The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

• (1) Schedule 1 is amended as follows.

• (2) In paragraph 2(3), for “GDPR” substitute “ UK GDPR ”.

• (3) In paragraph 4(b), for “GDPR” substitute “ UK GDPR ”.

• (4) In paragraph 39(a), for “GDPR” substitute “ UK GDPR ”.

• (5) In paragraph 41, for “GDPR” (in both places) substitute “ UK GDPR ”.

92

• (1) Schedule 2 is amended as follows.

• (2) In the heading, for “GDPR” substitute “ UK GDPR ”.

• (3) In the heading of Part 1, for “based on” substitute “ as described in ”.

• (4) In the italic heading before paragraph 1, for “GDPR” (in the first place) substitute “ UK GDPR ”.

• (5) In paragraph 1—

• (a) in sub-paragraph (a), for “GDPR” (in both places) substitute “ UK GDPR ”;

• (b) in sub-paragraph (b), for “GDPR” (in both places) substitute “ UK GDPR ”.

• (6) In paragraph 2—

• (a) in sub-paragraph (1), for “GDPR” (in the second place) substitute “ UK GDPR ”;

• (b) in sub-paragraph (3), for “GDPR” substitute “ UK GDPR ”.

• (7) In paragraph 3—

• (a) in sub-paragraph (1), for “GDPR” substitute “ UK GDPR ”;

• (b) in sub-paragraph (3), for “GDPR” (in each place) substitute “ UK GDPR ”.

• (8) In paragraph 4—

• (a) in sub-paragraph (1), for “GDPR” substitute “ UK GDPR ”;

• (b) in sub-paragraph (2), in the opening words (but not the words following paragraph (g)), for “GDPR” (in each place) substitute “ UK GDPR ”;

• (c) in sub-paragraph (4), for “GDPR” substitute “ UK GDPR ”.

• (9) In the heading of Part 2, for “based on” substitute “ as described in ”.

• (10) In the italic heading before paragraph 6, for “GDPR” (in the first place) substitute “ UK GDPR ”.

• (11) In paragraph 6, for “GDPR” (in the second and third places) substitute “ UK GDPR ”.

• (12) In paragraph 13, for “GDPR” (in the second place) substitute “ UK GDPR ”.

• (13) In the heading of Part 3, for “based on Article 23(1):” substitute “ for the ”.

• (14) In paragraph 16(1), for “GDPR” (in both places) substitute “ UK GDPR ”.

• (15) In the heading of Part 4, for “based on” substitute “ as described in ”.

• (16) In the italic heading before paragraph 18, for “GDPR” (in the first place) substitute “ UK GDPR ”.

• (17) In paragraph 18, for “GDPR” (in the second and third places) substitute “ UK GDPR ”.

• (18) In paragraph 20(3), for “GDPR” substitute “ UK GDPR ”.

• (19) In paragraph 25—

• (a) in sub-paragraph (2), for “GDPR” (in both places) substitute “ UK GDPR ”;

• (b) in sub-paragraph (3), for “GDPR” substitute “ UK GDPR ”.

• (20) In the heading of Part 5, omit “based on Article 85(2)”.

• (21) In paragraph 26(9)—

• (a) in the opening words, for “GDPR” (in the second and third places) substitute “ UK GDPR ”;

• (b) in paragraphs (a), (b), (c) and (d), for “GDPR” substitute “ UK GDPR ”;

• (c) omit paragraph (e).

• (22) In the heading of Part 6, omit “based on Article 89”.

• (23) In paragraph 27—

• (a) in sub-paragraph (1), for “sub-paragraph (3)” substitute “ sub-paragraphs (3) and (4) ”;

• (b) in sub-paragraph (2), for “GDPR (the rights in which may be derogated from by virtue of Article 89(2) of the GDPR)” substitute “ UK GDPR ”;

• (c) in sub-paragraph (3)(a), for “GDPR” substitute “ UK GDPR ”;

• (d) after sub-paragraph (3) insert—

(4) Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.

• (24) In paragraph 28—

• (a) in sub-paragraph (1), for “sub-paragraph (3)” substitute “ sub-paragraphs (3) and (4) ”;

• (b) in sub-paragraph (2), for “GDPR (the rights in which may be derogated from by virtue of Article 89(3) of the GDPR)” substitute “ UK GDPR ”;

• (c) in sub-paragraph (3), for “GDPR” substitute “ UK GDPR ”;

• (d) after sub-paragraph (3) insert—

(4) Where processing for a purpose described in sub-paragraph (1) serves at the same time another purpose, the exemption in sub-paragraph (1) is available only where the personal data is processed for a purpose referred to in that sub-paragraph.

93

• (1) Schedule 3 is amended as follows.

• (2) In the heading, for “GDPR” substitute “ UK GDPR ”.

• (3) In the heading of Part 1, for “GDPR” substitute “ UK GDPR ”.

• (4) In paragraph 1, for “GDPR” (in the second and third places) substitute “ UK GDPR ”.

• (5) In paragraph 2(2), for “GDPR” substitute “ UK GDPR ”.

• (6) In the italic heading before paragraph 5, for “GDPR” substitute “ UK GDPR ”.

• (7) In paragraph 5(1), for “GDPR” substitute “ UK GDPR ”.

• (8) In the italic heading before paragraph 6, for “GDPR” substitute “ UK GDPR ”.

• (9) In paragraph 6(1), for “GDPR” substitute “ UK GDPR ”.

• (10) In paragraph 7(2), for “GDPR” substitute “ UK GDPR ”.

• (11) In the italic heading before paragraph 11, for “GDPR” substitute “ UK GDPR ”.

• (12) In paragraph 11, for “GDPR” substitute “ UK GDPR ”.

• (13) In the italic heading before paragraph 12, for “GDPR” substitute “ UK GDPR ”.

• (14) In paragraph 12(1)(a) and (3), for “GDPR” substitute “ UK GDPR ”.

• (15) In paragraph 17(2), for “GDPR” substitute “ UK GDPR ”.

• (16) In the italic heading before paragraph 19, for “GDPR” substitute “ UK GDPR ”.

• (17) In paragraph 19, for “GDPR” substitute “ UK GDPR ”.

• (18) In the italic heading before paragraph 20, for “GDPR” substitute “ UK GDPR ”.

• (19) In paragraph 20(1)(a) and (3), for “GDPR” substitute “ UK GDPR ”.

• (20) In the italic heading before paragraph 21, for “GDPR” substitute “ UK GDPR ”.

• (21) In paragraph 21(2), for “GDPR” substitute “ UK GDPR ”.

94

• (1) Schedule 4 is amended as follows.

• (2) In the heading, for “GDPR” substitute “ UK GDPR ”.

• (3) In the italic heading before paragraph 1, for “GDPR” (in the first place) substitute “ UK GDPR ”.

• (4) In paragraph 1, for “GDPR” (in the second and third places) substitute “ UK GDPR ”.

