The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

Made: 28th February 2019

Coming into force in accordance with regulation 1(2) and (3)

The Secretary of State makes these Regulations in exercise of the powers conferred by sections 8(1) and 23(1) of, paragraph 1(1) of Schedule 4 to and paragraph 21 of Schedule 7 to the European Union (Withdrawal) Act 2018 , section 211(2) of the Data Protection Act 2018 and section 2(2) of the European Communities Act 1972 .

In accordance with paragraph 3(1) of Schedule 4 to the European Union (Withdrawal) Act 2018, these Regulations are made with the consent of the Treasury.

The Secretary of State is a Minister designated for purposes of section 2(2) of the European Communities Act 1972 in respect of matters relating to electronic communications.

In accordance with paragraphs 1(1) and 12(1) of Schedule 7 to the European Union (Withdrawal) Act 2018, section 211(5) of the Data Protection Act 2018 and paragraph 2(2) of Schedule 2 to the European Communities Act 1972 a draft of this instrument has been laid before, and approved by a resolution of, each House of Parliament.

Citation, commencement and extent

1

• (1) These Regulations may be cited as the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

• (2) Subject to paragraph (3), they come into force on exit day.

• (3) Regulations 7 and 8 and Schedule 4 come into force on 29th March 2019.

• (4) An amendment, repeal or revocation made by these Regulations has the same extent in the United Kingdom as the provision to which it relates.

Interpretation

2

In these Regulations—

• “the 2018 Act” means the Data Protection Act 2018;

• “the UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.

Amendment of the UK GDPR

3

Schedule 1 amends the UK GDPR.

Amendment of the Data Protection Act 2018

4

Schedule 2 amends the 2018 Act.

GDPR merger modifications

5

• (1) Schedules 1 and 2 include modifications (“the GDPR merger modifications”) that merge the provisions relating to the processing of personal data that, immediately before IP completion day, are found in the EU GDPR and the applied GDPR, read with the 2018 Act.

• (2) Assimilated case law falling within paragraph (3) is not, by virtue of the GDPR merger modifications, to be treated as relevant to the UK GDPR or the 2018 Act as they apply to applied GDPR processing on and after IP completion day.

• (3) Assimilated case law falls within this paragraph so far as it is, or is derived from, principles or decisions that are not relevant to any of the following immediately before IP completion day—

• (a) the applied GDPR,

• (b) the applied Chapter 2, or

• (c) Parts 5 to 7 of the 2018 Act so far as they apply to applied GDPR processing,

having regard (among other things) to the limits of EU competence immediately before IP completion day.

• (4) In this regulation—

• “the applied Chapter 2” means Chapter 2 of Part 2 of the 2018 Act as applied by Chapter 3 of that Part immediately before IP completion day (see section 22 of that Act);

• “the applied GDPR” means the EU GDPR as applied by Chapter 3 of Part 2 of the 2018 Act as it has effect immediately before IP completion day (see section 22 of that Act);

• “applied GDPR processing” means the processing of personal data to which the applied GDPR applied immediately before IP completion day (see section 21 of the 2018 Act);

• “assimilated case law” has the same meaning as in the European Union (Withdrawal) Act 2018 (see section 6(7) of that Act);

• “the EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law immediately before IP completion day .

• ...

Consequential amendments of other legislation

6

In Schedule 3—

• (a) Part 1 revokes certain retained EU law;

• (b) Part 2 contains amendments of primary legislation (as defined in section 211(7) of the 2018 Act) that are consequential on Schedules 1 and 2;

• (c) Part 3 contains amendments of other legislation that are consequential on those Schedules;

• (d) Part 4 contains modifications of legislation that are consequential on those Schedules;

• (e) Part 5 contains supplementary provision.

Amendments consequential on provisions of the 2018 Act

7

Schedule 4 contains amendments consequential on provisions of the 2018 Act.

Amendment of the Privacy and Electronic Communications Regulations 2003

8

• (1) Regulation 2 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 is amended as follows.

• (2) In paragraph (1), at the appropriate place, insert—

“consent” by a user or subscriber corresponds to the data subject's consent in the GDPR (as defined in section 3(10) of the Data Protection Act 2018);

• (3) Omit paragraph (3).

SCHEDULE 1 — Amendments of the UK GDPR

Introduction

1

The UK GDPR is amended as follows.

2

In the title of the Regulation, for “, and repealing Directive 95/46/EC (General Data Protection Regulation)” substitute “(United Kingdom General Data Protection Regulation)”.

Chapter 1 (general provisions)

3

In Article 1, omit paragraph 3.

4

• (1) Article 2 is amended as follows.

• (2) For paragraph 1 substitute—

(1) This Regulation applies to the automated or structured processing of personal data, including— (a) processing in the course of an activity which, immediately before IP completion day, fell outside the scope of EU law, and (b) processing in the course of an activity which, immediately before IP completion day, fell within the scope of Chapter 2 of Title 5 of the Treaty on European Union (common foreign and security policy activities). (1A) This Regulation also applies to the manual unstructured processing of personal data held by an FOI public authority.

