Section 74 | Processing of special categories of personal data

(1)In Chapter 2 of the UK GDPR, after Article 11 insert—

Article 11AFurther provision about processing of special categories of personal data

(1)The Secretary of State may by regulations—

(a)make provision so that an additional description of processing of personal data is subject to the prohibition in Article 9(1),

(b)make provision so that added processing is not subject to that prohibition,

(c)make provision so that an exception in Article 9(2) may or may not be relied on in connection with added processing, and

(d)make provision varying such an exception as it applies in connection with added processing.

(2)In paragraph 1, “added processing” means a description of processing which is subject to the prohibition in Article 9(1) by virtue of provision made under paragraph 1(a).

(3)Regulations made under this Article (in reliance on Article 91A(4)(b)) may amend section 5, 205 or 206 of the 2018 Act (interpretation).

(4)Regulations under this Article are subject to the affirmative resolution procedure.

(2)The 2018 Act is amended in accordance with subsections (3) to (9).

(3)In section 33 (definitions of expressions used in Part 3), after subsection (6) insert—

(6A)“Sensitive processing” has the meaning given in section 35(8).

(4)In section 35 (the first data protection principle)—

(a)in subsection (6)(b) (power to omit conditions added to Schedule 8 by regulations), after “by”, in the first place it occurs, insert “varying or”, and

(b)in subsection (8) (definition of “sensitive processing”), for “section” substitute “Part”.

(5)After section 42 insert—

42AFurther provision about sensitive processing

(1)The Secretary of State may by regulations—

(a)make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,

(b)make provision so that added processing is not sensitive processing for the purposes of this Part,

(c)make provision so that a protected condition in Schedule 8 may or may not be relied on in connection with added processing, and

(d)make provision varying such a condition as it relates to added processing.

(2)In subsection (1)—

“added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);

“protected condition in Schedule 8” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 35(6).

(3)Regulations under this section may amend this Part and sections 205 and 206.

(4)Regulations under this section are subject to the affirmative resolution procedure.

(6)In section 84 (definitions of expressions used in Part 4), after subsection (6) insert—

(6A)“Sensitive processing” has the meaning given in section 86(7).

(7)In section 86 (the first data protection principle)—

(a)in subsection (3)(b) (power to omit conditions added to Schedule 10 by regulations), after “by”, in the first place it occurs, insert “varying or”, and

(b)in subsection (7) (definition of “sensitive processing”), for “section” substitute “Part”.

(8)After section 91 insert—

91AFurther provision about sensitive processing

(1)The Secretary of State may by regulations—

(a)make provision so that an additional description of processing of personal data is sensitive processing for the purposes of this Part,

(b)make provision so that added processing is not sensitive processing for the purposes of this Part,

(c)make provision so that a protected condition in Schedule 10 may or may not be relied on in connection with added processing, and

(d)make provision varying such a condition as it relates to added processing.

(2)In subsection (1)—

“added processing” means a description of processing which is sensitive processing by virtue of provision made under subsection (1)(a);

“protected condition in Schedule 10” means a condition in that Schedule other than one that was added to the Schedule by regulations under section 86(3).

(3)Regulations under this section may amend this Part and sections 205 and 206.

(4)Regulations under this section are subject to the affirmative resolution procedure.

(9)In section 206 (index of defined expressions), in the Table, at the appropriate place insert—

(10)The Investigatory Powers Act 2016 is amended in accordance with subsections (11) to (13).

(11)In section 202(4) (restrictions on use of class BPD warrants: definitions), omit the definition of “sensitive personal data” and insert—

(12)After that section insert—

202AFurther provision about sensitive processing

(1)The Secretary of State may by regulations—

(a)make provision so that a description of Part 4 sensitive processing, or of processing that would be such processing if the information processed related to a living individual, is sensitive processing for the purposes of section 202, and

(b)make provision so that added processing is not sensitive processing for the purposes of that section.

(2)In this section—

“added processing” means a description of processing that is sensitive processing for the purposes of section 202 by virtue of provision made under subsection (1)(a);

“Part 4 sensitive processing” means processing of personal data that, at the time the regulations are made, is sensitive processing for the purposes of Part 4 of the Data Protection Act 2018 by virtue of regulations made under section 91A of that Act.

(3)Regulations under this section may amend section 202.

(13)In section 267(3) (regulations subject to the affirmative procedure), after paragraph (e) insert—

(ea)section 202A,

.