Data Protection: Introduction to the Data Protection Act 2018

Fibre Optic Cable

Author Bidgee
Licence Creative Commons Attribution Share Alike 2.4 Australia
Source Wikipedia

Jane Lambert

It is well known that the General Data Protection Regulation ("GDPR") came into force throughout the European Union on 25 May 2018.  What is less well known is that a new Data Protection Act 2018 came into force in the UK on the same day.  The Act complements the GDPR in that it repeals the Data Protection Act 1998 which had transposed the Data Protection Directive into English and Welsh, Scottish and Northern Irish law.  The GDPR repealed the Directive but not member states' implementing legislation,  The 2018 Act also provides machinery for the enforcement of the GDPR and regulates personal data processing that falls outside the scope of the Regulation.

Where to find out more about the Act
I publish most of my articles on data protection in a separate blog called NIPC Data Protection.  NIPC Data Protection is already a comprehensive resource on English and EU data protection law.  It has direct links to the Act as well as the GDPR as well as the previous legislation and the policy documents that led to the statute. There is an index page for the Act as well as an index page for the GDPR and a data protection glossary.  The blog now contains some 20 articles on data protection including several on the Act.

Articles on the Act
One of the reasons for the Act is that Her Majesty's government has given notice to leave the EU with effect from 29 March 2019 whereupon the GDPR will cease to apply to the UK in the absence of legislation to continue it.  HMG is negotiating terms for the orderly withdrawal of the UK from the EU and the UK's future relationship with the EU which will allow the free flow of data between the UK and remaining member states.  In HMG's Exchange and Protection of Personal Data Position Paper 28 Aug 2017 I discussed the government's proposals which included a new Data Protection Bill.  That Bill was introduced on 14 Sept 2017 and I discussed it in my Introduction to the Data Protection Bill on 16 Sept 2017.  I charted the Bill's second reading in Data Protection Bill Second Reading 17 Oct 2017.  After the Bill received royal assent I wrote The Data Protection Act 2018 - repealing the 1998 Act and applying the GDPR on 11 June 2018, The Relationship between the Data Protection Act 2018 and the GDPR  20 June 2018 and What is meant by the "Applied GDPR" 25 June 2018.

My Data Protection Practice
I advise controllers, data subjects and processors on their rights and obligations under the GDPR, the Data Protection Law Enforcement Directive and the Data Protection Act 2018. I draft complex legal instruments such as contracts relating to the collection, processing, transfer and use of personal data and privacy statements. I represent clients in proceedings before the courts and the First-tier Tribunal (Information Rights) and the Upper Tribunals.

I have specialized in data protection law since the early 1980s  I first became professionally interested in the topic in about 1983 when I was legal adviser to VISA International for Europe, the Middle East and Africa.   I contributed the first chapters on data protection to Atkin’s Court Forms and the Encyclopedia of Forms and Precedents in 1985. I have written about the history of data protection, the right to be forgotten, safe harbour and many other topics. I have spoken extensively on the topic to businesses and local authorities and have appeared as counsel in subject access and other proceedings.  Many of the articles on data protection that I have contributed to this blog are to be found on my Data Protection Services page.

Further Information
Anyone wishing to discuss this article or data protection law generally should call me on +44 (0)20 7404 5252 during office hours or send me a message through my contact form.