DOCSLIB.ORG

Data Protection & Privacy 2020

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Data Protection & Privacy 2020 Data Protection & Privacy 2020 Contributing editors Aaron P Simpson and Lisa J Sotto Hunton Andrews Kurth LLP © Law Business Research 2019 Leaders in Privacy and Cybersecurity Keep the trust you’ve earned. Complying with global privacy, data protection and cybersecurity rules is challenging, especially for businesses that operate across borders. Our top-ranked privacy team, in combination with the firm’s Centre for Information Policy Leadership, advises on all aspects of US and European data protection law and cybersecurity events. We help businesses develop global compliance frameworks addressing regulatory obligations in the US, the EU and across the world. The firm is widely recognized globally as a leading privacy and data security firm. For more information, visit www.huntonprivacyblog.com. ©2019 Hunton Andrews Kurth LLP | HuntonAK.com © Law Business Research 2019 19268_GettingTheDealThrough_SponsorAd_R2.indd 2 7/9/19 9:22 AM Publisher Tom Barnes [email protected] Subscriptions Claire Bagnall Data Protection & [email protected] Senior business development managers Adam Sargent Privacy [email protected] Dan White [email protected] 2020 Published by Law Business Research Ltd 87 Lancaster Road London, W11 1QQ, UK Contributing editors Tel: +44 20 3780 4147 Aaron P Simpson and Lisa J Sotto Fax: +44 20 7229 6910 Hunton Andrews Kurth LLP The information provided in this publication is general and may not apply in a specific situation. Legal advice should always be sought before taking any legal action based on the information provided. This Lexology Getting The Deal Through is delighted to publish the eighth edition of Data Protection information is not intended to create, nor and Privacy, which is available in print and online at www.lexology.com/gtdt. does receipt of it constitute, a lawyer– Lexology Getting The Deal Through provides international expert analysis in key areas of client relationship. The publishers and law, practice and regulation for corporate counsel, cross-border legal practitioners, and company authors accept no responsibility for any directors and officers. acts or omissions contained herein. The information provided was verified between Throughout this edition, and following the unique Lexology Getting The Deal Through format, June and July 2019. Be advised that this is the same key questions are answered by leading practitioners in each of the jurisdictions featured. a developing area. Our coverage this year includes new chapters on Hungary, Iceland, Indonesia and Malaysia. Lexology Getting The Deal Through titles are published annually in print. Please ensure you © Law Business Research Ltd 2019 are referring to the latest edition or to the online version at www.lexology.com/gtdt. No photocopying without a CLA licence. Every effort has been made to cover all matters of concern to readers. However, specific First published 2012 legal advice should always be sought from experienced local advisers. Eighth edition Lexology Getting The Deal Through gratefully acknowledges the efforts of all the contribu- ISBN 978-1-83862-146-9 tors to this volume, who were chosen for their recognised expertise. We also extend special thanks to the contributing editors, Aaron P Simpson and Lisa J Sotto of Hunton Andrews Kurth Printed and distributed by LLP, for their continued assistance with this volume. Encompass Print Solutions Tel: 0844 2480 112 London July 2019 Reproduced with permission from Law Business Research Ltd This article was first published in August 2019 For further information please contact [email protected] www.lexology.com/gtdt 1 © Law Business Research 2019 Contents Introduction 5 Greece 90 Aaron P Simpson and Lisa J Sotto Vasiliki Christou Hunton Andrews Kurth LLP Vasiliki Christou EU overview 9 Hungary 97 Aaron P Simpson, Claire François and James Henderson Endre Várady and Eszter Kata Tamás Hunton Andrews Kurth LLP VJT & Partners Law Firm The Privacy Shield 12 Iceland 104 Aaron P Simpson and Maeve Olney Áslaug Björgvinsdóttir and Steinlaug Högnadóttir Hunton Andrews Kurth LLP LOGOS legal services Australia 16 India 112 Alex Hutchens, Jeremy Perier and Meena Muthuraman Stephen Mathias and Naqeeb Ahmed Kazia McCullough Robertson Kochhar & Co Austria 24 Indonesia 119 Rainer Knyrim Abadi Abi Tisnadisastra, Prihandana Suko Prasetyo Adi Knyrim Trieb Attorneys at Law and Filza Adwani AKSET Law Belgium 32 David Dumont and Laura Léonard Italy 126 Hunton Andrews Kurth LLP Rocco Panetta and Federico Sartore Panetta & Associati Brazil 43 Fabio Ferreira Kujawski, Paulo Marcos Rodrigues Brancher Japan 136 and Thiago Luís Sombra Akemi Suzuki and Tomohiro Sekiguchi Mattos Filho Nagashima Ohno & Tsunematsu Chile 50 Korea 144 Carlos Araya, Claudio Magliona and Nicolás Yuraszeck Young-Hee Jo, Seungmin Jasmine Jung and Kwangbok Kim