Data Protection Act 2018 (c. 12)

SCHEDULES

SCHEDULE 6 U.K. The applied GDPR and the applied Chapter 2

PART 1 U.K. Modifications to the GDPR

Chapter V of the GDPR (transfers of data to third countries or international organisations) U.K.

35 U.K. In Article 45 (transfers on the basis of an adequacy decision)—

(a) in paragraph 1, after “decided” insert “ in accordance with Article 45 of the GDPR ”;

(b) after paragraph 1 insert—

“1A But a transfer of personal data to a third country or international organisation must not take place under paragraph 1, if the Commission's decision in relation to the third country (including a territory or sector within it) or the international organisation—

(a) is suspended,

(b) has been amended, or

(c) has been repealed,

by the Commission under Article 45(5) of the GDPR.”;

(c) omit paragraphs 2 to 8;

(d) in paragraph 9, for “of this Article” substitute “ of Article 45 of the GDPR ”.

Commencement Information

I1 Sch. 6 para. 35 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

36 U.K. In Article 46 (transfers subject to appropriate safeguards)—

(a) in paragraph 1, for “Article 45(3)” substitute “ Article 45(3) of the GDPR ”;

(b) in paragraph 2, omit point (c);

(c) in paragraph 2, in point (d), omit “and approved by the Commission pursuant to the examination procedure referred to in Article 93(2)”;

(d) omit paragraph 4;

(e) in paragraph 5—

(i) in the first sentence, for “a Member State or supervisory authority” substitute “ the Commissioner ”;

(ii) in the second sentence, for “this Article” substitute “ Article 46 of the GDPR ”.

Commencement Information

I2 Sch. 6 para. 36 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

37 U.K. In Article 47 (binding corporate rules)—

(a) in paragraph 1, in the first sentence, omit “in accordance with the consistency mechanism set out in Article 63”;

(b) in paragraph 2, in point (e), for “the competent courts of the Member States” substitute “ a court ”;

(c) in paragraph 2, in point (f), for “on the territory of a Member State” substitute “ in the United Kingdom ”;

(d) omit paragraph 3.

Commencement Information

I3 Sch. 6 para. 37 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

38 U.K. In Article 49 (derogations for specific situations)—

(a) in paragraph 1, in the first sentence—

(i) for “Article 45(3)” substitute “ Article 45(3) of the GDPR ”;

(ii) for “Article 46” substitute “ Article 46 of this Regulation ”;

(b) in paragraph 4, for “Union law or in the law of the Member State to which the controller is subject” substitute “ domestic law (see section 18 of the 2018 Act which makes certain provision about the public interest) ”;

(c) for paragraph 5 substitute—

“5 Paragraph 1 is subject to any regulations made under section 18(2) of the 2018 Act.”

Commencement Information

I4 Sch. 6 para. 38 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)

39 U.K. In Article 50 (international co-operation for the protection of personal data), omit “the Commission and”.

Commencement Information

I5 Sch. 6 para. 39 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)