Data Protection Act 2018 - Schedule 19 Part 1 Amendments of Primary Legislation

Registration Service Act 1953 (c. 37)

1. Section 19AC of the Registration Service Act 1953 (codes of practice) is amended as follows.
2. In subsection (2), for “issued under section 52B (data-sharing code) of the Data Protection Act 1998” substitute “prepared under section 121 of the Data Protection Act 2018 (data-sharing code) and issued under section 125(4) of that Act”.
3. In subsection (11), for “section 51(3) of the Data Protection Act 1998” substitute “section 128 of the Data Protection Act 2018”.

Veterinary Surgeons Act 1966 (c. 36)

1. Section 1A of the Veterinary Surgeons Act 1966 (functions of the Royal College of Veterinary Surgeons as competent authority) is amended as follows.
2. In subsection (8)—
   1. omit “personal data protection legislation in the United Kingdom that implements”,
   2. for paragraph (a) substitute—
      “(a) the GDPR; and”, and
   3. in paragraph (b), at the beginning insert “legislation in the United Kingdom that implements”.
3. In subsection (9), after “section” insert “—
   “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

Parliamentary Commissioner Act 1967 (c. 13)

In section 11AA(1) of the Parliamentary Commissioner Act 1967 (disclosure of information by Parliamentary Commissioner to Information Commissioner)—

1. in paragraph (a), for sub-paragraph (i) substitute—
   “(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and
2. for paragraph (b) substitute—
   “(b) the commission of an offence under—
   1. a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or
   2. section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

Local Government Act 1974 (c. 7)

The Local Government Act 1974 is amended as follows.

In section 33A(1) (disclosure of information by Local Commissioner to Information Commissioner)—

1. in paragraph (a), for sub-paragraph (i) substitute—
   “(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and
2. for paragraph (b) substitute—
   “(b) the commission of an offence under—
   1. a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or
   2. section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

6) In section 34O(1) (disclosure of information by Local Commissioner to Information Commissioner)—

1. in paragraph (a), for sub-paragraph (i) substitute—
   “(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and
2. for paragraph (b) substitute—
   “(b) the commission of an offence under—
   1. a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or
   2. section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

Consumer Credit Act 1974 (c. 39)

The Consumer Credit Act 1974 is amended as follows.

In section 157(2A) (duty to disclose name etc of agency)—

1. in paragraph (a), for “the Data Protection Act 1998” substitute “the GDPR”, and
2. in paragraph (b), after “any” insert “other”.

In section 159(1)(a) (correction of wrong information) for “section 7 of the Data Protection Act 1998” substitute “Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third-country transfers)”.

In section 189(1) (definitions), at the appropriate place insert—

“the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act);”.

Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22))

The Pharmacy (Northern Ireland) Order 1976 is amended as follows.

In article 2(2) (interpretation), omit the definition of “Directive 95/46/EC”.

In article 8D (European professional card), after paragraph (3) insert—

“(4) In Schedule 2C, “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018.”

In article 22A(6) (Directive 2005/36/EC: functions of competent authority etc.), before subparagraph (a) insert—

“(za) “the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

1. Schedule 2C (Directive 2005/36/EC: European professional card) is amended as follows.
2. In paragraph 8(1) (access to data), for “Directive 95/46/EC” substitute “the GDPR”.
3. In paragraph 9 (processing data), omit sub-paragraph (2) (deeming the Society to be the controller for the purposes of Directive 95/46/EC).

1. The table in Schedule 2D (functions of the Society under Directive 2005/36/ EC) is amended as follows.
2. In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “the GDPR”.
3. In the entry for Article 56a(4), in the second column, for “Directive 95/46/ EC” substitute “the GDPR”.

1. Paragraph 2 of Schedule 3 (fitness to practice: disclosure of information) is amended as follows.
2. In sub-paragraph (2)(a), after “provision” inserts “or the GDPR”.
3. For sub-paragraph (3) substitute—
   “(3) In determining for the purposes of sub-paragraph (2)(a) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this paragraph.”
4. After sub-paragraph (4) insert—
   “(5) In this paragraph, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Representation of the People Act 1983 (c. 2)

1. Schedule 2 to the Representation of the People Act 1983 (provisions which may be contained in regulations as to registration etc) is amended as follows.
2. In paragraph 1A(5), for “the Data Protection Act 1998” substitute “Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act)”.
3. In paragraph 8C(2), for “the Data Protection Act 1998” substitute “Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) and (14) of that Act)”.
4. In paragraph 11A—
   1. in sub-paragraph (1) for “who are data users to supply data, or documents containing information extracted from data and” substitute “to supply information”, and
   2. omit sub-paragraph (2).

Medical Act 1983 (c. 54)

The Medical Act 1983 is amended as follows.