Magliona Abogados LAB Partners China 56 Lithuania 153 Vincent Zhang and John Bolin Laimonas Marcinkevičius Jincheng Tongda & Neal Juridicon Law Firm Colombia 66 Malaysia 159 María Claudia Martínez Beltrán and Daniela Huertas Vergara Jillian Chia and Natalie Lim DLA Piper Martínez Beltrán Abogados Skrine France 73 Malta 166 Benjamin May and Farah Bencheliha Ian Gauci and Michele Tufigno Aramis Gatt Tufigno Gauci Advocates Germany 83 Mexico 174 Peter Huppertz Abraham Díaz Arceo and Gustavo A Alcocer Hoffmann Liebs Partnerschaft von Rechtsanwälten mbB OLIVARES 2 Data Protection & Privacy 2020 © Law Business Research 2019 Contents Netherlands 182 Inge de Laat and Margie Breugem Rutgers Posch Visée Endedijk NV Portugal 188 Helena Tapp Barroso and Tiago Félix da Costa Morais Leitão, Galvão Teles, Soares da Silva & Associados Russia 196 Ksenia Andreeva, Anastasia Dergacheva, Anastasia Kiseleva, Vasilisa Strizh and Brian Zimbler Morgan, Lewis & Bockius LLP Serbia 204 Bogdan Ivanišević and Milica Basta BDK Advokati Singapore 212 Lim Chong Kin Drew & Napier LLC Sweden 229 Henrik Nilsson Wesslau Söderqvist Advokatbyrå Switzerland 236 Lukas Morscher and Nadja Flühler Lenz & Staehelin Taiwan 245 Yulan Kuo, Jane Wang, Brian, Hsiang-Yang Hsieh and Ruby, Ming-Chuang Wang Formosa Transnational Attorneys at Law Turkey 252 Esin Çamlıbel, Beste Yıldızili and Naz Esen TURUNÇ United Kingdom 259 Aaron P Simpson, James Henderson and Jonathan Wright Hunton Andrews Kurth LLP United States 268 Lisa J Sotto and Aaron P Simpson Hunton Andrews Kurth LLP www.lexology.com/gtdt 3 © Law Business Research 2019 Introduction Aaron P Simpson and Lisa J Sotto Hunton Andrews Kurth LLP This introductory piece aims to highlight the main developments in the International instruments international privacy and data protection arena in the past year. The There are a number of international instruments that continue to have first introduction to this publication in 2013 noted the rapid growth of a significant influence on the development of privacy and data protec- privacy and data protection laws across the globe and reflected on the tion laws. commercial and social pressures giving rise to this global development. The main international instruments are the Convention for the Those economic and social pressures have not diminished since that Protection of Individuals with regard to the Automatic Processing of first edition, and they are increasingly triggering new initiatives from Personal Data (Convention 108) of the Council of Europe, the OECD legislators to regulate the use of personal information. Privacy Recommendations and Guidelines (OECD Guidelines), the The exponential increase of privacy and data protection rules fuels European Union General Data Protection Regulation (GDPR), the Asia- the idea that personal information has become the new ‘oil’ of today’s Pacific Economic Cooperation Privacy Framework (the Framework) data-driven economies, with laws governing its use becoming ever and the African Union Convention on Cyber Security and Personal Data more significant. Protection. The same caveat as in previous editions still holds true today: as Convention 108 has been ratified by 53 countries; in June 2018, privacy and data protection rules are constantly evolving, any publica- Cape Verde and Mexico became the fifth and sixth non-European tion on the topic is likely to be outdated shortly after it is circulated. countries – after Mauritius, Uruguay, Senegal and Tunisia – to ratify Therefore, anyone looking at a new project that involves the jurisdic- Convention 108. Morocco, Burkina Faso and Argentina have been invited tions covered in this publication should verify whether there have been to accede to Convention 108 and are expected to be the next countries new legislative or regulatory developments since the date of writing. to become parties. All parties to Convention 108 have passed domestic laws that implement the Convention’s standards. An Additional Protocol Convergence of laws to the Convention requires each party to establish an independent In previous editions of this publication, the variation in the types and authority to ensure compliance with data protection principles and sets content of privacy and data protection laws across jurisdictions has out rules on international data transfers. Convention 108 is open to been highlighted. It has also been noted that, although privacy and data signature by any country and claims to be the only instrument providing protection laws in different jurisdictions are far from identical, they often binding standards that have the potential to be applied globally. It has focus on similar principles and
Load more

Recommended publications
  • Security Forum Strategic Panel Phorm Position Paper