95

In Schedule 5, in the following provisions, for “national accreditation body” substitute “ UK national accreditation body ”

• (a) paragraph 1(2) (in both places);

• (b) paragraph 4(4) (in both places);

• (c) paragraph 6(4).

96

Omit Schedule 6.

97

• (1) Schedule 13 is amended as follows.

• (2) In paragraph 1(1)—

• (a) in paragraph (e), omit “LED supervisory authorities and”;

• (b) in paragraph (f), omit “LED supervisory authorities and” and “the Law Enforcement Directive and”;

• (c) in paragraph (g), omit “an LED supervisory authority,”;

• (d) omit paragraph (i).

• (3) In paragraph 3, omit the definition of “LED supervisory authority”.

98

In Schedule 14, omit Part 1.

99

• (1) Schedule 18 is amended as follows.

• (2) In paragraph 1(2), for “section 21(2)” substitute “ Article 2(1A) of the UK GDPR ”.

• (3) In paragraph 5(a) and (b), for “GDPR” substitute “ UK GDPR ”.

100

• (1) Schedule 19 is amended as follows.

• (2) In paragraph 431(3), for “the GDPR or the applied GDPR” substitute “ the UK GDPR ”.

• (3) In paragraph 432(5)(a), for “the GDPR or the applied GDPR” substitute “ the UK GDPR ”.

101

• (1) Schedule 20 is amended as follows.

• (2) In the heading of Part 3, for “GDPR” substitute “ UK GDPR ”.

• (3) In the italic heading before paragraph 12, for “GDPR” (in both places) substitute “ UK GDPR ”.

• (4) In paragraph 18—

• (a) in sub-paragraphs (2)(b) and (6)(b), for “applied GDPR” substitute “ UK GDPR ”;

• (b) after sub-paragraph (7) insert—

(8) In this paragraph, references to the UK GDPR do not include the EU GDPR as it was directly applicable to the United Kingdom before IP completion day (see paragraph 2 of Schedule 21).

• (5) In paragraph 50, for “GDPR” substitute “ UK GDPR ”.

