Data Protection Act 2018

PART 3 Modifications

Introduction

430 (1) Unless the context otherwise requires, legislation described in sub-paragraph (2) has effect on and after the day on which this Part of this Schedule comes into force as if it were modified in accordance with this Part of this Schedule.

(2) That legislation is—

(a) subordinate legislation made before the day on which this Part of this Schedule comes into force;

(b) primary legislation that is passed or made before the end of the Session in which this Act is passed.

(3) In this Part of this Schedule—

• “primary legislation” has the meaning given in section 211(7);

• “references” includes any references, however expressed.

General modifications

431 (1) References to a particular provision of, or made under, the Data Protection Act 1998 have effect as references to the equivalent provision or provisions of, or made under, the data protection legislation.

(2) Other references to the Data Protection Act 1998 have effect as references to the data protection legislation.

(3) References to disclosure, use or other processing of information that is prohibited or restricted by an enactment which include disclosure, use or other processing of information that is prohibited or restricted by the Data Protection Act 1998 have effect as if they included disclosure, use or other processing of information that is prohibited or restricted by the GDPR or the applied GDPR.

Specific modification of references to terms used in the Data Protection Act 1998

432 (1) References to personal data, and to the processing of such data, as defined in the Data Protection Act 1998, have effect as references to personal data, and to the processing of such data, as defined for the purposes of Parts 5 to 7 of this Act (see section 3(2), (4) and (14)).

(2) References to processing as defined in the Data Protection Act 1998, in relation to information, have effect as references to processing as defined in section 3(4).

(3) References to a data subject as defined in the Data Protection Act 1998 have effect as references to a data subject as defined in section 3(5).

(4) References to a data controller as defined in the Data Protection Act 1998 have effect as references to a controller as defined for the purposes of Parts 5 to 7 of this Act (see section 3(6) and (14)).

(5) References to the data protection principles set out in the Data Protection Act 1998 have effect as references to the principles set out in—

(a) Article 5(1) of the GDPR and the applied GDPR, and

(b) sections 34(1) and 85(1) of this Act.

(6) References to direct marketing as defined in section 11 of the Data Protection Act 1998 have effect as references to direct marketing as defined in section 122 of this Act.

(7) References to a health professional within the meaning of section 69(1) of the Data Protection Act 1998 have effect as references to a health professional within the meaning of section 204 of this Act.

(8) References to a health record within the meaning of section 68(2) of the Data Protection Act 1998 have effect as references to a health record within the meaning of section 205 of this Act.