Source: http://www.legislation.gov.uk/ukpga/2018/12/schedule/2
Timestamp: 2018-07-19 23:45:33
Document Index: 190145277

Matched Legal Cases: ['art. 9', 'art. 7', 'art. 5', 'ART 1', 'ART 2', 'art 6', 'art 2', 'art 10', 'art 10', 'art 16', 'art 6', 'art 16', 'art 3', 'ART 3', 'ART 5']

Sch. 2 para. 1 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 2 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 4 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 5 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 6 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 7 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 8 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 9 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 10 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 11 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 12 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 13 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 15 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 16 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 17 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 18 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 19 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 20 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 21 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 22 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 23 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 24 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 25 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 26 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 27 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 28 coming into force by S.I. 2018/625 reg. 2(1)(b)
Sch. 2 para. 7 modified by S.I. 1999/3145, art. 9(1)(2) (as substituted) by 2018 c. 12 Sch. 19 para. 238
Sch. 2 para. 7 modified by S.I. 1999/677, art. 7(1)(2) (as substituted) by 2018 c. 12 Sch. 19 para. 237
Sch. 2 para. 7 modified by S.I. 2007/1118, art. 5(1)(2) (as substituted) by 2018 c. 12 Sch. 19 para. 324
SCHEDULE 2E+W+S+N.I.Exemptions etc from the GDPR
PART 1 E+W+S+N.I.Adaptations and restrictions based on Articles 6(3) and 23(1)
GDPR provisions to be adapted or restricted: “the listed GDPR provisions”E+W+S+N.I.
1In this Part of this Schedule, “the listed GDPR provisions” means—E+W+S+N.I.
(a)the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—
(vi)Article 18(1) (restriction of processing);
(x)Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and
(b)the following provisions of the GDPR (the application of which may be adapted by virtue of Article 6(3) of the GDPR)—
(i)Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6;
(ii)Article 5(1)(b) (purpose limitation).
Crime and taxation: generalE+W+S+N.I.
2(1)The listed GDPR provisions and Article 34(1) and (4) of the GDPR (communication of personal data breach to the data subject) do not apply to personal data processed for any of the following purposes—E+W+S+N.I.
(c)the assessment or collection of a tax or duty or an imposition of a similar nature,
(a)personal data is processed by a person (“Controller 1”) for any of the purposes mentioned in sub-paragraph (1)(a) to (c), and
(b)another person (“Controller 2”) obtains the data from Controller 1 for the purpose of discharging statutory functions and processes it for the purpose of discharging statutory functions.
(3)Controller 2 is exempt from the obligations in the following provisions of the GDPR—
(a)Article 13(1) to (3) (personal data collected from data subject: information to be provided),
(b)Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),
(c)Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers), and
(d)Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in paragraphs (a) to (c),
to the same extent that Controller 1 is exempt from those obligations by virtue of sub-paragraph (1).
Crime and taxation: risk assessment systemsE+W+S+N.I.
ImmigrationE+W+S+N.I.
4(1)The GDPR provisions listed in sub-paragraph (2) do not apply to personal data processed for any of the following purposes—E+W+S+N.I.
(b)the investigation or detection of activities that would undermine the maintenance of effective immigration control,
(2)The GDPR provisions referred to in sub-paragraph (1) are the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—
(d)Article 17(1) and (2) (right to erasure);
(e)Article 18(1) (restriction of processing);
(f)Article 21(1) (objections to processing);
(g)Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (f).
(That is, the listed GDPR provisions other than Article 16 (right to rectification), Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing) and Article 20(1) and (2) (right to data portability) and, subject to sub-paragraph (2)(g) of this paragraph, the provisions of Article 5 listed in paragraph 1(b).)
(a)personal data is processed by a person (“Controller 1”), and
(b)another person (“Controller 2”) obtains the data from Controller 1 for any of the purposes mentioned in sub-paragraph (1)(a) and (b) and processes it for any of those purposes.
(4)Controller 1 is exempt from the obligations in the following provisions of the GDPR—
to the same extent that Controller 2 is exempt from those obligations by virtue of sub-paragraph (1).
Information required to be disclosed by law etc or in connection with legal proceedingsE+W+S+N.I.
