Legalize / United Kingdom / Statutory-Instrument

The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

Type Statutory-Instrument

Publication 2019-02-28

Last updated 2025-02-27

State In force

Department King's Printer of Acts of Parliament

Source legislation.gov.uk

PDF Download

articles Not indexed

Reform history JSON API

Made: 28th February 2019

Coming into force in accordance with regulation 1(2) and (3)

The Secretary of State makes these Regulations in exercise of the powers conferred by sections 8(1) and 23(1) of, paragraph 1(1) of Schedule 4 to and paragraph 21 of Schedule 7 to the European Union (Withdrawal) Act 2018 , section 211(2) of the Data Protection Act 2018 and section 2(2) of the European Communities Act 1972 .

In accordance with paragraph 3(1) of Schedule 4 to the European Union (Withdrawal) Act 2018, these Regulations are made with the consent of the Treasury.

The Secretary of State is a Minister designated for purposes of section 2(2) of the European Communities Act 1972 in respect of matters relating to electronic communications.

In accordance with paragraphs 1(1) and 12(1) of Schedule 7 to the European Union (Withdrawal) Act 2018, section 211(5) of the Data Protection Act 2018 and paragraph 2(2) of Schedule 2 to the European Communities Act 1972 a draft of this instrument has been laid before, and approved by a resolution of, each House of Parliament.

Citation, commencement and extent

1

(1) These Regulations may be cited as the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

(2) Subject to paragraph (3), they come into force on exit day.

(3) Regulations 7 and 8 and Schedule 4 come into force on 29th March 2019.

(4) An amendment, repeal or revocation made by these Regulations has the same extent in the United Kingdom as the provision to which it relates.

Interpretation

2

In these Regulations—

“the 2018 Act” means the Data Protection Act 2018;

“the UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.

3

Schedule 1 amends the UK GDPR.

Amendment of the Data Protection Act 2018

4

Schedule 2 amends the 2018 Act.

5

(1) Schedules 1 and 2 include modifications (“the GDPR merger modifications”) that merge the provisions relating to the processing of personal data that, immediately before IP completion day, are found in the EU GDPR and the applied GDPR, read with the 2018 Act.

(2) Assimilated case law falling within paragraph (3) is not, by virtue of the GDPR merger modifications, to be treated as relevant to the UK GDPR or the 2018 Act as they apply to applied GDPR processing on and after IP completion day.

(3) Assimilated case law falls within this paragraph so far as it is, or is derived from, principles or decisions that are not relevant to any of the following immediately before IP completion day—

(a) the applied GDPR,

(b) the applied Chapter 2, or

having regard (among other things) to the limits of EU competence immediately before IP completion day.

(4) In this regulation—

“the applied Chapter 2” means Chapter 2 of Part 2 of the 2018 Act as applied by Chapter 3 of that Part immediately before IP completion day (see section 22 of that Act);

“the applied GDPR” means the EU GDPR as applied by Chapter 3 of Part 2 of the 2018 Act as it has effect immediately before IP completion day (see section 22 of that Act);

“applied GDPR processing” means the processing of personal data to which the applied GDPR applied immediately before IP completion day (see section 21 of the 2018 Act);

“assimilated case law” has the same meaning as in the European Union (Withdrawal) Act 2018 (see section 6(7) of that Act);

“the EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law immediately before IP completion day .

Consequential amendments of other legislation

6

In Schedule 3—

(a) Part 1 revokes certain retained EU law;

(b) Part 2 contains amendments of primary legislation (as defined in section 211(7) of the 2018 Act) that are consequential on Schedules 1 and 2;

(d) Part 4 contains modifications of legislation that are consequential on those Schedules;

(e) Part 5 contains supplementary provision.

Amendments consequential on provisions of the 2018 Act

7

Schedule 4 contains amendments consequential on provisions of the 2018 Act.

Amendment of the Privacy and Electronic Communications Regulations 2003

8

(1) Regulation 2 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 is amended as follows.

(2) In paragraph (1), at the appropriate place, insert—

“consent” by a user or subscriber corresponds to the data subject's consent in the GDPR (as defined in section 3(10) of the Data Protection Act 2018);

(3) Omit paragraph (3).

Introduction

1

The UK GDPR is amended as follows.

2

In the title of the Regulation, for “, and repealing Directive 95/46/EC (General Data Protection Regulation)” substitute “(United Kingdom General Data Protection Regulation)”.

Chapter 1 (general provisions)

3

In Article 1, omit paragraph 3.

4

(1) Article 2 is amended as follows.

(2) For paragraph 1 substitute—

(1) This Regulation applies to the automated or structured processing of personal data, including— (a) processing in the course of an activity which, immediately before IP completion day, fell outside the scope of EU law, and (b) processing in the course of an activity which, immediately before IP completion day, fell within the scope of Chapter 2 of Title 5 of the Treaty on European Union (common foreign and security policy activities). (1A) This Regulation also applies to the manual unstructured processing of personal data held by an FOI public authority.

(3) For paragraph 2 substitute—

(2) This Regulation does not apply to— (a) the processing of personal data by an individual in the course of a purely personal or household activity; (b) the processing of personal data by a competent authority for any of the law enforcement purposes (see Part 3 of the 2018 Act); (c) the processing of personal data to which Part 4 of the 2018 Act (intelligence services processing) applies.

(4) Omit paragraph 3.

(5) In paragraph 4, for “Directive 2000/31/EC” to the end substitute “the Electronic Commerce (EC Directive) Regulations 2002 , in particular the provisions about mere conduits, caching and hosting (see regulations 17 to 19 of those Regulations).”.

(6) After paragraph 4 insert—

(5) In this Article— (a) ‘the automated or structured processing of personal data’ means— (i) the processing of personal data wholly or partly by automated means, and (ii) the processing otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system; (b) ‘the manual unstructured processing of personal data’ means the processing of personal data which is not the automated or structured processing of personal data; (c) ‘FOI public authority’ has the same meaning as in Chapter 3 of Part 2 of the 2018 Act (see section 21(5) of that Act); (d) references to personal data ‘held’ by an FOI public authority are to be interpreted in accordance with section 21(6) and (7) of the 2018 Act; (e) ‘competent authority’ and ‘law enforcement purposes’ have the same meaning as in Part 3 of the 2018 Act (see sections 30 and 31 of that Act).

5

(1) Article 3 is amended as follows.

(2) In paragraph 1, for “the Union” (in both places) substitute “ the United Kingdom ”.

(3) In paragraph 2—

(a) before “processing” (in the first place) insert “ relevant ”;

(b) for “the Union” (in each place) substitute “ the United Kingdom ”.

(4) After paragraph 2 insert—

(2A) In paragraph 2, “relevant processing of personal data” means processing to which this Regulation applies, other than processing described in Article 2(1)(a) or (b) or (1A).

(5) In paragraph 3—

(a) for “the Union” substitute “ the United Kingdom ”;

(b) for “Member State law” substitute “ domestic law ”.

6

(1) Article 4 is amended as follows.

(2) Before paragraph (1) insert—

(A1) ‘the 2018 Act’ means the Data Protection Act 2018; (A2) ‘domestic law’ means the law of the United Kingdom or of a part of the United Kingdom; (A3) ‘the Commissioner’ means the Information Commissioner (see section 114 of the 2018 Act);

(3) In paragraph (7), for “; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law” substitute “ (but see section 6 of the 2018 Act) ”.

(4) In paragraph (9), for “Union or Member State law” substitute “ domestic law ”.

(5) After paragraph (10) insert—

(10A) ‘public authority’ and ‘public body’ are to be interpreted in accordance with section 7 of the 2018 Act and provision made under that section;

(6) Omit paragraph (16).

(7) In paragraph (17), for “the Union” substitute “ the United Kingdom ”.

(8) In paragraph (20), for “on the territory of a Member State” substitute “ in the United Kingdom ”.

(9) Omit paragraph (21).

(10) After paragraph (21) insert—

(21A) ‘foreign designated authority’ means an authority designated for the purposes of Article 13 of the Data Protection Convention (as defined in section 3 of the 2018 Act) by a party, other than the United Kingdom, which is bound by that Convention;

(11) Omit paragraphs (22), (23) and (24).

(12) In paragraph (25), at the end insert “as it has effect immediately before IP completion day”.

(13) After paragraph (26) insert—

(27) ‘third country’ means a country or territory outside the United Kingdom; (28) references to a fundamental right or fundamental freedom (however expressed) are to a fundamental right or fundamental freedom which continues to form part of domestic law on and after IP completion day by virtue of section 4 of the European Union (Withdrawal) Act 2018, as the right or freedom is amended or otherwise modified by domestic law from time to time on or after IP completion day.

