The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

PART 3 Amendments of other legislation

Channel Tunnel (International Arrangements) Order 1993

27.—(1) Article 4 of the Channel Tunnel (International Arrangements) Order 1993 (application of enactments)(1) is amended as follows.

(2) In paragraph (2)—

(a) after “For the purposes of” insert “Article 3 of the UK GDPR and”;

(b) in the words following paragraph (c), after “establishment (and” insert “the UK GDPR and”.

(3) In paragraph (3)—

(a) after “For the purposes of” insert “Article 3 of the UK GDPR and”;

(b) in the words following paragraph (b), after “establishment (and” insert “the UK GDPR and”.

(4) After paragraph (3) insert—

“(4) In this article, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”.

Channel Tunnel (Miscellaneous Provisions) Order 1994

28.—(1) Article 4 of the Channel Tunnel (Miscellaneous Provisions) Order 1994 (application of enactments)(2) is amended as follows.

(2) In paragraph (2)—

(a) after “For the purposes of” insert “Article 3 of the UK GDPR and”;

(b) for “the 2018 Act applies” substitute “the UK GDPR and the 2018 Act apply”.

(3) In paragraph (3)—

(a) after “For the purposes of” insert “Article 3 of the UK GDPR and”;

(b) for “the 2018 Act does” substitute “the UK GDPR and the 2018 Act do”.

(4) After paragraph (3) insert—

“(4) In this article, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”.

Scottish Parliamentary Corporate Body (Crown Status) Order 1999

29.  In article 7 of the Scottish Parliamentary Corporate Body (Crown Status) Order 1999 (Data Protection Act 2018)(3)—

(a) in paragraph (2)(a), (d) and (e), for “GDPR” substitute “UK GDPR”;

(b) omit paragraph (5).

Northern Ireland Assembly Commission (Crown Status) Order 1999

30.  In article 9 of the Northern Ireland Assembly Commission (Crown Status) Order 1999 (Data Protection Act 2018)(4)—

(a) in paragraph (2)(a), (d) and (e), for “GDPR” substitute “UK GDPR”;

(b) omit paragraph (5).

Representation of the People (England and Wales) Regulations 2001

31.  The Representation of the People (England and Wales) Regulations 2001(5) are amended as follows.

32.—(1) Regulation 3(1) (interpretation) is amended as follows.

(2) In the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “the UK GDPR”.

(3) Omit the definition of “the GDPR”.

(4) At the appropriate place insert—

““the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;”.

33.  In regulation 92(2)(ba) (interpretation and application of Part VI etc), for “the GDPR” substitute “the UK GDPR”.

Representation of the People (Scotland) Regulations 2001

34.  The Representation of the People (Scotland) Regulations 2001(6) are amended as follows.

35.—(1) Regulation 3(1) (interpretation) is amended as follows.

(2) In the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “the UK GDPR”.

(3) Omit the definition of “the GDPR”.

(4) At the appropriate place insert—

““the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;”.

36.  In regulation 92(2)(ba) (interpretation of Part VI etc), for “the GDPR” substitute “the UK GDPR”.

Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001

37.—(1) Article 9 of the Financial Services and Markets 2000 (Disclosure of Confidential Information) Regulations 2001 (disclosure by regulators or regulator workers to certain other persons)(7) is amended as follows.

(2) In paragraph (2B)(a), for “GDPR” substitute “UK GDPR”.

(3) For paragraph (6) substitute—

“(6) In this article, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).”.

Nursing and Midwifery Order 2001

38.  The Nursing and Midwifery Order 2001(8) is amended as follows.

39.—(1) Article 3 (the Nursing and Midwifery Council and its Committees) is amended as follows.

(2) In paragraph (18), for “GDPR” substitute “UK GDPR”.

(3) Omit paragraph (19).

40.—(1) Article 25 (the Council’s power to require disclosure of information) is amended as follows.

(2) In paragraph (3), for “GDPR” substitute “UK GDPR”.

(3) In paragraph (6), omit the definition of “the GDPR”.

