Search Legislation

The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020

 Help about what version

What Version

  • Latest available (Revised)
  • Original (As made)
 Help about opening options

Opening Options

Status:

This is the original version (as it was originally made). This item of legislation is currently only available in its original format.

Statutory Instruments

2020 No. 1586

Exiting The European Union

Data Protection

The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020

Made

17th December 2020

Coming into force in accordance with regulation 1(2) and (3)

The Secretary of State makes these Regulations in exercise of the powers conferred by section 8(1) of, and paragraph 21 of Schedule 7 to, the European Union (Withdrawal) Act 2018(1).

In accordance with paragraph 1(3) of Schedule 7 to the European Union (Withdrawal) Act 2018, a draft of this instrument has been laid before Parliament and approved by a resolution of each House of Parliament.

Citation and commencement

1.—(1) These Regulations may be cited as the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020.

(2) Subject to paragraph (3), they come into force immediately before IP completion day.

(3) Regulation 7 comes into force on the day after these Regulations are made.

Amendments to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

2.  The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019(2) are amended as follows.

3.—(1) Regulation 5 is amended as follows.

(2) In paragraph (1), for “exit day” substitute “IP completion day”.

(3) In paragraph (2), for “exit day” substitute “IP completion day”.

(4) In paragraph (3), for “exit day”, in both places where it appears, substitute “IP completion day”.

(5) In paragraph (4), for “exit day”, in each of the four places where it appears, substitute “IP completion day”.

4.—(1) Schedule 1 is amended as follows.

(2) In paragraph 4(2), for “exit day”, in both places where it appears, substitute “IP completion day”.

(3) In paragraph 6—

(a)in sub-paragraph (12), for “exit day” substitute “IP completion day”;

(b)in sub-paragraph (13), for “exit day”, in both places where it appears, substitute “IP completion day”.

(4) In paragraph 17(b), for “exit day” substitute “IP completion day”.

(5) In paragraph 74(3), for “exit day” substitute “IP completion day”.

(6) In paragraph 80, for “exit day” substitute “IP completion day”.

5.—(1) Schedule 2 is amended as follows.

(2) In paragraph 85, for “exit day, in each of the three places where it appears, substitute “IP completion day”.

(3) In paragraph 101(4)(b), for “exit day” substitute “IP completion day”.

(4) In paragraph 102, in the Schedule inserted by that paragraph—

(a)in paragraph 1, for “exit day” substitute “IP completion day”;

(b)in paragraph 2—

(i)in sub-paragraph (1), for “exit day”, in each of the four places where it appears, substitute “IP completion day”;

(ii)in sub-paragraph (2), for “exit day”, in both places where it appears, substitute “IP completion day”;

(c)in paragraph 3(1), for “exit day”, in each of the five places where it appears, substitute “IP completion day”;

(d)in paragraph 4(1), for “exit day” substitute “IP completion day”;

(e)in paragraph 5—

(i)in sub-paragraph (1), for “exit day”, in each of the three places where it appears, substitute “IP completion day”;

(ii)in sub-paragraph (2)—

(aa)omit paragraph (l);

(bb)at the end insert—

(m)Commission Implementing Decision (EU) 2019/419(3) of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information.;

(iii)in sub-paragraph (4), for “exit day” substitute “IP completion day”;

(f)in paragraph 7—

(i)in sub-paragraph (1), for “exit day” substitute “IP completion day”;

(ii)in sub-paragraph (2), for “exit day” substitute “IP completion day”;

(iii)in sub-paragraph (5), for “exit day”, in each of the three places where it appears, substitute “IP completion day”;

(g)in paragraph 9—

(i)in sub-paragraph (1), for “exit day” substitute “IP completion day”;

(ii)in sub-paragraph (2), for “exit day” substitute “IP completion day”;

(iii)in sub-paragraph (5), for “exit day” substitute “IP completion day”;

(iv)after sub-paragraph (5), insert—

(5A) For the purposes of sub-paragraph (2), binding corporate rules which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR but which were authorised other than by the Commissioner are to be treated as authorised by the Commissioner where—

(a)a valid notification of the rules has been made to the Commissioner,

(b)the Commissioner has approved them, and

(c)that approval has not been withdrawn.

(5B) A notification is valid if it—

(a)is made by a controller or processor established in the United Kingdom,

(b)is made to the Commissioner before the end of the period of 6 months beginning with IP completion day, and

(c)includes—

(i)the name and contact details of the data protection officer or other contact point for the controller or processor, and

(ii)such other information as the Commissioner may reasonably require.

(5C) Where a valid notification is made the Commissioner must, without undue delay—

(a)decide whether or not to approve the rules, and

(b)notify the controller or processor of that decision.;

(h)in paragraph 10(1), for “exit day” substitute “IP completion day”;

(i)in paragraph 11(1)—

(i)for sub-paragraph (1)(a) substitute—

(a)an EEA state;

(aa)Switzerland;;

(ii)in sub-paragraph (1)(c), for “exit day”, in both places where it appears, substitute “IP completion day”;

(j)in paragraph 11(3), for “exit day” substitute “IP completion day”;

(k)in paragraph 13—

(i)in sub-paragraph (1), for “exit day” substitute “IP completion day”;

(ii)in sub-paragraph (2), for “exit day” substitute “IP completion day”;

(l)in paragraph 14—

(i)in sub-paragraph (1), for “exit day” substitute “IP completion day”;

(ii)in sub-paragraph (2), for “exit day” substitute “IP completion day”;

(m)in paragraph 15, for “exit day” substitute “IP completion day”;

(n)in paragraph 16, for “exit day” substitute “IP completion day”;

(o)in paragraph 17(1)(a), for “exit day” substitute “IP completion day”.