Chapter 2 (principles)

7

(1) Article 6 is amended as follows.

(2) Omit paragraph 2.

(3) In paragraph 3—

(a) in the first subparagraph, for points (a) and (b) (and the colon before them) substitute “ domestic law ”;

(b) in the second subparagraph, for “The Union or Member State law” substitute “ The domestic law ”.

(4) In paragraph 4—

(a) for “a Union or Member State law” substitute “ domestic law ”;

(b) after “safeguard” insert “ national security, defence or any of ”.

8

(1) Article 8 is amended as follows.

(2) In paragraph 1—

(a) for “16 years old” substitute “ 13 years old ”;

(b) for “of 16 years” substitute “ of 13 years ”;

(3) In paragraph 3, for “of Member States” substitute “ as it operates in domestic law ”.

(4) After paragraph 3 insert—

(4) In paragraph 1, the reference to information society services does not include preventive or counselling services.

9

(1) Article 9 is amended as follows.

(2) In paragraph 2(a), for “Union or Member State law provide” substitute “ domestic law provides ”.

(3) In paragraph 2(b)—

(a) for “Union or Member State law” substitute “ domestic law ”;

(b) for “to Member State law” substitute “ to domestic law ”.

(4) In paragraph 2(g), for “Union or Member State law” substitute “ domestic law ”.

(5) In paragraph 2(h), for “Union or Member State law” substitute “ domestic law ”.

(6) In paragraph 2(i), for “Union or Member State law” substitute “ domestic law ”.

(7) paragraph 2(j)—

(a) after “Article 89(1)” insert “ (as supplemented by section 19 of the 2018 Act) ”;

(b) for “Union or Member State law” substitute “ domestic law ”.

(8) In paragraph 3, for “Union or Member State law” (in both places) substitute “ domestic law ”.

(9) After that paragraph insert—

(3A) In paragraph 3, ‘national competent bodies’ means competent bodies of the United Kingdom or a part of the United Kingdom.

(10) Omit paragraph 4.

(11) After that paragraph insert—

(5) In the 2018 Act— (a) section 10 makes provision about when the requirement in paragraph 2(b), (g), (h), (i) or (j) of this Article for authorisation by, or a basis in, domestic law is met; (b) section 11(1) makes provision about when the processing of personal data is carried out in circumstances described in paragraph 3 of this Article.

10

(1) Article 10 is amended as follows.

(2) The existing text becomes paragraph 1.

(3) In that paragraph, for “Union or Member State law” substitute “ domestic law ”.

(4) After that paragraph insert—

(2) In the 2018 Act— (a) section 10 makes provision about when the requirement in paragraph 1 of this Article for authorisation by domestic law is met; (b) section 11(2) makes provision about the meaning of “personal data relating to criminal convictions and offences or related security measures”.

Chapter 3 (rights of the data subject)

11

(1) Article 12 is amended as follows.

(2) In paragraph 4, for “a supervisory authority” substitute “ the Commissioner ”.

(3) After paragraph 6 insert—

(6A) The Commissioner may publish (and amend or withdraw)— (a) standardised icons for use in combination with information provided to data subjects under Articles 13 and 14; (b) a notice stating that other persons may publish (and amend or withdraw) such icons, provided that the icons satisfy requirements specified in the notice as to the information to be presented by the icons and the procedures for providing the icons. (6B) The Commissioner must not publish icons or a notice under paragraph 6A unless satisfied (as appropriate) that the icons give a meaningful overview of the intended processing in an easily visible, intelligible and clearly legible manner or that the notice will result in icons that do so.

(4) In paragraph 7—

(a) for “The information” substitute “ If standardised icons are published as described in paragraph 6A (and not withdrawn), the information ”;

(b) for “standardised” to “processing” substitute “ the icons ”.

(5) Omit paragraph 8.

12

(1) Article 13 is amended as follows.

(2) In paragraph 1(f), for “an adequacy decision by the Commission” substitute “ relevant adequacy regulations under section 17A of the 2018 Act ”.

(3) In paragraph 2(d), for “a supervisory authority” substitute “ the Commissioner ”.

13

(1) Article 14 is amended as follows.

(2) In paragraph 1(f), for “an adequacy decision by the Commission” substitute “ relevant adequacy regulations under section 17A of the 2018 Act ”.

(3) In paragraph 2(e), for “a supervisory authority” substitute “ the Commissioner ”.

(4) In paragraph 5(c), for “Union or Member State law to which the controller is subject and” substitute “ a provision of domestic law ”.

(5) In paragraph 5(d), for “Union or Member State law” substitute “ domestic law ”.

14

In Article 15(1)(f), for “a supervisory authority” substitute “ the Commissioner ”.

15

(1) Article 17 is amended as follows.

(2) In paragraph 1(e), for “in Union or Member State law to which the controller is subject” substitute “ under domestic law ”.

(3) In paragraph 3(b), for “by Union or Member State law to which the controller is subject” substitute “ under domestic law ”.

16

In Article 18(2), omit “of the Union or of a Member State”.

17

In Article 21(5)—

(a) omit “and notwithstanding Directive 2002/58/EC ,”;

(b) at the end insert “ , notwithstanding domestic law made before IP completion day implementing Directive 2002/58/EC of the European Parliament and of the Council of 12th July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector ” .

18

(1) Article 22 is amended as follows.

(2) In paragraph 2(b), for “authorised by Union or Member State law to which the controller is subject and” substitute “ required or authorised by domestic law ”.

(3) After paragraph 3 insert—

(3A) Section 14 of the 2018 Act, and regulations under that section, make provision to safeguard data subjects' rights, freedoms and legitimate interests in cases that fall within point (b) of paragraph 2 (but not within point (a) or (c) of that paragraph).

19

(1) Article 23 is amended as follows.

(2) In paragraph 1—

(a) for “Union or Member State law to which the data controller or processor is subject may restrict by way of legislative measure” substitute “ The Secretary of State may restrict ”;

(b) omit points (a) and (b);

(i) omit “of the Union or of a Member State” in the first place it occurs;

(ii) for “of the Union or of a Member State”, in the second place it occurs, substitute “ of the United Kingdom ”.

(3) In paragraph 2, for “any legislative measure referred to in” substitute “ provision made in exercise of the power under ”.

(4) After that paragraph insert—

(3) The Secretary of State may exercise the power under paragraph 1 only by making regulations under section 16 of the 2018 Act.

Chapter 4 (controller and processor)

20

In Article 26(1), for “Union or Member State law to which the controllers are subject” substitute “ domestic law ”.

21

(1) Article 27 is amended as follows.

(2) In the heading, for “the Union” substitute “the United Kingdom.

(3) In paragraph 1, for “the Union” substitute “the United Kingdom.

(4) Omit paragraph 3.

(5) In paragraph 4, for “supervisory authorities” substitute “ the Commissioner ”.

22

(1) Article 28 is amended as follows.

(2) In paragraph 3—

(a) in the opening words, for “Union or Member State law” substitute “ domestic law ”;

(b) in point (a), for “Union or Member State law to which the processor is subject” substitute “ domestic law ”;

(d) in the second subparagraph, for “other Union or Member State data protection provisions” substitute “ other domestic law relating to data protection ”.

(3) In paragraph 4, “for Union or Member State law” substitute “ domestic law ”.

(4) In paragraph 6, for “paragraphs 7 and 8” substitute “ paragraph 8 ”.

(5) Omit paragraph 7.

(6) In paragraph 8—

(a) for “A supervisory authority” substitute “ The Commissioner ”;

(b) omit “and in accordance with the consistency mechanism referred to in Article 63”.

23

In Article 29, for “Union or Member State law” substitute “ domestic law ”.

24

(1) Article 30 is amended as follows.

(2) In paragraph 1(g), after “Article 32(1)” insert “ or, as appropriate, the security measures referred to in section 28(3) of the 2018 Act ”.

(3) In paragraph 2(d), after “Article 32(1)” insert “ or, as appropriate, the security measures referred to in section 28(3) of the 2018 Act ”.

(4) In paragraph 4, for “the supervisory authority” substitute “ the Commissioner ”.

25

(1) Article 31 is amended as follows.

(2) In the heading, for “the supervisory authority” substitute “ the Commissioner ”.

(3) For “the supervisory authority in the performance of its tasks” substitute “ the Commissioner in the performance of the Commissioner's tasks ”.

26

In Article 32(4), for “Union or Member State law” substitute “ domestic law ”.