    Security Forum Strategic Panel Phorm Position Paper PHORM – PRIVACY IMPACT OF NEW INTERNET ADVERTISING MECHANISMS 1. INTRODUCTION 1.1. Online advertising company Phorm has caused a stir in the Internet community because of its profile-driven service. Phorm has trialled this service with BT, and signed further contracts with Virgin Media and TalkTalk. However, critics claim that the service breaches the Regulation of Investigatory Powers Act (2000), and that Phorm’s approach is contrary to users’ privacy wishes. 1.2. The BCS believes that the solution to this debate rests in self-regulation of online advertising: companies must establish and enforce a code of conduct; be completely transparent about their practices; resist sharing data with third parties; and submit to ongoing oversight from an independent third party organisation. 2. THE BATTLE FOR THE INTERNET 2.1. The massive market for online advertising is one that affects every Internet user: many search engines and websites depend upon advertising revenues for funding, and some ISPs use advertising to subsidise subscription costs. In the absence of those funding sources they would either have to pass on additional operating costs to users, or cease trading altogether. 2.2. The battle for control of Internet advertising had, until recently, been confined to a small number of (rapidly consolidating) players including the likes of Microsoft, Google, Yahoo! and DoubleClick. These well-established companies have built their offerings over many years and believed themselves to control the market, with little threat from new companies. 2.3. However, a new breed of online advertising company has recently appeared.
    [Show full text]
  • Protection of Biometric Information of Children in Schools and Colleges
    Protection of biometric information of children in schools and colleges Advice for proprietors, governing bodies, head teachers, principals and school and college staff March 2018 Contents 1. About this advice 3 Expiry/review date 3 What legislation does this advice relate to? 3 Who is this advice for? 3 2. Key Points 4 What is biometric data? 4 What is an automated biometric recognition system? 5 What does processing data mean? 5 3. The Protection of Freedoms Act 2012 6 Notification and Parental Consent 6 The pupil’s right to refuse 7 Providing alternatives 8 The Data Protection Act 1998 8 Associated Resources 9 4. Template Notification and Consent Form 10 2 1. About this advice This is non-statutory advice from the Department for Education. It explains the legal duties schools and colleges have if they wish to use biometric information about pupils for the purposes of using automated biometric recognition systems. The duties on schools and colleges in the Protection of Freedoms Act 2012 set out in this advice came into effect from 1 September 2013. Schools and colleges using automated biometric recognition systems, or planning to install them, should make arrangements to notify parents and obtain the consent required under the duties set out in the body of this advice. There are no circumstances in which a school or college can lawfully process a pupil’s biometric data without having notified each parent of a child and received the necessary consent. This advice replaces “Protection of biometric information of children in schools”, which was issued in December 2012.
    [Show full text]
  • The Data Protection Act 1998 and Personal Privacy
    Introduction On 2 February 1998 Lord Williams of Mostyn commenced his second reading speech for the Data Protection Bill: “I recognise that data protection does not sound like a subject to attract obsessive interest; witness the general exodus from your Lordships’ House as I start to Monday, 19 March 2012 introduce this Second Reading. Data protection is redolent in many ways of computers and electronic processing: necessary but essentially technical providers The Data Protection Act 1998 & Personal Privacy of services. In fact it affects our well-being in a much more general way. It shares common ground to that extent with the Human Rights Bill. That Bill will improve Philip Coppel QC the position of citizens of this country by enabling them to rely on the wide range of civil and political rights contained in the European Convention on Human Rights. Those rights include the right to respect for private and family life. The Data Protection Bill also concerns privacy, albeit a specific form of privacy; Synopsis: Described in Campbell v MGN [2003] QB 633 at [72] as “a thicket” personal information privacy. The subject matter of the Bill is, therefore, and as “certainly a cumbersome and inelegant piece of legislation”, inherently important to our general social welfare.”1 the Data Protection Act 1998 is the ugly relation in the law of As I penned this talk, with more than a decade having passed since Lord privacy. As the Human Rights Act 1998 has extruded the law of Williams’s speech echoed in the House, I did wonder whether his words confidentiality to protect personal privacy, the Data Protection Act would similarly resonate tonight.
