Source: https://seersco.com/law/part-1-modifications-to-the-gdpr/
Timestamp: 2020-08-11 04:41:06
Document Index: 147967659

Matched Legal Cases: ['art 1', 'art 2', 'art 5', 'art 6', 'art 6', 'art 6']

Data Protection Act 2018 - Schedule 6 Part 1 Modifications to the GDPR
In its application by virtue of section 22(1), the GDPR has effect as if it were modified as follows.
References to “this Regulation” and to provisions of the GDPR have effect as references to the applied GDPR and to the provisions of the applied GDPR.
But sub-paragraph (1) does not have an effect—
in the case of the references which are modified or inserted by paragraphs 9(f)(ii), 15(b), 16(a)(ii), 35, 36(a) and (e)(ii) and 38(a)(i);
in relation to the references in points (a) and (b) of paragraph 2 of Article 61, as inserted by paragraph 49.
References to “Union law”, “Member State law”, “the law of a Member State” and “Union or Member State law” have effect as references to domestic law.
Sub-paragraph (1) is subject to the specific modifications made in this Part of this Schedule.
In this paragraph, “domestic law” means the law of the United Kingdom, or of a part of the United Kingdom, and includes law in the form of an enactment, an instrument made under Her Majesty’s prerogative or a rule of law.
References to “the Union”, “a Member State” and “Member States” have effect as references to the United Kingdom.
Sub-paragraph (1) is subject to the specific modifications made in this Part of this Schedule (including paragraph 3(1)).
References to a “supervisory authority”, a “competent supervisory authority” or “supervisory authorities”, however, expressed, have effect as references to the Commissioner.
Sub-paragraph (1) does not apply to the references in—
Article 4(21) as modified by paragraph 9(f);
Article 57(1)(h);
Article 61(1) inserted by paragraph 49.
Sub-paragraph (1) is also subject to the specific modifications made in this Part of this Schedule.
References to “the national parliament” have effect as references to both Houses of Parliament.
For Article 2 (material scope) substitute—
“2 This Regulation applies to the processing of personal data to which Chapter 3 of Part 2 of the 2018 Act applies (see section 21 of that Act).”
For Article 3 substitute—
in subsection (1), the reference to subsection (3), and
in subsection (7), the words following paragraph (d).”
In Article 4 (definitions)—
in paragraph (7) (meaning of “controller”), for “; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law” substitute “, subject to section 6 of the 2018 Act (meaning of “controller”)”;
after paragraph (7) insert—
“(7A) “the 2018 Act” means the Data Protection Act 2018 as applied by section 22 of that Act and further modified by section 3 of that Act.”;
omit paragraph (16) (meaning of “the main establishment”);
omit paragraph (17) (meaning of “representative”);
in paragraph (20) (meaning of “binding corporate rules”), for “on the territory of a Member State” substitute “in the United Kingdom”;
in paragraph (21) (meaning of “supervisory authority”)—
after “a Member State” insert “(other than the United Kingdom)”;
for “Article 51” substitute “Article 51 of the GDPR”;
after paragraph (21) insert—
“(21A) “the Commissioner” means the Information Commissioner (see section 114 of the 2018 Act);”;
omit paragraph (22) (meaning of “supervisory authority concerned”);
omit paragraph (23) (meaning of “cross-border processing”);
omit paragraph (24) (meaning of “relevant and reasoned objection”);
after paragraph (26) insert—
“(27) “the GDPR” has the meaning given in section 3(10) of the 2018 Act.
(28) “domestic law” has the meaning given in paragraph 3(3) of Schedule 6 to the 2018 Act.”
In Article 6 (lawfulness of processing)—
omit paragraph 2;
in paragraph 3, for the first subparagraph substitute—
in paragraph 3, in the second subparagraph, for “The Union or the Member State law shall” substitute “The regulations must”.
In Article 8 (conditions applicable to child’s consent in relation to information society services)—
in paragraph 1, for the second subparagraph substitute—
in paragraph 3, for “the general contract law of Member States” substitute “the general law of contract as it operates in domestic law”.
