Paragraph 18 I1

Article 22 is amended as follows.

In paragraph 2(b), for “authorised by Union or Member State law to which the controller is subject and” substitute “ required or authorised by domestic law ”.

After paragraph 3 insert—

“3A

Section 14 of the 2018 Act, and regulations under that section, make provision to safeguard data subjects' rights, freedoms and legitimate interests in cases that fall within point (b) of paragraph 2 (but not within point (a) or (c) of that paragraph).”.