102

After Schedule 20 insert—

SCHEDULE 21 (1) In this Schedule, “the applied GDPR” means the EU GDPR as applied by Chapter 3 of Part 2 before IP completion day. (2) (1) On and after IP completion day, references in an enactment to the UK GDPR (including the reference in the definition of “the data protection legislation” in section 3(9)) include— (a) the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, read with Chapter 2 of Part 2 of this Act as it had effect before IP completion day, and (b) the applied GDPR, read with Chapter 3 of Part 2 of this Act as it had effect before IP completion day. (2) On and after IP completion day, references in an enactment to, or to a provision of, Chapter 2 of Part 2 of this Act (including general references to this Act or to Part 2 of this Act) include that Chapter or that provision as applied by Chapter 3 of Part 2 of this Act as it had effect before IP completion day. (3) Sub-paragraphs (1) and (2) have effect— (a) in relation to references in this Act, except as otherwise provided; (b) in relation to references in other enactments, unless the context otherwise requires. (3) (1) Anything done in connection with the EU GDPR as it was directly applicable to the United Kingdom before IP completion day, the applied GDPR or this Act— (a) if in force or effective immediately before IP completion day, continues to be in force or effective on and after IP completion day, and (b) if in the process of being done immediately before IP completion day, continues to be done on and after IP completion day. (2) References in this paragraph to anything done include references to anything omitted to be done. (4) (1) On and after IP completion day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes— (a) in the case of a third country, the country or a relevant territory or sector within the country, or (b) in the case of an international organisation, the organisation. (2) Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1). (3) The Secretary of State may by regulations— (a) repeal sub-paragraphs (1) and (2) and paragraph 5; (b) amend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph; (c) amend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2). (4) Regulations under this paragraph may, among other things—— (a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time; (b) confer a discretion on a person. (5) Regulations under this paragraph are subject to the negative resolution procedure. (6) Sub-paragraphs (1) and (2) have effect in addition to section 17A(2) and (3). (5) (1) The following are specified for the purposes of paragraph 4(1)— (a) an EEA state; (b) Gibraltar; (c) a Union institution, body, office or agency set up by, or on the basis of, the Treaty on the European Union, the Treaty on the Functioning of the European Union or the Euratom Treaty; (d) an equivalent institution, body, office or agency set up by, or on the basis of, the Treaties establishing the European Economic Area; (e) a third country which is the subject of a decision listed in sub-paragraph (2), other than a decision that, immediately before IP completion day, had been repealed or was suspended; (f) a third country, territory or sector within a third country or international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 45(3) of the EU GDPR, other than a decision that, immediately before IP completion day, had been repealed or was suspended. (2) The decisions mentioned in sub-paragraph (1)(e) are the following— (a) Commission Decision 2000/518/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland; (b) Commission Decision 2002/2/EC of 20th December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act; (c) Commission Decision 2003/490/EC of 30th June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina; (d) Commission Decision 2003/821/EC of 21st November 2003 on the adequate protection of personal data in Guernsey; (e) Commission Decision 2004/411/EC of 28th April 2004 on the adequate protection of personal data in the Isle of Man; (f) Commission Decision 2008/393/EC of 8th May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey; (g) Commission Decision 2010/146/EU of 5th March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data; (h) Commission Decision 2010/625/EU of 19th October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra; (i) Commission Decision 2011/61/EU of 31st January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data; (j) Commission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data; (k) Commission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand; (l) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . (m) Commission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information. (3) Where a decision described in sub-paragraph (1)(e) or (f) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 4(1). (4) The references to a decision in sub-paragraphs (1)(e) and (f) and (2) are to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (5) and (6). (5) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(e) or (f) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer. (6) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(e) or (f) relates to— (a) transfers from the European Union (or the European Community) or the European Economic Area, or (b) transfers to which the EU GDPR applies, it is to be treated as relating to equivalent transfers to or from the United Kingdom or transfers to which the UK GDPR applies (as appropriate). (6) (1) In the provisions listed in sub-paragraph (2)— (a) references to regulations made under section 17A (other than references to making such regulations) include the provision made in paragraph 5; (b) references to the revocation of such regulations include the repeal of all or part of paragraph 5. (2) Those provisions are— (a) Articles 13(1)(f), 14(1)(f), 45(1) and (7), 46(1) and 49(1) of the UK GDPR; (b) sections 17B(1), (3), (6) and (7) and 18(2) of this Act. UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses (7) (1) Subject to paragraph 8, the appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after IP completion day as described in this paragraph. (2) The safeguards may be provided for by any standard data protection clauses included in an arrangement which, if the arrangement had been entered into immediately before IP completion day, would have provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR. (3) The safeguards may be provided for by a version of standard data protection clauses described in sub-paragraph (2) incorporating changes where— (a) all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), and (b) none of the changes alters the effect of the clauses. (4) The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)— (a) changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule; (b) changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom. (5) In the case of a transfer of personal data made under arrangements entered into before IP completion day, the safeguards may be provided for on and after IP completion day by standard data protection clauses not falling within sub-paragraph (2) which— (a) formed part of the arrangements immediately before IP completion day, and (b) at that time, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR. (6) The Secretary of State and the Commissioner must keep the operation of this paragraph under review. (7) In this paragraph, “adequacy decision” means a decision made on the basis of— (a) Article 45(3) of the EU GDPR, or (b) Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. (8) This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR. (8) (1) Paragraph 7 does not apply to the extent that it has been disapplied by— (a) regulations made by the Secretary of State, or (b) a document issued by the Commissioner. (2) Regulations under this paragraph are subject to the negative resolution procedure. (3) Subsections (3) to (8) and (10) to (12) of section 119A apply in relation to a document issued by the Commissioner under this paragraph as they apply to a document issued by the Commissioner under section 119A(2). UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules (9) (1) The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after IP completion day as described sub-paragraphs (2) to (4), subject to sub-paragraph (5). (2) The safeguards may be provided for by any binding corporate rules authorised by the Commissioner which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR. (3) The safeguards may be provided for by a version of binding corporate rules described in sub-paragraph (2) incorporating changes where— (a) all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), and (b) none of the changes alters the effect of the rules. (4) The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)— (a) changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule; (b) changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom. (5) Sub-paragraphs (2) to (4) cease to apply in relation to binding corporate rules if, on or after IP completion day, the Commissioner withdraws the authorisation of the rules (or, where sub-paragraph (3) is relied on, the authorisation of the rules mentioned in sub-paragraph (2)). (5A) For the purposes of sub-paragraph (2), binding corporate rules which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR but which were authorised other than by the Commissioner are to be treated as authorised by the Commissioner where— (a) a valid notification of the rules has been made to the Commissioner, (b) the Commissioner has approved them, and (c) that approval has not been withdrawn. (5B) A notification is valid if it— (a) is made by a controller or processor established in the United Kingdom, (b) is made to the Commissioner before the end of the period of 6 months beginning with IP completion day, and (c) includes— (i) the name and contact details of the data protection officer or other contact point for the controller or processor, and (ii) such other information as the Commissioner may reasonably require. (5C) Where a valid notification is made the Commissioner must, without undue delay— (a) decide whether or not to approve the rules, and (b) notify the controller or processor of that decision. (6) The Commissioner must keep the operation of this paragraph under review. (7) In this paragraph— - “adequacy decision” means a decision made on the basis of— 1. Article 45(3) of the EU GDPR, or 2. Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; - “binding corporate rules” has the meaning given in Article 4(20) of the UK GDPR. (8) This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR. Part 3 (law enforcement processing): adequacy decisions and adequacy regulations (10) (1) On and after IP completion day, for the purposes of Part 3 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 11 specifies, or specifies a description which includes— (a) in the case of a third country, the country or a relevant territory or sector within the country, or (b) in the case of an international organisation, the organisation. (2) Sub-paragraph (1) has effect subject to provision in paragraph 11 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 11 for the purposes of sub-paragraph (1). (3) The Secretary of State may by regulations— (a) repeal sub-paragraphs (1) and (2) and paragraph 11; (b) amend paragraph 11 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph; (c) amend paragraph 11 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and by making provision described in sub-paragraph (2). (4) Regulations under this paragraph may, among other things— (a) identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time; (b) confer a discretion on a person. (5) Regulations under this paragraph are subject to the negative resolution procedure. (6) Sub-paragraphs (1) and (2) have effect in addition to section 74A(2) and (3). (11) (1) The following are specified for the purposes of paragraph 10(1)— (a) an EEA state; (aa) Switzerland; (b) Gibraltar; (c) a third country, a territory or sector within a third country or an international organisation which is the subject of an adequacy decision made by the European Commission before IP completion day on the basis of Article 36(3) of the Law Enforcement Directive, other than a decision that, immediately before IP completion day, had been repealed or was suspended. (2) Where a decision described in sub-paragraph (1)(c) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 10(1). (3) The reference to a decision in sub-paragraph (1)(c) is to the decision as it had effect in EU law immediately before IP completion day, subject to sub-paragraphs (4) and (5). (4) For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(c) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer. (5) For the purposes of this paragraph, where a decision described in sub-paragraph (1)(c) relates to— (a) transfers from the European Union (or the European Community) or the European Economic Area, or (b) transfers to which the Law Enforcement Directive applies, it is to be treated as relating to equivalent transfers from the United Kingdom or transfers to which Part 3 of this Act applies (as appropriate). (12) In section 74B(1), (3), (6) and (7)— (a) references to regulations made under section 74A (other than references to making such regulations) include the provision made in paragraph 11; (b) references to the revocation of such regulations include the repeal of all or part of paragraph 11. (13) (1) Regulations made under section 23 before IP completion day continue in force until they are revoked, despite the repeal of that section by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. (2) The provisions listed in section 186(3) include regulations made under section 23 before IP completion day (and not revoked). (3) Sub-paragraphs (1) and (2) do not have effect so far as otherwise provided by the law of England and Wales, Scotland or Northern Ireland. Applied GDPR: national security certificates (14) (1) This paragraph applies to a certificate issued under section 27 of this Act which has effect immediately before IP completion day. (2) A reference in the certificate to a provision of the applied GDPR has effect, on and after IP completion day, as it if were a reference to the corresponding provision of the UK GDPR or this Act. (15) The repeal of section 132(2)(d) by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 has effect only in relation to a disclosure of information made on or after IP completion day. (16) In relation to an infringement, before IP completion day, of a provision of the EU GDPR (as it was directly applicable to the United Kingdom) or the applied GDPR— (a) Article 83(5) and (6) of the UK GDPR and section 157(5)(a) and (b) of this Act have effect as if for “£17,500,000” there were substituted “ 20 million Euros ”; (b) Article 83(4) of the UK GDPR and section 157(6)(a) and (b) of this Act have effect as if for “£8,700,000” there were substituted “ 10 million Euros ”; (c) the maximum amount of a penalty in sterling must be determined by applying the spot rate of exchange set by the Bank of England on the day on which the penalty notice is given under section 155 of this Act. GDPR: right to an effective remedy against the Commissioner (17) (1) This paragraph applies where— (a) proceedings are brought against a decision made by the Commissioner before IP completion day, and (b) the Commissioner's decision was preceded by an opinion or decision of the European Data Protection Board in accordance with the consistency mechanism referred to in Article 63 of the EU GDPR. (2) The Commissioner must forward the Board's opinion or decision to the court or tribunal dealing with the proceedings.

