Victims and Prisoners Act 2024

31 Right to erasure of personal data in the UK

(1) Article 17 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (right to erasure) is amended in accordance with subsections (2) and (3).

(2) In paragraph 1, after point (f) insert—

“(g) the personal data have been processed as a result of an allegation about the data subject—

(i) which was made by a person who is a malicious person in relation to the data subject (whether they became such a person before or after the allegation was made),

(ii) which has been investigated by the controller, and

(iii) in relation to which the controller has decided that no further action is to be taken.”

(3) After paragraph 3 insert—

“4. For the purposes of paragraph (1)(g), a person who has made an allegation about a data subject is a “malicious person” in relation to the data subject if the person—

(a) has been convicted of an offence specified in column 1 of the table in paragraph 5 in relation to which the data subject is a person specified in the corresponding entry in column 2 of that table, or

(b) is subject to a stalking protection order under section 2 of the Stalking Protection Act 2019 or section 8 of the Protection from Stalking Act (Northern Ireland) 2022 (c. 17 (N.I.)) made to protect the data subject from a risk associated with stalking (see section 2(1)(c) of the 2019 Act and section 8(2)(c) of the 2022 Act).

5. The table is as follows—

	Offence	Data subject
1.	An offence under section 2 of the Protection from Harassment Act 1997 (offence of harassment: England and Wales)	A person mentioned in section 1(1)(a) or 1(1A)(a) of that Act
2.	An offence under section 2A, 4 or 4A of the Protection from Harassment Act 1997 (other harassment and stalking offences: England and Wales)	The person against whom the offence is committed
3.	An offence under section 8 of the Stalking Protection Act 2019 (offence of breaching stalking protection order etc)	A person who the stalking protection order was made to protect from a risk associated with stalking (see section 2(1)(c) of that Act)
4.	An offence under section 42 of the Armed Forces Act 2006 as respects which the corresponding offence under the law of England and Wales (within the meaning given by that section) is an offence specified in entry 1, 2 or 3 of this table	A person specified in column 2 of the entry in which the corresponding offence is specified
5.	An offence under section 70 of the Army Act 1955 or Air Force Act 1955 as respects which the corresponding civil offence (within the meaning of that Act) is an offence specified in entry 1 or 2 of this table	A person specified in column 2 of the entry in which the corresponding civil offence is specified
6.	An offence under section 42 of the Naval Discipline Act 1957 as respects which the civil offence (within the meaning of that section) is an offence specified in entry 1 or 2 of this table	A person specified in column 2 of the entry in which the civil offence is specified
7.	An offence under section 39 of the Criminal Justice and Licensing (Scotland) Act 2010 (asp 13) (stalking offences: Scotland)	The person against whom the offence is committed
8.	An offence under section 1 of the Protection from Stalking Act (Northern Ireland) 2022 (stalking offences: Northern Ireland)	The person against whom the offence is committed
9.	An offence under section 13 of the Protection from Stalking Act (Northern Ireland) 2022 (offence of breaching order: Northern Ireland)	A person who the stalking protection order was made to protect from a risk associated with stalking (see section 8(2)(c) of that Act)
10.	An offence under Article 4 or 6 of the Protection from Harassment (Northern Ireland) Order 1997 (S.I. 1997/1180 (N.I. 9)) (harassment offences: Northern Ireland)	The person against whom the offence is committed”

(4) After section 13 of the Data Protection Act 2018 insert—

“13A Meaning of “relevant offence” for purpose of right to erasure

(1) The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR.

(2) Regulations under this section are subject to the affirmative resolution procedure.”