27

(1) Article 33 is amended as follows.

(2) In the heading, for “the supervisory authority” substitute “ the Commissioner ”.

(3) In paragraph 1—

(a) for “the supervisory authority competent in accordance with Article 55” substitute “ the Commissioner ”;

(b) for “the notification to the supervisory authority” substitute “ the notification under this paragraph ”.

(4) In paragraph 5, for “the supervisory authority” substitute “ the Commissioner ”.

28

In Article 34(4), for “the supervisory authority” substitute “ the Commissioner ”.

29

(1) Article 35 is amended as follows.

(2) In paragraph 4—

(a) in the first sentence, for “The supervisory authority” substitute “ The Commissioner ”;

(b) omit the second sentence.

(3) In paragraph 5—

(a) in the first sentence, for “The supervisory authority” substitute “ The Commissioner ”;

(b) omit the second sentence.

(4) Omit paragraph 6.

(5) For paragraph 10 substitute—

(10) In the case of processing pursuant to point (c) or (e) of Article 6(1), paragraphs 1 to 7 of this Article do not apply if a data protection impact assessment has already been carried out for the processing as part of a general impact assessment required by domestic law, unless domestic law provides otherwise.

30

(1) Article 36 is amended as follows.

(2) In paragraph 1, for “the supervisory authority” substitute “ the Commissioner ”.

(3) In paragraph 2—

(a) in the first sentence, for “the supervisory authority” (in both places) substitute “ the Commissioner ”;

(b) in the third sentence, for “The supervisory authority” substitute “ The Commissioner ”;

(c) in the last sentence, for “the supervisory authority has obtained information it” substitute “ the Commissioner has obtained information the Commissioner ”.

(4) In paragraph 3—

(a) in the opening words, for “the supervisory authority” (in both places) substitute “ the Commissioner ”;

(b) in point (f), for “the supervisory authority” substitute “ the Commissioner ”.

(5) In paragraph 4—

(a) for “Members States shall consult the supervisory authority” substitute “ The relevant authority must consult the Commissioner ”;

(b) for “a national parliament” substitute “ Parliament, the National Assembly for Wales, the Scottish Parliament or the Northern Ireland Assembly ”.

(6) After that paragraph insert—

(4A) In paragraph 4, “the relevant authority” means— (a) in relation to a legislative measure adopted by Parliament, or a regulatory measure based on such a legislative measure, the Secretary of State; (b) in relation to a legislative measure adopted by the National Assembly for Wales, or a regulatory measure based on such a legislative measure, the Welsh Ministers; (c) in relation to a legislative measure adopted by the Scottish Parliament, or a regulatory measure based on such a legislative measure, the Scottish Ministers; (d) in relation to a legislative measure adopted by the Northern Ireland Assembly, or a regulatory measure based on such a legislative measure, the relevant Northern Ireland department.

(7) Omit paragraph 5.

31

(1) Article 37 is amended as follows.

(2) In paragraph 4, omit “or, where required by Union or Member State law shall,”.

(3) In paragraph 7, for “the supervisory authority” substitute “ the Commissioner ”.

32

In Article 38(5), for “Union or Member State law” substitute “ domestic law ”.

33

(1) Article 39 is amended as follows.

(2) In paragraph 1(a) and (b), for “other Union or Member State data protection provisions” substitute “ other domestic law relating to data protection ”.

(3) In paragraph 1(d) and (e), for “the supervisory authority” substitute “ the Commissioner ”.

34

(1) Article 40 is amended as follows.

(2) In paragraph 1, for “The Member States, the supervisory authorities, the Board and the Commission” substitute “ The Commissioner ”.

(3) In paragraph 2(i), for “supervisory authorities” substitute “ the Commissioner ”.

(4) In paragraph 3, omit “and having general validity pursuant to paragraph 9 of this Article”.

(5) In paragraph 4, for “supervisory authorities competent pursuant to Article 55 or 56” substitute “ the Commissioner ”.

(6) In paragraph 5—

(a) for “the supervisory authority which is competent pursuant to Article 55. The supervisory authority” substitute “ the Commissioner, who ”;

(b) for “it finds” substitute “ the Commissioner finds ”.

(7) In paragraph 6, for “and where the code of conduct concerned does not relate to processing activities in several Member States, the supervisory authority” substitute “ the Commissioner ”.

(8) Omit paragraphs 7, 8, 9, 10 and 11.

35

(1) Article 41 is amended as follows.

(2) In paragraph 1, for “the competent supervisory authority” (in both places) substitute “ the Commissioner ”.

(3) In paragraph 2(a) and (d), for “the competent supervisory authority” substitute “ the Commissioner ”.

(4) Omit paragraph 3.

(5) In paragraph 4, for “the competent supervisory authority” (in both places) substitute “ the Commissioner ”.

(6) In paragraph 5, for “The competent supervisory authority” substitute “ The Commissioner ”.

36

(1) Article 42 is amended as follows.

(2) In paragraph 1—

(a) for “The Member States, the supervisory authorities, the Board and the Commission” substitute “ The Commissioner ”;

(b) omit “, in particular at Union level,”.

(3) In paragraph 4, for “the supervisory authorities which are competent pursuant to Article 55 or 56” substitute “ the Commissioner ”.

(4) In paragraph 5—

(a) for “the competent supervisory authority” substitute “ the Commissioner ”;

(b) for “that competent supervisory authority” substitute “ the Commissioner ”;

(5) In paragraph 6, for “the competent supervisory authority” substitute “ the Commissioner ”.

(6) In paragraph 7, for “the competent supervisory authority” substitute “ the Commissioner ”.

(7) In paragraph 8, for “The Board” substitute “ The Commissioner ”.

37

(1) Article 43 is amended as follows.

(2) In paragraph 1—

(a) in the opening words—

(i) for “the competent supervisory authority” substitute “ the Commissioner ”;

(ii) for “the supervisory authority” substitute “ the Commissioner ”;

(iii) for “Members States shall ensure that those certification bodies are” substitute “ In accordance with section 17 of the 2018 Act, those certification bodies may only be ”;

(b) for point (a) substitute—

(a) the Commissioner;

(i) for “the national accreditation body” substitute “ the UK national accreditation body ”;

(ii) for “the supervisory authority which is competent pursuant to Article 55 or 56” substitute “ the Commissioner ”.

(3) In paragraph 2—

(a) in point (a), for “the competent supervisory authority” substitute “ the Commissioner ”;

(b) in point (b), for “the supervisory authority” to the end substitute “ the Commissioner ”;

(4) In paragraph 3, for “the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board pursuant to Article 63” substitute “ the Commissioner ”.

(5) In paragraph 5, for “the competent supervisory authorities” substitute “ the Commissioner ”.

(6) In paragraph 6—

(a) for “the supervisory authority” substitute “ the Commissioner ”;

(b) omit from “The supervisory authorities” to the end.

(7) In paragraph 7, for “the competent supervisory authority or the national accreditation body” substitute “ the Commissioner or the UK national accreditation body ”.

(8) Omit paragraphs 8 and 9.

Chapter 5 (transfers of personal data to third countries or international organisations)

38

(1) Article 45 is amended as follows.

(2) In paragraph 1, for “where the Commission” to the end of the first sentence substitute “ where it is based on adequacy regulations (see section 17A of the 2018 Act) ”.

(3) In paragraph 2—

(a) for “, the Commission” substitute “ for the purposes of sections 17A and 17B of the 2018 Act, the Secretary of State ”;

(b) in point (b), for “the supervisory authorities of the Member States” substitute “ the Commissioner ”.

(4) Omit paragraphs 3, 4, 5 and 6.

(5) In paragraph 7, for “A decision pursuant to paragraph 5 of this Article” substitute “ The amendment or revocation of regulations under section 17A of the 2018 Act ”.

(6) Omit paragraphs 8 and 9.

39

(1) Article 46 is amended as follows.

(2) In paragraph 1, for “a decision pursuant to Article 45(3)” substitute “ adequacy regulations under section 17A of the 2018 Act ”.

(3) In paragraph 2—

(a) for “a supervisory authority” substitute “ the Commissioner ”;

(b) for paragraph (c) substitute—

(c) standard data protection clauses specified in regulations made by the Secretary of State under section 17C of the 2018 Act and for the time being in force;

(d) standard data protection clauses specified in a document issued (and not withdrawn) by the Commissioner under section 119A of the 2018 Act and for the time being in force;

(4) In paragraph 3, for “Subject to the authorisation from the competent supervisory authority” substitute “ With authorisation from the Commissioner ”.