41.  In article 40(6) (Directive 2005/36/EC: designation of competent authority etc), omit the definition of “the GDPR”.

42.  In Schedule 4 (interpretation), at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

Electronic Commerce (EC Directive) Regulations 2002

43.—(1) Regulation 3 of the Electronic Commerce (EC Directive) Regulations 2002 (exclusions)(9) is amended as follows.

(2) In paragraph (1)(b), for “GDPR” substitute “UK GDPR”.

(3) In paragraph (3)—

(a) omit the definition of “the GDPR”;

(b) at the appropriate place insert—

““the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;”.

Privacy and Electronic Communications (EC Directive) Regulations 2003

44.  In regulation 2(1) of the Privacy and Electronic Communications (EC Directive) Regulations 2003(10), for “GDPR” substitute “UK GDPR”.

Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003

45.  The Nationality, Immigration and Asylum Act 2002 (Juxtaposed Controls) Order 2003(11) is amended as follows.

46.—(1) Article 8 (exercise of powers by French officers in a control zone in the United Kingdom: disapplication of law of England and Wales) is amended as follows.

(2) In paragraph (2), for “The Data Protection Act 2018” substitute “The UK GDPR and the Data Protection Act 2018.

(3) After paragraph (2) insert—

“(2A) In paragraph (2), “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”.

47.—(1) Article 11 (exercise of powers by UK immigration officers and constables in a control zone in France: enactments having effect) is amended as follows.

(2) In paragraph (4)—

(a) for “The Data Protection Act 2018” substitute “The UK GDPR and the Data Protection Act 2018 (“the 2018 Act”)”;

(b) for “section 207 of that Act” substitute “Article 3 of the UK GDPR and section 207 of the 2018 Act”.

(3) After paragraph (4) insert—

“(4A) In paragraph (4), “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”.

Pupils’ Educational Records (Scotland) Regulations 2003

48.  The Pupils’ Educational Records (Scotland) Regulations 2003(12) are amended as follows.

49.  In regulation 2 (interpretation)—

(a) omit the definition of “the GDPR”;

(b) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

50.  In regulation 6(aa) and (ab) (circumstances where information should not be disclosed), for “GDPR” substitute “UK GDPR”.

51.  In regulation 9(1A) (in both places) and (1B), for “GDPR” substitute “UK GDPR”.

Environmental Information Regulations 2004

52.  The Environmental Information Regulations 2004(13) are amended as follows.

53.—(1) Regulation 2 (interpretation) is amended as follows.

(2) In paragraph (1)—

(a) in the definition of “the data protection principles”, for “GDPR” substitute “UK GDPR”;

(b) omit the words from ““the GDPR”” to “(14) of that Act);”;

(c) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

(3) In paragraph (4A)—

(a) after “references to” insert “the UK GDPR and”;

(b) after “as if in” insert “Article 2 of the UK GDPR and”;

(c) for “(other general processing)” substitute “(exemptions for manual unstructured processing and for national security and defence purposes)”.

54.  In regulation 13 (personal data), in paragraphs (2B)(a), (3A)(a), (5B)(b) and (c) and (6) (in both places), for “GDPR” substitute “UK GDPR”.

Environmental Information (Scotland) Regulations 2004

55.  The Environmental Information (Scotland) Regulations 2004(14) are amended as follows.

56.—(1) Regulation 2 (interpretation) is amended as follows.

(2) In paragraph (1)—

(a) in the definition of “the data protection principles”, for “GDPR” substitute “UK GDPR”;

(b) omit the words from ““the GDPR”” to “(14) of that Act);”;

(c) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

(3) In paragraph (3A)—

(a) after “references to” insert “the UK GDPR and”;

(b) after “as if in” insert “Article 2 of the UK GDPR and”;

(c) for “(other general processing)” substitute “(exemptions for manual unstructured processing and for national security and defence purposes)”.

57.  In regulation 11 (personal data), in paragraphs (3B), (4A)(a) and (7) (in both places), for “GDPR” substitute “UK GDPR”.

Licensing Act 2003 (Personal Licences) Regulations 2005

58.—(1) Regulation 7 of the Licensing Act 2003 (Personal Licences) Regulations 2005 (application for grant of a personal licence)(15) is amended as follows.

