Data Protection Act 2018

PART 1 U.K. Modifications to the GDPR

Introductory U.K.

1 U.K. In its application by virtue of section 22(1), the GDPR has effect as if it were modified as follows.

Commencement Information

I1 Sch. 6 para. 1 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

References to the GDPR and its provisions U.K.

2 (1) References to “this Regulation” and to provisions of the GDPR have effect as references to the applied GDPR and to the provisions of the applied GDPR. U.K.

(2) But sub-paragraph (1) does not have effect—

(a) in the case of the references which are modified or inserted by paragraphs 9(f)(ii), 15(b), 16(a)(ii), 35, 36(a) and (e)(ii) and 38(a)(i);

(b) in relation to the references in points (a) and (b) of paragraph 2 of Article 61, as inserted by paragraph 49.

Commencement Information

I2 Sch. 6 para. 2 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

References to Union law and Member State law U.K.

3 (1) References to “Union law”, “Member State law”, “the law of a Member State” and “Union or Member State law” have effect as references to domestic law. U.K.

(2) Sub-paragraph (1) is subject to the specific modifications made in this Part of this Schedule.

(3) In this paragraph, “domestic law” means the law of the United Kingdom, or of a part of the United Kingdom, and includes law in the form of an enactment, an instrument made under Her Majesty's prerogative or a rule of law.

Commencement Information

I3 Sch. 6 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

References to the Union and to Member States U.K.

4 (1) References to “the Union”, “a Member State” and “Member States” have effect as references to the United Kingdom. U.K.

(2) Sub-paragraph (1) is subject to the specific modifications made in this Part of this Schedule (including paragraph 3(1)).

Commencement Information

I4 Sch. 6 para. 4 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

References to supervisory authorities U.K.

5 (1) References to a “supervisory authority”, a “competent supervisory authority” or “supervisory authorities”, however expressed, have effect as references to the Commissioner. U.K.

(2) Sub-paragraph (1) does not apply to the references in—

(a) Article 4(21) as modified by paragraph 9(f);

(b) Article 57(1)(h);

(c) Article 61(1) inserted by paragraph 49.

(3) Sub-paragraph (1) is also subject to the specific modifications made in this Part of this Schedule.

Commencement Information

I5 Sch. 6 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

References to the national parliament U.K.

6 U.K. References to “the national parliament” have effect as references to both Houses of Parliament.

Commencement Information

I6 Sch. 6 para. 6 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Chapter I of the GDPR (general provisions) U.K.

7 U.K. For Article 2 (material scope) substitute—

“2 This Regulation applies to the processing of personal data to which Chapter 3 of Part 2 of the 2018 Act applies (see section 21 of that Act).”

Commencement Information

I7 Sch. 6 para. 7 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

8 U.K. For Article 3 substitute—

“Article 3 U.K. Territorial application

Subsections (1), (2) and (7) of section 207 of the 2018 Act have effect for the purposes of this Regulation as they have effect for the purposes of that Act but as if the following were omitted—

(a) in subsection (1), the reference to subsection (3), and

(b) in subsection (7), the words following paragraph (d).”

Commencement Information

I8 Sch. 6 para. 8 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

9 U.K. In Article 4 (definitions)—

(a) in paragraph (7) (meaning of “controller”), for “; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law” substitute “ , subject to section 6 of the 2018 Act (meaning of “controller”) ”;

(b) after paragraph (7) insert—

“(7A) “the 2018 Act” means the Data Protection Act 2018 as applied by section 22 of that Act and further modified by section 3 of that Act.”;

(c) omit paragraph (16) (meaning of “main establishment”);

(d) omit paragraph (17) (meaning of “representative”);

(e) in paragraph (20) (meaning of “binding corporate rules”), for “on the territory of a Member State” substitute “ in the United Kingdom ”;

(f) in paragraph (21) (meaning of “supervisory authority”)—

(i) after “a Member State” insert “ (other than the United Kingdom) ”;

(ii) for “Article 51” substitute “ Article 51 of the GDPR ”;

(g) after paragraph (21) insert—

“(21A) “the Commissioner” means the Information Commissioner (see section 114 of the 2018 Act);”;

(h) omit paragraph (22) (meaning of “supervisory authority concerned”);

(i) omit paragraph (23) (meaning of “cross-border processing”);

(j) omit paragraph (24) (meaning of “relevant and reasoned objection”);

(k) after paragraph (26) insert—

“(27) “the GDPR” has the meaning given in section 3(10) of the 2018 Act.