(5) Omit paragraphs 4 and 5.

40

(1) Article 47 is amended as follows.

(2) In paragraph 1—

(a) for “The competent supervisory authority” substitute “ The Commissioner ”;

(b) omit “in accordance with the consistency mechanism set out in Article 63”.

(3) In paragraph 2(e), for “the competent supervisory authority and before the competent courts of the Member States in accordance with Article 79” substitute “ the Commissioner and before a court in accordance with Article 79 (see section 180 of the 2018 Act) ”.

(4) In paragraph 2(f)—

(a) for “established on the territory of a Member State” substitute “ established in the United Kingdom ”;

(b) for “not established in the Union” substitute “ not established in the United Kingdom ”.

(5) In paragraph 2(j), for “the competent supervisory authority” substitute “ the Commissioner ”.

(6) In paragraph 2(k), for “the supervisory authority” substitute “ the Commissioner ”.

(7) In paragraph 2(l), for “the supervisory authority” (in both places) substitute “ the Commissioner ”.

(8) In paragraph 2(m), for “the competent supervisory authority” substitute “ the Commissioner ”.

(9) Omit paragraph 3.

41

Omit Article 48.

42

(1) Article 49 is amended as follows.

(2) In paragraph 1—

(a) in the opening words, for “an adequacy decision pursuant to Article 45(3)” substitute “ adequacy regulations under section 17A of the 2018 Act ”;

(b) in point (g), for “Union or Member State law” (in both places) substitute “ domestic law ”;

(3) In paragraph 4, for “shall be recognised in Union law or in the law of the Member State to which the controller is subject” substitute “ must be public interest that is recognised in domestic law (whether in regulations under section 18(1) of the 2018 Act or otherwise) ”.

(4) Omit paragraph 5.

(5) After that paragraph insert—

(5A) This Article and Article 46 are subject to restrictions in regulations under section 18(2) of the 2018 Act.

43

In Article 50, for “the Commission and supervisory authorities” substitute “ the Commissioner ”.

Chapter 6 (independent supervisory authorities)

44

For the heading of Chapter 6 substitute “ The Commissioner ”.

45

(1) Article 51 is amended as follows.

(2) For the heading, substitute “ Monitoring the application of this Regulation ”.

(3) In paragraph 1—

(a) for “Each Member State shall provide for one or more independent public authorities to be” substitute “ The Commissioner is ”;

(b) omit “within the Union (“supervisory authority”)”.

(4) Omit paragraphs 2, 3 and 4.

46

(1) Article 52 is amended as follows.

(2) In paragraph 1—

(a) for “Each supervisory authority” substitute “ The Commissioner ”;

(b) omit “its” (in both places).

(3) In paragraph 2—

(a) for “The member or members of each supervisory authority” substitute “ The Commissioner ”;

(b) omit “their” (in both places).

(4) In paragraph 3—

(a) for “Member or members of each supervisory authority” substitute “ The Commissioner ”;

(b) for “their duties” substitute “ the Commissioner's duties ”;

(5) Omit paragraphs 4, 5 and 6.

47

Omit Article 53.

48

Omit Article 54.

49

In the heading of section 2 of Chapter 6, for “Competence, tasks” substitute “ Tasks ”.

50

Omit Article 55.

51

Omit Article 56.

52

(1) Article 57 is amended as follows.

(2) In paragraph 1—

(a) for “each supervisory authority shall on its territory” substitute “ the Commissioner must ”;

(b) in point (c), for “, in accordance with Member State law, the national parliament” substitute “ Parliament ”;

(c) in point (e), for “the supervisory authorities in other Member States” substitute “ foreign designated authorities ”;

(d) in point (f), for “another supervisory authority” substitute “ a foreign designated authority ”;

(e) omit point (g);

(f) in point (h), for “another supervisory authority” substitute “ a foreign designated authority ”;

(g) in point (j), after “and” insert “ issue standard data protection clauses referred to ”;

(h) after point (o) insert—

(oa) maintain a public register of certification mechanisms and data protection seals and marks pursuant to Article 42(8) and of controllers or processors established in third countries and certified pursuant to Article 42(7);

(i) omit point (t).

(3) In paragraph 2, for “Each supervisory authority” substitute “ The Commissioner ”.

(4) In paragraph 3, for “the tasks of each supervisory authority shall be” substitute “ the Commissioner's tasks is to be ”.

(5) In paragraph 4, for “supervisory authority” (in both places) substitute “ Commissioner ”.

53

(1) Article 58 is amended as follows.

(2) In paragraph 1—

(a) for “Each supervisory authority shall have” substitute “ The Commissioner has ”;

(b) in point (e), for “its” substitute “the Commissioner's”;

(3) In paragraph 2, for “Each supervisory authority shall have” substitute “ The Commissioner has ”.

(4) In paragraph 3—

(a) for “Each supervisory authority shall have” substitute “ The Commissioner has ”;

(b) in point (b)—

(i) for “its” substitute “the Commissioner's”;

(ii) for “the national parliament, the Member State government or, in accordance with Member State law, to” substitute “ Parliament, the government or ”;

(5) After paragraph 3 insert—

(3A) In the 2018 Act, section 115(4) to (9) provide that the Commissioner's functions under this Article are subject to certain safeguards.

(6) Omit paragraphs 4, 5 and 6.

54

In Article 59—

(a) for “Each supervisory authority” substitute “ The Commissioner ”;

(b) for “its” substitute “the Commissioner's”;

(c) for the second sentence substitute “ The Commissioner must arrange for those reports to be laid before Parliament and send a copy to the Secretary of State. ”;

(d) omit “, to the Commission and to the Board”.

Chapter 7 (cooperation and consistency)

55

Omit Articles 60 to 76 and the headings for, and for the sections of, Chapter 7.

Chapter 8 (remedies, liability and penalties)

56

(1) Article 77 is amended as follows.

(2) In the heading, for “a supervisory authority” substitute “ the Commissioner ”.

(3) In paragraph 1, for “a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement” substitute “ the Commissioner ”.

(4) In paragraph 2, for “The supervisory authority with which the complaint has been lodged” substitute “ The Commissioner ”.

57

(1) Article 78 is amended as follows.

(2) In the heading, for “a supervisory authority” substitute “ the Commissioner ”.

(3) In paragraph 1, for “a supervisory authority” substitute “ the Commissioner ”.

(4) In paragraph 2, for “the supervisory authority which is competent pursuant to Articles 55 and 56” substitute “ the Commissioner ”.

(5) Omit paragraph 3.

(6) Omit paragraph 4.

58

(1) Article 79 is amended as follows.

(2) In paragraph 1, for “a supervisory authority” substitute “ the Commissioner ”.

(3) Omit paragraph 2.

59

(1) Article 80 is amended as follows.

(2) In paragraph 1—

(a) for the words from “a not-for profit” to “their personal data” substitute “ a body or other organisation which meets the conditions in section 187(3) and (4) of the 2018 Act ”;

(b) omit “where provided for by Member State law”.

(3) In paragraph 2—

(a) for “Member States” substitute “ The Secretary of State ”;

(b) omit “, in that Member State,”;

(4) After that paragraph insert—

(3) The Secretary of State may exercise the power under paragraph 2 of this Article only by making regulations under section 190 of the 2018 Act.

60

Omit Article 81.

61

In Article 82, omit paragraph 6.

62

(1) Article 83 is amended as follows.

(2) In paragraph 1, for “Each supervisory authority” substitute “ The Commissioner ”.

(3) In paragraph 2—

(a) in point (f), for “the supervisory authority” substitute “ the Commissioner ”;

(b) in point (h), for “the supervisory authority” substitute “ the Commissioner ”.

(4) In paragraph 4, for “10 000 000 EUR” substitute “ £8,700,000 ”.

(5) In paragraph 5—

(a) for “20 000 000 EUR” substitute “ £17,500,000 ”;

(b) for point (d) substitute—

(d) any obligations under Part 5 or 6 of Schedule 2 to the 2018 Act or regulations made under section 16(1)(c) of the 2018 Act;

(6) In paragraph 6—

(a) for “the supervisory authority” substitute “ the Commissioner ”;

(b) for “20 000 000 EUR” substitute “ £17,500,000 ”.

(7) Omit paragraphs 7, 8 and 9.

(8) After paragraph 9 insert—

(10) In the 2018 Act, section 115(9) makes provision about the exercise of the Commissioner's functions under this Article.

63

In Article 84, for paragraphs 1 and 2 substitute—

Part 6 of the 2018 Act makes further provision about penalties applicable to infringements of this Regulation.

