Data Protection Act 2018 (c. 12)

SCHEDULES

SCHEDULE 2 U.K. Exemptions etc from the [F1 UK GDPR]

Textual Amendments

F1 Words in Sch. 2 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

PART 1 U.K. Adaptations and restrictions [F2 as described in] Articles 6(3) and 23(1)

Textual Amendments

F2 Words in Sch. 2 Pt. 1 heading substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

[F3 Immigration: safeguards: immigration exemption decisions U.K.

Textual Amendments

F3 Sch. 2 paras. 4A, 4B and cross-headings substituted (8.3.2024) by The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 (S.I. 2024/342), regs. 1(2), 3

4A. (1) A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) (referred to in this paragraph as “an immigration exemption decision”) must be made in accordance with this paragraph. U.K.

(2) An immigration exemption decision must be made—

(a) on a case by case basis,

(b) separately in respect of each of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) which relates to the data subject, and

(c) afresh on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) in relation to the data subject.

(3) When making an immigration exemption decision, the Secretary of State must take into account all the circumstances of the case, including at least the following—

(a) any potential vulnerability of the data subject that is relevant to the decision,

(b) all the rights and freedoms of the data subject including the data subject’s Convention rights, and

(c) any relevant duties or obligations of the United Kingdom, the Secretary of State or any other person, including—

(i) the United Kingdom’s obligations under the Refugee Convention and the Trafficking Convention,

(ii) any duty under section 55 of the Borders, Citizenship and Immigration Act 2009 (duty regarding the welfare of children), and

(iii) the need to ensure compliance with the UK GDPR.

(4) A decision that the application of a particular relevant UK GDPR provision mentioned in paragraph 4(2)(a) to (f) (or that provision in combination with the provision mentioned in paragraph 4(2)(g), so far as it applies) would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) may be made only if—

(a) the application of that provision or those provisions would give rise to a substantial risk of prejudice to any of the matters mentioned in paragraph 4(1)(a) and (b),

(b) that risk outweighs the risk of prejudice to the interests of the data subject concerned that would arise if the exemption in paragraph 4(1) were to apply in relation to that provision or those provisions, and

(c) the application of the exemption in relation to that provision or those provisions is necessary and proportionate to the risks in the particular case.

(5) In this paragraph—

• “Convention rights” has the same meaning as in the Human Rights Act 1998 (see section 1(1) of that Act);

• “the Refugee Convention” means the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol;

• “the Trafficking Convention” means the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005.]