Legislation – Data Protection Act 2018

New Search

Introduction

PART 1
Preliminary

1 Overview

2 Protection of personal data

3 Terms relating to the processing of personal data

PART 2
General processing

CHAPTER 1 Scope and definitions

4 Processing to which this Part applies

5 Definitions

CHAPTER 2 The GDPR

Meaning of certain terms used in the GDPR

6 Meaning of “controller”

7 Meaning of “public authority” and “public body”

Lawfulness of processing

8 Lawfulness of processing: public interest etc

9 Child’s consent in relation to information society services

Special categories of personal data

10 Special categories of personal data and criminal convictions etc data

11 Special categories of personal data etc: supplementary

Rights of the data subject

12 Limits on fees that may be charged by controllers

13 Obligations of credit reference agencies

14 Automated decision-making authorised by law: safeguards

Restrictions on data subject’s rights

15 Exemptions etc

16 Power to make further exemptions etc by regulations

Accreditation of certification providers

17 Accreditation of certification providers

Transfers of personal data to third countries etc

18 Transfers of personal data to third countries etc

Specific processing situations

19 Processing for archiving, research and statistical purposes: safeguards

Minor definition

20 Meaning of “court”

CHAPTER 3 Other general processing

Scope

21 Processing to which this Chapter applies

Application of the GDPR

22 Application of the GDPR to processing to which this Chapter applies

23 Power to make provision in consequence of regulations related to the GDPR

Exemptions etc

24 Manual unstructured data held by FOI public authorities

25 Manual unstructured data used in longstanding historical research

26 National security and defence exemption

27 National security: certificate

28 National security and defence: modifications to Articles 9 and 32 of the applied GDPR

PART 3
Law enforcement processing

CHAPTER 1 Scope and definitions

Scope

29 Processing to which this Part applies

Definitions

30 Meaning of “competent authority”

31 “The law enforcement purposes”