    [Show full text]
  • Data Protection, Caldicott
    This printed version may be out of date. You should refer to the Hampshire Partnership Trust website (www.hantspt.nhs.uk) for the most up to date copy of this policy NCP 25 DATA PROTECTION, CALDICOTT & CONFIDENTIALITY POLICY & PROCEDURES [VERSION 2] Author: Information Governance Manager 1 Version 2 March 2007 This printed version may be out of date. You should refer to the Hampshire Partnership Trust website (www.hantspt.nhs.uk) for the most up to date copy of this policy NCP 25 Hampshire Partnership NHS Trust POLICIES AND PROCEDURES PROFORMA Subject and Version of Document: Data Protection, Caldicott & Confidentiality Policy and Procedure; Version 2 Author: Gordon Cheeseman, Information Governance Manager Persons/Committees etc consulted Information Governance Group, P&PC, TMT, whilst document in draft: TB Date agreed: Version 1: June 2004 Version 2: March 2007 By whom agreed: P&PC (March 04), TMT (June 04), TB Date of next review/update March 2010 and by whom: Information Governance Group Copy obtainable from: Website Date document issued: Version 1: July 2004 – Update 9 Version 2: March 2007 – Update 22 Responsibility for dissemination All Department Heads to new staff: Principal Target Audience: All staff who come into contact with personal identifiable information Training Implications: Staff Awareness Legal responsibilities covered in Organisational Induction. Amendments Summary: Amend. No. Issued Page Subject 1, Version 2 Nov 2006 All Minor changes to update document 2. Version 2 Dec 2006 24 & 30 Procedure for franked mail 3. Version 2 March 2007 8 Confidentiality: NHS Code of Practice 4. Version 2 March 2007 24 NHSmail Guidance Author: Information Governance Manager 2 Version 2 March 2007 This printed version may be out of date.
    [Show full text]
  • Data Protection and Human Rights
    House of Lords House of Commons Joint Committee on Human Rights Data Protection and Human Rights Fourteenth Report of Session 2007–08 HL Paper 72 HC 132 House of Lords House of Commons Joint Committee on Human Rights Data Protection and Human Rights Fourteenth Report of Session 2007–08 Report, together with formal minutes, and oral and written evidence Ordered by The House of Commons to be printed 4 March 2008 Ordered by The House of Lords to be printed 4 March 2008 HL Paper 72 HC 132 Published on 14 March 2008 by authority of the House of Commons London: The Stationery Office Limited £0.00 Joint Committee on Human Rights The Joint Committee on Human Rights is appointed by the House of Lords and the House of Commons to consider matters relating to human rights in the United Kingdom (but excluding consideration of individual cases); proposals for remedial orders, draft remedial orders and remedial orders. The Joint Committee has a maximum of six Members appointed by each House, of whom the quorum for any formal proceedings is two from each House. Current membership HOUSE OF LORDS HOUSE OF COMMONS Lord Bowness John Austin MP (Labour, Erith & Thamesmead) Lord Dubs Mr Douglas Carswell MP (Conservative, Harwich) Lord Lester of Herne Hill Mr Andrew Dismore MP (Labour, Hendon) (Chairman) Lord Morris of Handsworth OJ Dr Evan Harris MP (Liberal Democrat, Oxford West & The Earl of Onslow Abingdon) Baroness Stern Virendra Sharma MP (Labour, Ealing, Southall) Mr Richard Shepherd MP (Conservative, Aldridge-Brownhills) Powers The Committee has the power to require the submission of written evidence and documents, to examine witnesses, to meet at any time (except when Parliament is prorogued or dissolved), to adjourn from place to place, to appoint specialist advisers, and to make Reports to both Houses.
    [Show full text]
  • UK & EU Data Protection Bulletin
    UK & EU Data Protection Bulletin: April - May 2019 United Kingdom Information Commissioner's Office (ICO) Date Description 15 April The ICO has released its new code on age-appropriate design. It imposes strict rules on information society service providers whose services are likely to be accessed by children. As drafted, compliance with the code may require substantial design and operational changes and organisations which are likely to be affected by its provisions should review carefully. This code is open for public consultation until 31 May 2019. For more please see our Bird & Bird update here. 29 April ICO call for views on a data protection and journalism code of practice. The ICO issued a consultation on the upcoming data protection and journalism code of practice. This consultation, which ends on 27 May, is meant to be the first stage of the consultation process. Contributions will be used to draft and develop the code which will also be based on the detailed guidance already issued by the ICO on this topic. To help with the consultation process, the ICO made available a survey (available here) that can be completed by organisations wishing to express their view on this topic. 1 UK Cases Date Description 10 April Robin Rudd V (1) John Bridle (2) J&S Bridle Ltd [2019] Ewhc 893 This case relates to the Court exercising its discretion in connection with a subject access request. Facts In this decision, Mr Rudd, who is a doctor who specialises in the science of exposure to asbestos and who often acted as an expert witness for claimants in asbestos actions, brought a claim under S7 of the old Data Protection Act 1998 and sought an order requiring the defendants to comply with a subject access request.