In Article 9 (processing of special categories of personal data)—
in paragraph 2(a), omit “, except where Union or Member State law provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject”;
in paragraph 2(b), for “Union or Member State law” substitute “domestic law (see section 10 of the 2018 Act)”;
in paragraph 2, for point (g) substitute—
“(g) processing is necessary for reasons of substantial public interest and is authorised by domestic law (see section 10 of the 2018 Act);”;
in paragraph 2(h), for “Union or Member State law” substitute “domestic law (see section 10 of the 2018 Act)”;
in paragraph 2(i), for “Union or Member State law” insert “domestic law (see section 10 of the 2018 Act);”;
in paragraph 2, for point (j) substitute—
“(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act) and is authorised by domestic law (see section 10 of that Act).”;
in paragraph 3, for “national competent bodies”, in both places, substitute “a national competent body of the United Kingdom”;
omit paragraph 4.
In Article 10 (processing of personal data relating to criminal convictions and offences), in the first sentence, for “Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects” substitute “domestic law (see section 10 of the 2018 Act)”.
In Article 12 (transparent information etc for the exercise of the rights of the data subject), omit paragraph 8.
In Article 13 (personal data collected from data subject: information to be provided), in paragraph 1—
in point (a), omit “and, where applicable, of the controller’s representative”;
in point (f), after “the Commission” insert “pursuant to Article 45(3) of the GDPR”.
In Article 14 (personal data collected other than from data subject: information to be provided)—
in point (f), after “the Commission” insert “pursuant to Article 45(3) of the GDPR”;
in paragraph 5(c), for “Union or Member State law to which the controller is subject” substitute “a rule of domestic law”.
In Article 17 (right to erasure (‘right to be forgotten’))—
in paragraph 1(e), for “in Union or Member State law to which the controller is subject” substitute “under domestic law”;
in paragraph 3(b), for “by Union or Member State law to which the controller is subject” substitute “under domestic law”.
In Article 18 (right to the restriction of processing), in paragraph 2, for “of the Union or of a Member State” substitute “of the United Kingdom”.
In Article 21 (right to object), in paragraph 5, omit “, and notwithstanding Directive 2002/58/EC,”.
In Article 22 (automated individual decision-making, including profiling), for paragraph 2(b) substitute—
“(b) is a qualifying significant decision for the purposes of section 14 of the 2018 Act; or”.
In Article 23 (restrictions), in paragraph 1—
for “Union or Member State law to which the data controller or processor is subject” substitute “In addition to the provision made by section 15 of and Schedules 2, 3 and 4 to the 2018 Act, the Secretary of State”;
in point (e), for “of the Union or of a Member State”, in both places, substitute “of the United Kingdom”;
after point (j) insert—
In Article 26 (joint controllers), in paragraph 1, for “Union or Member State law to which the controllers are subject” substitute “domestic law”.
Omit Article 27 (representatives of controllers or processors not established in the Union).
In Article 28 (processor)—
in paragraph 3, in point (a), for “Union or Member State law to which the processor is subject” substitute “domestic law”;
in paragraph 3, in the second subparagraph, for “other Union or Member State data protection provisions” substitute “any other rule of domestic law relating to data protection”;
in paragraph 6, for “paragraphs 7 and 8” substitute “paragraph 8”;
omit paragraph 7;
in paragraph 8, omit “and in accordance with the consistency mechanism referred to in Article 63”.
In Article 30 (records of processing activities)—
in paragraph 1, in the first sentence, omit “and, where applicable, the controller’s representative,”;
in paragraph 1, in point (a), omit “, the controller’s representative”;
in paragraph 1, in point (g), after “32(1)” insert “or section 28(3) of the 2018 Act”;
in paragraph 2, in the first sentence, omit “and, where applicable, the processor’s representative”;
in paragraph 2, in point (a), omit “the controller’s or the processor’s representative, and”;
in paragraph 2, in point (d), after “32(1)” insert “or section 28(3) of the 2018 Act”;
in paragraph 4, omit “and, where applicable, the controller’s or the processor’s representative,”.
In Article 31 (co-operation with the supervisory authority), omit “and, where applicable, their representatives,”.
In Article 35 (data protection impact assessment), omit paragraphs 4, 5, 6 and 10.
In Article 36 (prior consultation)—
for paragraph 4 substitute—
“4 The Secretary of State must consult the Commissioner during the preparation of any proposal for a legislative measure which relates to processing.”;
In Article 37 (designation of data protection officers), omit paragraph 4.
In Article 39 (tasks of the data protection officer), in paragraph 1(a) and (b), for “other Union or Member State data protection provisions” substitute “other rules of domestic law relating to data protection”.
In Article 40 (codes of conduct)—
in paragraph 1, for “The Member States, the supervisory authorities, the Board and the Commission shall” substitute “The Commissioner must”;
omit paragraph 3;
in paragraph 6, omit “, and where the code of conduct concerned does not relate to processing activities in the several Member States”;
omit paragraphs 7 to 11.