Chapter 9 (provisions relating to specific processing situations)

64

(1) Article 85 is amended as follows.

(2) Omit paragraph 1.

(3) In paragraph 2—

(a) for “Members States shall” substitute “ the Secretary of State may ”;

(b) for “independent supervisory authorities” substitute “ the Commissioner ”;

(4) After that paragraph insert—

(2A) The Secretary of State may exercise the power under paragraph 2 of this Article only by making regulations under section 16 of the 2018 Act.

(5) Omit paragraph 3.

65

(1) Article 86 is amended as follows.

(2) The existing text becomes paragraph 1.

(3) In that paragraph, for “Union or Member State law” substitute “ domestic law ”.

(4) After that paragraph insert—

(2) Chapter 3 of Part 2 of the 2018 Act makes provision about the application of this Regulation to the manual unstructured processing of personal data held by an FOI public authority (as defined in Article 2).

66

After Article 86 insert—

Processing and national security and defence Chapter 3 of Part 2 of the 2018 Act makes provision about the application of this Regulation where processing is carried out, or exemption from a provision of this Regulation is required, for the purposes of safeguarding national security or for defence purposes.

67

Omit Article 87.

68

Omit Article 88.

69

(1) Article 89 is amended as follows.

(2) After paragraph 1 insert—

(1A) In the 2018 Act, section 19 makes provision about when the requirements in paragraph 1 are satisfied.

(3) Omit paragraphs 2, 3 and 4.

70

Omit Article 90.

71

Omit Article 91.

Chapter 10 (delegated acts and implementing acts)

72

Omit Articles 92 and 93 and the heading for Chapter 10.

Chapter 11 (final provisions)

73

(1) Article 94 is amended as follows.

(2) Omit paragraph 1.

(3) In paragraph 2—

(a) in the first sentence, for “the repealed Directive” substitute “ Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (which ceased to have effect on 25th May 2018) ”;

(b) in the second sentence, for “by this Regulation” substitute “ by the EU GDPR (as defined in section 3 of the 2018 Act) ” .

74

(1) Article 95 is amended as follows.

(2) For “the Union” substitute “ the United Kingdom ”.

(3) For “Directive 2002/58/EC” substitute “ domestic law made before IP completion day implementing Directive 2002/58/EC of the European Parliament and of the Council of 12th July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector ”.

75

(1) Article 96 is amended as follows.

(2) For “Member States” substitute “ the United Kingdom or the Commissioner ”.

(3) For “Union law” substitute “ domestic law ”.

76

Omit Article 97.

77

Omit Article 98.

78

Omit Article 99.

79

Omit the sentence following Article 99.

Supplementary

80

It is not to be presumed, by virtue of the revocation of a provision by this Schedule, that the provision was applicable to the United Kingdom immediately before IP completion day (and so would, but for this Schedule, be part of the UK GDPR).

SCHEDULE 2 — Amendments of the Data Protection Act 2018

Introduction

1

The Data Protection Act 2018 is amended as follows.

Part 1 (preliminary)

2

(1) Section 1 is amended as follows.

(2) In subsection (2), for “GDPR” substitute “ UK GDPR ”.

(3) In subsection (3), for “GDPR” to the end substitute “ UK GDPR ”.

(4) In subsection (4), omit “and implements the Law Enforcement Directive”.

3

In section 2(1) and (2), for “GDPR, the applied GDPR” substitute “ UK GDPR ”.

4

(1) Section 3 is amended as follows.

(2) In subsection (6), omit “Chapter 2 or 3 of” and “Chapter or”.

(3) In subsection (9)—

(a) for paragraph (a) substitute—

(a) the UK GDPR,

(b) omit paragraph (b);

(4) In subsection (10)—

(a) for “The GDPR” substitute “ The UK GDPR ”;

(b) for “(General Data Protection Regulation)” substitute “ (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4) ) ”.

(5) After subsection (10) insert—

(10A) “The EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law.

(6) Omit subsection (11).

(7) In subsection (14)—

(a) for paragraph (a) substitute—

(a) references to the UK GDPR are to the UK GDPR read with Part 2;

(b) omit paragraph (b);

Part 2 (general processing) (other than Schedules 1 to 6)

5

(1) Section 4 is amended as follows.

(2) In subsection (2)—

(a) for “Chapter 2 of this Part” substitute “ This Part ”;

(b) for “GDPR” (in each place) substitute “ UK GDPR ”.

(3) Omit subsection (3).

6

(1) Section 5 is amended as follows.

(2) In subsection (1)—

(a) omit “Chapter 2 of”;

(b) for “GDPR” (in both places) substitute “ UK GDPR ”;

(3) In subsection (2)—

(a) for “GDPR” (in each place) substitute “ UK GDPR ”;

(b) for “Chapter 2” substitute “ this Part ”.

(4) In subsection (3), for “Chapter 2” substitute “ this Part ”.

(5) Omit subsections (4), (5) and (6).

(6) In subsection (7)—

(a) omit “Chapter 2 or Chapter 3 of”;

(b) for “the Chapter” substitute “ this Part ”.

7

For the heading of Chapter 2 substitute “ The UK GDPR ”.

8

In the italic heading before section 6, for “GDPR” substitute “ UK GDPR ”.

9

In section 6(1) and (2), for “GDPR” substitute “ UK GDPR ”.

10

(1) Section 7 is amended as follows.

(2) In subsection (1)—

(a) for “GDPR” substitute “ UK GDPR ”;

(b) omit “under the law of the United Kingdom”.

(3) In subsections (2) and (4), for “GDPR” substitute “ UK GDPR ”.

11

In section 8, for “GDPR” substitute “ UK GDPR ”.

12

Omit section 9.

13

(1) Section 10 is amended as follows.

(2) In subsections (1), (2) and (3), for “GDPR” substitute “ UK GDPR ”.

(3) In subsection (5), for “10 of the GDPR” substitute “ 10(1) of the UK GDPR ”.

14

In section 11, in subsection (1) (in both places) and in subsection (2), for “GDPR” substitute “ UK GDPR ”.

15

In section 12(1)(a) and (b), for “GDPR” substitute “ UK GDPR ”.

16

In section 13(2) and (3), for “GDPR” substitute “ UK GDPR ”.

17

(1) Section 14 is amended as follows.

(2) In subsection (1)—

(a) for “GDPR” (in both places) substitute “ UK GDPR ”;

(b) for “authorised by law” substitute “ required or authorised under the law of the United Kingdom or a part of the United Kingdom ”.

(3) In subsections (3)(c), (5) and (6) (in both places), for “GDPR” substitute “ UK GDPR ”.

18

For the italic heading before section 15 substitute “ Exemptions etc ”.

19

(1) Section 15 is amended as follows.

(2) In subsection (1), for “GDPR” substitute “ UK GDPR ”.

(3) In subsection (2)(a)—

(a) for “GDPR” (in the first place) substitute “ UK GDPR ”;

(b) for “, as allowed for by” substitute “ (of a kind described in ”;

(4) In subsection (2)(b)—

(a) for “GDPR” (in the first place) substitute “ UK GDPR ”;

(b) for “, as allowed for by” substitute “ (of a kind described in ”;

(5) In subsection (2)(c)—

(a) for “GDPR” (in the first place) substitute “ UK GDPR ”;

(b) for “, as allowed for by” substitute “ (of a kind described in ”;

(6) In subsection (2)(d)—

(a) for “GDPR” (in the first place) substitute “ UK GDPR ”;

(b) for “, as allowed for by” substitute “ (of a kind described in ”;

(7) In subsection (2)(e)—

(a) for “, V and VII of the GDPR” substitute “ and V of the UK GDPR ”;

(b) for “, as allowed for by Article 85(2) of the GDPR” substitute “ (of a kind described in Article 85(2) of the UK GDPR) ”.

(8) In subsection (2)(f)—

(a) for “GDPR” (in the first place) substitute “ UK GDPR ”;

(b) omit “, as allowed for by Article 89(2) and (3) of the GDPR”.

(9) In subsection (3)—

(a) for “GDPR” (in the first place) substitute “ UK GDPR ”;

(b) for “, as allowed for by” substitute “ (of a kind described in ”;

(10) In subsection (4) —

(a) for “GDPR” (in the first place) substitute “ UK GDPR ”;

(b) for “, as allowed for by” substitute “ (of a kind described in ”;

(11) After subsection (4) insert—

(4A) In connection with the manual unstructured processing of personal data held by an FOI public authority, see Chapter 3 of this Part (sections 21, 24 and 25).

(12) In subsection (5), for “and the exemption in section 26” substitute “ (sections 26 to 28) ”.