    [Show full text]
  • The Data Protection Act 1998 & Market
    The Data Protection Act 1998 & Market Research: Guidance for MRS Members September 2003 NB. The document refers to the MRS Code of Conduct and other documents in force at the time of its adoption 1 of 38 This has been produced as a response to the Data Protection Act 1998 and replaces the MRS Guidelines for Handling Databases. "I welcome this guidance. It would not be appropriate for me to produce detailed bespoke guidance for all different sectors and industries. I am, therefore, pleased that the Market Research Society and other bodies have taken the initiative to produce guidance on the Data Protection Act 1998. This guidance, reflecting the MRS's detailed knowledge of the uses of personal data within their industry, should prove very useful to the market research community." Elizabeth France This material is provided for information only. It is not legal advice and should not be relied upon as such. Specific legal advice should be taken in relation to specific issues. CONTENTS 1. Introduction: why a new guideline is necessary; who should read it; main source documents. 2. The Data Protection Act 1998: the main Principles of the new Act; how it differs from the 1984 Act; exemptions covering research; definitions of the terms used in the Act. 3. Definitions of Survey Research and Categories of Data Processing Projects: differentiating market research from other data processing activities and the limits allowed when feeding back information to clients. 4. Using and Managing Databases in Market Research: expanded guidance covering the growing importance of databases in market research; the implications for market research of the new data controller status defined in the Act.
    [Show full text]
  • The Contactpoint Database
    The ContactPoint database Standard Note: SN/SP/5171 Last updated: 25 March 2011 Author: Manjit Gheera Section Social Policy Section ContactPoint, or the Children’s Information Sharing Index, as it was originally called, was introduced by the previous Labour Government following concerns that professionals working with children lacked adequate resources to identify children vulnerable to abuse. Legislation was introduced in 2004 allowing the Secretary of State to require local authorities to establish databases in connection with their duties to safeguard children. Under those provisions, ContactPoint was launched in 2009 as an online directory containing basic information on all children in England and accessible to frontline professionals such as teachers and social workers. Following the 2010 General Election, the Coalition Government made it clear that it intended to scrap ContactPoint in due course. The database was shut down on 6th August 2010. The Government is currently considering the feasibility of replacing ContactPoint with a new signposting service for professionals working with vulnerable children. This note provides background information on the ContactPoint database. This information is provided to Members of Parliament in support of their parliamentary duties and is not intended to address the specific circumstances of any particular individual. It should not be relied upon as being up to date; the law or policies may have changed since it was last updated; and it should not be relied upon as legal or professional advice or as a substitute for it. A suitably qualified professional should be consulted if specific advice or information is required. This information is provided subject to our general terms and conditions which are available online or may be provided on request in hard copy.
    [Show full text]
  • The Data Protection (Subject Access Modification) (Education) Order 2000
    Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format. STATUTORY INSTRUMENTS 2000 No. 414 DATA PROTECTION The Data Protection (Subject Access Modification) (Education) Order 2000 Made - - - - 17th February 2000 Coming into force - - 1st March 2000 Whereas a draft of this Order has been laid before and approved by a resolution of each House of Parliament: Now, therefore, the Secretary of State, in exercise of powers conferred upon him by sections 30(2) and (4) and 67(2) of the Data Protection Act 1998(1), and after consultation with the Data Protection Commissioner in accordance with section 67(3) of the Act, hereby makes the following Order: Citation and commencement 1. This Order may be cited as the Data Protection (Subject Access Modification) (Education) Order 2000 and shall come into force on 1st March 2000. Interpretation 2. In this Order— “the Act” means the Data Protection Act 1998; “education authority” in article 6 has the same meaning as in paragraph 6 of Schedule 11 to the Act; “Principal Reporter” means the Principal Reporter appointed under section 127 of the Local Government etc. (Scotland) Act 1994(2) or any officer of the Scottish Children’s Reporter Administration to whom there is delegated under section 131(1) of that Act any function of the Principal Reporter; “request” means a request made under section 7; and “section 7” means section 7 of the Act. (1) 1998 c. 29; as respects Wales, the functions of the Secretary of State under section 30 were transferred to the National Assembly for Wales by article 2 of, and Schedule 1 to, S.I.