SCHEDULE 3 — Consequential amendments of other legislation

PART 1 — Revocation of retained EU law

Revocation of Regulations and Decisions

1

The following Regulations and Decisions are revoked in so far as they are retained EU law—

• (a) Commission Decision 2000/518/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland;

• (aa) Commission Decision 2000/519/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Hungary;

• (b) Commission Decision 2001/497/EC of 15th June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC;

• (c) Commission Decision 2002/2/EC of 20th December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act;

• (d) Commission Decision 2003/490/EC of 30th June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina;

• (e) Commission Decision 2003/821/EC of 21st November 2003 on the adequate protection of personal data in Guernsey;

• (f) Commission Decision 2004/411/EC of 28th April 2004 on the adequate protection of personal data in the Isle of Man;

• (fa) Council Decision 2004/644/EC of 13th September 2004 adopting implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data;

• (g) Commission Decision 2004/915/EC of 27th December 2004 amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries;

• (h) Commission Decision 2008/393/EC of 8th May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey;

• (ha) Commission Decision 2008/597/EC of 3rd June 2008 adopting implementing rules concerning the Data Protection Officer pursuant to Article 24(8) of Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data;

• (i) Commission Decision 2010/87/EU of 5th February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council;

• (j) Commission Decision 2010/146/EU of 5th March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data;

• (k) Commission Decision 2010/625/EU of 19th October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra;

• (l) Commission Decision 2011/61/EU of 31st January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data;

• (m) Commission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data;

• (n) Commission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand;

• (o) Commission Implementing Decision (EU) 2016/1250 of 12th July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield;

• (p) Commission Implementing Decision (EU) 2016/2295 of 16th December 2016 amending Decisions 2000/518/EC, 2002/2/EC, 2003/490/EC, 2003/821/EC, 2004/411/EC, 2008/393/EC, 2010/146/EU, 2010/625/EU, 2011/61/EU and Implementing Decisions 2012/484/EU, 2013/65/EU on the adequate protection of personal data by certain countries, pursuant to Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council;

• (q) Commission Implementing Decision (EU) 2016/2297 of 16th December 2016 amending Decisions 2001/497/EC and 2010/87/EU on standard contractual clauses for the transfer of personal data to third countries and to processors established in such countries, under Directive 95/46/EC of the European Parliament and of the Council;

• (r) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23rd October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.

• (s) Commission Decision (EU) 2019/165 of 1st February 2019 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their data protection rights by the Commission in the context of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings;

• (t) Commission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information;

• (u) Regulation (EU, Euratom) 2019/493 of the European Parliament and of the Council of 25th March 2019 amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament.

Revocation of provisions of EEA agreement

2

Paragraphs 5e, 5ea, 5ed, 5ee, 5ef, 5eg, 5eh, 5ei, 5ek, 5el, 5em, 5en, 5eo, 5ep , 5eq, 5er and 5es of Annex 11 to the EEA agreement, as it forms part of the law of England and Wales, Scotland or Northern Ireland on and after IP completion day by virtue of section 3(1) of the European Union (Withdrawal) Act 2018, are revoked in so far as they are retained EU law.

PART 2 — Amendments of primary legislation

Consumer Credit Act 1974

3

The Consumer Credit Act 1974 is amended as follows.

4

In section 157(2A)(a) (duty to disclose name etc of agency), for “GDPR” substitute “ UK GDPR ”.

5

In section 159(1)(a) (correction of wrong information), for “GDPR” substitute “ UK GDPR ”.

6

In section 189(1) (definitions)—

• (a) omit the definition of “the GDPR”;

• (b) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

Pharmacy (Northern Ireland) Order 1976

7

In paragraph 2 of Schedule 3 to the Pharmacy (Northern Ireland) Order 1976 (fitness to practice: disclosure of information)—

• (a) in sub-paragraph (2)(a), for “GDPR” substitute “ UK GDPR ”;

• (b) for sub-paragraph (5) substitute—

(5) In this paragraph, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

Medical Act 1983

8

The Medical Act 1983 is amended as follows.

9

• (1) Section 29E (evidence) is amended as follows.

• (2) In subsection (5), for “GDPR” substitute “ UK GDPR ”.

• (3) In subsection (9), omit the definition of “the GDPR”.

10

• (1) Section 35A (General Medical Council's power to require disclosure of information) is amended as follows.

• (2) In subsection (4), for “GDPR” substitute “ UK GDPR ”.

• (3) In subsection (7), omit the definition of “the GDPR”.

11

In section 55(1) (interpretation), at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

12

In paragraph 9B of Schedule 1 (incidental powers of the General Medical Council)—

• (a) in sub-paragraph (2)(a), for “GDPR” substitute “ UK GDPR ”;

• (b) omit sub-paragraph (4).

13

In paragraph 5A of Schedule 4 (professional performance assessments and health assessments)—

• (a) in sub-paragraph (8), for “GDPR” substitute “ UK GDPR ”;

• (b) omit sub-paragraph (14).

Dentists Act 1984

14

The Dentists Act 1984 is amended as follows.

15

• (1) Section 33B (the General Dental Council's power to require disclosure of information: the dental profession) is amended as follows.

• (2) In subsection (3), for “GDPR” substitute “ UK GDPR ”.

• (3) In subsection (4), in the definition of “relevant provision of the GDPR”—

• (a) for “the GDPR” (in both places) substitute “ the UK GDPR ”;

• (b) for “GDPR provisions” substitute “ UK GDPR provisions ”.

• (4) Omit subsection (11).

16

• (1) Section 36Y (the General Dental Council's power to require disclosure of information: professions complementary to dentistry) is amended as follows.

• (2) In subsection (3), for “GDPR” substitute “ UK GDPR ”.

• (3) In subsection (4), in the definition of “relevant provision of the GDPR”—

• (a) for “the GDPR” (in both places) substitute “ the UK GDPR ”;

• (b) for “GDPR provisions” (in the second place) substitute “ UK GDPR provisions ”.

• (4) Omit subsection (11).

17

In section 53(1) (interpretation), at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

Opticians Act 1989

18

• (1) Section 13B of the Opticians Act 1989 (the Council's power to require disclosure of information) is amended as follows.

• (2) In subsection (3), for “GDPR” substitute “ UK GDPR ”.

• (3) For subsection (10) substitute—

(10) In this section, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

Immigration and Asylum Act 1999

19

• (1) Section 13 of the Immigration and Asylum Act 1999 (proof of identity of persons to be removed or deported) is amended as follows.

• (2) In subsection (4), for “GDPR” substitute “ UK GDPR ”.

• (3) For subsection (4A) substitute—

(4A) “The UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

Freedom of Information Act 2000

20

• (1) Section 40 of the Freedom of Information Act 2000 (personal information) is amended as follows.

• (2) In subsections (3B), (4A)(a) and (5B)(b) and (c), for “GDPR” substitute “ UK GDPR ”.

• (3) In subsection (7)—

• (a) in the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;

• (b) omit the words from “ “the GDPR”, “personal data”, “processing”” to the “(14) of that Act);”;

• (c) at the appropriate places insert—

“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

• (4) In subsection (8), for “GDPR” (in both places) substitute “ UK GDPR ”.

