Section 77 amends Article 13 and Article 14 of the UK GDPR. These two articles specify the information that should be provided to data subjects at the point of data collection, when collected directly from the data subject (Article 13), or within a reasonable period (at the latest within one month) after obtaining the personal data, for personal data obtained indirectly (Article 14).
	Article 13(3) of the UK GDPR currently provides that when a data controller intends to further process personal data (which is the reuse of personal data for a separate purpose than that for which it was originally collected), they are required to provide additional information to the data subject. These requirements are laid out in Article 13(2). Section 77(1) adds Article 13(5) which creates an exemption from Article 13(3) for processing for research, archiving and statistical (RAS) purposes where there would be a disproportionate effort to provide the required information to data subjects and where the research complies with the safeguards for research found in Article 84B of the new Chapter 8A of the UK GDPR as inserted by section 86.
	New paragraph 6 of Article 13 provides a non-exhaustive list of factors for the controller to determine what could constitute a disproportionate effort for the purposes of the new exemption.
	New paragraph 7 of Article 13 outlines that any controller relying on the new paragraph 5 must take appropriate measures to protect the data subject’s rights, freedoms and legitimate interests, including by making the information publicly available that would otherwise be provided to the data subject through Article 13. For example, if it is considered disproportionate for a controller to issue individual notices, the information normally required to be provided as part of Article 13 requirements (such as identity and contact details of the data protection officer if applicable) should be made publicly available so that a data subject has this information if they wish to search for it. Subsection (2) of section 77 amends Article 14 of the UK GDPR. Section 77(2)(a)(i),(iii) and (iv) all make minor and technical changes to parts of paragraph 5 of Article 14 to accommodate other amendments to Article 14 made by section 77.
	Article 14(5)(b) of the UK GDPR is removed and replaced by section 77(2)(a), which splits the current disproportionate effort exemption into two new paragraphs 14(5)(e) and (f) and removes the example of RAS purposes from the non-exhaustive list. This does not materially affect how the current exemption in Article 14 operates, but does make it clearer that the exemption applies to all processing activities.
	Subsection (2)(b) of section 77 inserts two new paragraphs at the end of Article 14 of the UK GDPR. Paragraph 6 replicates the non-exhaustive list of examples of disproportionate effort being inserted into Article 13 by section 77(1).
	Paragraph 7 of Article 14 of the UK GDPR adds the same safeguard for the disproportionate effort or impossibility exemption as that currently found in Article 14(5)(b), which is being removed by section 77(2)(a)(ii).
Part 5: Data Protection and Privacy Data subject’s rights Section 77: Information to be provided to data subjects