Amendment of Part 1 of Schedule 2 to the Data Protection Act 2018

2.—(1) Part 1 of Schedule 2 (exemptions etc. from the UK GDPR) to the Data Protection Act 2018(1) is amended as follows.

(2) In paragraph 4 (immigration exemption)—

(a) in sub-paragraph (1), in the words before paragraph (a), after “processed” insert “by the Secretary of State”;

(b) after sub-paragraph (1), insert—

“(1A) But sub-paragraph (1) does not apply unless the Secretary of State has an immigration exemption policy document in place.

(1B) For the purposes of sub-paragraph (1A), the Secretary of State has an immigration exemption policy document in place if the Secretary of State has produced a document which explains the Secretary of State’s policies and processes for—

(a) determining the extent to which the application of any of the UK GDPR provisions listed in sub-paragraph (2) would be likely to prejudice any of the matters mentioned in sub-paragraph (1)(a) and (b), and

(b) where it is determined that any of those provisions do not apply in relation to personal data processed for any of the purposes mentioned in sub-paragraph (1)(a) and (b), preventing—

(i) the abuse of that personal data, and

(ii) any access to, or transfer of, it otherwise than in accordance with the UK GDPR.

(1C) Paragraphs 4A and 4B make provision about additional safeguards in connection with the exemption in this paragraph.”;

(c) in sub-paragraph (2), for “sub-paragraph (1)” substitute “sub-paragraphs (1) and (1B)”;

(d) omit sub-paragraphs (3) and (4).

(3) After paragraph 4 insert—

“4A.    Immigration: additional safeguard: decisions for the purposes of paragraph 4(1) and requirement to have regard to immigration exemption policy document

(1) The Secretary of State must—

(a) determine the extent to which the application of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) on a case by case basis, and

(b) have regard, when making such a determination, to the immigration exemption policy document.

(2) The Secretary of State must also—

(a) review the immigration exemption policy document and (if appropriate) update it from time to time;

(b) publish it, and any update to it, in such manner as the Secretary of State considers appropriate.

(3) In this paragraph and paragraph 4B “the relevant UK GDPR provisions” means the provisions of the UK GDPR listed in paragraph 4(2).

4B.    Immigration: additional safeguard: record etc of decision that exemption applies

(1) Where the Secretary of State determines in any particular case that the application of any of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b), the Secretary of State must—

(a) keep a record of that determination and the reasons for it, and

(b) inform the data subject of that determination.

(2) But the Secretary of State is not required to comply with sub-paragraph (1)(b) if doing so may be prejudicial to any of the matters mentioned in paragraph 4(1)(a) and (b).”.

(1)

Part 1 of Schedule 2 was amended by S.I. 2019/419.