358(1)Schedule 2A (Directive 2005/36/EC: European professional card) is amended as follows.
(2)In paragraph 8(1) (access to data), for “Directive 95/46/EC)” substitute “the GDPR”.
(3)In paragraph 9 (processing data)—
(a)omit sub-paragraph (2) (deeming the Council to be the controller for the purposes of Directive 95/46/EC), and
(b)after sub-paragraph (2) insert—
“(3)In this paragraph, “personal data” has the same meaning as in the Data Protection Act 2018 (see section 3(2) of that Act).”