20

(1) Section 16 is amended as follows.

(2) In subsection (1)—

(a) in the opening words, for “GDPR” substitute “ UK GDPR ”;

(b) in paragraph (a)—

(i) omit “for Member State law”;

(ii) for “GDPR” substitute “ UK GDPR ”;

(d) in paragraph (c), for “GDPR” substitute “ UK GDPR ”.

(3) In subsection (2)—

(a) omit “and” at the end of paragraph (a)(ii);

(b) after paragraph (b) insert—

, and (c) consequentially amend the UK GDPR by adding, varying or omitting a reference to section 15, Schedule 2, 3 or 4, this section or regulations under this section.

21

For the italic heading before section 17 substitute “ Certification ”.

22

(1) Section 17 is amended as follows.

(2) In subsection (1)(b), for “national accreditation body” substitute “ UK national accreditation body ”.

(3) In subsection (3), for “national accreditation body” substitute “ UK national accreditation body ”.

(4) In subsection (6)—

(a) for “national accreditation body” substitute “ UK national accreditation body ”;

(b) for “GDPR” substitute “ UK GDPR ”.

(5) In subsection (7)—

(a) for “national accreditation body” substitute “ UK national accreditation body ”;

(b) for “GDPR” substitute “ UK GDPR ”.

(6) In subsection (8)—

(a) for “GDPR” substitute “ UK GDPR ”;

(b) for “national accreditation body” (in both places) substitute “ UK national accreditation body ”.

23

Before section 18 (but after the italic heading before it) insert—

(17A) (1) The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data— (a) a third country, (b) a territory or one or more sectors within a third country, (c) an international organisation, or (d) a description of such a country, territory, sector or organisation. (2) For the purposes of the UK GDPR and this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes— (a) in the case of a third country, the country or a relevant territory or sector within the country, or (b) in the case of an international organisation, the organisation. (3) Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2). (4) Article 45(2) of the UK GDPR makes provision about the assessment of the adequacy of the level of protection for the purposes of this section and section 17B. (5) Regulations under this section— (a) where they relate to a third country, must specify their territorial and sectoral application; (b) where applicable, must specify the independent supervisory authority or authorities referred to in Article 45(2)(b) of the UK GDPR. (6) Regulations under this section may, among other things— (a) provide that in relation to a country, territory, sector, organisation or transfer specified, or falling within a description specified, in the regulations, section 17B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations; (b) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time; (c) confer a discretion on a person. (7) Regulations under this section are subject to the negative resolution procedure. (17B) (1) For so long as regulations under section 17A are in force which specify, or specify a description which includes, a third country, a territory or sector within a third country or an international organisation, the Secretary of State must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years. (2) Each review under subsection (1) must take into account all relevant developments in the third country or international organisation. (3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under section 17A or to amend or revoke such regulations. (4) Where the Secretary of State becomes aware that a country, territory, sector or organisation specified, or falling within a description specified, in regulations under section 17A no longer ensures an adequate level of protection of personal data, whether as a result of a review under this section or otherwise, the Secretary of State must, to the extent necessary, amend or revoke the regulations. (5) Where regulations under section 17A are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to remedying the lack of an adequate level of protection. (6) The Secretary of State must publish— (a) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which are for the time being specified in regulations under section 17A, and (b) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which have been but are no longer specified in such regulations. (7) In the case of regulations under section 17A which specify that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations— (a) the duty under subsection (1) is only to carry out a review of the level of protection ensured for such a transfer, and (b) the lists published under subsection (6) must specify or describe the relevant transfers. (17C) (1) The Secretary of State may by regulations specify standard data protection clauses which the Secretary of State considers provide appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Article 46 of the UK GDPR (and see also section 119A). (2) The Secretary of State must keep under review the standard data protection clauses specified in regulations under this section that are for the time being in force. (3) Regulations under this section are subject to the negative resolution procedure.

24

(1) Section 18 is amended as follows.

(2) In the heading, at the end insert “ : public interest ”.

(3) In subsection (1), for “GDPR” substitute “ UK GDPR ”.

(4) In subsection (2), for paragraph (a) (but not the final “and”) substitute—

(a) the transfer cannot take place based on adequacy regulations (see section 17A),

25

In section 19(2), for “GDPR” substitute “ UK GDPR ”.

26

In section 20—

(a) for “this Chapter” (in both places) substitute “ this Part ”;

(b) for “GDPR” substitute “ UK GDPR ”.

27

For the heading of Chapter 3 substitute “ Exemptions for manual unstructured processing and for national security and defence purposes ”.

28

For the italic heading before section 21 substitute “ Definitions ”.

29

(1) Section 21 is amended as follows.

(2) For the heading substitute “ Definitions ”.

(3) Omit subsections (1), (2), (3) and (4).

30

Omit section 22 and the italic heading before it.

31

Omit section 23.

32

(1) Section 24 is amended as follows.

(2) In subsection (1)—

(a) for “the applied GDPR” substitute “ the UK GDPR ”;

(b) for “this Chapter” substitute “ the UK GDPR ”;

(3) In subsection (2)—

(a) in paragraphs (a), (b) and (c), for “the applied GDPR” substitute “ the UK GDPR ”;

(b) after paragraph (c) insert—

(ca) in Part 2 of this Act, sections 17A, 17B and 17C (transfers to third countries); (cb) in Part 5 of this Act, section 119A (standard clauses for transfers to third countries);

(d) in Part 7 of this Act, sections 170 and 171 (offences relating to personal data).

(4) In subsection (3)—

(a) for “the applied GDPR” substitute “ the UK GDPR ”;

(b) for “this Chapter” substitute “ the UK GDPR ”;

(5) In subsection (5)—

(a) for “the applied GDPR” substitute “ the UK GDPR ”;

(b) for “this Chapter” substitute “ the UK GDPR ”;

(d) in paragraph (a), for “that Article” substitute “ Article 15 ”.

33

(1) Section 25 is amended as follows.

(2) In subsection (1)—

(a) for “the applied GDPR” substitute “ the UK GDPR ”;

(b) for “this Chapter” substitute “ the UK GDPR ”;

(3) In subsection (2)(a) and (b), omit “of the applied GDPR”.

34

(1) Section 26 is amended as follows.

(2) In subsection (1)—

(a) for “the applied GDPR” substitute “ the UK GDPR ”;

(b) for “this Chapter” substitute “ the UK GDPR ”.

(3) In subsection (2)—

(a) in paragraphs (a), (b), (c) and (d), for “the applied GDPR” substitute “ the UK GDPR ”;

(b) in paragraph (e), for “the applied GDPR” (in both places) substitute “ the UK GDPR ”;

(d) after paragraph (f) insert—

(fa) in Part 2 of this Act, sections 17A, 17B and 17C (transfers to third countries);

(e) in paragraph (g)—

(i) in sub-paragraph (ii), for “the applied GDPR” substitute “ the UK GDPR ”;

(ii) after sub-paragraph (iii) insert—

(iv) section 119A (standard clauses for transfers to third countries);

35

In section 27(5), for “the applied GDPR” substitute “ the UK GDPR ”.

36

(1) Section 28 is amended as follows.

(2) In the heading, for “applied GDPR” substitute “ UK GDPR ”.

(3) In subsections (1) and (2)—

(a) for “the applied GDPR” substitute “ the UK GDPR ”;

(b) for “this Chapter” substitute “ the UK GDPR ”.

(4) In subsection (3), for “the applied GDPR” substitute “ the UK GDPR ”.

(5) After subsection (4) insert—

(5) The functions conferred on the Commissioner in relation to the UK GDPR by Articles 57(1)(a), (d), (e), (h) and (u) and 58(1)(d) and (2)(a) to (d) of the UK GDPR (which are subject to safeguards set out in section 115) include functions in relation to subsection (3).

Part 3 (law enforcement processing) (other than Schedules 7 and 8)

37

In section 33(7), for “other than a member State” substitute “ outside the United Kingdom ”.

38

In section 48, omit subsection (8).

39

In section 67, omit subsection (8).

40

(1) Section 73 is amended as follows.

(2) In subsection (1)(b), omit “other than the United Kingdom”.

(3) In subsection (3)—

(a) in paragraph (a) for “an adequacy decision (see section 74)” substitute “ adequacy regulations (see section 74A) ”;

(b) in paragraphs (b) and (c), for “an adequacy decision” substitute “ adequacy regulations ”.

(4) In subsection (5)(a), omit “a member State or”.

41

Omit section 74.