(28) “domestic law” has the meaning given in paragraph 3(3) of Schedule 6 to the 2018 Act.”

Commencement Information

I9 Sch. 6 para. 9 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Chapter II of the GDPR (principles) U.K.

10 U.K. In Article 6 (lawfulness of processing)—

(a) omit paragraph 2;

(b) in paragraph 3, for the first subparagraph substitute—

“In addition to the provision made in section 15 of and Part 1 of Schedule 2 to the 2018 Act, a legal basis for the processing referred to in point (c) and (e) of paragraph 1 may be laid down by the Secretary of State in regulations (see section 16 of the 2018 Act).”;

(c) in paragraph 3, in the second subparagraph, for “The Union or the Member State law shall” substitute “ The regulations must ”.

Commencement Information

I10 Sch. 6 para. 10 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

11 U.K. In Article 8 (conditions applicable to child's consent in relation to information society services)—

(a) in paragraph 1, for the second subparagraph substitute—

“This paragraph is subject to section 9 of the 2018 Act.”;

(b) in paragraph 3, for “the general contract law of Member States” substitute “ the general law of contract as it operates in domestic law ”.

Commencement Information

I11 Sch. 6 para. 11 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

12 U.K. In Article 9 (processing of special categories of personal data)—

(a) in paragraph 2(a), omit “, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject”;

(b) in paragraph 2(b), for “Union or Member State law” substitute “ domestic law (see section 10 of the 2018 Act) ”;

(c) in paragraph 2, for point (g) substitute—

“(g) processing is necessary for reasons of substantial public interest and is authorised by domestic law (see section 10 of the 2018 Act);”;

(d) in paragraph 2(h), for “Union or Member State law” substitute “ domestic law (see section 10 of the 2018 Act) ”;

(e) in paragraph 2(i), for “Union or Member State law” insert “ domestic law (see section 10 of the 2018 Act); ”;

(f) in paragraph 2, for point (j) substitute—

“(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act) and is authorised by domestic law (see section 10 of that Act).”;

(g) in paragraph 3, for “national competent bodies”, in both places, substitute “ a national competent body of the United Kingdom ”;

(h) omit paragraph 4.

Commencement Information

I12 Sch. 6 para. 12 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

13 U.K. In Article 10 (processing of personal data relating to criminal convictions and offences), in the first sentence, for “Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects” substitute “ domestic law (see section 10 of the 2018 Act) ”.

Commencement Information

I13 Sch. 6 para. 13 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Section 1 of Chapter III of the GDPR (rights of the data subject: transparency and modalities) U.K.

14 U.K. In Article 12 (transparent information etc for the exercise of the rights of the data subject), omit paragraph 8.

Commencement Information

I14 Sch. 6 para. 14 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Section 2 of Chapter III of the GDPR (rights of the data subject: information and access to personal data) U.K.

15 U.K. In Article 13 (personal data collected from data subject: information to be provided), in paragraph 1—

(a) in point (a), omit “and, where applicable, of the controller's representative”;

(b) in point (f), after “the Commission” insert “ pursuant to Article 45(3) of the GDPR ”.

Commencement Information

I15 Sch. 6 para. 15 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

16 U.K. In Article 14 (personal data collected other than from data subject: information to be provided)—

(a) in paragraph 1—

(i) in point (a), omit “and, where applicable, of the controller's representative”;

(ii) in point (f), after “the Commission” insert “ pursuant to Article 45(3) of the GDPR ”;

(b) in paragraph 5(c), for “Union or Member State law to which the controller is subject” substitute “ a rule of domestic law ”.

Commencement Information

I16 Sch. 6 para. 16 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Section 3 of Chapter III of the GDPR (rights of the data subject: rectification and erasure) U.K.

17 U.K. In Article 17 (right to erasure (‘right to be forgotten’))—

(a) in paragraph 1(e), for “in Union or Member State law to which the controller is subject” substitute “ under domestic law ”;

(b) in paragraph 3(b), for “by Union or Member State law to which the controller is subject” substitute “ under domestic law ”.

Commencement Information

I17 Sch. 6 para. 17 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

18 U.K. In Article 18 (right to restriction of processing), in paragraph 2, for “of the Union or of a Member State” substitute “ of the United Kingdom ”.

Commencement Information

I18 Sch. 6 para. 18 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Section 4 of Chapter III of the GDPR (rights of the data subject: right to object and automated individual decision-making) U.K.

