SCHEDULE 2Amendments of the Data Protection Act 2018
I192
1
Schedule 2 is amended as follows.
2
In the heading, for “GDPR” substitute “
UK GDPR
”
.
3
In the heading of Part 1, for “based on” substitute “
as described in
”
.
4
In the italic heading before paragraph 1, for “GDPR” (in the first place) substitute “
UK GDPR
”
.
5
In paragraph 1—
a
in sub-paragraph (a), for “GDPR” (in both places) substitute “
UK GDPR
”
;
b
in sub-paragraph (b), for “GDPR” (in both places) substitute “
UK GDPR
”
.
6
In paragraph 2—
a
in sub-paragraph (1), for “GDPR” (in the second place) substitute “
UK GDPR
”
;
b
in sub-paragraph (3), for “GDPR” substitute “
UK GDPR
”
.
7
In paragraph 3—
a
in sub-paragraph (1), for “GDPR” substitute “
UK GDPR
”
;
b
in sub-paragraph (3), for “GDPR” (in each place) substitute “
UK GDPR
”
.
8
In paragraph 4—
a
in sub-paragraph (1), for “GDPR” substitute “
UK GDPR
”
;
b
in sub-paragraph (2), in the opening words (but not the words following paragraph (g)), for “GDPR” (in each place) substitute “
UK GDPR
”
;
c
in sub-paragraph (4), for “GDPR” substitute “
UK GDPR
”
.
9
In the heading of Part 2, for “based on” substitute “
as described in
”
.
10
In the italic heading before paragraph 6, for “GDPR” (in the first place) substitute “
UK GDPR
”
.
11
In paragraph 6, for “GDPR” (in the second and third places) substitute “
UK GDPR
”
.
12
In paragraph 13, for “GDPR” (in the second place) substitute “
UK GDPR
”
.
13
In the heading of Part 3, for “based on Article 23(1):” substitute “
for the
”
.
14
In paragraph 16(1), for “GDPR” (in both places) substitute “
UK GDPR
”
.
15
In the heading of Part 4, for “based on” substitute “
as described in
”
.
16
In the italic heading before paragraph 18, for “GDPR” (in the first place) substitute “
UK GDPR
”
.
17
In paragraph 18, for “GDPR” (in the second and third places) substitute “
UK GDPR
”
.
18
In paragraph 20(3), for “GDPR” substitute “
UK GDPR
”
.
19
In paragraph 25—
a
in sub-paragraph (2), for “GDPR” (in both places) substitute “
UK GDPR
”
;
b
in sub-paragraph (3), for “GDPR” substitute “
UK GDPR
”
.
20
In the heading of Part 5, omit “based on Article 85(2)”.
21
In paragraph 26(9)—
a
in the opening words, for “GDPR” (in the second and third places) substitute “
UK GDPR
”
;
b
in paragraphs (a), (b), (c) and (d), for “GDPR” substitute “
UK GDPR
”
;
c
omit paragraph (e).
22
In the heading of Part 6, omit “based on Article 89”.
23
In paragraph 27—
a
in sub-paragraph (1), for “sub-paragraph (3)” substitute “
sub-paragraphs (3) and (4)
”
;
b
in sub-paragraph (2), for “GDPR (the rights in which may be derogated from by virtue of Article 89(2) of the GDPR)” substitute “
UK GDPR
”
;
c
in sub-paragraph (3)(a), for “GDPR” substitute “
UK GDPR
”
;
d
after sub-paragraph (3) insert—
4
Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.
24
In paragraph 28—
a
in sub-paragraph (1), for “sub-paragraph (3)” substitute “
sub-paragraphs (3) and (4)
”
;
b
in sub-paragraph (2), for “GDPR (the rights in which may be derogated from by virtue of Article 89(3) of the GDPR)” substitute “
UK GDPR
”
;
c
in sub-paragraph (3), for “GDPR” substitute “
UK GDPR
”
;
d
after sub-paragraph (3) insert—
4
Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.