Do You Need To Update Your Contracts For The Data Protection Act 2018?

What is the Data Protection Act 2018?

Hot on the heels of the General Data Protection Regulation 2016 ("GDPR") coming into effect on 25 May 2018, the UK passed the Data Protection Act 2018 ("DPA") on 23 May 2018. The GDPR is directly effective, so needs no further UK legislation, so why has the government passed more legislation?

Brexit preparations. The DPA states that GDPR will apply in the UK. So, post Brexit, this will allow for continued application of GDPR standards in the UK's domestic law and there will be no question about any divergence in rules over processing personal data. Derogations. The GDPR allows Member States to derogate from the GDPR in two areas. Firstly in areas where the European Commission does not typically look to assert its authority such as national security, healthcare, balancing the right to privacy with freedom of speech. Secondly to create exemptions from some of the data subject rights (e.g. exemptions to disclosing information under subject access requests which are the same as in the now repealed Data Protection Act 1998) or to create additional grounds for processing of special categories of data or profiling. Law enforcement. Most of the DPA relates to the processing of personal data by law enforcement agencies or national intelligence agencies. Parts 3 and 4 of the DPA transpose the EU Data Protection Directive 2016/680 (known as the Law Enforcement Directive) into domestic law. Do I need to change my contracts?

Most contracts include a definition relating to data protection laws in the UK. This will need to include the Data Protection Act 2018 as well as the GDPR given the important derogations and additional offences in the DPA.

Otherwise, the new law does not affect the mandatory clauses that Article 28 of the GDPR requires that contracts must contain.

The DPA also does not amend the GDPR in any way but it does contain exemptions and derogation as permitted by the GDPR.

What are the key derogations and other new detail in the DPA?

Children's consent in relation to information society services (i.e. online services) Article 8 GDPR states that in the absence of national derogation, the default position is 16 years old. Section 9 DPA confirms that a child may give a valid consent to legitimise the processing of personal data if aged 13. Processing of criminal conviction and offence data Article 10 GDPR prohibits the processing of criminal offence data other than as permitted by national laws. Schedule 1...