• (3) For paragraph 2 substitute—

(2) This Regulation does not apply to— (a) the processing of personal data by an individual in the course of a purely personal or household activity; (b) the processing of personal data by a competent authority for any of the law enforcement purposes (see Part 3 of the 2018 Act); (c) the processing of personal data to which Part 4 of the 2018 Act (intelligence services processing) applies.

• (4) Omit paragraph 3.

• (5) In paragraph 4, for “Directive 2000/31/EC” to the end substitute “the Electronic Commerce (EC Directive) Regulations 2002 , in particular the provisions about mere conduits, caching and hosting (see regulations 17 to 19 of those Regulations).”.

• (6) After paragraph 4 insert—

(5) In this Article— (a) ‘the automated or structured processing of personal data’ means— (i) the processing of personal data wholly or partly by automated means, and (ii) the processing otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system; (b) ‘the manual unstructured processing of personal data’ means the processing of personal data which is not the automated or structured processing of personal data; (c) ‘FOI public authority’ has the same meaning as in Chapter 3 of Part 2 of the 2018 Act (see section 21(5) of that Act); (d) references to personal data ‘held’ by an FOI public authority are to be interpreted in accordance with section 21(6) and (7) of the 2018 Act; (e) ‘competent authority’ and ‘law enforcement purposes’ have the same meaning as in Part 3 of the 2018 Act (see sections 30 and 31 of that Act).

5

• (1) Article 3 is amended as follows.

• (2) In paragraph 1, for “the Union” (in both places) substitute “ the United Kingdom ”.

• (3) In paragraph 2—

• (a) before “processing” (in the first place) insert “ relevant ”;

• (b) for “the Union” (in each place) substitute “ the United Kingdom ”.

• (4) After paragraph 2 insert—

(2A) In paragraph 2, “relevant processing of personal data” means processing to which this Regulation applies, other than processing described in Article 2(1)(a) or (b) or (1A).

• (5) In paragraph 3—

• (a) for “the Union” substitute “ the United Kingdom ”;

• (b) for “Member State law” substitute “ domestic law ”.

6

• (1) Article 4 is amended as follows.

• (2) Before paragraph (1) insert—

(A1) ‘the 2018 Act’ means the Data Protection Act 2018; (A2) ‘domestic law’ means the law of the United Kingdom or of a part of the United Kingdom; (A3) ‘the Commissioner’ means the Information Commissioner (see section 114 of the 2018 Act);

• (3) In paragraph (7), for “; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law” substitute “ (but see section 6 of the 2018 Act) ”.

• (4) In paragraph (9), for “Union or Member State law” substitute “ domestic law ”.

• (5) After paragraph (10) insert—

(10A) ‘public authority’ and ‘public body’ are to be interpreted in accordance with section 7 of the 2018 Act and provision made under that section;

• (6) Omit paragraph (16).

• (7) In paragraph (17), for “the Union” substitute “ the United Kingdom ”.

• (8) In paragraph (20), for “on the territory of a Member State” substitute “ in the United Kingdom ”.

• (9) Omit paragraph (21).

• (10) After paragraph (21) insert—

(21A) ‘foreign designated authority’ means an authority designated for the purposes of Article 13 of the Data Protection Convention (as defined in section 3 of the 2018 Act) by a party, other than the United Kingdom, which is bound by that Convention;

• (11) Omit paragraphs (22), (23) and (24).

• (12) In paragraph (25), at the end insert “as it has effect immediately before IP completion day”.

• (13) After paragraph (26) insert—

(27) ‘third country’ means a country or territory outside the United Kingdom; (28) references to a fundamental right or fundamental freedom (however expressed) are to a fundamental right or fundamental freedom which continues to form part of domestic law on and after IP completion day by virtue of section 4 of the European Union (Withdrawal) Act 2018, as the right or freedom is amended or otherwise modified by domestic law from time to time on or after IP completion day.

Chapter 2 (principles)

7

• (1) Article 6 is amended as follows.

• (2) Omit paragraph 2.

• (3) In paragraph 3—

• (a) in the first subparagraph, for points (a) and (b) (and the colon before them) substitute “ domestic law ”;

• (b) in the second subparagraph, for “The Union or Member State law” substitute “ The domestic law ”.

• (4) In paragraph 4—

• (a) for “a Union or Member State law” substitute “ domestic law ”;

• (b) after “safeguard” insert “ national security, defence or any of ”.

8

• (1) Article 8 is amended as follows.

• (2) In paragraph 1—

• (a) for “16 years old” substitute “ 13 years old ”;

• (b) for “of 16 years” substitute “ of 13 years ”;

• (c) omit the second subparagraph.