5(1)The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation.E+W+S+N.I.
PART 2 E+W+S+N.I.Restrictions based on Article 23(1): restrictions of rules in Articles 13 to 21 and 34
6In this Part of this Schedule, “the listed GDPR provisions” means the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—E+W+S+N.I.
(d)Article 16 (right to rectification);
(e)Article 17(1) and (2) (right to erasure);
(f)Article 18(1) (restriction of processing);
(g)Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing);
(h)Article 20(1) and (2) (right to data portability);
(i)Article 21(1) (objections to processing);
(j)Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (i).
Functions designed to protect the public etcE+W+S+N.I.
7The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—E+W+S+N.I.
(a)is designed as described in column 1 of the Table, and
(b)meets the condition relating to the function specified in column 2 of the Table,
to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.
Description of function design
1. The function is designed to protect members of the public against—
financial loss due to dishonesty, malpractice or other seriously improper conduct by, or the unfitness or incompetence of, persons concerned in the provision of banking, insurance, investment or other financial services or in the management of bodies corporate, or
financial loss due to the conduct of discharged or undischarged bankrupts.
The function is—
conferred on a person by an enactment,
a function of the Crown, a Minister of the Crown or a government department, or
of a public nature, and is exercised in the public interest.
2. The function is designed to protect members of the public against—
dishonesty, malpractice or other seriously improper conduct, or
unfitness or incompetence.
3. The function is designed—
to protect charities or community interest companies against misconduct or mismanagement (whether by trustees, directors or other persons) in their administration,
to protect the property of charities or community interest companies from loss or misapplication, or
to recover the property of charities or community interest companies.
5. The function is designed to protect members of the public against—
maladministration by public bodies,
failures in services provided by public bodies, or
a failure of a public body to provide a service which it is a function of the body to provide.
The function is conferred by any enactment on—
the Parliamentary Commissioner for Administration,
the Commissioner for Local Administration in England,
the Health Service Commissioner for England,
the Northern Ireland Public Services Ombudsman,
the Prison Ombudsman for Northern Ireland, or
the Scottish Public Services Ombudsman.
6. The function is designed—
to protect members of the public against conduct which may adversely affect their interests by persons carrying on a business,
to regulate agreements or conduct which have as their object or effect the prevention, restriction or distortion of competition in connection with any commercial activity, or
to regulate conduct on the part of one or more undertakings which amounts to the abuse of a dominant position in a market.
The function is conferred on the Competition and Markets Authority by an enactment.
Audit functionsE+W+S+N.I.
8(1)The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.E+W+S+N.I.
(2)The functions are any function that is conferred by an enactment on—
(b)the Auditor General for Scotland;
Functions of the Bank of EnglandE+W+S+N.I.
9(1)The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a relevant function of the Bank of England to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.E+W+S+N.I.
(2)“Relevant function of the Bank of England” means—
(a)a function discharged by the Bank acting in its capacity as a monetary authority (as defined in section 244(2)(c) and (2A) of the Banking Act 2009);
(b)a public function of the Bank within the meaning of section 349 of the Financial Services and Markets Act 2000;
(c)a function conferred on the Prudential Regulation Authority by or under the Financial Services and Markets Act 2000 or by another enactment.
Regulatory functions relating to legal services, the health service and children's servicesE+W+S+N.I.
10(1)The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function listed in sub-paragraph (2) to the extent that the application of those provisions would be likely to prejudice the proper discharge of the function.E+W+S+N.I.
(a)a function of the Legal Services Board;
(b)the function of considering a complaint under the scheme established under Part 6 of the Legal Services Act 2007 (legal complaints);
(c)the function of considering a complaint under—
(i)section 14 of the NHS Redress Act 2006,
(ii)section 113(1) or (2) or section 114(1) or (3) of the Health and Social Care (Community Health and Standards) Act 2003,
(iii)section 24D or 26 of the Children Act 1989, or
(iv)Part 2A of the Public Services Ombudsman (Wales) Act 2005;
(d)the function of considering a complaint or representations under Chapter 1 of Part 10 of the Social Services and Well-being (Wales) Act 2014 (anaw 4).
Regulatory functions of certain other personsE+W+S+N.I.
