SCHEDULES

SCHEDULE 6The applied GDPR and the applied Chapter 2

PART 1Modifications to the GDPR

Chapter II of the GDPR (principles)

10

In Article 6 (lawfulness of processing)—

(a)

omit paragraph 2;

(b)

in paragraph 3, for the first subparagraph substitute—

“In addition to the provision made in section 15 of and Part 1 of Schedule 2 to the 2018 Act, a legal basis for the processing referred to in point (c) and (e) of paragraph 1 may be laid down by the Secretary of State in regulations (see section 16 of the 2018 Act).”;

(c)

in paragraph 3, in the second subparagraph, for “The Union or the Member State law shall” substitute “ The regulations must ”.

11

In Article 8 (conditions applicable to child's consent in relation to information society services)—

(a)

in paragraph 1, for the second subparagraph substitute—

“This paragraph is subject to section 9 of the 2018 Act.”;

(b)

in paragraph 3, for “the general contract law of Member States” substitute “ the general law of contract as it operates in domestic law ”.

12

In Article 9 (processing of special categories of personal data)—

(a)

in paragraph 2(a), omit “, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject”;

(b)

in paragraph 2(b), for “Union or Member State law” substitute “ domestic law (see section 10 of the 2018 Act) ”;

(c)

in paragraph 2, for point (g) substitute—

“(g)

processing is necessary for reasons of substantial public interest and is authorised by domestic law (see section 10 of the 2018 Act);”;

(d)

in paragraph 2(h), for “Union or Member State law” substitute “ domestic law (see section 10 of the 2018 Act) ”;

(e)

in paragraph 2(i), for “Union or Member State law” insert “ domestic law (see section 10 of the 2018 Act); ”;

(f)

in paragraph 2, for point (j) substitute—

“(j)

processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act) and is authorised by domestic law (see section 10 of that Act).”;

(g)

in paragraph 3, for “national competent bodies”, in both places, substitute “ a national competent body of the United Kingdom ”;

(h)

omit paragraph 4.

13

In Article 10 (processing of personal data relating to criminal convictions and offences), in the first sentence, for “Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects” substitute “ domestic law (see section 10 of the 2018 Act) ”.