In Article 41 (monitoring of approved codes of conduct), omit paragraph 3.
In Article 42 (certification)—
for “The Member States, the supervisory authorities, the Board and the Commission” substitute “The Commissioner”;
omit “, in particular at Union level,”;
in paragraph 5, omit “or by the Board pursuant to Article 63. Where the criteria are approved by the Board, this may result in a common certification, the European Data Protection Seal”;
omit paragraph 8.
In Article 43 (certification bodies)—
in paragraph 1, in the second sentence, for “Member States shall ensure that those certification bodies are” substitute “Those certification bodies must be”;
in paragraph 2, in point (b), omit “or by the Board pursuant to Article 63”;
in paragraph 3, omit “or by the Board pursuant to Article 63”;
in paragraph 6, omit the second and third sentences;
omit paragraphs 8 and 9.
In Article 45 (transfers on the basis of an adequacy decision)—
in paragraph 1, after “decided” insert “in accordance with Article 45 of the GDPR”;
after paragraph 1 insert—
“1A But a transfer of personal data to a third country or international organisation must not take place under paragraph 1 if the Commission’s decision in relation to the third country (including a territory or sector within it) or the international organisation—
is suspended,
has been amended, or
has been repealed,
omit paragraphs 2 to 8;
in paragraph 9, for “of this Article” substitute “of Article 45 of the GDPR”.
In Article 46 (transfers subject to appropriate safeguards)—
in paragraph 1, for “Article 45(3)” substitute “Article 45(3) of the GDPR”;
in paragraph 2, omit point (c);
in paragraph 2, in point (d), omit “and approved by the Commission pursuant to the examination procedure referred to in Article 93(2)”;
omit paragraph 4;
in paragraph 5—
in the first sentence, for “a Member State or supervisory authority” substitute “the Commissioner”;
in the second sentence, for “this Article” substitute “Article 46 of the GDPR”.
In Article 47 (binding corporate rules)—
in paragraph 1, in the first sentence, omit “in accordance with the consistency mechanism set out in Article 63”;
in paragraph 2, in point (e), for “the competent courts of the Member States” substitute “a court”;
in paragraph 2, in point (f), for “on the territory of a Member State” substitute “in the United Kingdom”;
omit paragraph 3.
In Article 49 (derogations for specific situations)—
in paragraph 1, in the first sentence—
for “Article 45(3)” substitute “Article 45(3) of the GDPR”;
for “Article 46” substitute “Article 46 of this Regulation”;
in paragraph 4, for “Union law or in the law of the Member State to which the controller is subject” substitute “domestic law (see section 18 of the 2018 Act which makes certain provision about the public interest)”;
for paragraph 5 substitute—
“5 Paragraph 1 is subject to any regulations made under section 18(2) of the 2018 Act.”
In Article 50 (international co-operation for the protection of personal data), omit “the Commission and”.
In Article 51 (supervisory authority)—
for “Each Member State shall provide for one or more independent public authorities to be” substitute “The Commissioner is”;
omit “and to facilitate the free flow of personal data within the Union (‘supervisory authority’)”;
omit paragraphs 2 to 4.
In Article 52 (independence)—
for “The member or members of each supervisory authority” substitute “The Commissioner”;
for “their”, in both places, substitute “the Commissioner’s”;
for “Member or members of each supervisory authority” substitute “The Commissioner”;
omit paragraphs 4 to 6.
Omit Article 53 (general conditions for the members of the supervisory authority).
Omit Article 54 (rules on the establishment of the supervisory authority).
In Article 55 (competence)—
in paragraph 1, omit “on the territory of its own Member State”;
omit paragraph 2.
Omit Article 56 (competence of the lead supervisory authority).
In Article 57 (tasks)—
in paragraph 1, in the first sentence, for “each supervisory authority shall on its territory” substitute “the Commissioner is to”;
in paragraph 1, in point (e), omit “and, if appropriate, cooperate with the supervisory authorities in other Member States to that end”;
in paragraph 1, in point (f), omit “or coordination with another supervisory authority”;
in paragraph 1, omit points (g), (k) and (t);
“1A In this Article and Article 58, references to “this Regulation” have effect as references to this Regulation and section 28(3) of the 2018 Act.”