1. Section 29E (evidence) is amended as follows.
2. In subsection (5), after “enactment” inserts “or the GDPR”.
3. For subsection (7) substitute—
   “(7) In determining for the purposes of subsection (5) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.”
4. In subsection (9), at the end insert—
   “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

1. Section 35A (General Medical Council’s power to require disclosure of information) is amended as follows.
2. In subsection (4), after “enactment” inserts “or the GDPR”.
3. For subsection (5A) substitute—
   “(5A) In determining for the purposes of subsection (4) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.”
4. In subsection (7), at the end insert—
   ““the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

In section 49B(7) (Directive 2005/36: designation of competent authority etc.), after “Schedule 4A” insert “—
“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

In section 55(1) (interpretation), omit the definition of “Directive 95/46/EC”.

1. Paragraph 9B of Schedule 1 (incidental powers of the General Medical Council) is amended as follows.
2. In sub-paragraph (2)(a), after “enactment” inserts “or the GPDR”.
3. After sub-paragraph (3) insert—
   “(4) In this paragraph, “the GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”

1. Paragraph 5A of Schedule 4 (professional performance assessments and health assessments) is amended as follows.
2. In sub-paragraph (8), after “enactment” inserts “or the GDPR”.
3. For sub-paragraph (8A) substitute—
   “(8A) In determining for the purposes of sub-paragraph (8) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this paragraph.”
4. After sub-paragraph (13) insert—
   “(14) In this paragraph, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

1. The table in Schedule 4A (functions of the General Medical Council as competent authority under Directive 2005/36) is amended as follows.
2. In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “the GDPR”.
3. In the entry for Article 56a(4), in the second column, for “Directive 95/46/ EC” substitute “the GDPR”.
   Dentists Act 1984 (c. 24)

The Dentists Act 1984 is amended as follows.

1. Section 33B (the General Dental Council’s power to require disclosure of information: the dental profession) is amended as follows.
2. In subsection (3), after “enactment” inserts “or relevant provision of the GDPR”.
3. For subsection (4) substitute—
   “(4) For the purposes of subsection (3)—
   “relevant enactment” means any enactment other than—
   1. this Act, or
   2. the listed provisions in paragraph 1 of Schedule 11 to the Data Protection Act 2018 (exemptions to Part 4: disclosures required by law);
      “relevant provision of the GDPR” means any provision of the GDPR apart from the listed GDPR provisions in paragraph 1 of Schedule 2 to the Data Protection Act 2018 (GDPR provisions to be adapted or restricted: disclosures required by law).”
4. After subsection (10) insert—
   “(11) In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

In section 36ZA(6) (Directive 2005/36: designation of competent authority etc), after “Schedule 4ZA—” insert—

““the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.

1. Section 36Y (the General Dental Council’s power to require disclosure of information: Professions complementary to dentistry) is amended as follows.
2. In subsection (3), after “enactment” inserts “or relevant provision of the GDPR”.
3. For subsection (4) substitute—
   “(4) For the purposes of subsection (3)—
   “relevant enactment” means any enactment other than—
   1. this Act, or
   2. the listed provisions in paragraph 1 of Schedule 11 to the Data Protection Act 2018 (exemptions to Part 4: disclosures required by law);
      “relevant provision of the GDPR” means any provision of the GDPR apart from the listed GDPR provisions in paragraph 1 of Schedule 2 to the Data Protection Act 2018 (GDPR provisions to be adapted or restricted: disclosures required by law).”
4. After subsection (10) insert—
   “(11) In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

In section 53(1) (interpretation), omit the definition of “Directive 95/46/EC”.

1. The table in Schedule 4ZA (Directive 2005/36: functions of the General Dental Council under section 36ZA(3)) is amended as follows.
2. In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” substitute “the GDPR”.
3. In the entry for Article 56a(4), in the second column, for “Directive 95/46/ EC” substitute “the GDPR”.

Companies Act 1985 (c. 6)

In section 449(11) of the Companies Act 1985 (provision for the security of information obtained), for “the Data Protection Act 1998” substitute “the data protection legislation”.

Access to Medical Reports Act 1988 (c. 28)

In section 2(1) of the Access to Medical Reports Act 1988 (interpretation), for the definition of “health professional” substitute—

“health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act);”.

Opticians Act 1989 (c. 44)

1. Section 13B of the Opticians Act 1989 (the Council’s power to require disclosure of information) is amended as follows.
2. In subsection (3), after “enactment” inserts “or the GDPR”.
3. For subsection (4) substitute—
   “(4) In determining for the purposes of subsection (3) whether a disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this section.”
4. After subsection (9) insert—
   “(10) In this section, “the GDPR” and references to Schedule 2 to the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(10), (11) and (14) of that Act).”

Access to Health Records Act 1990 (c. 23)

The Access to Health Records Act 1990 is amended as follows.

For section 2 substitute—

“2 Health professionals

In this Act, “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204 of that Act).”

1. Section 3 (right of access to health records) is amended as follows.
2. In subsection (2), omit “Subject to subsection (4) below,”.
3. In subsection (4), omit from “other than the following” to the end.