(2) In paragraph (1)(b)(iii), for “GDPR” substitute “UK GDPR”.

(3) For paragraph (3) substitute—

“(3) In this regulation, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).”.

Education (Pupil Information) (England) Regulations 2005

59.—(1) Regulation 5 of the Education (Pupil Information) (England) Regulations 2005 (disclosure of curricular and educational records)(16) is amended as follows.

(2) In paragraph (4), for “GDPR” (in both places) substitute “UK GDPR”.

(3) For paragraph (7) substitute—

“(7) In this regulation, “the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).”.

Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005

60.—(1) Regulation 45 of the Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005 (sensitive information)(17) is amended as follows.

(2) In paragraphs (1B)(a) and (1C)(a), for “GDPR” substitute “UK GDPR”.

(3) In paragraph (1D)—

(a) in the definition of “the data protection principles”, for “GDPR” substitute “UK GDPR”;

(b) omit the words from ““the GDPR”” to “(14) of that Act);”;

(c) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

(4) In paragraph (1E), for “GDPR” (in both places) substitute “UK GDPR”.

Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005

61.—(1) Regulation 39 of the Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 (sensitive information)(18) is amended as follows.

(2) In paragraphs (1B)(a) and (1C)(a), for “GDPR” substitute “UK GDPR”.

(3) In paragraph (1D)—

(a) in the definition of “the data protection principles”, for “GDPR” substitute “UK GDPR”;

(b) omit the words from ““the GDPR”” to “(14) of that Act);”;

(c) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

(4) In paragraph (1E), for “GDPR” (in both places) substitute “UK GDPR”.

Register of Judgments, Orders and Fines Regulations 2005

62.  In regulation 3 of the Register of Judgments, Orders and Fines Regulations 2005 (interpretation)(19)—

(a) in the definition of “the data protection principles”, for “GDPR” substitute “UK GDPR”;

(b) omit the definition of “the GDPR”;

(c) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

National Assembly for Wales (Representation of the People) Order 2007

63.—(1) Paragraph 14 of Schedule 1 to the National Assembly for Wales (Representation of the People) Order 2007 (absent voting at Assembly elections: conditions on the use, supply and inspection of absent vote records or lists)(20) is amended as follows.

(2) In sub-paragraph (1)(a), for “GDPR” substitute “UK GDPR”.

(3) For sub-paragraph (2) substitute—

“(2) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”.

National Assembly for Wales Commission (Crown Status) Order 2007

64.  In article 5 of the National Assembly for Wales Commission (Crown Status) Order 2007 (Data Protection Act 2018)(21)—

(a) in paragraph (2)(a), (d) and (e), for “GDPR” substitute “UK GDPR”;

(b) omit paragraph (5).

Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007

65.—(1) Regulation 18 of the Representation of the People (Absent Voting at Local Elections) (Scotland) Regulations 2007 (conditions on the supply and inspection of absent voter records or lists)(22) is amended as follows.

(2) In paragraph (1)(a), for “GDPR” substitute “UK GDPR”.

(3) For paragraph (2) substitute—

“(2) In this regulation, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”.

Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007

66.—(1) Regulation 5 of the Representation of the People (Post-Local Government Elections Supply and Inspection of Documents) (Scotland) Regulations 2007 (conditions on the use, supply and disclosure of documents open to public inspection)(23) is amended as follows.

(2) In paragraph (2)(i), for “GDPR” substitute “UK GDPR”.

(3) For paragraph (4) substitute—

“(4) In this regulation, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”.

Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007

67.  The Education (Pupil Records and Reporting) (Transitional) Regulations (Northern Ireland) 2007(24) are amended as follows.

68.  In regulation 2 (interpretation)—

(a) omit the definition of “the GDPR”;

(b) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

69.  In regulation 10(2) (duties of Boards of Governors), for “GDPR” substitute “UK GDPR”.

Representation of the People (Northern Ireland) Regulations 2008

70.—(1) Regulation 118 of the Representation of the People (Northern Ireland) Regulations 2008 (conditions on the use, supply and disclosure of documents open to public inspection)(25) is amended as follows.

