The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

Citation, commencement and extent U.K.

1.—(1) These Regulations may be cited as the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

(2) Subject to paragraph (3), they come into force on exit day.

(3) Regulations 7 and 8 and Schedule 4 come into force on 29th March 2019.

(4) An amendment, repeal or revocation made by these Regulations has the same extent in the United Kingdom as the provision to which it relates.

Commencement Information

I1 Reg. 1 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)

Interpretation U.K.

2.  In these Regulations—

“the 2018 Act” means the Data Protection Act 2018;

“the UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.

Commencement Information

I2 Reg. 2 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)

Amendment of the UK GDPR U.K.

3.  Schedule 1 amends the UK GDPR.

Commencement Information

I3 Reg. 3 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)

Amendment of the Data Protection Act 2018 U.K.

4.  Schedule 2 amends the 2018 Act.

Commencement Information

I4 Reg. 4 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)

GDPR merger modifications U.K.

5.—(1) Schedules 1 and 2 include modifications (“the GDPR merger modifications”) that merge the provisions relating to the processing of personal data that, immediately before [F1 IP completion day], are found in the EU GDPR and the applied GDPR, read with the 2018 Act.

(2) Retained case law and retained general principles of EU law falling within paragraph (3) are not, by virtue of the GDPR merger modifications, to be treated as relevant to the UK GDPR or the 2018 Act as they apply to applied GDPR processing on and after [F2 IP completion day].

(3) Retained case law and retained general principles of EU law fall within this paragraph so far as they are, or are derived from, principles or decisions that are not relevant to any of the following immediately before [F3 IP completion day]—

(a) the applied GDPR,

(b) the applied Chapter 2, or

(c) Parts 5 to 7 of the 2018 Act so far as they apply to applied GDPR processing,

having regard (among other things) to the limits of EU competence immediately before [F3 IP completion day].

(4) In this regulation—

“the applied Chapter 2” means Chapter 2 of Part 2 of the 2018 Act as applied by Chapter 3 of that Part immediately before [F4 IP completion day] (see section 22 of that Act);

“the applied GDPR” means the EU GDPR as applied by Chapter 3 of Part 2 of the 2018 Act as it has effect immediately before [F4 IP completion day] (see section 22 of that Act);

“applied GDPR processing” means the processing of personal data to which the applied GDPR applied immediately before [F4 IP completion day] (see section 21 of the 2018 Act);

“the EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it has effect in EU law immediately before [F4 IP completion day];

“retained case law” and “retained general principles of EU law” have the same meaning as in the European Union (Withdrawal) Act 2018 (see section 6(7) of that Act).

Textual Amendments

F1 Words in reg. 5(1) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 3(2)

F2 Words in reg. 5(2) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 3(3)

F3 Words in reg. 5(3) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 3(4)

F4 Words in reg. 5(4) substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 3(5)

Commencement Information

I5 Reg. 5 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)

Consequential amendments of other legislation U.K.

6.  In Schedule 3—

(a) Part 1 revokes certain retained EU law;

(b) Part 2 contains amendments of primary legislation (as defined in section 211(7) of the 2018 Act) that are consequential on Schedules 1 and 2;

(c) Part 3 contains amendments of other legislation that are consequential on those Schedules;

(d) Part 4 contains modifications of legislation that are consequential on those Schedules;

(e) Part 5 contains supplementary provision.

Commencement Information

I6 Reg. 6 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)

Amendments consequential on provisions of the 2018 Act U.K.

7.  Schedule 4 contains amendments consequential on provisions of the 2018 Act.

Commencement Information

I7 Reg. 7 in force at 29.3.2019, see reg. 1(3)

Amendment of the Privacy and Electronic Communications Regulations 2003 U.K.

8.—(1) Regulation 2 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 M1 is amended as follows.

(2) In paragraph (1), at the appropriate place, insert—

““consent” by a user or subscriber corresponds to the data subject's consent in the GDPR (as defined in section 3(10) of the Data Protection Act 2018);”M2 .

(3) Omit paragraph (3).

Commencement Information

I8 Reg. 8 in force at 29.3.2019, see reg. 1(3)

Marginal Citations

M1 S.I. 2003/2426.

M2 These regulations make a further amendment to this provision (see Sch. 3, para. 3).

We consent to the making of these Regulations

Paul Maynard

Jeremy Quin

Two of the Lords Commissioners of Her Majesty's Treasury

Margot James

Minister of State

Department for Digital, Culture, Media and Sport