SCHEDULE 1Amendments of the UK GDPR

Chapter 1 (general provisions)4

1

Article 2 is amended as follows.

2

For paragraph 1 substitute—

1

This Regulation applies to the automated or structured processing of personal data, including—

a

processing in the course of an activity which, immediately before exit day, fell outside the scope of EU law, and

b

processing in the course of an activity which, immediately before exit day, fell within the scope of Chapter 2 of Title 5 of the Treaty on European Union (common foreign and security policy activities).

1A

This Regulation also applies to the manual unstructured processing of personal data held by an FOI public authority.

3

For paragraph 2 substitute—

2

This Regulation does not apply to—

a

the processing of personal data by an individual in the course of a purely personal or household activity;

b

the processing of personal data by a competent authority for any of the law enforcement purposes (see Part 3 of the 2018 Act);

c

the processing of personal data to which Part 4 of the 2018 Act (intelligence services processing) applies.

4

Omit paragraph 3.

5

In paragraph 4, for “Directive 2000/31/EC”7 to the end substitute “the Electronic Commerce (EC Directive) Regulations 20028, in particular the provisions about mere conduits, caching and hosting (see regulations 17 to 19 of those Regulations).”.

6

After paragraph 4 insert—

5

In this Article—

a

‘the automated or structured processing of personal data’ means—

i

the processing of personal data wholly or partly by automated means, and

ii

the processing otherwise than by automated means of personal data which forms part of a filing system or is intended to form part of a filing system;

b

‘the manual unstructured processing of personal data’ means the processing of personal data which is not the automated or structured processing of personal data;

c

‘FOI public authority’ has the same meaning as in Chapter 3 of Part 2 of the 2018 Act (see section 21(5) of that Act);

d

references to personal data ‘held’ by an FOI public authority are to be interpreted in accordance with section 21(6) and (7) of the 2018 Act;

e

‘competent authority’ and ‘law enforcement purposes’ have the same meaning as in Part 3 of the 2018 Act (see sections 30 and 31 of that Act).