The Privacy and Electronic Communications (EC Directive) Regulations 2003

• (i) automatically authenticating the identity of the subscriber or user, or

• (ii) maintaining a record of selections made on a website, or information put into a website, by the subscriber or user.

Collecting information for statistical purposes

5

• (1) Regulation 6(1) does not prevent a person storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user if—

• (a) the person provides an information society service,

• (b) the sole purpose of the storage or access is to enable the person—

• (i) to collect information for statistical purposes about how the service is used with a view to making improvements to the service, or

• (ii) to collect information for statistical purposes about how a website by means of which the service is provided is used with a view to making improvements to the website,

• (c) any information that the storage or access enables the person to collect is not shared with any other person except for the purpose of enabling that other person to assist with making improvements to the service or website,

• (d) the subscriber or user is provided with clear and comprehensive information about the purpose of the storage or access, and

• (e) the subscriber or user is given a simple means of objecting, free of charge, to the storage or access and does not object.

• (2) In sub-paragraph (1), the reference to gaining access to information stored in the terminal equipment of a subscriber or user does not include a reference to collecting or monitoring information automatically emitted by the terminal equipment.

• (3) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user for the same purpose on more than one occasion, it is sufficient that the requirements of sub-paragraph (1)(d) and (e) are met in respect of the initial use.

Website appearance etc

6

• (1) Regulation 6(1) does not prevent a person storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user if—

• (a) the person provides an information society service by means of a website,

• (b) the sole purpose of the storage or access is—

• (i) to enable the way the website appears or functions when displayed on, or accessed by, the terminal equipment to adapt to the preferences of the subscriber or user, or

• (ii) to otherwise enable an enhancement of the appearance or functionality of the website when displayed on, or accessed by, the terminal equipment,

• (c) the subscriber or user is provided with clear and comprehensive information about the purpose of the storage or access, and

• (d) the subscriber or user is given a simple means of objecting, free of charge, to the storage or access and does not object.

• (2) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user for the same purpose on more than one occasion, it is sufficient that the requirements of sub-paragraph (1)(c) and (d) are met in respect of the initial use.

Emergency assistance

7

Regulation 6(1) does not prevent a person storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user if—

• (a) the person receives a communication from the terminal equipment,

• (b) the communication is a request from the subscriber or user for emergency assistance or otherwise indicates that the subscriber or user is in need of emergency assistance, and

• (c) the sole purpose of the storage or access is to enable the geographical position of the subscriber or user to be ascertained with a view to the emergency assistance being provided.

Provisions applied for enforcement purposes

General modification of references to the Data Protection Act 2018

Modification of section 142 (information notices)

Modification of section 143 (information notices: restrictions)

Modification of section 145 (information orders)

Modification of section 146 (assessment notices)

Modification of section 146A (assessment notices: approval of person to prepare report)

Modification of section 147 (assessment notices: restrictions)

Modification of section 148A (interview notices)

Modification of section 148B (interview notices: restrictions)

Modification of section 149 (enforcement notices)

Modification of section 150 (enforcement notices: supplementary)

Modification of section 152 (enforcement notices: restrictions)

Modification of Schedule 15 (powers of entry and inspection)

14

• (1) Schedule 15 has effect as if paragraph 3 were omitted.

• (2) Paragraph 1(1) of that Schedule (issue of warrants in connection with non-compliance and offences) has effect as if for paragraph (a) (but not the final “and”) there were substituted—

(a) there are reasonable grounds for suspecting that— (i) a person has failed or is failing to comply with a requirement of the PEC Regulations, or (ii) an offence under section 144, 148, or 148C or paragraph 15 of this Schedule has been or is being committed,

• (3) Paragraph 2 of that Schedule (issue of warrants in connection with assessment notices) has effect as if—

• (a) in sub-paragraphs (1) and (2), for “controller or processor” there were substituted “person”;

• (b) in sub-paragraph (2), for “the data protection legislation” there were substituted “the PEC Regulations”.

• (4) Paragraph 5 of that Schedule (content of warrants) has effect as if—

• (a) in sub-paragraph (1)(c), for “the processing of personal data” there were substituted “an activity regulated by the PEC Regulations”;

• (b) in sub-paragraph (2)(d), for the words from “controller or processor” to the end there were substituted “person mentioned in paragraph 1(1)(a) has failed or is failing to comply with a requirement of the PEC Regulations”;

• (c) in sub-paragraph (3)(a) and (d)—

• (i) for “controller or processor” there were substituted “person mentioned in paragraph 2(1)”;

• (ii) for “the data protection legislation” there were substituted “the requirements of the PEC Regulations”.

• (5) Paragraph 11 of that Schedule (privileged communications) has effect as if, in sub-paragraphs (1)(b) and (2)(b), for “the data protection legislation” there were substituted “the PEC Regulations”.

Modification of section 155 (penalty notices)

15

Section 155 has effect as if—

• (a) in subsection (1)—

• (i) in paragraph (a), for “as described in section 149(2), (3), (4), (5) or (5A)” there were substituted “to comply with a requirement of the PEC Regulations”;

• (ii) after paragraph (c), there were inserted

, or (d) has failed to comply with the prohibition in section 142(8B),

• (b) after subsection (1) there were inserted—

(1A) But the Commissioner may not give a penalty notice to a person in respect of a failure to comply with regulation 5A of the PEC Regulations.