42

After section 74 insert—

(74A) (1) The Secretary of State may by regulations specify any of the following which the Secretary of State considers ensures an adequate level of protection of personal data— (a) a third country, (b) a territory or one or more sectors within a third country, (c) an international organisation, or (d) a description of such a country, territory, sector or organisation. (2) For the purposes of this Part of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, regulations made under this section are in force which specify, or specify a description which includes— (a) in the case of a third country, the country or a relevant territory or sector within the country, and (b) in the case of an international organisation, the organisation, and such a transfer does not require specific authorisation. (3) Regulations under this section may specify that the Secretary of State considers that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations and, if they do so, only such a transfer may rely on those regulations for the purposes of subsection (2). (4) When assessing the adequacy of the level of protection for the purposes of this section or section 74B, the Secretary of State must, in particular, take account of— (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation, which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data is transferred, (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with data protection rules, including adequate enforcement powers, for assisting and advising data subjects in exercising their rights and for cooperation with the Commissioner, and (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data. (5) Regulations under this section— (a) where they relate to a third country, must specify their territorial and sectoral application; (b) where applicable, must specify the independent supervisory authority or authorities referred to in subsection (4)(b). (6) Regulations under this section may, among other things— (a) provide that, in relation to a country, territory, sector, organisation or territory specified, or falling within a description specified, in the regulations, section 74B(1) has effect as if it required the reviews described there to be carried out at such shorter intervals as are specified in the regulations; (b) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time; (c) confer a discretion on a person. (7) Regulations under this section are subject to the negative resolution procedure. (74B) (1) For so long as regulations under section 74A are in force which specify, or specify a description which includes, a third country, a territory or sector within a third country or an international organisation, the Secretary of State must carry out a review of whether the country, territory, sector or organisation ensures an adequate level of protection of personal data at intervals of not more than 4 years. (2) Each review under subsection (1) must take into account all relevant developments in the third country or international organisation. (3) The Secretary of State must, on an ongoing basis, monitor developments in third countries and international organisations that could affect decisions to make regulations under section 74A or to amend or revoke such regulations. (4) Where the Secretary of State becomes aware that a country, territory, sector or organisation specified, or falling within a description specified, in regulations under section 74A no longer ensures an adequate level of protection of personal data, whether as a result of a review under this section or otherwise, the Secretary of State must, to the extent necessary, amend or revoke the regulations. (5) Where regulations under section 74A are amended or revoked in accordance with subsection (4), the Secretary of State must enter into consultations with the third country or international organisation concerned with a view to remedying the lack of an adequate level of protection. (6) The Secretary of State must publish— (a) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which are for the time being specified in regulations under section 74A, and (b) a list of the third countries, territories and specified sectors within a third country and international organisations, and the descriptions of such countries, territories, sectors and organisations, which have been but are no longer specified in such regulations. (7) In the case of regulations under section 74A which specify that an adequate level of protection of personal data is ensured only for a transfer specified or described in the regulations— (a) the duty under subsection (1) is only to carry out a review of the level of protection ensured for such a transfer, and (b) the lists published under subsection (6) must specify or describe the relevant transfers.

43

In section 76(1)(c), omit “a member State or”.

44

Section 77(8), for “member States” substitute “ the United Kingdom ”.

45

(1) Section 78 is amended as follows.

(2) In subsection (4), omit “other than the United Kingdom”.

(3) In subsection (5)(a), omit “a member State or”.

46

(1) Section 80 is amended as follows.

(2) In subsection (1), for “an EU recipient or a non-EU recipient” substitute “ a non-UK recipient ”.

(3) In subsection (2)—

(a) omit the definition of “EU recipient”;

(b) for “non-EU recipient” substitute “ non-UK recipient ”.

(4) In subsection (4), for “the EU recipient or non-EU recipient” substitute “ the non-UK recipient ”.

(5) Omit subsections (5), (6) and (7).

Part 5 (Information Commissioner) (other than Schedules 12 to 14)

47

(1) Section 115 is amended as follows.

(2) In the heading, for “GDPR” substitute “ UK GDPR ”.

(3) Omit subsection (1).

(4) In subsection (2)—

(a) in paragraphs (a) and (b), for “GDPR” substitute “ UK GDPR ”;

(b) after “section 2” insert “ and section 28(5) ”.

(5) In subsections (3) and (4), for “GDPR” substitute “ UK GDPR ”.

(6) In subsection (5), for “GDPR” (in both places) substitute “ UK GDPR ”.

(7) In subsection (6), for “GDPR” substitute “ UK GDPR ”.

(8) In subsection (7), for “GDPR” (in both places) substitute “ UK GDPR ”.

(9) In subsection (8)(a) and (b), for “GDPR” substitute “ UK GDPR ”.

(10) In subsections (9) and (10), for “GDPR” substitute “ UK GDPR ”.

48

(1) Section 116 is amended as follows.

(2) Before subsection (1) insert—

(A1) The Commissioner is responsible for monitoring the application of Part 3 of this Act, in order to protect the fundamental rights and freedoms of individuals in relation to processing by a competent authority for any of the law enforcement purposes (as defined in Part 3) and to facilitate the free flow of personal data.

(3) In subsection (1), omit paragraph (a) (including the final “and”).

(4) In subsection (2), for “GDPR” substitute “ UK GDPR ”.

49

(1) Section 117 is amended as follows.

(2) After “this Act” insert “ or the UK GDPR ”.

(3) Omit “(and see also Article 55(3) of the GDPR)” (and the comma before those words).

50

(1) Section 118 is amended as follows.

(2) For the heading substitute “ Co-operation between parties to the Data Protection Convention ”.

(3) Omit subsections (1), (2), (3) and (4).

51

After section 119 insert—

(119A) (1) The Commissioner may issue a document specifying standard data protection clauses which the Commissioner considers provide appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Article 46 of the UK GDPR (and see also section 17C). (2) The Commissioner may issue a document that amends or withdraws a document issued under subsection (1). (3) A document issued under this section— (a) must specify when it comes into force, (b) may make different provision for different purposes, and (c) may include transitional provision or savings. (4) Before issuing a document under this section, the Commissioner must consult the Secretary of State and such of the following as the Commissioner considers appropriate— (a) trade associations; (b) data subjects; (c) persons who appear to the Commissioner to represent the interests of data subjects. (5) After a document is issued under this section— (a) the Commissioner must send a copy to the Secretary of State, and (b) the Secretary of State must lay it before Parliament. (6) If, within the 40-day period, either House of Parliament resolves not to approve the document then, with effect from the end of the day on which the resolution is passed, the document is to be treated as not having been issued under this section (so that the document, and any amendment or withdrawal made by the document, is to be disregarded for the purposes of Article 46(2)(d) of the UK GDPR). (7) Nothing in subsection (6)— (a) affects any transfer of personal data previously made in reliance on the document, or (b) prevents a further document being laid before Parliament. (8) The Commissioner must publish— (a) a document issued under this section, and (b) a notice identifying any document which, under subsection (6), is treated as not having been issued under this section. (9) The Commissioner must keep under review the clauses specified in a document issued under this section for the time being in force. (10) In this section, “the 40-day period” means— (a) if the document is laid before both Houses of Parliament on the same day, the period of 40 days beginning with that day, or (b) if the document is laid before the Houses of Parliament on different days, the period of 40 days beginning with the later of those days. (11) In calculating the 40-day period, no account is to be taken of any period during which Parliament is dissolved or prorogued or during which both Houses of Parliament are adjourned for more than 4 days. (12) In this section, “trade association” includes a body representing controllers or processors.

52

(1) Section 120 is amended as follows.

(2) In subsection (2), for “GDPR” (in each place) substitute “ UK GDPR ”.

(3) After subsection (2) insert—

(2A) The Commissioner may contribute to the activities of international organisations with data protection functions.

(4) In subsection (6), in the definition of “third country”, for “that is not a member State” substitute “ outside the United Kingdom ”.

53

In section 123(7), for “GDPR” (in both places) substitute “ UK GDPR ”.

54

In section 129(1), for “GDPR” substitute “ UK GDPR ”.

55

In section 132(2), omit paragraph (d).

56

In section 135(4), for “GDPR” substitute “ UK GDPR ”.

57

In section 136(1)(b), for “GDPR” substitute “ UK GDPR ”.

58

In section 139(2), for “GDPR” substitute “ UK GDPR ”.

Part 6 (enforcement) (other than Schedules 15 to 17)

59

In section 142(9)—

(a) for “GDPR” (in both places) substitute “ UK GDPR ”;

(b) for “the European Union” substitute “ the United Kingdom ”.

