SCHEDULES

SCHEDULE 19U.K.Minor and consequential amendments

PART 2 U.K.Amendments of other legislation

National Assembly for Wales Commission (Crown Status) Order 2007 (S.I. 2007/1118)U.K.

324U.K.For article 5 of the National Assembly for Wales Commission (Crown Status) Order 2007 substitute—

“Data Protection Act 2018U.K.

5(1)The Assembly Commission is to be treated as a Crown body for the purposes of the Data Protection Act 2018 to the extent specified in this article.

(2)The Assembly Commission is to be treated as a government department for the purposes of the following provisions—

(a)section 8(d) (lawfulness of processing under the GDPR: public interest etc),

(b)section 209 (application to the Crown),

(c)paragraph 6 of Schedule 1 (statutory etc and government purposes),

(d)paragraph 7 of Schedule 2 (exemptions from the GDPR: functions designed to protect the public etc), and

(e)paragraph 8(1)(o) of Schedule 3 (exemptions from the GDPR: health data).

(3)In the provisions mentioned in paragraph (4)—

(a)references to employment by or under the Crown are to be treated as including employment as a member of staff of the Assembly Commission, and

(b)references to a person in the service of the Crown are to be treated as including a person so employed.

(4)The provisions are—

(a)section 24(3) (exemption for certain data relating to employment under the Crown), and

(b)section 209(6) (application of certain provisions to a person in the service of the Crown).

(5)In this article, references to a provision of Chapter 2 of Part 2 of the Data Protection Act 2018 have the same meaning as in Parts 5 to 7 of that Act (see section 3(14) of that Act).”

Commencement Information