Rights of the data subjectU.K.
12Limits on fees that may be charged by controllersU.K.
(1)The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on—
(a)Article 12(5) of the [F1UK GDPR] (reasonable fees when responding to manifestly unfounded or excessive requests), or
(b)Article 15(3) of the [F2UK GDPR] (reasonable fees for provision of further copies).
(2)The Secretary of State may by regulations—
(a)require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in reliance on those provisions, and
(b)specify what the guidance must include.
(3)Regulations under this section are subject to the negative resolution procedure.
Textual Amendments
F1Words in s. 12(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 15 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F2Words in s. 12(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 15 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I1S. 12 in force at Royal Assent for specified purposes, see s. 212(2)(f)
13Obligations of credit reference agenciesU.K.
(1)This section applies where a controller is a credit reference agency (within the meaning of section 145(8) of the Consumer Credit Act 1974).
(2)The controller's obligations under Article 15(1) to (3) of the [F3UK GDPR] (confirmation of processing, access to data and safeguards for third country transfers) are taken to apply only to personal data relating to the data subject's financial standing, unless the data subject has indicated a contrary intention.
(3)Where the controller discloses personal data in pursuance of Article 15(1) to (3) of the [F4UK GDPR], the disclosure must be accompanied by a statement informing the data subject of the data subject's rights under section 159 of the Consumer Credit Act 1974 (correction of wrong information).
Textual Amendments
F3Words in s. 13(2) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 16 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F4Words in s. 13(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 16 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
14Automated decision-making authorised by law: safeguardsU.K.
(1)This section makes provision for the purposes of Article 22(2)(b) of the [F5UK GDPR] (exception from Article 22(1) of the [F5UK GDPR] for significant decisions based solely on automated processing that are [F6required or authorised under the law of the United Kingdom or a part of the United Kingdom] and subject to safeguards for the data subject's rights, freedoms and legitimate interests).
(2)A decision is a “significant decision” for the purposes of this section if, in relation to a data subject, it—
(a)produces legal effects concerning the data subject, or
(b)similarly significantly affects the data subject.
(3)A decision is a “qualifying significant decision” for the purposes of this section if—
(a)it is a significant decision in relation to a data subject,
(b)it is required or authorised by law, and
(c)it does not fall within Article 22(2)(a) or (c) of the [F7UK GDPR] (decisions necessary to a contract or made with the data subject's consent).
(4)Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—
(a)the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and
(b)the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to—
(i)reconsider the decision, or
(ii)take a new decision that is not based solely on automated processing.
(5)If a request is made to a controller under subsection (4), the controller must, within the period described in Article 12(3) of the [F8UK GDPR]—
(a)consider the request, including any information provided by the data subject that is relevant to it,
(b)comply with the request, and
(c)by notice in writing inform the data subject of—
(i)the steps taken to comply with the request, and
(ii)the outcome of complying with the request.
(6)In connection with this section, a controller has the powers and obligations under Article 12 of the [F9UK GDPR] (transparency, procedure for extending time for acting on request, fees, manifestly unfounded or excessive requests etc) that apply in connection with Article 22 of the [F9UK GDPR].
(7)The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject's rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.
(8)Regulations under subsection (7)—
(a)may amend this section, and
(b)are subject to the affirmative resolution procedure.
Textual Amendments
F5Words in s. 14(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 17(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F6Words in s. 14(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 17(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F7Words in s. 14(3)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 17(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F8Words in s. 14(5) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 17(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F9Words in s. 14(6) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 17(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I2S. 14 in force at Royal Assent for specified purposes, see s. 212(2)(f)