Health and Personal Social Services Act (Northern Ireland) 2001

21

• (1) Section 7A of the Health and Personal Social Services Act (Northern Ireland) 2001 (power to obtain information etc) is amended as follows.

• (2) In subsection (3), for “GDPR” substitute “ UK GDPR ”.

• (3) For subsection (8) substitute—

(8) In this section, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

Freedom of Information (Scotland) Act 2002

22

• (1) Section 38 of the Freedom of Information (Scotland) Act 2002 (personal information) is amended as follows.

• (2) In subsections (2B) and (3A)(a), for “GDPR” substitute “ UK GDPR ”.

• (3) In subsection (5)—

• (a) in the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;

• (b) omit the words from “ “the GDPR”, “personal data”, “processing”” to “(14) of that Act);”;

• (c) at the appropriate places insert—

“personal data” and “processing” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

• (4) In subsection (5A), for “GDPR” (in both places) substitute “ UK GDPR ”.

Mental Health (Care and Treatment) (Scotland) Act 2003

23

• (1) Section 279 of the Mental Health (Care and Treatment) (Scotland) Act 2003 (information for research) is amended as follows.

• (2) In subsection (2), for “GDPR” substitute “ UK GDPR ”.

• (3) For subsection (10) substitute—

(10) In this section, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

Crime and Courts Act 2013

24

• (1) Section 42 of the Crime and Courts Act 2013 (other interpretive provisions) is amended as follows.

• (2) In subsection (5)(a), for “GDPR” substitute “ UK GDPR ”.

• (3) For subsection (5A) substitute—

(5A) In subsection (5)(a), “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

Small Business, Enterprise and Employment Act 2015

25

• (1) Section 6 of the Small Business, Enterprise and Employment Act 2015 (application of listed provisions to designated credit reference agencies) is amended as follows.

• (2) In subsection (7)(b), for “GDPR” substitute “ UK GDPR ”.

• (3) For subsection (7A) substitute—

(7A) In subsection (7), “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

Social Security (Scotland) Act 2018

26

• (1) Section 60 of the Social Security (Scotland) Act 2018 (right to reports used in determining entitlement) is amended as follows.

• (2) In subsection (2), for “GDPR” substitute “ UK GDPR ”.

• (3) For subsection (3) substitute—

(3) In subsection (2), “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

PART 3 — Amendments of other legislation

Channel Tunnel (International Arrangements) Order 1993

27

• (1) Article 4 of the Channel Tunnel (International Arrangements) Order 1993 (application of enactments) is amended as follows.

• (2) In paragraph (2)—

• (a) after “For the purposes of” insert “ Article 3 of the UK GDPR and ”;

• (b) in the words following paragraph (c), after “establishment (and” insert “ the UK GDPR and ”.

• (3) In paragraph (3)—

• (a) after “For the purposes of” insert “ Article 3 of the UK GDPR and ”;

• (b) in the words following paragraph (b), after “establishment (and” insert “ the UK GDPR and ”.

• (4) After paragraph (3) insert—

(4) In this article, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

Channel Tunnel (Miscellaneous Provisions) Order 1994

28

• (1) Article 4 of the Channel Tunnel (Miscellaneous Provisions) Order 1994 (application of enactments) is amended as follows.

• (2) In paragraph (2)—

• (a) after “For the purposes of” insert “ Article 3 of the UK GDPR and ”;

• (b) for “the 2018 Act applies” substitute “ the UK GDPR and the 2018 Act apply ”.

• (3) In paragraph (3)—

• (a) after “For the purposes of” insert “ Article 3 of the UK GDPR and ”;

• (b) for “the 2018 Act does” substitute “ the UK GDPR and the 2018 Act do ”.

• (4) After paragraph (3) insert—

(4) In this article, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

Scottish Parliamentary Corporate Body (Crown Status) Order 1999

29

In article 7 of the Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (Data Protection Act 2018) —

• (a) in paragraph (2)(a), (d) and (e), for “GDPR” substitute “ UK GDPR ”;

• (b) omit paragraph (5).

Northern Ireland Assembly Commission (Crown Status) Order 1999

30

In article 9 of the Northern Ireland Assembly Commission (Crown Status) Order 1999 (Data Protection Act 2018) —

• (a) in paragraph (2)(a), (d) and (e), for “GDPR” substitute “ UK GDPR ”;

• (b) omit paragraph (5).

Representation of the People (England and Wales) Regulations 2001

31

The Representation of the People (England and Wales) Regulations 2001 are amended as follows.

32

• (1) Regulation 3(1) (interpretation) is amended as follows.

• (2) In the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “ the UK GDPR ”.

• (3) Omit the definition of “the GDPR”.

• (4) At the appropriate place insert—

“the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;

33

In regulation 92(2)(ba) (interpretation and application of Part VI etc), for “the GDPR” substitute “ the UK GDPR ”.

Representation of the People (Scotland) Regulations 2001

34

The Representation of the People (Scotland) Regulations 2001 are amended as follows.

35

• (1) Regulation 3(1) (interpretation) is amended as follows.

• (2) In the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “ the UK GDPR ”.

• (3) Omit the definition of “the GDPR”.

• (4) At the appropriate place insert—

“the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;

36

In regulation 92(2)(ba) (interpretation of Part VI etc), for “the GDPR” substitute “ the UK GDPR ”.

Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001

37

• (1) Regulation 9 of the Financial Services and Markets 2000 (Disclosure of Confidential Information) Regulations 2001 (disclosure by regulators or regulator workers to certain other persons) is amended as follows.

• (2) In paragraph (2B)(a), for “GDPR” substitute “ UK GDPR ”.

• (3) For paragraph (6) substitute—

(6) In this regulation, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

Nursing and Midwifery Order 2001

38

The Nursing and Midwifery Order 2001 is amended as follows.

39

• (1) Article 3 (the Nursing and Midwifery Council and its Committees) is amended as follows.

• (2) In paragraph (18), for “GDPR” substitute “ UK GDPR ”.

• (3) Omit paragraph (19).

40

• (1) Article 25 (the Council's power to require disclosure of information) is amended as follows.

• (2) In paragraph (3), for “GDPR” substitute “ UK GDPR ”.

• (3) In paragraph (6), omit the definition of “the GDPR”.

41

In article 40(6) (Directive 2005/36/EC: designation of competent authority etc), omit the definition of “the GDPR”.

42

In Schedule 4 (interpretation), at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

Electronic Commerce (EC Directive) Regulations 2002

43

• (1) Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002 (exclusions) is amended as follows.

• (2) In paragraph (1)(b), for “GDPR” substitute “ UK GDPR ”.

• (3) In paragraph (3)—

• (a) omit the definition of “the GDPR”;

• (b) at the appropriate place insert—

“the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;

Privacy and Electronic Communications (EC Directive) Regulations 2003

44

In regulation 2(1) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 , for “GDPR” substitute “ UK GDPR ”.

Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003

45

The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003 is amended as follows.

46

• (1) Article 8 (exercise of powers by French officers in a control zone in the United Kingdom: disapplication of law of England and Wales) is amended as follows.

