Data Protection Act 2018

The Data Protection Act 2018 achieved Royal Assent on 23 May 2018. It applies the EU's GDPR standards.[1] Whereas the GDPR gives member states limited opportunities to make provisions for how it applies in their country, one element of the DPA 2018 is the details of these, applying as the national law. The DPA 2018 is however not limited to the UK GDPR provisions.[2]

The Act has seven parts. These are outlined in Section 1:[3]

1. This Act makes provision about the processing of personal data.
2. Most processing of personal data is subject to GDPR.
3. Part 2 supplements the GDPR (see Chapter 2) and applies a broadly equivalent regime to certain types of processing to which the GDPR does not apply (see Chapter 3).
4. Part 3 makes provision about the processing of personal data by competent authorities for law enforcement purposes and implements the Law Enforcement Directive.
5. Part 4 makes provision about the processing of personal data by the intelligence services.
6. Part 5 makes provision about the Information Commissioner.
7. Part 6 makes provision about the enforcement of the data protection legislation.
8. Part 7 makes supplementary provision, including provision about the application of this Act to the Crown and to Parliament.

The Act introduces new offences that include knowingly or recklessly obtaining or disclosing personal data without the consent-giving of the data controller, procuring such disclosure, or retaining the data obtained without consent. Selling, or offering to sell, personal data knowingly or recklessly obtained or disclosed would also be an offence.[4]

Essentially, the Act implements the EU Law Enforcement Directive,[5] it implements those parts of the GDPR which "are to be determined by Member State law" and it creates a framework similar to the GDPR for the processing of personal data which is outside the scope of the GDPR. This includes intelligence services processing, immigration services processing and the processing of personal data held in unstructured form by public authorities.

Under section 3 of the European Union (Withdrawal) Act 2018,[6] the GDPR will be incorporated directly into domestic law immediately after the UK exits the European Union.

The enforcement of the Act by the Information Commissioner's Office is supported by a data protection charge on UK data controllers under the Data Protection (Charges and Information) Regulations 2018. Exemptions from the charge were left broadly the same as for 1998 Act: largely some businesses and non-profits internal core purposes (staff or members, marketing and accounting), household affairs, some public purposes, and non-automated processing.[7][8] Under the 2018 Act the enforcement regime for registration changed from criminal to civil monetary penalties.[9]

The Data Protection Act (2018) is a revision of the Data Protection Act (1998) which includes the importance of organizations to be more responsible with the information as well as improving the confidentiality.[10] The latter revision also works in tandem with the GDPR, which the Data Protection Act (1998) didn't do. [11]

From the Data Protection Act (1998) to the Data Protection Act (2018), the key additions are the following:[12]

• the right to erasure
• inclusions of exemptions of the Data Protection Act
• being regulated in tandem with the GDPR

The revision allowed the law makers to add the ability to erase any data if the individual chooses to and this is based on the premise of the basic right to privacy.[12]

The 2018 version allowed people to get a clear interpretation of the exemptions of the act, which was unclear in the 1998 version.[11]

When the 1998 act was being made, the GDPR did not exist, thus there was no law for the DPA to work with. Eventually, with the creation of the GPDR, the DPA was updated to work in tandem.[13]

• Full text of the Data Protection Act 2018
• The Data Protection (Charges and Information) Regulations 2018
• Information Commissioner's Office DPA 2018 page
• Easier to read GDPR in 24 languages