Human Fertilisation and Embryology Act 1990 (c. 37)

1. Section 33D of the Human Fertilisation and Embryology Act 1990 (disclosure for the purposes of medical or other research) is amended as follows.
2. In subsection (6), for “the Data Protection Act 1998” substitute “the data protection legislation”.
3. In subsection (9), at the appropriate place insert—
   “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Trade Union and Labour Relations (Consolidation) Act 1992 (c. 52)

1. Section 251B of the Trade Union and Labour Relations (Consolidation) Act 1992 (prohibition on disclosure of information) is amended as follows.
2. In subsection (3), for “the Data Protection Act 1998” substitute “the data protection legislation”.
3. After subsection (6) insert—
   “(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Tribunals and Inquiries Act 1992 (c. 53)

In the table in Part 1 of Schedule 1 to the Tribunals and Inquiries Act 1992 (tribunals to which the Act applies), in the second column, in paragraph 14(a), for “section 6 of the Data Protection Act 1998” substitute “section 114 of the Data Protection Act 2018”.

Industrial Relations (Northern Ireland) Order 1992 (S.I. 1992/807 (N.I. 5))

1. Article 90B of the Industrial Relations (Northern Ireland) Order 1992 (prohibition on disclosure of information held by the Labour Relations Agency) is amended as follows.
2. In paragraph (3), for “the Data Protection Act 1998” substitute “the data protection legislation”.
3. After paragraph (6) insert—
   “(7) In this Article, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

Health Service Commissioners Act 1993 (c. 46)

In section 18A(1) of the Health Service Commissioners Act 1993 (power to disclose information)—

1. in paragraph (a), for sub-paragraph (i) substitute—
   “(i) sections 142 to 154, 160 to 164 or 174 to 176 of, or Schedule 15 to, the Data Protection Act 2018 (certain provisions relating to enforcement),”, and
2. for paragraph (b) substitute—
   “(b) the commission of an offence under—
   1. a provision of the Data Protection Act 2018 other than paragraph 15 of Schedule 15 (obstruction of execution of warrant etc), or
   2. section 77 of the Freedom of Information Act 2000 (offence of altering etc records with intent to prevent disclosure).”

Data Protection Act 1998 (c. 29)

The Data Protection Act 1998 is repealed, with the exception of section 62 and paragraphs 13, 15, 16, 18 and 19 of Schedule 15 (which amend other enactments).

Crime and Disorder Act 1998 (c. 37)

In section 17A(4) of the Crime and Disorder Act 1998 (sharing of information), for “(within the meaning of the Data Protection Act 1998)” substitute “(within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act))”.

Food Standards Act 1999 (c. 28)

1. Section 19 of the Food Standards Act 1999 (publication etc by the Food Standards Agency of advice and information) is amended as follows.
2. In subsection (2), for “the Data Protection Act 1998” substitute “the data protection legislation”.
3. In subsection (8), after “section” insert “—
   “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Immigration and Asylum Act 1999 (c. 33)

1. Section 13 of the Immigration and Asylum Act 1999 (proof of identity of persons to be removed or deported) is amended as follows.
2. For subsection (4) substitute—
   “(4) For the purposes of Article 49(1)(d) of the GDPR, the provision under this section of identification data is a transfer of personal data which is necessary for important reasons of public interest.”
3. After subsection (4) insert—
   “(4A) “The GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10), (11) and (14) of that Act).”

Financial Services and Markets Act 2000 (c. 8)

The Financial Services and Markets Act 2000 is amended as follows.

In section 86(9) (exempt offers to the public), for “the Data Protection Act 1998 or any directly applicable EU legislation relating to data protection” substitute “—

1. the data protection legislation or
2. any directly applicable EU legislation which is not part of the data protection legislation but which relates to data protection”.

In section 391A(6)(b) (publication: special provisions relating to the capital requirements directive), for “the Data Protection Act 1998” substitute “the data protection legislation”.

In section 391C(7)(a) (publication: special provisions relating to the UCITS directive), for “the Data Protection Act 1998” substitute “the data protection legislation”.

In section 391D(9)(a) (publication: special provisions relating to the markets in financial instruments directive), for “the Data Protection Act 1998” substitute “the data protection legislation”.

In section 417 (definitions), at the appropriate place insert—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);”.

Terrorism Act 2000 (c. 11)

In section 21F(2)(d) of the Terrorism Act 2000 (other permitted disclosures between institutions etc) for “(within the meaning of section 1 of the Data Protection Act 1998)” substitute “(within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act))”.

Freedom of Information Act 2000 (c. 36)

The Freedom of Information Act 2000 is amended as follows.

In section 2(3) (absolute exemptions), for paragraph (f) substitute—
“(f) section 40(1),
(fa) section 40(2) so far as relating to cases where the first condition referred to in that subsection is satisfied,”.

In section 18 (the Information Commissioner), omit subsection (1).

1. Section 40 (personal information) is amended as follows.
2. In subsection (2)—
   1. in paragraph (a), for “do” substitute “does”, and
   2. in paragraph (b), for “either the first or the second%9