Section 190 — Data Protection Act 2018: Post-review powers to make provision about representation of data subjects

Post-review powers to make provision about representation of data subjects 190 1 After the report under section 189(1) is laid before Parliament, the Secretary of State may by regulations—

a exercise the powers under Article 80(2) of the UK GDPR in relation to England and Wales and Northern Ireland, b make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the UK GDPR to exercise a data subject's rights under Article 82 of the UK GDPR in England and Wales and Northern Ireland without being authorised to do so by the data subject, and c make provision described in section 189(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.

2 The powers under subsection (1) include power—

a to make provision enabling a data subject to prevent a body or other organisation from exercising, or continuing to exercise, the data subject's rights;

b to make provision about proceedings before a court or tribunal where a body or organisation exercises a data subject's rights;

c to make provision for bodies or other organisations to bring proceedings before a court or tribunal combining two or more claims in respect of a right of a data subject;

d to confer functions on a person, including functions involving the exercise of a discretion;

e to amend sections 166 to 168, 180, 187, 203, 205 and 206;

f to insert new sections and Schedules into Part 6 or 7 ;

g to make different provision in relation to England and Wales and in relation to Northern Ireland.

3 The powers under subsection (1)(a) and (b) include power to make provision in relation to data subjects who are children or data subjects who are not children or both.

4 The provision mentioned in subsection (2)(b) and (c) includes provision about—

a the effect of judgments and orders;

b agreements to settle claims;

c the assessment of the amount of compensation;

d the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;

e costs.

5 Regulations under this section are subject to the affirmative resolution procedure.