Prospective
Section 103
1The UK GDPR is amended as follows.
Commencement Information
I1Sch. 10 para. 1 not in force at Royal Assent, see s. 142(1)
2In Article 12(4) (transparent information, communication and modalities for the exercise of the rights of the data subject), for “lodging a complaint with the Commissioner” substitute “making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commissioner under section 165 of that Act”.
Commencement Information
I2Sch. 10 para. 2 not in force at Royal Assent, see s. 142(1)
3(1)Article 13(2) (information to be provided where personal data is collected from the data subject) is amended as follows.
(2)After point (c) insert—
“(ca)the right to make a complaint to the controller under section 164A of the 2018 Act;”.
(3)In point (d), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.
Commencement Information
I3Sch. 10 para. 3 not in force at Royal Assent, see s. 142(1)
4(1)Article 14(2) (information to be provided where personal data is not obtained from the data subject) is amended as follows.
(2)After point (d) insert—
“(da)the right to make a complaint to the controller (see section 164A of the 2018 Act);”.
(3)In point (e), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.
Commencement Information
I4Sch. 10 para. 4 not in force at Royal Assent, see s. 142(1)
5(1)Article 15(1) (right of access by the data subject) is amended as follows.
(2)After point (e) insert—
“(ea)the right to make a complaint to the controller under section 164A of the 2018 Act;”.
(3)In point (f), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.
Commencement Information
I5Sch. 10 para. 5 not in force at Royal Assent, see s. 142(1)
6In Article 47 (binding corporate rules), in paragraph 2(e), for “lodge a complaint with the Commissioner and” substitute “make a complaint to the controller under section 164A of the 2018 Act, the right to make a complaint to the Commissioner under section 165 of the 2018 Act, the right to lodge a complaint”.
Commencement Information
I6Sch. 10 para. 6 not in force at Royal Assent, see s. 142(1)
7(1)Article 80 (representation of data subjects) is amended as follows.
(2)In paragraph 1—
(a)for “lodge the complaint” substitute “make a complaint under section 164A or 165 of the 2018 Act”, and
(b)omit “77,”.
(3)In paragraph 2, for “lodge a complaint with the Commissioner” substitute “make a complaint under section 164A or 165 of the 2018 Act”.
Commencement Information
I7Sch. 10 para. 7 not in force at Royal Assent, see s. 142(1)
8The 2018 Act is amended as follows.
Commencement Information
I8Sch. 10 para. 8 not in force at Royal Assent, see s. 142(1)
9In section 26(2)(f) (national security and defence exemption), omit sub-paragraph (ai) (inserted by section 88 of this Act).
Commencement Information
I9Sch. 10 para. 9 not in force at Royal Assent, see s. 142(1)
10(1)Section 44 (information: controller’s general duties) is amended as follows.
(2)In subsection (1)—
(a)after paragraph (d) insert—
“(da)the existence of the right to make a complaint to the controller (see section 164A);”, and
(b)in paragraph (e), after “Commissioner”, in the first place it occurs, insert “(see section 165)”.
(3)In subsection (5)—
(a)after paragraph (c) insert—
“(ca)of the data subject’s right to make a complaint to the controller under section 164A,”, and
(b)in paragraph (d), after “Commissioner” insert “under section 165”.
Commencement Information
I10Sch. 10 para. 10 not in force at Royal Assent, see s. 142(1)
11(1)Section 45 (right of access by the data subject) is amended as follows.
(2)In subsection (2)—
(a)after paragraph (e) insert—
“(ea)the existence of the data subject’s right to make a complaint to the controller (see section 164A);”, and
(b)in paragraph (f), after “the Commissioner”, in the first place it occurs, insert “(see section 165)”.
(3)In subsection (5)—
(a)after paragraph (c) insert—
“(ca)of the data subject’s right to make a complaint to the controller under section 164A,”, and
(b)in paragraph (d), at the end insert “under section 165”.
Commencement Information
I11Sch. 10 para. 11 not in force at Royal Assent, see s. 142(1)
12In section 45A (exemption from sections 44 and 45: legal professional privilege) (inserted by section 79 of this Act), in subsection (2), after paragraph (c) insert—
“(ca)the data subject’s right to make a complaint to the controller under section 164A,”.
Commencement Information
I12Sch. 10 para. 12 not in force at Royal Assent, see s. 142(1)
13(1)Section 48 (rights to rectification, to erasure or to restriction of processing: supplementary) is amended as follows.
(2)In subsection (1)(b)—
(a)after sub-paragraph (ii) insert—
“(iia)of the data subject’s right to make a complaint to the controller under section 164A,”, and
(b)in sub-paragraph (iii), after “Commissioner” insert “under section 165”.
(3)In subsection (4)—
(a)after paragraph (b) insert—
“(ba)of the data subject’s right to make a complaint to the controller under section 164A,”, and
(b)in paragraph (c), after “Commissioner” insert “under section 165”.
Commencement Information
I13Sch. 10 para. 13 not in force at Royal Assent, see s. 142(1)
14In section 93(1)(e) (right to information), after “Commissioner”, in the first place it occurs, insert “under section 165”.
Commencement Information
I14Sch. 10 para. 14 not in force at Royal Assent, see s. 142(1)
15In section 94(2)(f) (right of access), after “Commissioner”, in the first place it occurs, insert “under section 165”.
Commencement Information
I15Sch. 10 para. 15 not in force at Royal Assent, see s. 142(1)
16(1)Section 149 (enforcement notices) is amended as follows.
(2)In subsection (1), for “or (5)” substitute “, (5) or (5A)”.
(3)After subsection (5) insert—
“(5A)The fifth type of failure is where a controller has failed, or is failing, to comply with section 164A or with regulations under section 164B.”
(4)In subsection (6), for “or (5)” substitute “, (5) or (5A)”.
Commencement Information
I16Sch. 10 para. 16 not in force at Royal Assent, see s. 142(1)
17In section 155 (penalty notices), in subsection (1)(a), for “or (5)” substitute “, (5) or (5A)”.
Commencement Information
I17Sch. 10 para. 17 not in force at Royal Assent, see s. 142(1)
18In section 157 (maximum amount of penalty), after subsection (4) insert—
“(4A)In relation to an infringement of section 164A or of regulations under section 164B, the maximum amount of the penalty that may be imposed by a penalty notice is the standard maximum amount.”
Commencement Information
I18Sch. 10 para. 18 not in force at Royal Assent, see s. 142(1)
19In section 165 (complaints by data subjects), in the heading, at the end insert “to the Commissioner”.
Commencement Information
I19Sch. 10 para. 19 not in force at Royal Assent, see s. 142(1)
20(1)Section 166 (orders to progress complaints) is amended as follows.
(2)In the heading, at the end insert “to the Commissioner”.
(3)In subsection (1), omit “or Article 77 of the UK GDPR”.
Commencement Information
I20Sch. 10 para. 20 not in force at Royal Assent, see s. 142(1)
21(1)Section 187 (representation of data subjects with their authority) is amended as follows.
(2)In subsection (1)(a)—
(a)for “Articles 77,” substitute “sections 164A and 165 (complaints) and Articles”, and
(b)omit “to lodge complaints and”.
(3)In subsection (2)—
(a)before paragraph (a) insert—
“(za)the right under section 164A (complaints to the controller);”, and
(b)in paragraph (a), for “165(2) and (4)(d)” substitute “165”.
Commencement Information
I21Sch. 10 para. 21 not in force at Royal Assent, see s. 142(1)