    [Show full text]
  • Upholding Information Rights for All
    A guide to the legislation the ICO regulates Upholding information rights for all 3 Contents About the ICO 4 Summary of the legislation 6 1. Freedom of Information Act 2000 6 2. Environmental Information Regulations 2004 14 3. Data Protection Act 1998 20 4. Privacy and Electronic Communications Regulations 2003 26 Explanation of terms 34 4 About the ICO About the ICO The ICO’s mission is to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. The ICO is the UK’s independent public authority set up to uphold information rights. We do this by promoting good practice, ruling on complaints, providing information to individuals and organisations and taking appropriate action when the law is broken. The ICO enforces and oversees the Freedom of Information Act, the Environmental Information Regulations, the Data Protection Act and the Privacy and Electronic Communications Regulations. About the ICO 5 The Freedom of Information Act 2000 gives people a general right of access to information held by public authorities. We aim to make public sector bodies more open and accountable. We also help people to understand better how public authorities carry out their duties, why they make the decisions they do and how they spend public money. The Environmental Information Regulations 2004 provide access to environmental information. The regulations potentially cover more organisations than the Freedom of Information Act, including some private sector bodies. The Data Protection Act 1998 gives citizens important rights, including the right to know what information is held about them and the right to correct information that is wrong.
    [Show full text]
  • Data Protection and Confidentiality Policy
    Data Protection and Confidentiality Policy Trust reference CA006 Version number 6.0 Description This policy and procedure inform how data protection and confidentiality is implemented throughout the Trust Level and type of Level 1: applicable across the Trust document Trust-wide corporate policy – controlled document Target audience This policy is relevant to all staff, contractors, and members of the public List related Records Management Policy documents/policies (do Incident Management Policy not include those listed as Access to Records Policy appendices) Informatics Security Policy Management of Medical Devices Policy Disciplinary Policy Author Judith Downing, Head of Data Protection Policy sponsor Karen Flaherty, Associate Director of Corporate Affairs This is a controlled document. Whilst this document may be printed, the electronic version posted on Staffnet is the controlled copy. Any printed copies of this document are not controlled. As a controlled document, this document should not be saved onto local or network drives but should always be accessed from Staffnet. 1 Version control Date Author(s) Version Approval committee Date of Date next Key changes made to document created approval review due July Judith 6.0 Quality Governance Chair’s 1 May 2022 2021 Downing Steering Group action 19.8.21 CA006. Data protection and confidentiality policy v6.0. Issued 19.8.21. Page 1 of 17 2 Index 1 Version control ......................................................................................................................... 1
    [Show full text]
  • Data Protection Act 2018
    Data Protection Act 2018 CHAPTER 12 Explanatory Notes have been produced to assist in the understanding of this Act and are available separately Data Protection Act 2018 CHAPTER 12 CONTENTS PART 1 PRELIMINARY 1Overview 2 Protection of personal data 3 Terms relating to the processing of personal data PART 2 GENERAL PROCESSING CHAPTER 1 SCOPE AND DEFINITIONS 4 Processing to which this Part applies 5 Definitions CHAPTER 2 THE GDPR Meaning of certain terms used in the GDPR 6 Meaning of “controller” 7 Meaning of “public authority” and “public body” Lawfulness of processing 8 Lawfulness of processing: public interest etc 9 Child’s consent in relation to information society services ii Data Protection Act 2018 (c. 12) Special categories of personal data 10 Special categories of personal data and criminal convictions etc data 11 Special categories of personal data etc: supplementary Rights of the data subject 12 Limits on fees that may be charged by controllers 13 Obligations of credit reference agencies 14 Automated decision-making authorised by law: safeguards Restrictions on data subject's rights 15 Exemptions etc 16 Power to make further exemptions etc by regulations Accreditation of certification providers 17 Accreditation of certification providers Transfers of personal data to third countries etc 18 Transfers of personal data to third countries etc Specific processing situations 19 Processing for archiving, research and statistical purposes: safeguards Minor definition 20 Meaning of “court” CHAPTER 3 OTHER GENERAL PROCESSING Scope 21 Processing
    [Show full text]