19 U.K. In Article 21 (right to object), in paragraph 5, omit “, and notwithstanding Directive 2002/58/EC,”.

Commencement Information

I19 Sch. 6 para. 19 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

20 U.K. In Article 22 (automated individual decision-making, including profiling), for paragraph 2(b) substitute—

“(b) is a qualifying significant decision for the purposes of section 14 of the 2018 Act; or”.

Commencement Information

I20 Sch. 6 para. 20 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Section 5 of Chapter III of the GDPR (rights of the data subject: restrictions) U.K.

21 U.K. In Article 23 (restrictions), in paragraph 1—

(a) for “Union or Member State law to which the data controller or processor is subject” substitute “ In addition to the provision made by section 15 of and Schedules 2, 3 and 4 to the 2018 Act, the Secretary of State ”;

(b) in point (e), for “of the Union or of a Member State”, in both places, substitute “ of the United Kingdom ”;

(c) after point (j) insert—

“See section 16 of the 2018 Act.”

Commencement Information

I21 Sch. 6 para. 21 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Section 1 of Chapter IV of the GDPR (controller and processor: general obligations) U.K.

22 U.K. In Article 26 (joint controllers), in paragraph 1, for “Union or Member State law to which the controllers are subject” substitute “ domestic law ”.

Commencement Information

I22 Sch. 6 para. 22 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

23 U.K. Omit Article 27 (representatives of controllers or processors not established in the Union).

Commencement Information

I23 Sch. 6 para. 23 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

24 U.K. In Article 28 (processor)—

(a) in paragraph 3, in point (a), for “Union or Member State law to which the processor is subject” substitute “ domestic law ”;

(b) in paragraph 3, in the second subparagraph, for “other Union or Member State data protection provisions” substitute “ any other rule of domestic law relating to data protection ”;

(c) in paragraph 6, for “paragraphs 7 and 8” substitute “ paragraph 8 ”;

(d) omit paragraph 7;

(e) in paragraph 8, omit “and in accordance with the consistency mechanism referred to in Article 63”.

Commencement Information

I24 Sch. 6 para. 24 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

25 U.K. In Article 30 (records of processing activities)—

(a) in paragraph 1, in the first sentence, omit “and, where applicable, the controller's representative,”;

(b) in paragraph 1, in point (a), omit “, the controller's representative”;

(c) in paragraph 1, in point (g), after “32(1)” insert “ or section 28(3) of the 2018 Act ”;

(d) in paragraph 2, in the first sentence, omit “and, where applicable, the processor's representative”;

(e) in paragraph 2, in point (a), omit “the controller's or the processor's representative, and”;

(f) in paragraph 2, in point (d), after “32(1)” insert “ or section 28(3) of the 2018 Act ”;

(g) in paragraph 4, omit “and, where applicable, the controller's or the processor's representative,”.

Commencement Information

I25 Sch. 6 para. 25 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

26 U.K. In Article 31 (co-operation with the supervisory authority), omit “and, where applicable, their representatives,”.

Commencement Information

I26 Sch. 6 para. 26 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Section 3 of Chapter IV of the GDPR (controller and processor: data protection impact assessment and prior consultation) U.K.

27 U.K. In Article 35 (data protection impact assessment), omit paragraphs 4, 5, 6 and 10.

Commencement Information

I27 Sch. 6 para. 27 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

28 U.K. In Article 36 (prior consultation)—

(a) for paragraph 4 substitute—

“4 The Secretary of State must consult the Commissioner during the preparation of any proposal for a legislative measure which relates to processing.”;

(b) omit paragraph 5.

Commencement Information

I28 Sch. 6 para. 28 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Section 4 of Chapter IV of the GDPR (controller and processor: data protection officer) U.K.

29 U.K. In Article 37 (designation of data protection officers), omit paragraph 4.

Commencement Information

I29 Sch. 6 para. 29 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

30 U.K. In Article 39 (tasks of the data protection officer), in paragraph 1(a) and (b), for “other Union or Member State data protection provisions” substitute “ other rules of domestic law relating to data protection ”.

Commencement Information

I30 Sch. 6 para. 30 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Section 5 of Chapter IV of the GDPR (controller and processor: codes of conduct and certification) U.K.

31 U.K. In Article 40 (codes of conduct)—

(a) in paragraph 1, for “The Member States, the supervisory authorities, the Board and the Commission shall” substitute “ The Commissioner must ”;

(b) omit paragraph 3;

(c) in paragraph 6, omit “, and where the code of conduct concerned does not relate to processing activities in several Member States”;

(d) omit paragraphs 7 to 11.