60

In section 143(9), for “GDPR” substitute “ UK GDPR ”.

61

In section 149(2)(a), (b), (c) and (e), (3) and (4)(b) and (c), for “GDPR” substitute “ UK GDPR ”.

62

In section 151(1)(b) and (8)(a), for “GDPR” substitute “ UK GDPR ”.

63

In section 155(2)(a), for “GDPR” (in both places) substitute “ UK GDPR ”.

64

(1) Section 157 is amended as follows.

(2) In subsection (1), for “GDPR” (in both places) substitute “ UK GDPR ”;

(3) In subsection (2)(a), omit “74,”.

(4) In subsection (5), for “20 million Euros” (in both places) substitute “ £17,500,000 ”.

(5) In subsection (6), for “10 million Euros” (in both places) substitute “ £8,700,000 ”.

(6) Omit subsection (7).

65

In section 159(1) and (2), for “GDPR” substitute “ UK GDPR ”.

66

(1) Section 165 is amended as follows.

(2) In subsection (1), for “GDPR” (in both places) substitute “ UK GDPR ”.

(3) In subsection (5)(b), for “another supervisory authority or” substitute “ a ”.

(4) Omit subsection (6).

(5) In subsection (7), omit the definition of “supervisory authority”.

67

In section 166(1), for “GDPR” substitute “ UK GDPR ”.

68

In section 167(4), for “GDPR” substitute “ UK GDPR ”.

69

(1) Section 168 is amended as follows.

(2) In the heading, for “GDPR” substitute “ UK GDPR ”.

(3) In subsections (1) and (2), for “GDPR” substitute “ UK GDPR ”.

70

In section 169(1), for “GDPR” substitute “ UK GDPR ”.

71

In section 170(7), for “GDPR” substitute “ UK GDPR ”.

72

In section 171(8)(a), for “GDPR” substitute “ UK GDPR ”.

73

In section 173(2)(a) and (b), for “GDPR” substitute “ UK GDPR ”.

74

In section 174(2)(a) and (b), for “GDPR” substitute “ UK GDPR ”.

75

In section 180(2)(d) and (e), for “GDPR” substitute “ UK GDPR ”.

76

In section 181, in the definition of “representative”, for “GDPR” (in both places) substitute “ UK GDPR ”.

Part 7 (supplementary and final provision) (other than Schedules 18 to 20)

77

In section 182(3), omit paragraph (a).

78

(1) Section 183 is amended as follows.

(2) In subsection (2)(d), for “processing of personal data to which Chapter 3 of Part 2 or Part 4 of this Act applies” substitute “ relevant processing of personal data ”.

(3) After subsection (2) insert—

(2A) In subsection (2)(d), “relevant processing of personal data” means— (a) processing of personal data described in Article 2(1)(a) or (b) or (1A) of the UK GDPR, and (b) processing of personal data to which Part 4 of this Act applies.

79

In section 185(4)(a) and (b), for “GDPR” substitute “ UK GDPR ”.

80

(1) Section 186 is amended as follows.

(2) In subsection (2)(a), for “GDPR” substitute “ UK GDPR ”.

(3) In subsection (3)(b), omit “23,”.

81

(1) Section 187 is amended as follows.

(2) In subsection (1), in the opening words, for “GDPR applies” insert “ UK GDPR applies, Article 80(1) of the UK GDPR (representation of data subjects) ”.

(3) In subsection (1)(a)—

(a) omit “Article 80(1) of the GDPR (representation of data subjects)”;

(b) for “that Article” substitute “ subsections (3) and (4) ”;

(4) In subsection (1)(b)—

(a) for “a data subject may also authorise” substitute “ also authorises ”;

(b) for “GDPR” substitute “ UK GDPR ”.

(5) In subsection (2)—

(a) for “GDPR” substitute “ UK GDPR ”;

(b) in paragraph (a), for “, (4)(d) and (6)(c)” substitute “ and (4)(d) ”.

(6) In subsection (5), for “GDPR” substitute “ UK GDPR ”.

82

In section 188(2), for “GDPR” substitute “ UK GDPR ”.

83

(1) Section 189 is amended as follows.

(2) In subsection (2), for “GDPR” (in each place) substitute “ UK GDPR ”.

(3) In subsection (4)(c) and (d), for “GDPR” substitute “ UK GDPR ”.

84

In section 190(1), for “GDPR” (in each place) substitute “ UK GDPR ”.

85

(1) Section 205 is amended as follows.

(2) In subsection (1), in the definition of “enactment”—

(a) omit “and” at the end of paragraph (d);

(b) after paragraph (e) insert—

and (f) any retained direct EU legislation;

(3) In subsection (1), in the definition of “international obligation of the United Kingdom”, omit paragraph (a).

(4) After subsection (1) insert—

(1A) In this Act, references to a fundamental right or fundamental freedom (however expressed) are to a fundamental right or fundamental freedom which continues to form part of domestic law on and after IP completion day by virtue of section 4 of the European Union (Withdrawal) Act 2018, as the right or freedom is amended or otherwise modified by the law of the United Kingdom, or of a part of the United Kingdom, from time to time on or after IP completion day.

(5) In subsection (2)—

(a) before paragraph (a) insert—

(za) section 119A(10) and (11);

(b) omit “Chapter 2 or 3 of”.

(6) Omit subsection (3).

(7) After subsection (3) insert—

(4) In the definition of “the UK GDPR” in section 3(10)— (a) the reference to Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 is to be treated as a reference to that Regulation as modified by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (“the 2019 Regulations”), but (b) nothing in the definition or in paragraph (a) determines whether, where Regulation (EU) 2016/679 is modified on or after IP completion day by the law of England and Wales, Scotland or Northern Ireland (other than by Schedule 1 to the 2019 Regulations), the reference to Regulation (EU) 2016/679 is then to be read as a reference to that Regulation as modified. (5) Subsection (4) is not to be read as implying anything about how other references to Regulation (EU) 2016/679 or references to other retained EU law are to be interpreted.

86

(1) The Table in section 206 is amended as follows.

(2) Omit the entries for “the applied Chapter 2” and “the applied GDPR”.

(3) After the entry for “enforcement notice” insert—

the EU GDPR	section 3

(4) Omit the entry for “the GDPR”.

(5) In the entries for “public authority” and “public body”, for “GDPR” substitute “ UK GDPR ”.

(6) At the end insert—

the UK GDPR	section 3

87

(1) Section 207 is amended as follows.

(2) In subsection (1), for “(2) and (3)” substitute “ (1A) and (2) ”.

(3) After subsection (1) insert—

(1A) In the case of the processing of personal data to which Part 2 (the UK GDPR) applies, it applies to the types of such processing to which the UK GDPR applies by virtue of Article 3 of the UK GDPR.

(4) In subsection (2), for “It applies to the processing of personal data” substitute “ In the case of the processing of personal data to which Part 2 does not apply, it applies where such processing is carried out ”.

(5) Omit subsection (3).

(6) In subsection (4), for “Subsections (1) to (3)” substitute “ Subsections (1), (1A) and (2) ”.

(7) Omit subsection (6).

(8) In subsection (7), omit the words after paragraph (d).

88

In section 209(2), (3) and (4), for “GDPR” substitute “ UK GDPR ”.

89

In section 210(2) and (3), for “GDPR” substitute “ UK GDPR ”.

90

(1) Section 213 is amended as follows.

(2) In subsection (2), for “GDPR” substitute “ EU GDPR ”.

(3) At the end insert—

(4) Schedule 21 contains further transitional, transitory and saving provision made in connection with the amendment of this Act and the UK GDPR by regulations under section 8 of the European Union (Withdrawal) Act 2018.

Schedules

91

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.

The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

Citation, commencement and extent

1

Interpretation

2

Amendment of the UK GDPR

3

Amendment of the Data Protection Act 2018

4

GDPR merger modifications

5

Consequential amendments of other legislation

6

Amendments consequential on provisions of the 2018 Act

7

Amendment of the Privacy and Electronic Communications Regulations 2003

8

SCHEDULE 1 — Amendments of the UK GDPR

Introduction

1

2

Chapter 1 (general provisions)

3

4

5

6

Chapter 2 (principles)

7

8

9

10

Chapter 3 (rights of the data subject)

11

12

13

14

15

16

17

18

19

Chapter 4 (controller and processor)

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

Chapter 5 (transfers of personal data to third countries or international organisations)

38

39

40

41

42

43

Chapter 6 (independent supervisory authorities)

44

45

46

47

48

49

50

51

52

53

54

Chapter 7 (cooperation and consistency)