32 Meaning of “controller” and “processor”

33 Other definitions

CHAPTER 2 Principles

34 Overview and general duty of controller

35 The first data protection principle

36 The second data protection principle

37 The third data protection principle

38 The fourth data protection principle

39 The fifth data protection principle

40 The sixth data protection principle

41 Safeguards: archiving

42 Safeguards: sensitive processing

CHAPTER 3 Rights of the data subject

Overview and scope

43 Overview and scope

Information: controller’s general duties

44 Information: controller’s general duties

Data subject’s right of access

45 Right of access by the data subject

Data subject’s rights to rectification or erasure etc

46 Right to rectification

47 Right to erasure or restriction of processing

48 Rights under section 46 or 47: supplementary

Automated individual decision-making

49 Right not to be subject to automated decision-making

50 Automated decision-making authorised by law: safeguards

Supplementary

51 Exercise of rights through the Commissioner

52 Form of provision of information etc

53 Manifestly unfounded or excessive requests by the data subject

54 Meaning of “applicable time period”

CHAPTER 4 Controller and processor

Overview and scope

55 Overview and scope

General obligations

56 General obligations of the controller

57 Data protection by design and default

58 Joint controllers

59 Processors

60 Processing under the authority of the controller or processor

61 Records of processing activities

62 Logging

63 Co-operation with the Commissioner

64 Data protection impact assessment

65 Prior consultation with the Commissioner

Obligations relating to security

66 Security of processing

Obligations relating to personal data breaches

67 Notification of a personal data breach to the Commissioner

68 Communication of a personal data breach to the data subject

Data protection officers

69 Designation of a data protection officer

70 Position of data protection officer

71 Tasks of data protection officer

CHAPTER 5 Transfers of personal data to third countries etc

Overview and interpretation

72 Overview and interpretation

General principles for transfers

73 General principles for transfers of personal data

74 Transfers on the basis of an adequacy decision

75 Transfers on the basis of appropriate safeguards

76 Transfers on the basis of special circumstances

Transfers to particular recipients

77 Transfers of personal data to persons other than relevant authorities

Subsequent transfers

78 Subsequent transfers

CHAPTER 6 Supplementary

79 National security: certificate

80 Special processing restrictions

81 Reporting of infringements

PART 4
Intelligence services processing

CHAPTER 1 Scope and definitions

Scope

82 Processing to which this Part applies

Definitions

83 Meaning of “controller” and “processor”

84 Other definitions

CHAPTER 2 Principles

Overview

85 Overview

The data protection principles

86 The first data protection principle

87 The second data protection principle

88 The third data protection principle

89 The fourth data protection principle

90 The fifth data protection principle

91 The sixth data protection principle

CHAPTER 3 Rights of the data subject

Overview

92 Overview

Rights

93 Right to information

94 Right of access

95 Right of access: supplementary

96 Right not to be subject to automated decision-making

97 Right to intervene in automated decision-making

98 Right to information about decision-making

99 Right to object to processing

100 Rights to rectification and erasure

CHAPTER 4 Controller and processor

Overview

101 Overview

General obligations

102 General obligations of the controller

103 Data protection by design

104 Joint controllers

105 Processors

106 Processing under the authority of the controller or processor

Obligations relating to security

107 Security of processing

Obligations relating to personal data breaches

108 Communication of a personal data breach

CHAPTER 5 Transfers of personal data outside the United Kingdom

109 Transfers of personal data outside the United Kingdom

CHAPTER 6 Exemptions

110 National security

111 National security: certificate

112 Other exemptions

113 Power to make further exemptions

PART 5
The Information Commissioner

114 The Information Commissioner

115 General functions under the GDPR and safeguards

116 Other general functions

117 Competence in relation to courts etc

118 Co-operation and mutual assistance

119 Inspection of personal data in accordance with international obligations

120 Further international role

121 Data-sharing code

122 Direct marketing code

123 Age-appropriate design code

124 Data protection and journalism code

125 Approval of codes prepared under sections 121 to 124

126 Publication and review of codes issued under section 125(4)

127 Effect of codes issued under section 125(4)

128 Other codes of practice

129 Consensual audits

130 Records of national security certificates

131 Disclosure of information to the Commissioner

132 Confidentiality of information

133 Guidance about privileged communications

134 Fees for services

135 Manifestly unfounded or excessive requests by data subjects etc

136 Guidance about fees

137 Charges payable to the Commissioner by controllers

138 Regulations under section 137: supplementary

139 Reporting to Parliament

140 Publication by the Commissioner

141 Notices from the Commissioner

PART 6
Enforcement

142 Information notices

143 Information notices: restrictions

144 False statements made in response to information notices

145 Information orders

146 Assessment notices

147 Assessment notices: restrictions

148 Destroying or falsifying information and documents etc

149 Enforcement notices

150 Enforcement notices: supplementary

151 Enforcement notices: rectification and erasure of personal data etc

152 Enforcement notices: restrictions

153 Enforcement notices: cancellation and variation

154 Powers of entry and inspection

155 Penalty notices

156 Penalty notices: restrictions

157 Maximum amount of penalty

158 Fixed penalties for non-compliance with charges regulations

159 Amount of penalties: supplementary

160 Guidance about regulatory action

161 Approval of first guidance about regulatory action

162 Rights of appeal

163 Determination of appeals

164 Applications in respect of urgent notices

165 Complaints by data subjects

166 Orders to progress complaints

167 Compliance orders

168 Compensation for contravention of the GDPR

169 Compensation for contravention of other data protection legislation

170 Unlawful obtaining etc of personal data

171 Re-identification of de-identified personal data

172 Re-identification: effectiveness testing conditions

173 Alteration etc of personal data to prevent disclosure to data subject

174 The special purposes

175 Provision of assistance in special purposes proceedings

176 Staying special purposes proceedings

177 Guidance about how to seek redress against media organisations

178 Review of processing of personal data for the purposes of journalism

179 Effectiveness of the media’s dispute resolution procedures

180 Jurisdiction

181 Interpretation of Part 6

PART 7
Supplementary and final provision

182 Regulations and consultation

183 Power to reflect changes to the Data Protection Convention

184 Prohibition of requirement to produce relevant records

185 Avoidance of certain contractual terms relating to health records

186 Data subject’s rights and other prohibitions and restrictions

187 Representation of data subjects with their authority

188 Representation of data subjects with their authority: collective proceedings

189 Duty to review provision for representation of data subjects

190 Post-review powers to make provision about representation of data subjects

191 Framework for Data Processing by Government

192 Approval of the Framework

193 Publication and review of the Framework

194 Effect of the Framework

195 Reserve forces: data-sharing by HMRC

196 Penalties for offences

197 Prosecution

198 Liability of directors etc

199 Recordable offences

200 Guidance about PACE codes of practice

201 Disclosure of information to the Tribunal

202 Proceedings in the First-tier Tribunal: contempt

203 Tribunal Procedure Rules

204 Meaning of “health professional” and “social work professional”

205 General interpretation

206 Index of defined expressions

207 Territorial application of this Act

208 Children in Scotland

209 Application to the Crown

210 Application to Parliament

211 Minor and consequential provision

212 Commencement

213 Transitional provision

214 Extent

215 Short title

SCHEDULES

SCHEDULE 1 Special categories of personal data and criminal convictions etc data

SCHEDULE 2 Exemptions etc from the GDPR

SCHEDULE 3 Exemptions etc from the GDPR: health, social work, education and child abuse data

SCHEDULE 4 Exemptions etc from the GDPR: disclosure prohibited or restricted by an enactment

SCHEDULE 5 Accreditation of certification providers: reviews and appeals

SCHEDULE 6 The applied GDPR and the applied Chapter 2

SCHEDULE 7 Competent authorities

SCHEDULE 8 Conditions for sensitive processing under Part 3

SCHEDULE 9 Conditions for processing under Part 4

SCHEDULE 10 Conditions for sensitive processing under Part 4

SCHEDULE 11 Other exemptions under Part 4

SCHEDULE 12 The Information Commissioner

SCHEDULE 13 Other general functions of the Commissioner

SCHEDULE 14 Co-operation and mutual assistance

SCHEDULE 15 Powers of entry and inspection

SCHEDULE 16 Penalties

SCHEDULE 17 Review of processing of personal data for the purposes of journalism

SCHEDULE 18 Relevant records

SCHEDULE 19 Minor and consequential amendments

SCHEDULE 20 Transitional provision etc

SCHEDULES

SCHEDULE 5Accreditation of certification providers: reviews and appeals

Section 17

Introduction

1

(1)

This Schedule applies where—

(a)

a person (“the applicant”) applies to an accreditation authority for accreditation as a certification provider, and

(b)

is dissatisfied with the decision on that application.