Commencement Information

I31 Sch. 6 para. 31 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

32 U.K. In Article 41 (monitoring of approved codes of conduct), omit paragraph 3.

Commencement Information

I32 Sch. 6 para. 32 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

33 U.K. In Article 42 (certification)—

(a) in paragraph 1—

(i) for “The Member States, the supervisory authorities, the Board and the Commission” substitute “ The Commissioner ”;

(ii) omit “, in particular at Union level,”;

(b) omit paragraph 2;

(c) in paragraph 5, omit “or by the Board pursuant to Article 63. Where the criteria are approved by the Board, this may result in a common certification, the European Data Protection Seal”;

(d) omit paragraph 8.

Commencement Information

I33 Sch. 6 para. 33 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

34 U.K. In Article 43 (certification bodies)—

(a) in paragraph 1, in the second sentence, for “Member States shall ensure that those certification bodies are” substitute “ Those certification bodies must be ”;

(b) in paragraph 2, in point (b), omit “or by the Board pursuant to Article 63”;

(c) in paragraph 3, omit “or by the Board pursuant to Article 63”;

(d) in paragraph 6, omit the second and third sentences;

(e) omit paragraphs 8 and 9.

Commencement Information

I34 Sch. 6 para. 34 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Chapter V of the GDPR (transfers of data to third countries or international organisations) U.K.

35 U.K. In Article 45 (transfers on the basis of an adequacy decision)—

(a) in paragraph 1, after “decided” insert “ in accordance with Article 45 of the GDPR ”;

(b) after paragraph 1 insert—

“1A But a transfer of personal data to a third country or international organisation must not take place under paragraph 1, if the Commission's decision in relation to the third country (including a territory or sector within it) or the international organisation—

(a) is suspended,

(b) has been amended, or

(c) has been repealed,

by the Commission under Article 45(5) of the GDPR.”;

(c) omit paragraphs 2 to 8;

(d) in paragraph 9, for “of this Article” substitute “ of Article 45 of the GDPR ”.

Commencement Information

I35 Sch. 6 para. 35 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

36 U.K. In Article 46 (transfers subject to appropriate safeguards)—

(a) in paragraph 1, for “Article 45(3)” substitute “ Article 45(3) of the GDPR ”;

(b) in paragraph 2, omit point (c);

(c) in paragraph 2, in point (d), omit “and approved by the Commission pursuant to the examination procedure referred to in Article 93(2)”;

(d) omit paragraph 4;

(e) in paragraph 5—

(i) in the first sentence, for “a Member State or supervisory authority” substitute “ the Commissioner ”;

(ii) in the second sentence, for “this Article” substitute “ Article 46 of the GDPR ”.

Commencement Information

I36 Sch. 6 para. 36 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

37 U.K. In Article 47 (binding corporate rules)—

(a) in paragraph 1, in the first sentence, omit “in accordance with the consistency mechanism set out in Article 63”;

(b) in paragraph 2, in point (e), for “the competent courts of the Member States” substitute “ a court ”;

(c) in paragraph 2, in point (f), for “on the territory of a Member State” substitute “ in the United Kingdom ”;

(d) omit paragraph 3.

Commencement Information

I37 Sch. 6 para. 37 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

38 U.K. In Article 49 (derogations for specific situations)—

(a) in paragraph 1, in the first sentence—

(i) for “Article 45(3)” substitute “ Article 45(3) of the GDPR ”;

(ii) for “Article 46” substitute “ Article 46 of this Regulation ”;

(b) in paragraph 4, for “Union law or in the law of the Member State to which the controller is subject” substitute “ domestic law (see section 18 of the 2018 Act which makes certain provision about the public interest) ”;

(c) for paragraph 5 substitute—

“5 Paragraph 1 is subject to any regulations made under section 18(2) of the 2018 Act.”

Commencement Information

I38 Sch. 6 para. 38 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

39 U.K. In Article 50 (international co-operation for the protection of personal data), omit “the Commission and”.

Commencement Information

I39 Sch. 6 para. 39 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Section 1 of Chapter VI of the GDPR (independent supervisory authorities: independent status) U.K.

40 U.K. In Article 51 (supervisory authority)—

(a) in paragraph 1—

(i) for “Each Member State shall provide for one or more independent public authorities to be” substitute “ The Commissioner is ”;

(ii) omit “and to facilitate the free flow of personal data within the Union (‘supervisory authority’)”;

(b) omit paragraphs 2 to 4.

