The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

PART 1 U.K. Revocation of retained EU law

Revocation of Regulations and Decisions U.K.

1.  The following Regulations and Decisions are revoked in so far as they are retained EU law—

(a) Commission Decision 2000/518/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland;

[F1 (aa) Commission Decision 2000/519/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Hungary;]

(b) Commission Decision 2001/497/EC M1 of 15th June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC;

(c) Commission Decision 2002/2/EC of 20th December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act;

(d) Commission Decision 2003/490/EC of 30th June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina;

(e) Commission Decision 2003/821/EC of 21st November 2003 on the adequate protection of personal data in Guernsey;

(f) Commission Decision 2004/411/EC of 28th April 2004 on the adequate protection of personal data in the Isle of Man;

[F2 (fa) Council Decision 2004/644/EC of 13th September 2004 adopting implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data;]

(g) Commission Decision 2004/915/EC M2 of 27th December 2004 amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries;

(h) Commission Decision 2008/393/EC of 8th May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey;

[F3 (ha) Commission Decision 2008/597/EC of 3rd June 2008 adopting implementing rules concerning the Data Protection Officer pursuant to Article 24(8) of Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data;]

(i) Commission Decision 2010/87/EU M3 of 5th February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council;

(j) Commission Decision 2010/146/EU of 5th March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data;

(k) Commission Decision 2010/625/EU of 19th October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra;

(l) Commission Decision 2011/61/EU of 31st January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data;

(m) Commission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data;

(n) Commission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand;

(o) Commission Implementing Decision (EU) 2016/1250 of 12th July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield;

(p) Commission Implementing Decision (EU) 2016/2295 M4 of 16th December 2016 amending Decisions 2000/518/EC, 2002/2/EC, 2003/490/EC, 2003/821/EC, 2004/411/EC, 2008/393/EC, 2010/146/EU, 2010/625/EU, 2011/61/EU and Implementing Decisions 2012/484/EU, 2013/65/EU on the adequate protection of personal data by certain countries, pursuant to Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council;

(q) Commission Implementing Decision (EU) 2016/2297 M5 of 16th December 2016 amending Decisions 2001/497/EC and 2010/87/EU on standard contractual clauses for the transfer of personal data to third countries and to processors established in such countries, under Directive 95/46/EC of the European Parliament and of the Council;

(r) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23rd October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.

[F4 (s) Commission Decision (EU) 2019/165 of 1st February 2019 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their data protection rights by the Commission in the context of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings;

(t) Commission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information;

(u) Regulation (EU, Euratom) 2019/493 of the European Parliament and of the Council of 25th March 2019 amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament.]

Textual Amendments

F1 Sch. 3 para. 1(aa) inserted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(2)(a)

F2 Sch. 3 para. 1(fa) inserted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(2)(b)

F3 Sch. 3 para. 1(ha) inserted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(2)(c)

F4 Sch. 3 para. 1(s)-(u) inserted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(2)(d)

Commencement Information

I1 Sch. 3 para. 1 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)

Marginal Citations

M1 OJ L 181, 4.7.2001, p. 19-31.

M2 OJ L 385, 29.12.2004, p. 74-84.

M3 OJ L 39, 12.2.2010, p. 5-18.

M4 OJ L 344, 17.12.2016, p. 83-91.

M5 OJ L 344, 17.12.2016, p. 100-101.

Revocation of provisions of EEA agreement U.K.

2.  Paragraphs 5e, 5ea, 5ed, 5ee, 5ef, 5eg, 5eh, 5ei, 5ek, 5el, 5em, 5en, 5eo, 5ep [F5 , 5eq, 5er and 5es] of Annex 11 to the EEA agreement, as it forms part of the law of England and Wales, Scotland or Northern Ireland on and after [F6 IP completion day] by virtue of section 3(1) of the European Union (Withdrawal) Act 2018, are revoked in so far as they are retained EU law.

Textual Amendments

F5 Words in Sch. 3 para. 2 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(3)(a)

F6 Words in Sch. 3 para. 2 substituted (31.12.2020 immediately before IP completion day) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(2), 6(3)(b)

Commencement Information

I2 Sch. 3 para. 2 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)