The Data Protection Act 2018 - repealing the 1998 Act and applying the GDPR

Jane Lambert

As everyone knows, the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) repealed and replaced the Data Protection Directive (Directive 94/46/EC) with effect from 25 May 2018.

Even though it repealed the Directive which was implemented into English and Welsh, Scottish and Northern Irish law by the Data Protection Act 1998, the GDPR did not automatically repeal the 1998 Act although the doctrine of the primacy of EU law recognized by the House of Lords in R (Factortame Ltd) v Secretary of State for Transport (No 2) [1991] [1990] UKHL 13, [1991] 1 Lloyd's Rep 10, [1991] 1 AC 603, [1991] 1 All ER 70, [1990] 3 WLR 818, [1991] AC 603, (1991) 3 Admin LR 333, [1990] 3 CMLR 375 would have had that practical effect.

For the avoidance of any doubt, Parliament passed the Data Protection Act 2018 which received royal assent on 23 May 2018, which was two days before the General Data Protection Regulation ("GDPR") was due to take effect.  The introductory text describes the newAct as:

"An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner’s functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes."

It consists of 215 sections and 20 schedules.  It is intended to supplement the GDPR and implement the Data Protection Law Enforcement Directive (Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA).

Because the Act received royal assent only days before the GDPR was due to come into effect, the following provisions came into effect immediately:

• s.1  The Overview setting out the purposes for which the legislation was enacted;
• s.3  Terms relating to the processing of personal data: definitions and interpretation;
• s.182 Regulations and consultation: power to make delegated legislation;
• s.204 Meaning of 'health professional' and 'social professional'
• s.204 General interpretation;
• s.205 Index of defined expressions;
• s.209 Application to the Crown;
• s.210 Application to Parliament;
• s.213 (2) Transitional provision: power of secretary of state to make provisional legislation;
• s.214 Extent
• s.215 Short Title.

The very next day, Margot James MP, Minister for State at the Department for Digital, Culture, Media and Sport, signed The Data Protection Act 2018 (Commencement No. 1 and Transitional and Saving Provisions) Regulations 2018 SI 2018 No 625. Reg 2 (1) of those Regulations brought the following provisions of the Data Protection Act 2018 into effect from 25 May 2018:

• s.2  Protection of Personal Data;
• Part 2 General Processing: s.4 to s.28 and Scheds. 1, 2, 3. 4. 5 and 6 except para 62 of Sched. 6;
• Part 3 Law Enforcement Processing: s.29 to s.81 and Scheds. 7 and 8;
• Part 4 Intelligence Services Processing: s.82 to s.113 and Scheds, 9, 10 and 11 except s.93, s.102, s.103, s.104, s.105 and s.108;
• Part 5  Information Commissioner: s.114 to s.141 and Scheds. 12, 13 and 14 other than s.124, s.125, s.126  and s.127 in so far as they relate to a code prepared under s.124, s.177, s.178 and Sched. 17 and s.179 which come into force on 23 July 2018 by virtue of s.212 (3) and s.123, s.125, s.126, s.127, s.188, s.189, s.190, s.191, s.192, s.193, s.194 and s.195 which also come into force on 23 July 2018 by virtue of reg 3;
• Part 6 Enforcement: s.142 to s.181 and Scheds. 15, 16 and 17 except for the provisions mentioned about which will come into force on 23 July 2018; and
Part 7 Supplementary and Final Provisions: s.182 to s.215 and Scheds. 18, 19 and 20 except for paras 76, 201, 211 and 227 of Sched. 19 and s.123, s.125, s.126, s.127, s.188, s.189, s.190, s.191, s.192, s.193, s.194 and s.195.

It will be seen that most of the Act is already in force and the few provisions that are not will come into force on 23 July 2018.

The provisions that repeal most of the 1998 Act are s.211 (1) (a) and para 44 of Sched. 19 of the Data Protection Act 2018.  S.111 (1) (a) provides:

"In Schedule 19—
(a)  Part 1 contains minor and consequential amendments of primary legislation ..."

Para 44 of Sched. 19 adds:

"The Data Protection Act 1998 is repealed, with the exception of section 62 and paragraphs 13, 15, 16, 18 and 19 of Schedule 15 (which amend other enactments)."

There are of course transitional and provisional measures that I shall address when occasion demands.

Anyone wishing to discuss this article, GDPR or data protection generally may call me on +44 (0)20 7404 5252 during office hours or send me a message through my contact form.

Introduction to The Data Protection Bill

Standard YouTube Licence


Jane Lambert

On 14 Sept 2017, the Government introduced The Data Protection Bill into the House of Lords. The purpose of the Bill is to

"Make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner’s functions under certain regulations relating to information; to make provision for a direct marketing code of conduct; and for connected purposes."

The Bill is needed to implement Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA which comes into force on the 5 May 2018 and to maintain in force the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) ("the GDPR") after we leave the EU.