11The listed GDPR provisions do not apply to personal data processed for the purposes of discharging a function that—E+W+S+N.I.
(a)is a function of a person described in column 1 of the Table, and
(b)is conferred on that person as described in column 2 of the Table,
Person on whom function is conferred
How function is conferred
1. The Commissioner.
By or under—
the data protection legislation;
the Freedom of Information Act 2000;
section 244 of the Investigatory Powers Act 2016;
the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426);
the Environmental Information Regulations 2004 (S.I. 2004/3391);
the INSPIRE Regulations 2009 (S.I. 2009/3157);
Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC;
the Re-use of Public Sector Information Regulations 2015 (S.I. 2015/1415);
the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696).
2. The Scottish Information Commissioner.
the Freedom of Information (Scotland) Act 2002 (asp 13);
the Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520);
the INSPIRE (Scotland) Regulations 2009 (S.S.I. 2009/440).
3. The Pensions Ombudsman. By or under Part 10 of the Pension Schemes Act 1993 or any corresponding legislation having equivalent effect in Northern Ireland.
4. The Board of the Pension Protection Fund. By or under sections 206 to 208 of the Pensions Act 2004 or any corresponding legislation having equivalent effect in Northern Ireland.
5. The Ombudsman for the Board of the Pension Protection Fund. By or under any of sections 209 to 218 or 286(1) of the Pensions Act 2004 or any corresponding legislation having equivalent effect in Northern Ireland.
6. The Pensions Regulator. By an enactment.
7. The Financial Conduct Authority. By or under the Financial Services and Markets Act 2000 or by another enactment.
8. The Financial Ombudsman. By or under Part 16 of the Financial Services and Markets Act 2000.
9. The investigator of complaints against the financial regulators. By or under Part 6 of the Financial Services Act 2012.
10. A consumer protection enforcer, other than the Competition and Markets Authority. By or under the CPC Regulation.
11. The monitoring officer of a relevant authority. By or under the Local Government and Housing Act 1989.
12. The monitoring officer of a relevant Welsh authority. By or under the Local Government Act 2000.
13. The Public Services Ombudsman for Wales. By or under the Local Government Act 2000.
14. The Charity Commission.
the Charities Act 1992;
the Charities Act 2006;
the Charities Act 2011.
12In the Table in paragraph 11—E+W+S+N.I.
“consumer protection enforcer” has the same meaning as “CPC enforcer” in section 213(5A) of the Enterprise Act 2002;
the “CPC Regulation” has the meaning given in section 235A of the Enterprise Act 2002;
the “Financial Ombudsman” means the scheme operator within the meaning of Part 16 of the Financial Services and Markets Act 2000 (see section 225 of that Act);
the “investigator of complaints against the financial regulators” means the person appointed under section 84(1)(b) of the Financial Services Act 2012;
“relevant authority” has the same meaning as in section 5 of the Local Government and Housing Act 1989, and “monitoring officer”, in relation to such an authority, means a person designated as such under that section;
“relevant Welsh authority” has the same meaning as “relevant authority” in section 49(6) of the Local Government Act 2000, and “monitoring officer”, in relation to such an authority, has the same meaning as in Part 3 of that Act.
Parliamentary privilegeE+W+S+N.I.
13The listed GDPR provisions and Article 34(1) and (4) of the GDPR (communication of personal data breach to the data subject) do not apply to personal data where this is required for the purpose of avoiding an infringement of the privileges of either House of Parliament.E+W+S+N.I.
Judicial appointments, judicial independence and judicial proceedingsE+W+S+N.I.
Crown honours, dignities and appointmentsE+W+S+N.I.
15(1)The listed GDPR provisions do not apply to personal data processed for the purposes of the conferring by the Crown of any honour or dignity.E+W+S+N.I.
(2)The listed GDPR provisions do not apply to personal data processed for the purposes of assessing a person's suitability for any of the following offices—
(a)archbishops and diocesan and suffragan bishops in the Church of England;
(b)deans of cathedrals of the Church of England;
(c)deans and canons of the two Royal Peculiars;
(d)the First and Second Church Estates Commissioners;
(e)lord-lieutenants;
(f)Masters of Trinity College and Churchill College, Cambridge;
(g)the Provost of Eton;
(h)the Poet Laureate;
(i)the Astronomer Royal.
