Data Protection Act 2018 (c. 12)

SCHEDULES

SCHEDULE 19 U.K. Minor and consequential amendments

PART 2 U.K. Amendments of other legislation

Register of People with Significant Control Regulations 2016 (S.I. 2016/339) U.K.

399 U.K. Schedule 4 to the Register of People with Significant Control Regulations 2016 (conditions for permitted disclosure) is amended as follows.

Commencement Information

I1 Sch. 19 para. 399 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

400 (1) Paragraph 6 (disclosure to a credit reference agency) is amended as follows. U.K.

(2) In sub-paragraph (b), for paragraph (ii) (together with the final “; and”) substitute—

“(ii) for the purposes of ensuring that it complies with its data protection obligations;”.

(3) In sub-paragraph (c)—

(a) omit “or” at the end of paragraph (ii), and

(b) at the end insert—

“(iv) section 144 of the Data Protection Act 2018 (false statements made in response to an information notice); or

(v) section 148 of that Act (destroying or falsifying information and documents etc);”

(4) After sub-paragraph (c) insert—

“(d) has not been given a penalty notice under section 155 of the Data Protection Act 2018 in circumstances described in sub-paragraph (c)(iii), other than a penalty notice that has been cancelled.”

Commencement Information

I2 Sch. 19 para. 400 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

401 U.K. In paragraph 12A (disclosure to a credit institution or a financial institution), for sub-paragraph (b) substitute—

“(b) for the purposes of ensuring that it complies with its data protection obligations.”

Commencement Information

I3 Sch. 19 para. 401 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)

402 U.K. In Part 3 (interpretation), after paragraph 13 insert—

“14 In this Schedule, “data protection obligations”, in relation to a credit reference agency, a credit institution or a financial institution, means—

(a) where the agency or institution carries on business in the United Kingdom, obligations under the data protection legislation (as defined in section 3 of the Data Protection Act 2018);

(b) where the agency or institution carries on business in a EEA State other than the United Kingdom, obligations under—

(i) the GDPR (as defined in section 3(10) of the Data Protection Act 2018),

(ii) legislation made in exercise of powers conferred on member States under the GDPR (as so defined), and

(iii) legislation implementing the Law Enforcement Directive (as defined in section 3(12) of the Data Protection Act 2018).”

Commencement Information

I4 Sch. 19 para. 402 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(g)