(2) In paragraph (2), for “GDPR” substitute “UK GDPR”.

(3) For paragraph (4) substitute—

“(4) In this regulation, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”.

Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008

71.  The Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008(26) are amended as follows.

72.—(1) Regulation 2(1) (interpretation) is amended as follows.

(2) In the English language text—

(a) omit the words from ““the GDPR”” to “(14) of that Act);”;

(b) at the appropriate place insert—

““the UK GDPR” (“GDPR y DU”) has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

(3) In the Welsh language text—

(a) omit the words from “mae i “y GDPR”” to “(14) o’r Ddeddf honno);”;

(b) at the appropriate place insert—

““mae i “GDPR y DU” yr un ystyr ag a roddir i honno yn Rhannau 5 i 7 o’r Ddeddf Diogelu Data 2018 (gweler adran 3(10) a (14) o’r Ddeddf honno);”.

73.  In regulation 25(7) (duty to co-operate by disclosing information as regards relevant persons)—

(a) in the English language text, for “GDPR” substitute “UK GDPR”;

(b) in the Welsh language text, for “neu’r GDPR” substitute “neu GDPR y DU”.

74.  In regulation 26(6) (responsible bodies requesting additional information be disclosed about relevant persons) —

(a) in the English language text, for “GDPR” substitute “UK GDPR”;

(b) in the Welsh language text, for “neu’r GDPR” substitute “neu GDPR y DU”.

75.  In regulation 29(3) (occurrence reports) —

(a) in the English language text, for “GDPR” substitute “UK GDPR”;

(b) in the Welsh language text, for “neu’r GDPR” substitute “neu GDPR y DU”.

Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008

76.—(1) Regulation 5 of the Energy Order 2003 (Supply of Information) Regulations (Northern Ireland) 2008 (information whose disclosure would be affected by the application of other legislation)(27) is amended as follows.

(2) In paragraph (3B)(a), for “GDPR” substitute “UK GDPR”.

(3) In paragraph (5)—

(a) in the definition of “data protection principles”, for “GDPR” substitute “UK GDPR”;

(b) omit the definition of “the GDPR”;

(c) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

INSPIRE Regulations 2009

77.—(1) Regulation 9 of the INSPIRE Regulations 2009 (public access to spatial data sets and spatial data services)(28) is amended as follows.

(2) In paragraph (2)(b), for “GDPR” substitute “UK GDPR”.

(3) In paragraph (8)—

(a) in the definition of “data protection principles”, for “GDPR” substitute “UK GDPR”;

(b) omit the definition of “the GDPR”;

(c) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

(4) In paragraph (9), for “GDPR” (in both places) substitute “UK GDPR”.

INSPIRE (Scotland) Regulations 2009

78.—(1) Regulation 10 of the INSPIRE (Scotland) Regulations 2009 (public access to spatial data sets and spatial data services)(29) is amended as follows.

(2) In paragraph (2)(b), for “GDPR” substitute “UK GDPR”.

(3) In paragraph (7)—

(a) in the definition of “data protection principles”, for “GDPR” substitute “UK GDPR”;

(b) omit the definition of “the GDPR”;

(c) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

(4) In paragraph (8), for “GDPR” (in both places) substitute “UK GDPR”.

Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009

79.  The Controlled Drugs (Supervision of Management and Use) Regulations (Northern Ireland) 2009(30) are amended as follows.

80.  In regulation 2(2) (interpretation)—

(a) omit the words from ““the GDPR”” to “(14) of that Act);”;

(b) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

81.  In regulation 25(7) (duty to co-operate by disclosing information as regards relevant persons), for “GDPR” substitute “UK GDPR”.

82.  In regulation 26(6) (responsible bodies requesting additional information be disclosed about relevant persons), for “GDPR” substitute “UK GDPR”.

83.  In regulation 29(3) (occurrence reports), for “GDPR” substitute “UK GDPR”.

Pharmacy Order 2010

84.  The Pharmacy Order 2010(31) is amended as follows.

85.  In article 3(1) (interpretation), at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

86.  In article 9(5) (inspection and enforcement), for “and references to Schedule 2 to the Data Protection Act 2018 have” substitute “has”.

