended as follows. The existing text becomes sub-paragraph (1). In that sub-paragraph, in paragraph (a)— In this paragraph, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Regulation 11 (personal data) is amended as follows. For paragraph (2) substitute— For paragraph (3) substitute— For paragraph (4) substitute— Omit paragraph (5). After paragraph (6) insert—

In regulation 5(5) (functions of competent authorities in the United Kingdom) for “Directives 95/46/EC” substitute “the GDPR and Directive”.

In paragraph 12A (disclosure to a credit institution or a financial institution), for sub-paragraph (b) substitute—

In section 948(9) (restrictions on disclosure) for “the Data Protection Act 1998 (c. 29)” substitute “the data protection legislation”.

Section 251B (duty to share information) is amended as follows. In subsection (5)(a), for “made by or under the Data Protection Act 1998” substitute “of the data protection legislation”. After subsection (6) insert—

In regulation 45(3) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “the GDPR”.

In Part 3 (interpretation), after paragraph 13 insert—

In section 1173(1) (minor definitions: general), at the appropriate place insert—.

In regulation 46(1) (processing and access to data regarding the European Professional Card), for “Directive 95/46/EC” substitute “the GDPR”.

In section 1224A(7) (restrictions on disclosure), for “the Data Protection Act 1998” substitute “the data protection legislation”.

In regulation 48(2) (processing and access to data regarding the European Professional Card), omit paragraph (2) (deeming the relevant designated competent authorities to be controllers for the purposes of Directive 95/46/EC).

In section 1253D(3) (restriction on transfer of audit working papers to third countries), for “the Data Protection Act 1998” substitute “the data protection legislation”.

In regulation 66(3) (exchange of information), for “Directives 95/46/EC” substitute “the GDPR and Directive”.

In section 1261(1) (minor definitions: Part 42), at the appropriate place insert—.

the data protection legislation section 1261(1)

the data protection legislation section 1173(1)

Schedule 1 to the European Parliamentary Elections (Northern Ireland) Regulations 2004 (European Parliamentary elections rules) is amended as follows.

Regulation 5 of the Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (information whose disclosure would be affected by the application of other legislation) is amended as follows. In paragraph (3)— After paragraph (3) insert— After paragraph (4) insert—

The Data Protection (Processing of Sensitive Personal Data) Order 2009 is revoked.

Regulation 10 of the INSPIRE (Scotland) Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows. In paragraph (2)— After paragraph (6) insert—

The Pharmacy Order 2010 is amended as follows.

The Court Files Privileged Access Rules (Northern Ireland) 2016 are amended as follows.

In regulation 1(2) of the Data Protection (Charges and Information) Regulations 2018 (interpretation), at the appropriate places insert—; .

Paragraph 74(1) (interpretation) is amended as follows. Omit the definitions of “relevant conditions” and “research purposes”. At the appropriate places insert—; .

In article 3(1) (interpretation), omit the definition of “Directive 95/46/EC”.

In rule 5 (information that may released) for “Schedule 1 of the Data Protection Act 1998” substitute —

In paragraph 77(2)(b) (conditions on the use, supply and disclosure of documents open to public inspection), for “research purposes” substitute “Article 89 GDPR purposes”.

Article 9 (inspection and enforcement) is amended as follows. For paragraph (4) substitute— After paragraph (4) insert—

In rule 7(2) (provision of information) for “Schedule 1 of the Data Protection Act 1998” substitute —

In article 33A (European professional card), after paragraph (2) insert—

Article 49 (disclosure of information: general) is amended as follows. In paragraph (2)(a), after “enactment” insert “or the GDPR”. In determining for the purposes of paragraph (2)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by paragraph (1) of this article. In this article, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

Article 55 (professional performance assessments) is amended as follows. In paragraph (5)(a), after “enactment” insert “or the GDPR”. In determining for the purposes of paragraph (5)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by paragraph (4) of this article. In this article, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).

In article 67(6) (Directive 2005/36/EC: designation of competent authority etc.), after sub-paragraph (a) insert—.

Schedule 2A (Directive 2005/36/EC: European professional card) is amended as follows. In paragraph 8(1) (access to data), for “Directive 95/46/EC)” substitute “the GDPR”. In paragraph 9 (processing data)—

The table in Schedule 3 (Directive 2005/36/EC: designation of competent authority etc.) is amended as follows. In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “the GDPR”. In the entry for Article 56a(4), in the second column, for “Directive 95/46/EC” substitute “the GDPR”.