Paragraph 3 I1

(1)

The F1UK GDPR provisions listed in sub-paragraph (3) do not apply to personal data which consists of a classification applied to the data subject as part of a risk assessment system falling within sub-paragraph (2) to the extent that the application of those provisions would prevent the system from operating effectively.

(2)

A risk assessment system falls within this sub-paragraph if—

(a)

it is operated by a government department, a local authority or another authority administering housing benefit, and

(b)

it is operated for the purposes of—

(i)

the assessment or collection of a tax or duty or an imposition of a similar nature, or

(ii)

the prevention F2, investigation or detection of crime or apprehension or prosecution of offenders, where the offence concerned involves the unlawful use of public money or an unlawful claim for payment out of public money.

(3)

The F3UK GDPR provisions referred to in sub-paragraph (1) are the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)—

(a)

Article 13(1) to (3) (personal data collected from data subject: information to be provided);

(b)

Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);

(c)

Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);

(d)

Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in paragraphs (a) to (c).

Annotations

Textual amendments

F1: Words in Sch. 2 para. 3(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(7)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F2: Word in Sch. 2 para. 3(2)(b)(ii) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 11 para. 29(3); S.I. 2026/82, reg. 2(z12)
F3: Words in Sch. 2 para. 3(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 92(7)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

I1: Sch. 2 para. 3 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)