• (c) for subsection (2) there were substituted—

(2) When deciding whether to give a penalty notice to a person and determining the amount of the penalty, the Commission must have regard to the matters listed in subsection (3), so far as relevant.

• (d) in subsection (3)—

• (i) for “the controller or processor” (in each place) there were substituted “the person”;

• (ii) in paragraph (c), for the words from “data subjects” to the end there were substituted “subscribers or users”;

• (iii) in paragraph (d), for the words “in accordance with section 57, 66, 103 or 107” there were substituted “with a view to securing compliance with the requirements of the PEC Regulations”;

• (iv) paragraph (g) were omitted;

• (v) in paragraph (j), the words “or certification mechanism” were omitted;

• (e) subsection (4) were omitted;

• (f) after subsection (4) there were inserted—

(4A) If a penalty notice is given to a body in respect of a failure to comply with any of regulations 19 to 24 of the PEC Regulations, the Commissioner may also give a penalty notice to an officer of the body if the Commissioner is satisfied that the failure— (a) took place with the consent or connivance of the officer, or (b) was attributable to any neglect on the part of the officer. (4B) In subsection (4A)— - “body” means a body corporate or a Scottish partnership; - “officer”, in relation to a body, means—in relation to a body corporate—a director, manager, secretary or other similar officer of the body or any person purporting to act in such capacity, andwhere the affairs of the body are managed by its members, a member; orin relation to a Scottish partnership, a partner or any person purporting to act as a partner.

• (g) subsections (6) to (8) were omitted.

Modification of Schedule 16 (penalties)

16

Schedule 16 has effect as if paragraphs 3(2)(b) and 5(2)(b) were omitted.

Modification of section 156 (penalty notices: restrictions)

17

• (1) Section 156 has effect as if subsections (1), (2), (4)(b) and (5) were omitted.

• (2) In that section, subsection (3) has effect as if for the words from “controller” to “determined by or” there were substituted “penalty notice to a person who acts”.

Modification of section 157 (maximum amount of penalty)

18

Section 157 has effect as if—

• (a) subsection (1) were omitted;

• (b) in subsection (2)—

• (i) for “Part 3 of this Act” there were substituted “the PEC Regulations”;

• (ii) in paragraph (a), for the words from “section 35” to “or 78” there were substituted “regulation 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23 , 24 or 32B(4) or (5)”;

• (c) subsections (3) and (4A) were omitted;

• (d) after subsection (4A) there were inserted—

(4B) In relation to an infringement of section 142(8B) of this Act, the maximum amount of the penalty that may be imposed by a penalty notice is the higher maximum amount.

Modification of section 159 (amount of penalties: supplementary)

19

Section 159 has effect as if—

• (a) in subsection (1), the words “Article 83 of the UK GDPR and” were omitted;

• (b) in subsection (2), the words “Article 83 of the UK GDPR,” and “and section 158” were omitted.

Modification of section 160 (guidance)

20

Section 160 has effect as if, in subsection (4)(f), for “controllers and processors” there were substituted “persons”.

Modification of section 162 (rights of appeal)

21

Section 162 has effect as if subsection (4) were omitted.

Modification of section 163 (determination of appeals)

22

Section 163 has effect as if subsection (6) were omitted.

Modification of section 180 (jurisdiction)

23

• (1) Section 180 has effect as if subsections (2)(b), (c), (d) and (e) and (3) were omitted.

• (2) Subsection (1) of that section has effect as if for “subsections (3) and (4)” there were substituted “subsection (4)”.

Modification of section 181 (interpretation of Part 6)

24

Section 181 has effect as if the definition of “certification provider” were omitted.

Modification of section 182 (regulations and consultation)

25

• (1) Section 182 has effect as if subsections (3), (6), (8), (11), (12) and (14) were omitted.

• (2) Subsection (13) of that section has effect as if for “provision comes into force” there were substituted “coming into force of section 115 of the Data (Use and Access) Act 2025”.

Modification of section 196 (penalties for offences)

26

• (1) Section 196 has effect as if subsections (3) to (5) were omitted.

• (2) In that section—

• (a) subsection (1) has effect as if the words “section 119 or 173 or” were omitted;

• (b) subsection (2) has effect as if for “section 132, 144, 148, 148C, 170, 171 or 184” there were substituted “section 144, 148 or 148C”.

Modification of section 200 (guidance about PACE codes of practice)

27

Section 200 has effect as if, in subsection (1), for “this Act” there were substituted “section 144, 148 and 148C and paragraph 15 of Schedule 15”.

Modification of section 202 (proceedings in the First-tier Tribunal: contempt)

28

Section 202 has effect as if, in subsection (1)(a), for sub-paragraphs (i) and (ii) there were substituted “on an appeal under section 162”.

Modification of section 203 (tribunal procedure rules)

29

Section 203 has effect as if—

• (a) in subsection (1), for paragraphs (a) and (b) there were substituted “the exercise of the rights of appeal conferred by section 162”;

• (b) in subsection (2)—

• (i) in paragraph (a), for “the processing of personal data” there were substituted “any activity regulated by the PEC Regulations”;

• (ii) in paragraph (b), for “the processing of personal data” there were substituted “any such activity”.

Interpretation

30

In this Schedule, “the PEC Regulations” means these Regulations.