• (2) In paragraph (2), for “The Data Protection Act 2018” substitute “The UK GDPR and the Data Protection Act 2018.

• (3) After paragraph (2) insert—

(2A) In paragraph (2), “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

47

• (1) Article 11 (exercise of powers by UK immigration officers and constables in a control zone in France: enactments having effect) is amended as follows.

• (2) In paragraph (4)—

• (a) for “The Data Protection Act 2018” substitute “ The UK GDPR and the Data Protection Act 2018 (“the 2018 Act”) ”;

• (b) for “section 207 of that Act” substitute “ Article 3 of the UK GDPR and section 207 of the 2018 Act ”.

• (3) After paragraph (4) insert—

(4A) In paragraph (4), “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

Pupils' Educational Records (Scotland) Regulations 2003

48

The Pupils' Educational Records (Scotland) Regulations 2003 are amended as follows.

49

In regulation 2 (interpretation)—

• (a) omit the definition of “the GDPR”;

• (b) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

50

In regulation 6(aa) and (ab) (circumstances where information should not be disclosed), for “GDPR” substitute “ UK GDPR ”.

51

In regulation 9(1A) (in both places) and (1B), for “GDPR” substitute “ UK GDPR ”.

Environmental Information Regulations 2004

52

The Environmental Information Regulations 2004 are amended as follows.

53

• (1) Regulation 2 (interpretation) is amended as follows.

• (2) In paragraph (1)—

• (a) in the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;

• (b) omit the words from “ “the GDPR”” to “(14) of that Act);”;

• (c) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

• (3) In paragraph (4A)—

• (a) after “references to” insert “ the UK GDPR and ”;

• (b) after “as if in” insert “ Article 2 of the UK GDPR and ”;

• (c) for “(other general processing)” substitute “ (exemptions for manual unstructured processing and for national security and defence purposes) ”.

54

In regulation 13 (personal data), in paragraphs (2B)(a), (3A)(a), (5B)(b) and (c) and (6) (in both places), for “GDPR” substitute “ UK GDPR ”.

Environmental Information (Scotland) Regulations 2004

55

The Environmental Information (Scotland) Regulations 2004 are amended as follows.

56

• (1) Regulation 2 (interpretation) is amended as follows.

• (2) In paragraph (1)—

• (a) in the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;

• (b) omit the words from “ “the GDPR”” to “(14) of that Act);”;

• (c) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

• (3) In paragraph (3A)—

• (a) after “references to” insert “ the UK GDPR and ”;

• (b) after “as if in” insert “ Article 2 of the UK GDPR and ”;

• (c) for “(other general processing)” substitute “ (exemptions for manual unstructured processing and for national security and defence purposes) ”.

57

In regulation 11 (personal data), in paragraphs (3B), (4A)(a) and (7) (in both places), for “GDPR” substitute “ UK GDPR ”.

Licensing Act 2003 (Personal Licences) Regulations 2005

58

• (1) Regulation 7 of the Licensing Act 2003 (Personal Licences) Regulations 2005 (application for grant of a personal licence) is amended as follows.

• (2) In paragraph (1)(b)(iii), for “GDPR” substitute “ UK GDPR ”.

• (3) For paragraph (3) substitute—

(3) In this regulation, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

Education (Pupil Information) (England) Regulations 2005

59

• (1) Regulation 5 of the Education (Pupil Information) (England) Regulations 2005 (disclosure of curricular and educational records) is amended as follows.

• (2) In paragraph (4), for “GDPR” (in both places) substitute “ UK GDPR ”.

• (3) For paragraph (7) substitute—

(7) In this regulation, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005

60

• (1) Regulation 45 of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (sensitive information) is amended as follows.

• (2) In paragraphs (1B)(a) and (1C)(a), for “GDPR” substitute “ UK GDPR ”.

• (3) In paragraph (1D)—

• (a) in the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;

• (b) omit the words from “ “the GDPR”” to “(14) of that Act);”;

• (c) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

• (4) In paragraph (1E), for “GDPR” (in both places) substitute “ UK GDPR ”.

Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005

61

• (1) Regulation 39 of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (sensitive information) is amended as follows.

• (2) In paragraphs (1B)(a) and (1C)(a), for “GDPR” substitute “ UK GDPR ”.

• (3) In paragraph (1D)—

• (a) in the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;

• (b) omit the words from “ “the GDPR”” to “(14) of that Act);”;

• (c) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

• (4) In paragraph (1E), for “GDPR” (in both places) substitute “ UK GDPR ”.

Register of Judgments, Orders and Fines Regulations 2005

62

In regulation 3 of the Register of Judgments, Orders and Fines Regulations 2005 (interpretation) —

• (a) in the definition of “the data protection principles”, for “GDPR” substitute “ UK GDPR ”;

• (b) omit the definition of “the GDPR”;

• (c) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

National Assembly for Wales (Representation of the People) Order 2007

63

• (1) Paragraph 14 of Schedule 1 to the National Assembly for Wales (Representation of the People) Order 2007 (absent voting at Assembly elections: conditions on the use, supply and inspection of absent vote records or lists) is amended as follows.

• (2) In sub-paragraph (1)(a), for “GDPR” substitute “ UK GDPR ”.

• (3) For sub-paragraph (2) substitute—

(2) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

National Assembly for Wales Commission (Crown Status) Order 2007

64

In article 5 of the National Assembly for Wales Commission (Crown Status) Order 2007 (Data Protection Act 2018) —

• (a) in paragraph (2)(a), (d) and (e), for “GDPR” substitute “ UK GDPR ”;

• (b) omit paragraph (5).

Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007

65

• (1) Regulation 18 of the Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (conditions on the supply and inspection of absent voter records or lists) is amended as follows.

• (2) In paragraph (1)(a), for “GDPR” substitute “ UK GDPR ”.

• (3) For paragraph (2) substitute—

(2) In this regulation, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007

66

• (1) Regulation 5 of the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (conditions on the use, supply and disclosure of documents open to public inspection) is amended as follows.

• (2) In paragraph (2)(i), for “GDPR” substitute “ UK GDPR ”.

• (3) For paragraph (4) substitute—

(4) In this regulation, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007

67

The Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007 are amended as follows.

68

In regulation 2 (interpretation)—

• (a) omit the definition of “the GDPR”;

• (b) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

69

In regulation 10(2) (duties of Boards of Governors), for “GDPR” substitute “ UK GDPR ”.

Representation of the People (Northern Ireland) Regulations 2008

70

• (1) Regulation 118 of the Representation of the People (Northern Ireland) Regulations 2008 (conditions on the use, supply and disclosure of documents open to public inspection) is amended as follows.

• (2) In paragraph (2), for “GDPR” substitute “ UK GDPR ”.

• (3) For paragraph (4) substitute—

(4) In this regulation, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008

71

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

72

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

73

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

74

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

75

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008

76

• (1) Regulation 5 of the Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (information whose disclosure would be affected by the application of other legislation) is amended as follows.