(2)

In this Schedule—

accreditation authority” means—

(a)

the Commissioner, or

(b)

the national accreditation body;

certification provider” and “national accreditation body” have the same meaning as in section 17.

Review

2

(1)

The applicant may ask the accreditation authority to review the decision.

(2)

The request must be made in writing before the end of the period of 28 days beginning with the day on which the person receives written notice of the accreditation authority’s decision.

(3)

The request must specify—

(a)

the decision to be reviewed, and

(b)

the reasons for asking for the review.

(4)

The request may be accompanied by additional documents which the applicant wants the accreditation authority to take into account for the purposes of the review.

(5)

If the applicant makes a request in accordance with sub-paragraphs (1) to (4), the accreditation authority must—

(a)

review the decision, and

(b)

inform the applicant of the outcome of the review in writing before the end of the period of 28 days beginning with the day on which the request for a review is received.

Right to appeal

3

(1)

If the applicant is dissatisfied with the decision on the review under paragraph 2, the applicant may ask the accreditation authority to refer the decision to an appeal panel constituted in accordance with paragraph 4.

(2)

The request must be made in writing before the end of the period of 3 months beginning with the day on which the person receives written notice of the decision on the review.

(3)

A request must specify—

(a)

the decision to be referred to the appeal panel, and

(b)

the reasons for asking for it to be referred.

(4)

The request may be accompanied by additional documents which the applicant wants the appeal panel to take into account.

(5)

The applicant may discontinue an appeal at any time by giving notice in writing to the accreditation authority.

Appeal panel

4

(1)

If the applicant makes a request in accordance with paragraph 3, an appeal panel must be established in accordance with this paragraph.

(2)

An appeal panel must consist of a chair and at least two other members.

(3)

Where the request relates to a decision of the Commissioner—

(a)

the Secretary of State may appoint one person to be a member of the appeal panel other than the chair, and

(b)

subject to paragraph (a), the Commissioner must appoint the members of the appeal panel.

(4)

Where the request relates to a decision of the national accreditation body—

(a)

the Secretary of State—

(i)

may appoint one person to be a member of the appeal panel other than the chair, or

(ii)

may direct the Commissioner to appoint one person to be a member of the appeal panel other than the chair, and

(b)

subject to paragraph (a), the chair of the national accreditation body must appoint the members of the appeal panel.

(5)

A person may not be a member of an appeal panel if the person—

(a)

has a commercial interest in the decision referred to the panel,

(b)

has had any prior involvement in any matters relating to the decision, or

(c)

is an employee or officer of the accreditation authority.

(6)

The Commissioner may not be a member of an appeal panel to which a decision of the Commissioner is referred.

(7)

The applicant may object to all or any of the members of the appeal panel appointed under sub-paragraph (3) or (4).

(8)

If the applicant objects to a member of the appeal panel under sub-paragraph (7), the person who appointed that member must appoint a replacement.

(9)

The applicant may not object to a member of the appeal panel appointed under sub-paragraph (8).

Hearing

5

(1)

If the appeal panel considers it necessary, a hearing must be held at which both the applicant and the accreditation authority may be represented.

(2)

Any additional documents which the applicant or the accreditation authority want the appeal panel to take into account must be submitted to the chair of the appeal panel at least 5 working days before the hearing.

(3)

The appeal panel may allow experts and witnesses to give evidence at a hearing.

Decision following referral to appeal panel

6

(1)

The appeal panel must, before the end of the period of 28 days beginning with the day on which the appeal panel is established in accordance with paragraph 4—

(a)

make a reasoned recommendation in writing to the accreditation authority, and

(b)

give a copy of the recommendation to the applicant.

(2)

For the purposes of sub-paragraph (1), where there is an objection under paragraph 4(7), an appeal panel is not to be taken to be established in accordance with paragraph 4 until the replacement member is appointed (or, if there is more than one objection, until the last replacement member is appointed).

(3)

The accreditation authority must, before the end of the period of 3 working days beginning with the day on which the authority receives the recommendation—

(a)

make a reasoned final decision in writing, and

(b)

give a copy of the decision to the applicant.

(4)

Where the accreditation authority is the national accreditation body, the recommendation must be given to, and the final decision must be made by, the chief executive of that body.

Meaning of “working day”

7

In this Schedule, “working day” means any day other than—

(a)

Saturday or Sunday,

(b)

Christmas Day or Good Friday, or

(c)

a day which is a bank holiday under the Banking and Financial Dealings Act 1971 in any part of the United Kingdom.