Schedule 10 | Complaints: minor and consequential amendments

(1)The UK GDPR is amended as follows.

(2)In Article 12(4) (transparent information, communication and modalities for the exercise of the rights of the data subject), for “lodging a complaint with the Commissioner” substitute “making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commissioner under section 165 of that Act”.

(1)Article 13(2) (information to be provided where personal data is collected from the data subject) is amended as follows.

(2)After point (c) insert—

(ca)the right to make a complaint to the controller under section 164A of the 2018 Act;

.

(3)In point (d), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.

(1)Article 14(2) (information to be provided where personal data is not obtained from the data subject) is amended as follows.

(2)After point (d) insert—

(da)the right to make a complaint to the controller (see section 164A of the 2018 Act);

.

(3)In point (e), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.

(1)Article 15(1) (right of access by the data subject) is amended as follows.

(2)After point (e) insert—

(ea)the right to make a complaint to the controller under section 164A of the 2018 Act;

.

(3)In point (f), for “lodge a complaint with the Commissioner” substitute “make a complaint to the Commissioner under section 165 of the 2018 Act”.

(6)In Article 47 (binding corporate rules), in paragraph 2(e), for “lodge a complaint with the Commissioner and” substitute “make a complaint to the controller under section 164A of the 2018 Act, the right to make a complaint to the Commissioner under section 165 of the 2018 Act, the right to lodge a complaint”.

(1)Article 80 (representation of data subjects) is amended as follows.

(2)In paragraph 1—

(a)for “lodge the complaint” substitute “make a complaint under section 164A or 165 of the 2018 Act”, and

(b)omit “77,”.

(3)In paragraph 2, for “lodge a complaint with the Commissioner” substitute “make a complaint under section 164A or 165 of the 2018 Act”.

(8)The 2018 Act is amended as follows.

(9)In section 26(2)(f) (national security and defence exemption), omit sub-paragraph (ai) (inserted by section 88 of this Act).

(1)Section 44 (information: controller’s general duties) is amended as follows.

(2)In subsection (1)—

(a)after paragraph (d) insert—

(da)the existence of the right to make a complaint to the controller (see section 164A);

, and

(b)in paragraph (e), after “Commissioner”, in the first place it occurs, insert “(see section 165)”.

(3)In subsection (5)—

(a)after paragraph (c) insert—

(ca)of the data subject’s right to make a complaint to the controller under section 164A,

, and

(b)in paragraph (d), after “Commissioner” insert “under section 165”.

(1)Section 45 (right of access by the data subject) is amended as follows.

(2)In subsection (2)—

(a)after paragraph (e) insert—

(ea)the existence of the data subject’s right to make a complaint to the controller (see section 164A);

, and

(b)in paragraph (f), after “the Commissioner”, in the first place it occurs, insert “(see section 165)”.

(3)In subsection (5)—

(a)after paragraph (c) insert—

(ca)of the data subject’s right to make a complaint to the controller under section 164A,

, and

(b)in paragraph (d), at the end insert “under section 165”.

(12)In section 45A (exemption from sections 44 and 45: legal professional privilege) (inserted by section 79 of this Act), in subsection (2), after paragraph (c) insert—.

(ca)the data subject’s right to make a complaint to the controller under section 164A,

(1)Section 48 (rights to rectification, to erasure or to restriction of processing: supplementary) is amended as follows.

(2)In subsection (1)(b)—

(a)after sub-paragraph (ii) insert—

(iia)of the data subject’s right to make a complaint to the controller under section 164A,

, and

(b)in sub-paragraph (iii), after “Commissioner” insert “under section 165”.

(3)In subsection (4)—

(a)after paragraph (b) insert—

(ba)of the data subject’s right to make a complaint to the controller under section 164A,

, and

(b)in paragraph (c), after “Commissioner” insert “under section 165”.

(14)In section 93(1)(e) (right to information), after “Commissioner”, in the first place it occurs, insert “under section 165”.

(15)In section 94(2)(f) (right of access), after “Commissioner”, in the first place it occurs, insert “under section 165”.

(1)Section 149 (enforcement notices) is amended as follows.

(2)In subsection (1), for “or (5)” substitute “, (5) or (5A)”.

(3)After subsection (5) insert—

(5A)The fifth type of failure is where a controller has failed, or is failing, to comply with section 164A or with regulations under section 164B.

(4)In subsection (6), for “or (5)” substitute “, (5) or (5A)”.

(17)In section 155 (penalty notices), in subsection (1)(a), for “or (5)” substitute “, (5) or (5A)”.

(18)In section 157 (maximum amount of penalty), after subsection (4) insert—

(4A)In relation to an infringement of section 164A or of regulations under section 164B, the maximum amount of the penalty that may be imposed by a penalty notice is the standard maximum amount.

(19)In section 165 (complaints by data subjects), in the heading, at the end insert “to the Commissioner”.

(1)Section 166 (orders to progress complaints) is amended as follows.

(2)In the heading, at the end insert “to the Commissioner”.

(3)In subsection (1), omit “or Article 77 of the UK GDPR”.

(1)Section 187 (representation of data subjects with their authority) is amended as follows.

(2)In subsection (1)(a)—

(a)for “Articles 77,” substitute “sections 164A and 165 (complaints) and Articles”, and

(b)omit “to lodge complaints and”.

(3)In subsection (2)—

(a)before paragraph (a) insert—

(za)the right under section 164A (complaints to the controller);

, and

(b)in paragraph (a), for “165(2) and (4)(d)” substitute “165”.