• (2) In paragraph (3B)(a), for “GDPR” substitute “ UK GDPR ”.

• (3) In paragraph (5)—

• (a) in the definition of “data protection principles”, for “GDPR” substitute “ UK GDPR ”;

• (b) omit the definition of “the GDPR”;

• (c) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

INSPIRE Regulations 2009

77

• (1) Regulation 9 of the INSPIRE Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows.

• (2) In paragraph (2)(b), for “GDPR” substitute “ UK GDPR ”.

• (3) In paragraph (8)—

• (a) in the definition of “data protection principles”, for “GDPR” substitute “ UK GDPR ”;

• (b) omit the definition of “the GDPR”;

• (c) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

• (4) In paragraph (9), for “GDPR” (in both places) substitute “ UK GDPR ”.

INSPIRE (Scotland) Regulations 2009

78

• (1) Regulation 10 of the INSPIRE (Scotland) Regulations 2009 (public access to spatial data sets and spatial data services) is amended as follows.

• (2) In paragraph (2)(b), for “GDPR” substitute “ UK GDPR ”.

• (3) In paragraph (7)—

• (a) in the definition of “data protection principles”, for “GDPR” substitute “ UK GDPR ”;

• (b) omit the definition of “the GDPR”;

• (c) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

• (4) In paragraph (8), for “GDPR” (in both places) substitute “ UK GDPR ”.

Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009

79

The Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009 are amended as follows.

80

In regulation 2(2) (interpretation)—

• (a) omit the words from “ “the GDPR”” to “(14) of that Act);”;

• (b) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

81

In regulation 25(7) (duty to co-operate by disclosing information as regards relevant persons), for “GDPR” substitute “ UK GDPR ”.

82

In regulation 26(6) (responsible bodies requesting additional information be disclosed about relevant persons), for “GDPR” substitute “ UK GDPR ”.

83

In regulation 29(3) (occurrence reports), for “GDPR” substitute “ UK GDPR ”.

Pharmacy Order 2010

84

The Pharmacy Order 2010 is amended as follows.

85

In article 3(1) (interpretation), at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

86

In article 9(5) (inspection and enforcement), for “and references to Schedule 2 to the Data Protection Act 2018 have” substitute “ has ”.

87

• (1) Article 49 (disclosure of information: general) is amended as follows.

• (2) In paragraph (2)(a), for “GDPR” substitute “ UK GDPR ”.

• (3) Omit paragraph (6).

88

• (1) Article 55 (professional performance assessments) is amended as follows.

• (2) In paragraph (5)(a), for “GDPR” substitute “ UK GDPR ”.

• (3) Omit paragraph (9).

Local Elections (Northern Ireland) Order 2010

89

In paragraph 1(1) of Schedule 3 to the Local Elections (Northern Ireland) Order 2010 (access to marked registers and other documents open to public inspection after an election) —

• (a) in the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “ the UK GDPR ”;

• (b) omit the definition of “the GDPR”;

• (c) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

Pupil Information (Wales) Regulations 2011

90

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

91

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Police and Crime Commissioner Elections Order 2012

92

The Police and Crime Commissioner Elections Order 2012 is amended as follows.

93

• (1) Schedule 2 (absent voting in Police and Crime Commissioner elections) is amended as follows.

• (2) In paragraph 20 (absent voter lists: supply of copies etc)—

• (a) in sub-paragraph (8)(a), for “GDPR” substitute “ UK GDPR ”;

• (b) for sub-paragraph (11) substitute—

(11) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

• (3) In paragraph 24 (restriction on use of absent voter records or lists or the information contained in them)—

• (a) in sub-paragraph (3)(a), for “GDPR” substitute “ UK GDPR ”;

• (b) for sub-paragraph (4) substitute—

(4) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

94

• (1) Schedule 10 (access to marked registers and other documents open to public inspection after an election) is amended as follows.

• (2) In paragraph 5 (restriction on use of absent voter records or lists or the information contained in them)—

• (a) in sub-paragraph (3)(a), for “GDPR” substitute “ UK GDPR ”;

• (b) for sub-paragraph (5) substitute—

(5) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

Neighbourhood Planning (Referendums) Regulations 2012

95

In paragraph 29(1) of Schedule 6 to the Neighbourhood Planning (Referendums) Regulations 2012 (interpretation of Part 8) —

• (a) in the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “ the UK GDPR ”;

• (b) omit the definition of “the GDPR”;

• (c) in the definition of “relevant requirement”, for “the GDPR” substitute “ the UK GDPR ”;

• (d) at the appropriate place insert—

“the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;

Controlled Drugs (Supervision of Management and Use) Regulations 2013

96

• (1) Regulation 20 of the Controlled Drugs (Supervision of Management and Use) Regulations 2013 (information management) is amended as follows.

• (2) In paragraph (5), for “GDPR” (in both places) substitute “ UK GDPR ”.

• (3) For paragraph (7) substitute—

(7) In this regulation, “personal data” and “the UK GDPR” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (10) and (14) of that Act).

Small and Medium Sized Business (Credit Information) Regulations 2015

97

• (1) Regulation 15 of the Small and Medium Sized Business (Credit Information) Regulations 2015 (access to and correction of information for individuals and small firms) is amended as follows.

• (2) In paragraph (1), for “GDPR” substitute “ UK GDPR ”.

• (3) Omit paragraph (4).

Scottish Parliament (Elections etc) Order 2015

98

The Scottish Parliament (Elections etc) Order 2015 is amended as follows.

99

• (1) Schedule 3 (absent voting) is amended as follows.

• (2) In paragraph 16 (absent voting lists: supply of copies etc)—

• (a) in sub-paragraph (4)(a), for “GDPR” substitute “ UK GDPR ”;

• (b) for sub-paragraph (11) substitute—

(11) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

• (3) In paragraph 20 (restriction on use of absent voting lists)—

• (a) in sub-paragraph (3)(a), for “GDPR” substitute “ UK GDPR ”;

• (b) for sub-paragraph (4) substitute—

(4) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

100

In Schedule 8 (access to marked registers and other documents open to public inspection after an election), in paragraph 5 (restriction on use of documents)—

• (a) in sub-paragraph (3)(a), for “GDPR” substitute “ UK GDPR ”;

• (b) for sub-paragraph (5) substitute—

(5) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

Electronic Identification and Trust Services for Electronic Transactions Regulations 2016

101

In Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (Information Commissioner's enforcement powers) , in paragraph 16(a) and (b) (modification of section 159 of the Data Protection Act 2018), for “GDPR” substitute “ UK GDPR ”.

Court Files Privileged Access Rules (Northern Ireland) 2016

102

The Court Files Privileged Access Rules (Northern Ireland) 2016 are amended as follows.

103

In rule 2 (interpretation), at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

104

In rule 5(a) (information that may be released), for “GDPR” substitute “ UK GDPR ”.