Commencement Information

I40 Sch. 6 para. 40 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

41 U.K. In Article 52 (independence)—

(a) in paragraph 2—

(i) for “The member or members of each supervisory authority” substitute “ The Commissioner ”;

(ii) for “their”, in both places, substitute “the Commissioner's”;

(b) in paragraph 3—

(i) for “Member or members of each supervisory authority” substitute “ The Commissioner ”;

(ii) for “their”, in both places, substitute “the Commissioner's”;

(c) omit paragraphs 4 to 6.

Commencement Information

I41 Sch. 6 para. 41 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

42 U.K. Omit Article 53 (general conditions for the members of the supervisory authority).

Commencement Information

I42 Sch. 6 para. 42 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

43 U.K. Omit Article 54 (rules on the establishment of the supervisory authority).

Commencement Information

I43 Sch. 6 para. 43 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Section 2 of Chapter VI of the GDPR (independent supervisory authorities: competence, tasks and powers) U.K.

44 U.K. In Article 55 (competence)—

(a) in paragraph 1, omit “on the territory of its own Member State”;

(b) omit paragraph 2.

Commencement Information

I44 Sch. 6 para. 44 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

45 U.K. Omit Article 56 (competence of the lead supervisory authority).

Commencement Information

I45 Sch. 6 para. 45 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

46 U.K. In Article 57 (tasks)—

(a) in paragraph 1, in the first sentence, for “each supervisory authority shall on its territory” substitute “ the Commissioner is to ”;

(b) in paragraph 1, in point (e), omit “and, if appropriate, cooperate with the supervisory authorities in other Member States to that end”;

(c) in paragraph 1, in point (f), omit “or coordination with another supervisory authority”;

(d) in paragraph 1, omit points (g), (k) and (t);

(e) after paragraph 1 insert—

“1A In this Article and Article 58, references to “this Regulation” have effect as references to this Regulation and section 28(3) of the 2018 Act.”

Commencement Information

I46 Sch. 6 para. 46 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

47 U.K. In Article 58 (powers)—

(a) in paragraph 1, in point (a), omit “, and, where applicable, the controller's or the processor's representative”;

(b) in paragraph 1, in point (f), for “Union or Member State procedural law” substitute “ domestic law ”;

(c) in paragraph 3, in point (b), for “the Member State government” substitute “ the Secretary of State ”;

(d) in paragraph 3, omit point (c);

(e) omit paragraphs 4 to 6.

Commencement Information

I47 Sch. 6 para. 47 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

48 U.K. In Article 59 (activity reports)—

(a) for “, the government and other authorities as designated by Member State law” substitute “ and the Secretary of State ”;

(b) omit “, to the Commission and to the Board”.

Commencement Information

I48 Sch. 6 para. 48 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Chapter VII of the GDPR (co-operation and consistency) U.K.

49 U.K. For Articles 60 to 76 substitute—

“Article 61 U.K. Co-operation with other supervisory authorities etc

1 The Commissioner may, in connection with carrying out the Commissioner's functions under this Regulation—

(a) co-operate with, provide assistance to and seek assistance from other supervisory authorities;

(b) conduct joint operations with other supervisory authorities, including joint investigations and joint enforcement measures.

2 The Commissioner must, in carrying out the Commissioner's functions under this Regulation, have regard to—

(a) decisions, advice, guidelines, recommendations and best practices issued by the European Data Protection Board established under Article 68 of the GDPR;

(b) any implementing acts adopted by the Commission under Article 67 of the GDPR (exchange of information).”

Commencement Information

I49 Sch. 6 para. 49 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Chapter VIII of the GDPR (remedies, liability and penalties) U.K.

50 U.K. In Article 77 (right to lodge a complaint with a supervisory authority)—

(a) in paragraph 1, omit “in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement”;

(b) in paragraph 2, for “The supervisory authority with which the complaint has been lodged” substitute “ The Commissioner ”.

Commencement Information

I50 Sch. 6 para. 50 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

51 U.K. In Article 78 (right to an effective judicial remedy against a supervisory authority)—

(a) omit paragraph 2;

(b) for paragraph 3 substitute—

“3 Proceedings against the Commissioner are to be brought before a court in the United Kingdom.”;

(c) omit paragraph 4.

Commencement Information

I51 Sch. 6 para. 51 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

52 U.K. In Article 79 (right to an effective judicial remedy against a controller or processor), for paragraph 2 substitute—

“2 Proceedings against a controller or a processor are to be brought before a court (see section 180 of the 2018 Act).”