The need to continue the provisions of the GDPR was spelt out in the Commission's Position Paper on the Use of Data and Protection of Information Obtained or Processed before the Withdrawal Date which I discussed in Commission Position Paper on Data Protection and Protection of Information obtained or processed before the Withdrawal Date 15 Sep 2017 NIPC Brexit:

"It is recalled that the United Kingdom's access to networks, information systems and databases established by Union law is, as a general rule, terminated on the date of withdrawal.
The United Kingdom or entities in the United Kingdom may keep and continue to use data or information received/processed in the United Kingdom before the withdrawal date and referred to below only if the conditions set out in this paper are fulfilled. Otherwise such data or information (including any copies thereof) should be erased or destroyed.
The principles set out in this paper should also apply, mutatis mutandis, to personal data, data or information which was received /processed by the United Kingdom or entities in the United Kingdom after the withdrawal date pursuant to the Withdrawal Agreement."

The conditions set out in the Position Paper will be implemented by the GDPR and continued by the Bill when it comes into law.

The Bill consists of 194 clauses and 18 Schedules. Clause 1 contains an overview:

"1  Overview (1) This Act makes provision about the processing of personal data.
(2) Most processing of personal data is subject to the GDPR.
(3) Part 2 supplements the GDPR (see Chapter 2) and applies a broadly equivalent regime to certain types of processing to which the GDPR does not apply (see Chapter 3).
(4) Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes and implements the Law Enforcement Directive.
(5) Part 4 makes provision about the processing of personal data by the intelligence services.
(6) Part 5 makes provision about the Information Commissioner.
(7) Part 6 makes provision about the enforcement of the data protection legislation.
(8) Part 7 makes supplementary provision, including provision about the application of this Act to the Crown and to Parliament."

 The Department of Culture, Media and Sport has published the press release Data laws to be made fit for digital age and fact sheets containing an Overview of the Bill, General Data Processing, Law Enforcement Data Processing, National Security Data Processing and The Information Commissioner and Enforcement. There are also Explanatory Notes.

The Bill has already had its first reading in the House of Lords and will have its second on the 10 Oct 2017. I will follow the Bill as it makes its way through Parliament and analyse its provisions. I will also analyse the GDPR and the Directive as the day for their implementation approaches.

Should anyone wish to discuss the Bill or the GDPR and Directive, he or she should call me during office hours on +44 (0)20 7404 5252 or send me a message through my contact form. 

Welcome to NIPC Data Protection

Jane Lambert

On 25 May 2018 the General Data Protection Regulation ("the GDPR") takes effect in every member state of the European Union including the United Kingdom. The position has been complicated in this country by last year's referendum on EU membership which means that the Regulation will cease to apply to the UK on the 29 March 2019 when we leave the EU unless there is evidence of a sufficient change of heart on the part of the public to persuade the government to change tack.

A fair size industry of consultants, publishers and conference organizers has grown up to prepare businesses for the introduction of this legislation. As Elizabeth Denham, our Information Commissioner has pointed out in GDPR – sorting the fact from the fiction 9 Aug 2017, there have been a lot of scare stories about the GDPR and not a little misinformation. There will be some changes as a result of the GDPR.  Data subjects will get new rights on 25 May 2018 and there will be increased sanctions for non-compliance. Those changes, however, are evolutionary rather than revolutionary. It should not be too difficult to prepare for them or to manage them.

Because it is a regulation rather than a directive, the GDPR does not require any implementing legislation.  However, there will be a new data protection statute for the United Kingdom for three reasons. The first is to transpose the Data Protection Law Enforcement Directive into the laws of the United Kingdom. The second is to confer rights on data subjects that are not provided by the GDPR such as the right to require social media platforms to delete information held on them at age 18. The third reason for the new Act is to preserve the provisions of the GDPR after Brexit day as I noted in
What will happen to the GDPR in the United Kingdom after Brexit? 10 Aug 2017 NIPC Brexit.

Like the Data Protection Directive which it replaces, the policy of the GDPR is to give effect to the Council of Europe Data Protection Convention and the OECD Guidelines on Transborder Data Flow having regard to changing technology and applying the experience of the operation of the Data Protection Directive. As before, the objectives are to facilitate transborder data flow while protecting the privacy and other interests of individuals

The Data Protection Law Enforcement Directive is new. It seeks to harmonize the use of information technology by law enforcement agencies throughout the member states. However, that legislation also traces its wellspring the Council of Europe's Data Protection Convention which itself applies the European Convention on Human Rights to data processing. Art 63 (1) of the Law Enforcement Directive requires member states to transpose it into national law by 6 May 2018.

Over the next few weeks I shall write about various aspects of the Law Enforcement Directive and the GDRP as the 6 and 25 May 2018 draw closer. I shall also write about the Data Protection Bill as it makes its way through Parliament. I have started with a glossary as the terminology used in the GDPR is different from that of the Data Protection Directive. In that endeavour, I hope to remove some of the hot air and panic about the new legislation.

Should anyone wish to discuss this article or data protection generally, he or she should call me on +44 (0)20 7404 5252 during office hours or send me a message through my contact form.