6.—(1) Schedule 3 is amended as follows.

(2) In paragraph 1—

(a)after sub-paragraph (a) insert—

(aa)Commission Decision 2000/519/EC(4) of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Hungary;;

(b)after sub-paragraph (f) insert—

(fa)Council Decision 2004/644/EC(5) of 13th September 2004 adopting implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data;;

(c)after sub-paragraph (h) insert—

(ha)Commission Decision 2008/597/EC(6) of 3rd June 2008 adopting implementing rules concerning the Data Protection Officer pursuant to Article 24(8) of Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data;;

(d)at the end insert—

(s)Commission Decision (EU) 2019/165(7) of 1st February 2019 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their data protection rights by the Commission in the context of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings;

(t)Commission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information;

(u)Regulation (EU, Euratom) 2019/493(8) of the European Parliament and of the Council of 25th March 2019 amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament..

(3) In paragraph 2—

(a)for “and 5eq” substitute “, 5eq, 5er and 5es”;

(b)for “exit day” substitute “IP completion day”.

(4) In paragraph 111—

(a)in sub-paragraph (1), for “exit day” substitute “IP completion day”;

(b)in sub-paragraph (2), for “exit day”, in both places where it appears, substitute “IP completion day”.

Revocation of the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No. 2) Regulations 2019

7.  The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No.2) Regulations 2019(9) are revoked.

John Whittingdale

Minister of State

Department for Digital, Culture, Media and Sport

17th December 2020

EXPLANATORY NOTE

(This note is not part of the Regulations)

These Regulations make amendments to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419) (“the 2019 Regulations”). The 2019 Regulations made amendments to legislation in relation to the regulation of the processing of personal data, in particular in connection with the withdrawal of the United Kingdom (“UK”) from the European Union (“EU”).

These Regulations exercise the powers in section 8(1) of the European Union (Withdrawal) Act 2018 (c. 16) (“the EUWA 2018”) in order to address failures of retained EU law to operate effectively and other deficiencies (in particular under section 8(2)(d)) arising from the withdrawal of the UK from the EU.

Regulations 3 to 6, amend a number of references to exit day in the 2019 Regulations. The provisions being amended will come into force on IP completion day by operation of paragraph 1 of Schedule 5 to the 2020 Act. The changes made by this instrument ensure that their effects begin from IP completion day rather than exit day.

Paragraph (4)(e)(ii) of regulation 5 amends the 2019 Regulations following the adequacy decision made by the European Commission in relation to Japan and the declaration by the Court of Justice of the European Union in the case of Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311.18) (“the Privacy Shield case”) that the Privacy Shield decision is invalid.

Paragraph (4)(g)(iv) of regulation 5 amends the 2019 Regulations to enable binding corporate rules that pre-date the GDPR and were authorised other than by the Information Commissioner to continue to be relied on in certain circumstances.

Paragraph (4)(i)(i) of regulation 5 amends the 2019 Regulations to reflect the obligation of Iceland, Liechtenstein, Norway (as EEA states) and Switzerland to implement Directive (EU) 2016/680 of the European Parliament and of the Council.

Paragraph (2) of regulation 6 amends the 2019 Regulations to revoke retained direct EU legislation.

Regulation 7 revokes the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No. 2) Regulations 2019 (S.I. 2019/485), which previously amended the 2019 Regulations but are not yet in force and are now redundant following the Privacy Shield case.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private or voluntary sector is foreseen.

(1)

2018 c. 16. Section 8 was amended by the European Union (Withdrawal Agreement) Act 2020 (c. 1), section 27. Paragraph 21, in Part 3 of Schedule 7, was amended by the European Union (Withdrawal Agreement) Act 2020, Schedule 5 , Part 2, paragraph 53.

(2)

S. I. 2019/419. This instrument is amended by S.I. 2019/485 (which is revoked by regulation 7 of this instrument). The reference to “exit day” in regulation 1(2) of S.I. 2019/419 (commencement) is to be read as a reference to IP completion day, by virtue of paragraph 1(1) of Schedule 5 to the European Union (Withdrawal Agreement) Act (c. 1).

(3)

EUDN 2019/419.

(4)

EUDN 2000/519.

(5)

EUDN 2004/644.

(6)

EUDN 2008/597.

(7)

EUDN 2019/165.

(8)

EUR 2019/493.

(9)

S.I. 2019/485. The reference to exit day in regulation 1 (commencement) is to be read as a reference to IP completion day, by virtue of paragraph 1(1) of Schedule 5 to the European Union (Withdrawal Agreement) Act (c. 1).

Back to top

Options/Help

Print Options

Close

Legislation is available in different versions:

Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.

Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.

Close

Opening Options

Different options to open legislation in order to view more content on screen at once

Close

Explanatory Memorandum

Explanatory Memorandum sets out a brief statement of the purpose of a Statutory Instrument and provides information about its policy objective and policy implications. They aim to make the Statutory Instrument accessible to readers who are not legally qualified and accompany any Statutory Instrument or Draft Statutory Instrument laid before Parliament from June 2004 onwards.

Close

More Resources

Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:

  • the original print PDF of the as enacted version that was used for the print copy
  • lists of changes made by and/or affecting this legislation item
  • confers power and blanket amendment details
  • all formats of all associated documents
  • correction slips
  • links to related legislation and further information resources
Close

More Resources

Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:

  • the original print PDF of the as made version that was used for the print copy
  • correction slips

Click 'View More' or select 'More Resources' tab for additional information including:

  • lists of changes made by and/or affecting this legislation item
  • confers power and blanket amendment details
  • all formats of all associated documents
  • links to related legislation and further information resources