Hacker News Reader

A school does not necessarily meet the definition of a public authority [1]; I would say it's not; it depends on individual EU countries to legislate on that definition.

Furthermore, in Ireland, for example, fines cannot be levied against public authorities: https://www.irishtimes.com/news/crime-and-law/public-bodies-...

[1] https://www.lexology.com/library/detail.aspx?g=e71ac55f-566b...

View on HN

The Data Protection Act 2018 was passed by parliament today. It applies the definitions of "public authority" given in Schedule I of the Freedom of Information Act 2010 (with a few exceptions), so maintained and academy schools are considered public authorities for the purposes of the GDPR. It does grant the Secretary of State the right to alter this definition, so it's possible that schools could be removed from this scope if the impact is deemed to be unreasonably onerous.

http://www.legislation.gov.uk/ukpga/2018/12/pdfs/ukpga_20180...

I bet the folks in Dublin will be happy to know that UK law applies to them again /s

The chap I was replying to mentioned that something would cost him "£300", not "€300". It's a reasonably safe bet that he's in the UK.

Fair enough. I haven't reviewed the UK legislation.

Reply on news.ycombinator.com