105

In rule 7(2)(a) (provision of information), for “GDPR” substitute “ UK GDPR ”.

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017

106

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 are amended as follows.

107

In regulation 3(1) (interpretation)—

• (a) omit the words from “ “the GDPR” to “(14) of that Act);”;

• (b) at the appropriate place insert—

“the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);

108

In regulation 16(8)(b) (risk assessment by the Treasury and Home Office), for “GDPR” substitute “ UK GDPR ”.

109

In regulation 17(9)(b) (risk assessment by supervisory authorities), for “GDPR” substitute “ UK GDPR ”.

110

In regulation 41 (data protection), in paragraphs (3)(a), (6), (7), (8) and (9), for “GDPR” substitute “ UK GDPR ”.

PART 4 — Modification

References to the GDPR

111

• (1) Legislation described in sub-paragraph (2) has effect on and after IP completion day as if it were modified in accordance with sub-paragraphs (3) and (4) (but see sub-paragraph (5)).

• (2) That legislation is—

• (a) subordinate legislation made on or before IP completion day;

• (b) primary legislation passed or made on or before IP completion day”.

• (3) The following have effect as references to the UK GDPR—

• (a) references to the GDPR as defined in section 3(10) of the 2018 Act or as defined for the purposes of Parts 5 to 7 of the 2018 Act;

• (b) other references to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

• (4) References described in sub-paragraph (3) which are references to the GDPR or the Regulation read with Chapter 2 of Part 2 of the 2018 Act have effect as references to the UK GDPR read with Part 2 of that Act.

• (5) Sub-paragraphs (1) to (4) have effect unless the context otherwise requires and, in particular, do not affect references to the Regulation mentioned in sub-paragraph (3)(b) as it has effect in EU law.

• (6) Paragraph 2 of Schedule 21 to the 2018 Act (inserted by these Regulations) has effect in relation to references to the UK GDPR arising as a result of this paragraph as it has effect in relation of other references to the UK GDPR.

• (7) In this paragraph—

• “primary legislation” has the meaning given in section 211 of the 2018 Act;

• “references” includes any references, however expressed;

• “subordinate legislation” has the meaning given in the Interpretation Act 1978.

PART 5 — Supplementary

Interpretation of references to enactments

112

Nothing in Parts 2 to 4 of this Schedule is to be read as implying anything about whether references to an enactment or statutory provision (whether in Acts or instruments amended by those Parts of this Schedule or elsewhere) include the UK GDPR or other assimilated direct legislation.

SCHEDULE 4 — Amendments consequential on provisions of the 2018 Act

Anti-terrorism, Crime and Security Act 2001

1

• (1) Part 1 of Schedule 4 to the Anti-terrorism, Crime and Security Act 2001 (extension of existing disclosure powers) is amended as follows.

• (2) Omit paragraph 42.

• (3) After paragraph 53F insert—

(53G) Section 132(1) of the Data Protection Act 2018.

Investigatory Powers Act 2016

2

In section 202(4) of the Investigatory Powers Act 2016 (restriction on use of class BDP warrants) , in the definition of “sensitive personal data”, for “section 2(a) to (f) of the Data Protection Act 1998” substitute “ section 86(7)(a) to (e) of the Data Protection Act 2018 ”.

Data Protection Act 2018

3

In Schedule 19 to the Data Protection Act 2018 (minor and consequential amendments) , omit paragraphs 76 and 201.

Signed

We consent to the making of these Regulations

Paul Maynard — Jeremy Quin — Two of the Lords Commissioners of Her Majesty's Treasury — 2019-02-27

Margot James — Minister of State — 2019-02-28

Explanatory note

(This note is not part of the Regulations)

Footnotes

[^f00001]: 2018 c. 16.

[^f00002]: 2018 c. 12.

[^f00003]: 1972. c. 68. Section 2 was amended by section 27(1)(a) of the Legislative and Regulatory Reform Act 2006 (c.51) and Part 1 of the Schedule to the European Union (Amendment) Act 2008 (c. 7).

[^f00004]: S.I. 2003/2426.

[^f00005]: These regulations make a further amendment to this provision (see Sch. 3, para. 3).

[^f00006]: OJ L 281, 23.11.1995, p31-50.

[^f00007]: OJ L 178, 17/07/2000, p1-16.

[^f00008]: S.I. 2002/2013.

[^f00009]: Section 17A is inserted into the 2018 Act by these Regulations (see Sch. 2, para. 23).

[^f00010]: OJ L 201, 31.7.2002, p37-47.

[^f00011]: Such domestic legislation includes the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426) (“PECR”) and the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (S.I. 2000/2699) (as amended by PECR).

[^f00012]: Section 17B is inserted into the 2018 Act by these Regulations (see Sch. 2, para. 23).

[^f00013]: Section 17C is inserted into the 2018 Act by these Regulations (see Sch. 2, para. 23).

[^f00014]: Section 119A is inserted into the 2018 Act by these Regulations (see Sch. 2, para. 51).

[^f00015]: The definition of the EU GDPR is inserted into section 3 of the 2018 Act by these Regulations (see Sch. 2, para. 4(5)).

[^f00016]: Section 205(4) is inserted into the 2018 Act by these Regulations (see Sch. 2, para. 85(7)).

[^f00017]: OJ L 215, 25.8.2000, p. 1-3.

[^f00018]: OJ L 2, 4.1.2002, p. 13-16.

[^f00019]: OJ L 168, 05.07.2003, p. 19-22.

[^f00020]: OJ L 308, 25.11.2003 p. 27-28.

[^f00021]: OJ L 151, 30.4.2004. , p. 48-51.

[^f00022]: OJ L 138, 28.5.2008, p. 21-23.

[^f00023]: OJ L 58, 9.3.2010, p. 17-19.

[^f00024]: OJ L 277, 21.10.2010, p. 27-29.

[^f00025]: OJ L 27, 1.2.2011, p. 39-42

[^f00026]: OJ L 227, 23.8.2012, p. 11-14.

[^f00027]: OJ L 28, 30.1.2013, p. 12-14.

[^f00028]: OJ L 207, 1.8.2016, p. 1-112.

[^f00029]: OJ L 181, 4.7.2001, p. 19-31.

[^f00030]: OJ L 385, 29.12.2004, p. 74-84.

[^f00031]: OJ L 39, 12.2.2010, p. 5-18.

[^f00032]: OJ L 344, 17.12.2016, p. 83-91.

[^f00033]: OJ L 344, 17.12.2016, p. 100-101.

[^f00034]: 1974 c. 39.

[^f00035]: S.I. 1976/1213 (N.I. 22)

[^f00036]: 1983 c. 54.

[^f00037]: 1984 c. 24.

[^f00038]: 1989 c. 44.

[^f00039]: 1999 c. 33.

[^f00040]: 2000 c. 36.

[^f00041]: 2001 c.3 (N.I.).

[^f00042]: 2002 asp 13.

[^f00043]: 2003 asp 13.

[^f00044]: 2013 c. 22.