In Article 58 (powers)—
in paragraph 1, in point (a), omit “, and, where applicable, the controller’s or the processor’s representative”;
in paragraph 1, in point (f), for “Union or Member State procedural law” substitute “domestic law”;
in paragraph 3, in point (b), for “the Member State government” substitute “the Secretary of State”;
in paragraph 3, omit point (c);
In Article 59 (activity reports)—
for “, the government and other authorities as designated by Member State law” substitute “and the Secretary of State”;
omit “, to the Commission and to the Board”.
For Articles 60 to 76 substitute—
Co-operation with other supervisory authorities etc
The Commissioner may, in connection with carrying out the Commissioner’s functions under this Regulation—
co-operate with, provide assistance to and seek assistance from other supervisory authorities;
conduct joint operations with other supervisory authorities, including joint investigations and joint enforcement measures.
The Commissioner must, in carrying out the Commissioner’s functions under this Regulation, have regard to—
decisions, advice, guidelines, recommendations and best practices issued by the European Data Protection Board established under Article 68 of the GDPR;
any implementing acts adopted by the Commission under Article 67 of the GDPR (exchange of information).”
In Article 77 (right to lodge a complaint with a supervisory authority)—
in paragraph 1, omit “in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement”;
in paragraph 2, for “The supervisory authority with which the complaint has been lodged” substitute “The Commissioner”.
In Article 78 (right to an effective judicial remedy against a supervisory authority)—
for paragraph 3 substitute—
“3 Proceedings against the Commissioner are to be brought before a court in the United Kingdom.”;
In Article 79 (right to an effective judicial remedy against a controller or processor), for paragraph 2 substitute—
“2 Proceedings against a controller or a processor are to be brought before a court (see section 180 of the 2018 Act).”
In Article 80 (representation of data subjects)—
in paragraph 1, omit “where provided for by Member State law”;
in paragraph 2, for “Member States” substitute “The Secretary of State”;
“3 The power under paragraph 2 may only be exercised by making regulations under section 190 of the 2018 Act.”
Omit Article 81 (suspension of proceedings).
In Article 82 (right to compensation and liability), for paragraph 6 substitute—
“6 Proceedings for exercising the right to receive compensation are to be brought before a court (see section 180 of the 2018 Act).”
In Article 83 (general conditions for imposing administrative fines)—
in paragraph 5, in point (d), for “pursuant to Member State law adopted under Chapter IX” substitute “under Part 5 or 6 of Schedule 2 to the 2018 Act or under regulations made under section 16 of that Act”;
for “each Member State” substitute “the Secretary of State”;
for “that Member State” substitute “the United Kingdom”;
“8 Section 115(9) of the 2018 Act makes provision about the exercise of the Commissioner’s powers under this Article. Part 6 of the 2018 Act (enforcement) makes further provision in connection with administrative penalties (including provision about appeals).”;
omit paragraph 9.
In Article 84 (penalties)—
“1 The rules on other penalties applicable to infringements of this Regulation are set out in the 2018 Act (see in particular Part 6 (enforcement)).”;
In Article 85 (processing and freedom of expression and information)—
omit paragraph 1;
in paragraph 2, for “Member States shall” substitute “the Secretary of State, in addition to the relevant provisions, may by way of regulations (see section 16 of the 2018 Act),”;
in paragraph 2, at the end insert—
In Article 86 (processing and public access to official documents), for “Union or Member State law to which the public authority or body is subject” substitute “domestic law”.
Omit Article 87 (processing of national identification number).
Omit Article 88 (processing in the context of employment).
In Article 89 (safeguards and derogations relating to processing for archiving purposes etc)—
in paragraph 2, for “Union or Member State law may” substitute “the Secretary of State, in addition to the relevant provisions, may in regulations (see section 16 of the 2018 Act)”;
in paragraph 3, for “Union or Member State law may” substitute “the Secretary of State, in addition to the relevant provisions, may in regulations (see section 16 of the 2018 Act)”;
after paragraph 3 insert—
“3A In this Article “the relevant provisions” means section 15 of and Part 6 of Schedule 2 to the 2018 Act.”
Omit Article 90 (obligations of secrecy).
Omit Article 91 (existing data protection rules of churches and religious associations).
Omit Article 92 (exercise of the delegation).
Omit Article 93 (committee procedure).
Omit Article 94 (repeal of Directive 95/46/EC).
Omit Article 95 (relationship with Directive 2002/58/EC).
In Article 96 (relationship with previously concluded Agreements), for “by the Member States” substitute “by the United Kingdom or the Commissioner”.
Omit Article 97 (Commission reports).
Omit Article 98 (Commission reviews).
Omit Article 99 (entry into force and application).