s 31 Right to erasure of personal data in the UK
(1) Article 17 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (right to erasure) is amended in accordance with subsections (2) and (3) . (2) In paragraph 1, after point (f) insert— (g) the personal data have been processed as a result of an allegation about the data subject— (i) which was made by a person who is a malicious person in relation to the data subject (whether they became such a person before or after the allegation was made), (ii) which has been investigated by the controller, and (iii) in relation to which the controller has decided that no further action is to be taken. (3) After paragraph 3 insert— (4) For the purposes of paragraph (1) (g) , a person who has made an allegation about a data subject is a “ malicious person ” in relation to the data subject if the person— (a) has been convicted of an offence specified in column 1 of the table in paragraph 5 in relation to which the data subject is a person specified in the corresponding entry in column 2 of that table, or (b) is subject to a stalking protection order under section 2 of the Stalking Protection Act 2019 or section 8 of the Protection from Stalking Act (Northern Ireland) 2022 (c. 17 (N.I.)) made to protect the data subject from a risk associated with stalking (see section 2(1)(c) of the 2019 Act and section 8(2)(c) of the 2022 Act). (5) The table is as follows— (4) After section 13 of the Data Protection Act 2018 insert— Meaning of “relevant offence” for purpose of right to erasure (13A) (1) The Secretary of State may by regulations amend the table in Article 17( 5 ) of the UK GDPR. (2) Regulations under this section are subject to the affirmative resolution procedure.