(3)The Secretary of State may by regulations amend the list in sub-paragraph (2) to—
(a)remove an office, or
(b)add an office to which appointments are made by Her Majesty.
(4)Regulations under sub-paragraph (3) are subject to the affirmative resolution procedure.
I1Sch. 2 para. 15 in force at Royal Assent for specified purposes, see s. 212(2)(f)
PART 3 E+W+S+N.I.Restriction based on Article 23(1): protection of rights of others
Protection of the rights of others: generalE+W+S+N.I.
16(1)Article 15(1) to (3) of the GDPR (confirmation of processing, access to data and safeguards for third country transfers), and Article 5 of the GDPR so far as its provisions correspond to the rights and obligations provided for in Article 15(1) to (3), do not oblige a controller to disclose information to the data subject to the extent that doing so would involve disclosing information relating to another individual who can be identified from the information.E+W+S+N.I.
(2)Sub-paragraph (1) does not remove the controller's obligation where—
(a)the other individual has consented to the disclosure of the information to the data subject, or
(b)it is reasonable to disclose the information to the data subject without the consent of the other individual.
(3)In determining whether it is reasonable to disclose the information without consent, the controller must have regard to all the relevant circumstances, including—
(a)the type of information that would be disclosed,
(b)any duty of confidentiality owed to the other individual,
(c)any steps taken by the controller with a view to seeking the consent of the other individual,
(d)whether the other individual is capable of giving consent, and
(e)any express refusal of consent by the other individual.
(a)“information relating to another individual” includes information identifying the other individual as the source of information;
(b)an individual can be identified from information to be provided to a data subject by a controller if the individual can be identified from—
(i)that information, or
(ii)that information and any other information that the controller reasonably believes the data subject is likely to possess or obtain.
Assumption of reasonableness for health workers, social workers and education workersE+W+S+N.I.
17(1)For the purposes of paragraph 16(2)(b), it is to be considered reasonable for a controller to disclose information to a data subject without the consent of the other individual where—E+W+S+N.I.
(a)the health data test is met,
(b)the social work data test is met, or
(c)the education data test is met.
(2)The health data test is met if—
(a)the information in question is contained in a health record, and
(b)the other individual is a health professional who has compiled or contributed to the health record or who, in his or her capacity as a health professional, has been involved in the diagnosis, care or treatment of the data subject.
(3)The social work data test is met if—
(a)the other individual is—
(i)a children's court officer,
(ii)a person who is or has been employed by a person or body referred to in paragraph 8 of Schedule 3 in connection with functions exercised in relation to the information, or
(iii)a person who has provided for reward a service that is similar to a service provided in the exercise of any relevant social services functions, and
(b)the information relates to the other individual in an official capacity or the other individual supplied the information—
(i)in an official capacity, or
(ii)in a case within paragraph (a)(iii), in connection with providing the service mentioned in paragraph (a)(iii).
(4)The education data test is met if—
(a)the other individual is an education-related worker, or
(b)the other individual is employed by an education authority (within the meaning of the Education (Scotland) Act 1980) in pursuance of its functions relating to education and—
(i)the information relates to the other individual in his or her capacity as such an employee, or
(ii)the other individual supplied the information in his or her capacity as such an employee.
“children's court officer” means a person referred to in paragraph 8(1)(q), (r), (s), (t) or (u) of Schedule 3;
“education-related worker” means a person referred to in paragraph 14(4)(a) or (b) or 16(4)(a), (b) or (c) of Schedule 3 (educational records);
“relevant social services functions” means functions specified in paragraph 8(1)(a), (b), (c) or (d) of Schedule 3.
PART 5 E+W+S+N.I.Exemptions etc based on Article 85(2) for reasons of freedom of expression and information
Journalistic, academic, artistic and literary purposesE+W+S+N.I.
26(1)In this paragraph, “the special purposes” means one or more of the following—E+W+S+N.I.
(c)Editors' Code of Practice.
(iv)Article 8(1) and (2) (child's consent);
I2Sch. 2 para. 26 in force at Royal Assent for specified purposes, see s. 212(2)(f)