Schedule 19: Minor and consequential amendments
This Schedule repeals the 1998 Act, and makes amendments to other legislation which are necessary to reflect both the repeal of the 1998 Act and the requirements of the GDPR. The explanatory notes will provide an overview of these amendments, but will not explain every amendment in detail.
	Often pieces of legislation refer to other legislation. One of the purposes this Schedule has is to make sure such references continue to work despite the other changes made by this Act. The Schedule also updates certain definitions to refer to definitions in this Act, for example where reference was made to the definition of "personal data" as defined in section 1 of the 1998 Act, this will now refer to the definition in section 3 of this Act.
	This Schedule makes a number of very similar amendments. For example there are a number of provisions in other legislation which require disclosure of information, but which state that such a duty does not apply where it would contravene the requirements of the 1998 Act. Schedule 19 amends these references to make it clear that the requirement to disclose information does not apply if doing so would breach any requirements or restrictions under the data protection legislation as defined in this Act. Such amendments are made in paragraphs 96, 159, 208 and 220 (among others).
	A number of the amendments listed in this Schedule relate to provisions in other legislation which require other bodies to provide personal data to the Information Commissioner which is required for her to fulfil her enforcement duties under this Act. See paragraphs 3, 4, 87, 168 and 204 for example.
	There were also a number of references in other legislation to the "non-disclosure" provisions as set out in section 27(3) of the 1998 Act. The "non-disclosure" provisions referred to exemptions under the 1998 Act which permitted disclosure of personal data where this would otherwise be prohibited. The references in other legislation most often referred to the exemption under section 35 of the 1998 Act (exemption for cases where disclosure is required by law).
	Although the "non-disclosure" provisions have not been replicated in the same way in the Act, in order to ensure the references in other legislation continue to function appropriately, the references have been updated to refer to either the provisions which can be exempt as listed in paragraph 1 of Schedule 2 to the Act, or to paragraph 5(3) of Schedule 2 which replaces the exemption in section 35 of the 1998 Act. Examples of such amendments can be found in paragraphs 19 to 30and 35 of this Schedule.
	Paragraphs 55 to 64 amend the 2000 Act to reflect the provisions of the GDPR.
	In particular, paragraph 58 amends section 40 of the 2000 Act to ensure that personal data is only disclosed in response to FOI requests where this would not breach the GDPR principles (Article 5) or specified rights of data subjects. When determining whether disclosure would be lawful under Article 5(1)(a) of the GDPR, by applying the first condition at section 40(3A)(a) of the 2000 Act to a request under section 40 of the 2000 Act, paragraph 6(8) allows FOI public authorities to rely on Article 6(1)(f) of the GDPR (legitimate interests) as a basis for processing.
	Paragraph 59 removes the requirement in section 49 of the 2000 Act for the Information Commissioner to publish reports on the operation of that Act. This is no longer needed in the light of section 140 of this Act which introduces a general requirement for the Information Commissioner to publish annual reports on his/her functions.
	Paragraph 60 mirrors the provisions on contempt of court in section 202 of this Act to ensure they apply to FOI proceedings.
	Paragraph 63 amends section 77 of the 2000 Act (altering records to prevent disclosure) to remove reference to the subject access provisions under the 1998 Act. The alteration of records to frustrate disclosure following a subject access request is now covered by the offence in section 173 of this Act.
	Paragraphs 88 to 90 amend the Freedom of Information (Scotland) Act 2002 to reflect the provisions of the GDPR. The changes are similar to the amendments described above in relation to the 2000 Act.
	Paragraph 150 omits sections 77 to 78 of the Criminal Justice and Immigration Act 2008. These sections introduced an order-making power to increase the maximum penalty for the offence of unlawfully obtaining data under section 55 of the 1998 Act and defences for journalistic activity. The provisions were never commenced. They are no longer needed because the offence of unlawfully obtaining data, defences and penalties are now set out in sections 170 and 196 of this Act.
	Paragraph 224 omits sections 108 to 110 of the Digital Economy Act 2017 which is concerned with charges payable to the Information Commissioner. These provisions have been superseded by section 137 of this Act. Paragraph 26 of Schedule 20 makes transitional provision.
	Paragraphs 305 to 309 make amendments to the Environmental Information Regulations 2004 and the Environmental Information (Scotland) Regulations 2004 to reflect the terminology of the GDPR and adding specific references to the GDPR principles. Similar amendments are made to other subordinate legislation by paragraphs 310 to 312.
	Paragraph 380 omits Part 4 of the Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014 (S.I. 2014/3141), which sets rules for data processing by competent authorities based on the requirements of the 1998 Act. This Part is now redundant.
	Paragraph 434 provides that provisions added to secondary legislation by this Schedule can be amended by powers under the legislation they amended.