Commencement Information

I52 Sch. 6 para. 52 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

53 U.K. In Article 80 (representation of data subjects)—

(a) in paragraph 1, omit “where provided for by Member State law”;

(b) in paragraph 2, for “Member States” substitute “ The Secretary of State ”;

(c) after that paragraph insert—

“3 The power under paragraph 2 may only be exercised by making regulations under section 190 of the 2018 Act.”

Commencement Information

I53 Sch. 6 para. 53 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

54 U.K. Omit Article 81 (suspension of proceedings).

Commencement Information

I54 Sch. 6 para. 54 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

55 U.K. In Article 82 (right to compensation and liability), for paragraph 6 substitute—

“6 Proceedings for exercising the right to receive compensation are to be brought before a court (see section 180 of the 2018 Act).”

Commencement Information

I55 Sch. 6 para. 55 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

56 U.K. In Article 83 (general conditions for imposing administrative fines)—

(a) in paragraph 5, in point (d), for “pursuant to Member State law adopted under Chapter IX” substitute “ under Part 5 or 6 of Schedule 2 to the 2018 Act or under regulations made under section 16 of that Act ”;

(b) in paragraph 7—

(i) for “each Member State” substitute “ the Secretary of State ”;

(ii) for “that Member State” substitute “ the United Kingdom ”;

(c) for paragraph 8 substitute—

“8 Section 115(9) of the 2018 Act makes provision about the exercise of the Commissioner's powers under this Article.”;

(d) omit paragraph 9.

Commencement Information

I56 Sch. 6 para. 56 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

57 U.K. In Article 84 (penalties)—

(a) for paragraph 1 substitute—

“1 The rules on other penalties applicable to infringements of this Regulation are set out in the 2018 Act (see in particular Part 6 (enforcement)).”;

(b) omit paragraph 2.

Commencement Information

I57 Sch. 6 para. 57 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Chapter IX of the GDPR (provisions relating to specific processing situations) U.K.

58 U.K. In Article 85 (processing and freedom of expression and information)—

(a) omit paragraph 1;

(b) in paragraph 2, for “Member States shall” substitute “ the Secretary of State, in addition to the relevant provisions, may by way of regulations (see section 16 of the 2018 Act), ”;

(c) in paragraph 2, at the end insert—

“In this paragraph, “the relevant provisions” means section 15 of and Part 5 of Schedule 2 to the 2018 Act.”;

(d) omit paragraph 3.

Commencement Information

I58 Sch. 6 para. 58 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

59 U.K. In Article 86 (processing and public access to official documents), for “Union or Member State law to which the public authority or body is subject” substitute “ domestic law ”.

Commencement Information

I59 Sch. 6 para. 59 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

60 U.K. Omit Article 87 (processing of national identification number).

Commencement Information

I60 Sch. 6 para. 60 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

61 U.K. Omit Article 88 (processing in the context of employment).

Commencement Information

I61 Sch. 6 para. 61 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Prospective

No commentary item could be found for this reference key-ed56ea896273a41068d24de6c71e616562 U.K. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

63 U.K. Omit Article 90 (obligations of secrecy).

Commencement Information

I62 Sch. 6 para. 63 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

64 U.K. Omit Article 91 (existing data protection rules of churches and religious associations).

Commencement Information

I63 Sch. 6 para. 64 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Chapter X of the GDPR (delegated acts and implementing acts) U.K.

65 U.K. Omit Article 92 (exercise of the delegation).

Commencement Information

I64 Sch. 6 para. 65 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

66 U.K. Omit Article 93 (committee procedure).

Commencement Information

I65 Sch. 6 para. 66 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

Chapter XI of the GDPR (final provisions) U.K.

67 U.K. Omit Article 94 (repeal of Directive 95/46/EC).

Commencement Information

I66 Sch. 6 para. 67 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

68 U.K. Omit Article 95 (relationship with Directive 2002/58/EC).

Commencement Information

I67 Sch. 6 para. 68 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

69 U.K. In Article 96 (relationship with previously concluded Agreements), for “by Member States” substitute “ by the United Kingdom or the Commissioner ”.

Commencement Information

I68 Sch. 6 para. 69 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

70 U.K. Omit Article 97 (Commission reports).

Commencement Information

I69 Sch. 6 para. 70 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

71 U.K. Omit Article 98 (Commission reviews).

Commencement Information

I70 Sch. 6 para. 71 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

72 U.K. Omit Article 99 (entry into force and application).

Commencement Information

I71 Sch. 6 para. 72 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)