87.—(1) Article 49 (disclosure of information: general) is amended as follows.

(2) In paragraph (2)(a), for “GDPR” substitute “UK GDPR”.

(3) Omit paragraph (6).

88.—(1) Article 55 (professional performance assessments) is amended as follows.

(2) In paragraph (5)(a), for “GDPR” substitute “UK GDPR”.

(3) Omit paragraph (9).

Local Elections (Northern Ireland) Order 2010

89.  In paragraph 1(1) of Schedule 3 to the Local Elections (Northern Ireland) Order 2010 (access to marked registers and other documents open to public inspection after an election)(32)—

(a) in the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “the UK GDPR”;

(b) omit the definition of “the GDPR”;

(c) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

Pupil Information (Wales) Regulations 2011

90.  Regulation 5 of the Pupil Information (Wales) Regulations 2011 (duties of head teacher - educational records)(33) is amended as follows.

91.—(1) In paragraph (5)(a) and (b) —

(a) in the English language text, for “GDPR” substitute “UK GDPR”;

(b) in the Welsh language text, for “neu’r GDPR” substitute “neu GDPR y DU”.

(2) For paragraph (6)—

(a) in the English language text substitute—

“(6) In this regulation, “the UK GDPR” (“GDPR y DU”) has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).”;

(b) in the Welsh language text substitute—

“(6) Yn y rheoliad hwn mae i “GDPR y DU” yr un ystyr ag a roddir i honno yn Rhannau 5 i 7 o’r Ddeddf Diogelu Data 2018 (gweler adran 3(10) a (14) o’r Ddeddf honno).”.

Police and Crime Commissioner Elections Order 2012

92.  The Police and Crime Commissioner Elections Order 2012(34) is amended as follows.

93.—(1) Schedule 2 (absent voting in Police and Crime Commissioner elections) is amended as follows.

(2) In paragraph 20 (absent voter lists: supply of copies etc)—

(a) in sub-paragraph (8)(a), for “GDPR” substitute “UK GDPR”;

(b) for sub-paragraph (11) substitute—

“(11) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”.

(3) In paragraph 24 (restriction on use of absent voter records or lists or the information contained in them)—

(a) in sub-paragraph (3)(a), for “GDPR” substitute “UK GDPR”;

(b) for sub-paragraph (4) substitute—

“(4) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”.

94.—(1) Schedule 10 (access to marked registers and other documents open to public inspection after an election) is amended as follows.

(2) In paragraph 5 (restriction on use of absent voter records or lists or the information contained in them)—

(a) in sub-paragraph (3)(a), for “GDPR” substitute “UK GDPR”;

(b) for sub-paragraph (5) substitute—

“(5) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”.

Neighbourhood Planning (Referendums) Regulations 2012

95.  In paragraph 29(1) of Schedule 6 to the Neighbourhood Planning (Referendums) Regulations 2012 (interpretation of Part 8)(35)—

(a) in the definition of “Article 89 GDPR purposes”, for “the GDPR” substitute “the UK GDPR”;

(b) omit the definition of “the GDPR”;

(c) in the definition of “relevant requirement”, for “the GDPR” substitute “the UK GDPR”;

(d) at the appropriate place insert—

““the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018;”.

Controlled Drugs (Supervision of Management and Use) Regulations 2013

96.—(1) Regulation 20 of the Controlled Drugs (Supervision of Management and Use) Regulations 2013 (information management)(36) is amended as follows.

(2) In paragraph (5), for “GDPR” (in both places) substitute “UK GDPR”.

(3) For paragraph (7) substitute—

“(7) In this regulation, “personal data” and “the UK GDPR” have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (10) and (14) of that Act).”.

Small and Medium Sized Business (Credit Information) Regulations 2015

97.—(1) Regulation 15 of the Small and Medium Sized Business (Credit Information) Regulations 2015 (access to and correction of information for individuals and small firms)(37) is amended as follows.

(2) In paragraph (1), for “GDPR” substitute “UK GDPR”.

