Data Protection Act 2018, section 16

Power to make further exemptions etc by regulations

PART 2 General processing

(1)The following powers to make provision altering the application of the [F90UK GDPRF90] may be exercised by way of regulations made by the Secretary of State under this section—

(a)F91the power in Article 6(3) ... to lay down a legal basis containing specific provisions to adapt the application of rules of the [F92UK GDPRF92] where processing is necessary for compliance with a legal obligation, for the performance of a task in the public interest or in the exercise of official authority;

(b)the power in Article 23(1) to make [F93provisionF93] restricting the scope of the obligations and rights mentioned in that Article where necessary and proportionate to safeguard certain objectives of general public interest;

(c)the power in Article 85(2) to provide for exemptions or derogations from certain Chapters of the [F94UK GDPRF94] where necessary to reconcile the protection of personal data with the freedom of expression and information.

(2)Regulations under this section may—

(a)amend Schedules 2 to 4—

(i)by adding or varying provisions, and

(ii)F95by omitting provisions added by regulations under this section, ...

(b)consequentially amend section 15 [F96, and

(c)consequentially amend the UK GDPR by adding, varying or omitting a reference to section 15, Schedule 2, 3 or 4, this section or regulations under this section.F96]

(3)Regulations under this section are subject to the affirmative resolution procedure.

Definitions used in section 16 1

the affirmative resolution procedure

(7) For the purposes of this Act, where regulations are subject to “the affirmative resolution procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before Parliament and approved by a resolution of each House of Parliament.

Defined in s.182(7) · see it in the full Act

Cases considering section 16 3

The 3Million & Anor, R (on the application of) v Secretary of State for the Home Department & Anor

[2023] EWCA Civ 1474 · 11 December 2023

Section 16 was used with Article 23(3) to show that regulations are the required legislative form for exercising the Article 23(1) power (see paras [48]-[50]). Section 16(3) confirmed that regulations made under section 16 are subject to the affirmative-resolution procedure, supporting the court’s conclusion that Parliament must scrutinise the safeguards (see paras [49]-[50]).

the3million & Anor, R (on the application of) v Secretary of State for the Home Department & Anor

[2023] EWHC 713 (Admin) · 29 March 2023Limits

Provides the regulation-making mechanism through which the Article 23(1) power may be exercised and permits amendment of Schedules 2 to 4, subject to affirmative resolution. (see paras [12], [14]-[16], [36]) Confirms that the Article 23(1) power to restrict UK GDPR rights is exercised through regulations under section 16. (see paras [14], [16]) Makes regulations under section 16 subject to affirmative resolution, which did not cure the absence of substantive safeguards in the Regulations themselves. (see paras [45], [64(1)], [72])

The Open Rights Group & Anor, R (On the Application Of) v The Secretary of State for the Home Department & Anor (Rev1)

[2021] EWCA Civ 800 · 26 May 2021

The court noted that section 16 appeared to confer wide powers to vary Schedule 2, but declined to prescribe how the legislature should remedy the omission (see para [54]).

What each judgment says about section 16 is in the case-law panel in the full Act.

Amendments and notes

9 notes from legislation.gov.uk

Amendments

  1. F90Words in s. 16(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  2. F91Words in s. 16(1)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(b)(i) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  3. F92Words in s. 16(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(b)(ii) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  4. F93Word in s. 16(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(c) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  5. F94Words in s. 16(1)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(2)(d) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  6. F95Word in s. 16(2)(a)(ii) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
  7. F96S. 16(2)(c) and word inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 20(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

  1. I17S. 16 in force at Royal Assent for specified purposes, see s. 212(2)(f) text for certain specified purposes only, see the commentary.
  2. I18S. 16 in force at 25.5.2018 in so far as not already in force by S.I. 2018/625, reg. 2(1)(b)