• (3) In paragraph 3, for “of Member States” substitute “ as it operates in domestic law ”.

• (4) After paragraph 3 insert—

(4) In paragraph 1, the reference to information society services does not include preventive or counselling services.

9

• (1) Article 9 is amended as follows.

• (2) In paragraph 2(a), for “Union or Member State law provide” substitute “ domestic law provides ”.

• (3) In paragraph 2(b)—

• (a) for “Union or Member State law” substitute “ domestic law ”;

• (b) for “to Member State law” substitute “ to domestic law ”.

• (4) In paragraph 2(g), for “Union or Member State law” substitute “ domestic law ”.

• (5) In paragraph 2(h), for “Union or Member State law” substitute “ domestic law ”.

• (6) In paragraph 2(i), for “Union or Member State law” substitute “ domestic law ”.

• (7) paragraph 2(j)—

• (a) after “Article 89(1)” insert “ (as supplemented by section 19 of the 2018 Act) ”;

• (b) for “Union or Member State law” substitute “ domestic law ”.

• (8) In paragraph 3, for “Union or Member State law” (in both places) substitute “ domestic law ”.

• (9) After that paragraph insert—

(3A) In paragraph 3, ‘national competent bodies’ means competent bodies of the United Kingdom or a part of the United Kingdom.

• (10) Omit paragraph 4.

• (11) After that paragraph insert—

(5) In the 2018 Act— (a) section 10 makes provision about when the requirement in paragraph 2(b), (g), (h), (i) or (j) of this Article for authorisation by, or a basis in, domestic law is met; (b) section 11(1) makes provision about when the processing of personal data is carried out in circumstances described in paragraph 3 of this Article.

10

• (1) Article 10 is amended as follows.

• (2) The existing text becomes paragraph 1.

• (3) In that paragraph, for “Union or Member State law” substitute “ domestic law ”.

• (4) After that paragraph insert—

(2) In the 2018 Act— (a) section 10 makes provision about when the requirement in paragraph 1 of this Article for authorisation by domestic law is met; (b) section 11(2) makes provision about the meaning of “personal data relating to criminal convictions and offences or related security measures”.

Chapter 3 (rights of the data subject)

11

• (1) Article 12 is amended as follows.

• (2) In paragraph 4, for “a supervisory authority” substitute “ the Commissioner ”.

• (3) After paragraph 6 insert—

(6A) The Commissioner may publish (and amend or withdraw)— (a) standardised icons for use in combination with information provided to data subjects under Articles 13 and 14; (b) a notice stating that other persons may publish (and amend or withdraw) such icons, provided that the icons satisfy requirements specified in the notice as to the information to be presented by the icons and the procedures for providing the icons. (6B) The Commissioner must not publish icons or a notice under paragraph 6A unless satisfied (as appropriate) that the icons give a meaningful overview of the intended processing in an easily visible, intelligible and clearly legible manner or that the notice will result in icons that do so.

• (4) In paragraph 7—

• (a) for “The information” substitute “ If standardised icons are published as described in paragraph 6A (and not withdrawn), the information ”;

• (b) for “standardised” to “processing” substitute “ the icons ”.

• (5) Omit paragraph 8.

12

• (1) Article 13 is amended as follows.

• (2) In paragraph 1(f), for “an adequacy decision by the Commission” substitute “ relevant adequacy regulations under section 17A of the 2018 Act ”.

• (3) In paragraph 2(d), for “a supervisory authority” substitute “ the Commissioner ”.

13

• (1) Article 14 is amended as follows.

• (2) In paragraph 1(f), for “an adequacy decision by the Commission” substitute “ relevant adequacy regulations under section 17A of the 2018 Act ”.

• (3) In paragraph 2(e), for “a supervisory authority” substitute “ the Commissioner ”.

• (4) In paragraph 5(c), for “Union or Member State law to which the controller is subject and” substitute “ a provision of domestic law ”.

• (5) In paragraph 5(d), for “Union or Member State law” substitute “ domestic law ”.

14

In Article 15(1)(f), for “a supervisory authority” substitute “ the Commissioner ”.

15

• (1) Article 17 is amended as follows.

• (2) In paragraph 1(e), for “in Union or Member State law to which the controller is subject” substitute “ under domestic law ”.

• (3) In paragraph 3(b), for “by Union or Member State law to which the controller is subject” substitute “ under domestic law ”.

16

In Article 18(2), omit “of the Union or of a Member State”.

17

In Article 21(5)—

• (a) omit “and notwithstanding Directive 2002/58/EC ,”;

• (b) at the end insert “ , notwithstanding domestic law made before IP completion day implementing Directive 2002/58/EC of the European Parliament and of the Council of 12th July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector ” .

18

• (1) Article 22 is amended as follows.

• (2) In paragraph 2(b), for “authorised by Union or Member State law to which the controller is subject and” substitute “ required or authorised by domestic law ”.