The draft Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 have been laid before the UK parliament under the European Union (Withdrawal) Act 2018, the Data Protection Act 2018 and the European Communities Act 1972 in preparation for the UK’s withdrawal from the European Union.
The draft Regulations amend UK primary and subordinate legislation and retained EU legislation and revoke other retained direct EU legislation in relation to the regulation of the processing of personal data. This is to ensure that the legal framework for data protection within the UK continues to function correctly after exit day. The Regulations come into force partly on 29 March 2018 and fully on exit day. An amendment, repeal or revocation made by the Regulations has the same extent in the United Kingdom as the provision to which it relates.
Regulations 1 and 2 cover citation, commencement, extent and interpretation.
Regulation 3 introduces Schedule 1, which amends Regulation (EU) 2016/679 (“the GDPR”) as it forms part of domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018.
Regulation 4 introduces Schedule 2, which amends the DPA 2018.
Among other things, changes made by Schedules 1 and 2 have the effect of merging two pre-existing regimes for the regulation of the processing of personal data – namely that established by the GDPR as supplemented by Chapter 2 of Part 2 of the DPA 2018 as originally enacted, and that established in Chapter 3 of Part 2 of the DPA 2018 as originally enacted (“the applied GDPR”). The applied GDPR extended GDPR standards to certain processing out of scope of EU law.
Regulation 5 makes provision concerning interpretation in relation to processing that before exit day was subject to the applied GDPR.
Regulation 6 introduces Schedule 3, which makes amendments to other legislation. Part 1 of Schedule 3 revokes certain EU data protection law that forms part of domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018. Parts 2 and 3 of Schedule 3 make amendments to other legislation consequential to the amendments made in Schedules 1 and 2. Part 4 of Schedule 3 makes general provision for references to the GDPR (that are not otherwise amended by Parts 2 or 3) to have effect as references to the UK GDPR on and after exit day. Part 5 of Schedule 3 makes supplementary provision in respect of Parts 2, 3 and 4.
Regulation 7 introduces Schedule 4 which makes amendments consequential to the DPA 2018 to the Anti-terrorism, Crime and Security Act 2001 and to the Investigatory Powers Act 2016. Related amendments appear in paragraphs 76 and 201 (respectively) of schedule 19 to the DPA but have not been commenced. Regulation 7 repeals those provisions.
Regulation 8 makes amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2002/2013) in light of provision made by the GDPR relating to the meaning of “consent”.
