Section 24: Manual unstructured data held by FOI public authorities, Data Protection Act 2018

The provisions of the UK GDPR and this Act listed in subsection (2) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) (manual unstructured personal data held by FOI public authorities).

Those provisions are—

in Chapter II of the UK GDPR (principles)—

Article 5(1)(a) to (c), (e) and (f) (principles relating to processing, other than the accuracy principle),

Article 6 (lawfulness),

Article 7 (conditions for consent),

Article 8(1) and (2) (child's consent),

Article 9 (processing of special categories of personal data),

Article 10 (data relating to criminal convictions etc), and

Article 11(2) (processing not requiring identification);

in Chapter III of the UK GDPR (rights of the data subject)—

Article 13(1) to (3) (personal data collected from data subject: information to be provided),

Article 14(1) to (4) (personal data collected other than from data subject: information to be provided),

Article 20 (right to data portability), and

Article 21(1) (objections to processing);

in Chapter V of the UK GDPR, Articles 44A to 49A (transfers of personal data to third countries or international organisations);

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

in Part 5 of this Act, section 119A (standard clauses for transfers to third countries);

in Part 7 of this Act, sections 170 and 171 (offences relating to personal data).

(see also paragraph 1(2) of Schedule 18).

In addition, the provisions of the UK GDPR listed in subsection (4) do not apply to personal data to which the UK GDPR applies by virtue of Article 2(1A) where the personal data relates to appointments, removals, pay, discipline, superannuation or other personnel matters in relation to—

service in any of the armed forces of the Crown;

service in any office or employment under the Crown or under any public authority;

service in any office or employment, or under any contract for services, in respect of which power to take action, or to determine or approve the action taken, in such matters is vested in—

Her Majesty,

a Minister of the Crown,

the National Assembly for Wales,

the Welsh Ministers,

a Northern Ireland Minister (within the meaning of the Freedom of Information Act 2000), or

an FOI public authority.

Those provisions are—

the remaining provisions of Chapters II and III (principles and rights of the data subject);

Chapter IV (controller and processor);

Chapter 8A (safeguards for processing for research, archiving or statistical purposes);

Chapter IX (specific processing situations).

A controller is not obliged to comply with Article 15(1) to (3) of the UK GDPR (right of access by the data subject) in relation to personal data to which the UK GDPR applies by virtue of Article 2(1A) if—

the request under Article 15 does not contain a description of the personal data, or

the controller estimates that the cost of complying with the request so far as relating to the personal data would exceed the appropriate maximum.

Subsection (5)(b) does not remove the controller's obligation to confirm whether or not personal data concerning the data subject is being processed unless the estimated cost of complying with that obligation alone in relation to the personal data would exceed the appropriate maximum.

An estimate for the purposes of this section must be made in accordance with regulations under section 12(5) of the Freedom of Information Act 2000.

In subsections (5) and (6), "the appropriate maximum" means the maximum amount specified by the Secretary of State by regulations.

Regulations under subsection (8) are subject to the negative resolution procedure.

Section 24: Manual unstructured data held by FOI public authorities

Discussed in

About this text