(3) Omit paragraph (4).

Scottish Parliament (Elections etc) Order 2015

98.  The Scottish Parliament (Elections etc) Order 2015(38) is amended as follows.

99.—(1) Schedule 3 (absent voting) is amended as follows.

(2) In paragraph 16 (absent voting lists: supply of copies etc)—

(a) in sub-paragraph (4)(a), for “GDPR” substitute “UK GDPR”;

(b) for sub-paragraph (11) substitute—

“(11) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”

(3) In paragraph 20 (restriction on use of absent voting lists)—

(a) in sub-paragraph (3)(a), for “GDPR” substitute “UK GDPR”;

(b) for sub-paragraph (4) substitute—

“(4) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”

100.  In Schedule 8 (access to marked registers and other documents open to public inspection after an election), in paragraph 5 (restriction on use of documents)—

(a) in sub-paragraph (3)(a), for “GDPR” substitute “UK GDPR”;

(b) for sub-paragraph (5) substitute—

“(5) In this paragraph, “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.”

Electronic Identification and Trust Services for Electronic Transactions Regulations 2016

101.  In Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (Information Commissioner’s enforcement powers)(39), in paragraph 16(a) and (b) (modification of section 159 of the Data Protection Act 2018), for “GDPR” substitute “UK GDPR”.

Court Files Privileged Access Rules (Northern Ireland) 2016

102.  The Court Files Privileged Access Rules (Northern Ireland) 2016(40) are amended as follows.

103.  In rule 2 (interpretation), at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

104.  In rule 5(a) (information that may be released), for “GDPR” substitute “UK GDPR”.

105.  In rule 7(2)(a) (provision of information), for “GDPR” substitute “UK GDPR”.

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017

106.  The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017(41) are amended as follows.

107.  In regulation 3(1) (interpretation)—

(a) omit the words from ““the GDPR” to “(14) of that Act);”;

(b) at the appropriate place insert—

““the UK GDPR” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act);”.

108.  In regulation 16(8)(b) (risk assessment by the Treasury and Home Office), for “GDPR” substitute “UK GDPR”.

109.  In regulation 17(9)(b) (risk assessment by supervisory authorities), for “GDPR” substitute “UK GDPR”.

110.  In regulation 41 (data protection), in paragraphs (3)(a), (6), (7), (8) and (9), for “GDPR” substitute “UK GDPR”.

(1)

S.I. 1993/1813.

(2)

S.I. 1994/1405.

(3)

S.I. 1999/677.

(4)

S.I. 1999/3145.

(5)

S.I. 2001/341.

(6)

S.I. 2001/497.

(7)

S.I. 2001/2188.

(8)

S.I. 2002/253.

(9)

S.I. 2002/2013.

(10)

S.I. 2003/2426.

(11)

S.I. 2003/2818.

(12)

S.S.I. 2003/581.

(13)

S.I. 2004/3391.

(14)

S.S.I. 2004/520.

(15)

S.I. 2005/41.

(16)

S.I. 2005/1437.

(17)

S.I. 2005/2042.

(18)

S.S.I. 2005/494.

(19)

S.I. 2005/3595.

(20)

S.I. 2007/236.

(21)

S.I. 2007/1118.

(22)

S.S.I. 2007/170.

(23)

S.S.I. 2007/264.

(24)

S.R. (N.I.) 2007 No. 43.

(25)

S.I. 2008/1741.

(26)

S.I. 2008/3239 (W.286).

(27)

S.R. (N.I.) 2008 No. 3.

(28)

S.I. 2009/3157.

(29)

S.S.I. 2009/440.

(30)

S.R. (N.I.) 2009 No. 225.

(31)

S.I. 2010/231.

(32)

S.I. 2010/2977.

(33)

S.I. 2011/1942 (W.209).

(34)

S.I. 2012/1917.

(35)

S.I. 2012/2031.

(36)

S.I. 2013/373.

(37)

S.I. 2015/1945.

(38)

S.S.I. 2015/425.

(39)

S.I. 2016/696.

(40)

S.R. (N.I.) 2016 No. 123.

(41)

S.I. 2017/692.