Schedule 11 | Further minor provision about data protection

(1)The UK GDPR is amended as follows.

(1)Article 4(1) (interpretation) is amended as follows.

(2)After point (15) insert—

“direct marketing” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;

.

(3)After point (28) insert—

“enactment” has the same meaning as in the 2018 Act (see section 205 of that Act);

“tribunal” means any tribunal in which legal proceedings may be brought.

(3)After Article 4 insert—

Article 4APeriods of time

(1)References in this Regulation to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of the Periods of Time Regulation, except in Article 91A(8) and (9).

(2)In this Article, “the Periods of Time Regulation” means Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.

(4)In Article 9 (processing of special categories of personal data)—

(a)in paragraph 2, after “apply if” insert “the processing is based on Article 6(1) and”,

(b)in paragraph 2(f), after “courts” insert “or tribunals”, and

(c)in paragraph 3, for the words from the beginning to “data are” substitute “Paragraph 1 is only disapplied by point (h) of paragraph 2 if the personal data is”.

(5)In Article 12(5) (information etc to be provided free of charge), at the beginning insert “Subject to Article 15(3),”.

(6)In Article 23(1)(h) (restrictions), for “(a)” substitute “(c)”.

(7)In Article 24(3) (responsibility of the controller), for “an element by which to demonstrate” substitute “a means of demonstrating”.

(8)In Article 25(3) (data protection by design and by default), for “an element to demonstrate” substitute “a means of demonstrating”.

(9)In Article 28(5) (processors), for “an element by which to demonstrate” substitute “a means of demonstrating”.

(10)In Article 32(3) (security of processing), for “an element by which to demonstrate” substitute “a means of demonstrating”.

(11)In Article 37(1)(a), after “courts” insert “and tribunals”.

(12)Omit Article 59 (activity reports).

(13)The 2018 Act is amended as follows.

(14)In section 3(9) (definition of “the data protection legislation”)—

(a)insert “and” at the end of paragraph (c), and

(b)omit paragraph (e) (regulations under section 2(2) of the European Communities Act 1972 which relate to the EU GDPR or the Law Enforcement Directive) and the “and” before it.

(15)Omit section 20 (meaning of “court” in Part 2).

(16)In section 94 (data subject’s right of access under Part 4), in subsection (10), for “subsection (6)” substitute “subsections (3), (5) and (6)”.

(17)In section 119A(11) (standard clauses for transfers to third countries etc), after “any” insert “whole days that fall within a”.

(18)In section 124(5) (data protection and journalism code), in the definition of “good practice in the processing of personal data for the purposes of journalism”—

(a)in paragraph (a), omit “, including compliance with the requirements of the data protection legislation”, and

(b)after paragraph (b) insert—.

(1)Section 125 (approval of codes of practice prepared by the Commissioner) is amended as follows.

(2)Omit subsection (2).

(3)In subsection (8), after “any” insert “whole days that fall within a”.

(4)In subsection (9), for “subsections (2) and (5)” substitute “subsection (5)”.

(20)In section 139 (reporting to Parliament), omit subsection (2).

(21)In section 161(6) (approval of first guidance about regulatory action), after “any” insert “whole days that fall within a”.

(22)In section 170(2)(a) (unlawful obtaining etc of personal data), after “preventing” insert “, investigating”.

(1)Section 171 (re-identification of de-identified personal data) is amended as follows.

(2)In subsection (3)(a), after “preventing” insert “, investigating”.

(3)In subsection (6)(a), after “preventing” insert “, investigating”.

(24)In section 181 (interpretation of Part 6) omit the definition of “representative”.

(25)In section 184(4) (prohibition of requirement to produce relevant records), after “prevention” insert “, investigation”.

(26)In section 192(6) (approval of the Framework), after “any” insert “whole days that fall within a”.

(27)In section 206 (index of defined expressions), in the Table, omit the entry for “representative (in Part 6)”.

(1)Schedule 1 (special categories of personal data and criminal convictions etc data) is amended as follows.

(2)In the heading before paragraph 10, for “or detecting” substitute “etc”.

(3)In paragraph 10(1)(a) (preventing etc unlawful acts), after “prevention” insert “, investigation”.

(4)In paragraph 13(1)(a) (journalism etc in connection with unlawful acts and dishonesty etc), after “consists of” insert “, or is carried out in preparation for,”.

(5)In paragraph 14(1)(b) (preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—

(iia)the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii),

.

(6)In paragraph 24(1)(a) (disclosure to elected representatives), after “consists of” insert “, or is carried out in preparation for,”.

(1)Schedule 2 (exemptions etc from the UK GDPR) is amended as follows.

(2)In paragraph 2(1)(a) (crime), after “prevention” insert “, investigation”.

(3)In paragraph 3(2)(b)(ii) (crime: risk assessment systems), after “prevention” insert “, investigation”.

(30)In paragraph 8(1)(b) of Schedule 8 (conditions for sensitive processing under Part 3: preventing fraud), after sub-paragraph (ii) (but before the “or” at the end of that sub-paragraph) insert—.

(iia)the processing of personal data carried out in preparation for disclosure described in sub-paragraph (i) or (ii),

(31)In paragraph 2(a) of Schedule 11 (other exemptions under Part 4: crime), after “prevention” insert “, investigation”.

(32)The following provisions (inserted by section 31 of the Victims and Prisoners Act 2024) extend to Scotland and Northern Ireland (as well as to England and Wales)—

(a)Article 17(1)(g), (4) and (5) of the UK GDPR (right to erasure), and

(b)section 13A of the 2018 Act (meaning of “relevant offence” for purpose of right to erasure).