Citation and commencement

1. —(1) These Regulations may be cited as the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020.

(2) Subject to paragraph (3), they come into force immediately before IP completion day.

(3) Regulation 7 comes into force on the day after these Regulations are made.

Amendments to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

2.The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019( 2 ) are amended as follows.

3. —(1) Regulation 5 is amended as follows.

(2) In paragraph (1), for “exit day” substitute “IP completion day”.

(3) In paragraph (2), for “exit day” substitute “IP completion day”.

(4) In paragraph (3), for “exit day”, in both places where it appears, substitute “IP completion day”.

(5) In paragraph (4), for “exit day”, in each of the four places where it appears, substitute “IP completion day”.

4. —(1) Schedule 1 is amended as follows.

(2) In paragraph 4(2), for “exit day”, in both places where it appears, substitute “IP completion day”.

(3) In paragraph 6—

(a) in sub-paragraph (12), for “exit day” substitute “IP completion day”;

(b) in sub-paragraph (13), for “exit day”, in both places where it appears, substitute “IP completion day”.

(4) In paragraph 17(b), for “exit day” substitute “IP completion day”.

(5) In paragraph 74(3), for “exit day” substitute “IP completion day”.

(6) In paragraph 80, for “exit day” substitute “IP completion day”.

5. —(1) Schedule 2 is amended as follows.

(2) In paragraph 85, for “exit day, in each of the three places where it appears, substitute “IP completion day”.

(3) In paragraph 101(4)(b), for “exit day” substitute “IP completion day”.

(4) In paragraph 102, in the Schedule inserted by that paragraph—

(a) in paragraph 1, for “exit day” substitute “IP completion day”;

(b) in paragraph 2—

(i) in sub-paragraph (1), for “exit day”, in each of the four places where it appears, substitute “IP completion day”;

(ii) in sub-paragraph (2), for “exit day”, in both places where it appears, substitute “IP completion day”;

(c) in paragraph 3(1), for “exit day”, in each of the five places where it appears, substitute “IP completion day”;

(d) in paragraph 4(1), for “exit day” substitute “IP completion day”;

(e) in paragraph 5—

(i) in sub-paragraph (1), for “exit day”, in each of the three places where it appears, substitute “IP completion day”;

(ii) in sub-paragraph (2)—

(aa) omit paragraph (l);

(bb) at the end insert—

“ (m) Commission Implementing Decision (EU) 2019/419 ( 3 ) of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information. ” ;

(iii) in sub-paragraph (4), for “exit day” substitute “IP completion day”;

(f) in paragraph 7—

(i) in sub-paragraph (1), for “exit day” substitute “IP completion day”;

(ii) in sub-paragraph (2), for “exit day” substitute “IP completion day”;

(iii) in sub-paragraph (5), for “exit day”, in each of the three places where it appears, substitute “IP completion day”;

(g) in paragraph 9—

(i) in sub-paragraph (1), for “exit day” substitute “IP completion day”;

(ii) in sub-paragraph (2), for “exit day” substitute “IP completion day”;

(iii) in sub-paragraph (5), for “exit day” substitute “IP completion day”;

(iv) after sub-paragraph (5), insert—

“ (5A) For the purposes of sub-paragraph (2), binding corporate rules which, immediately before IP completion day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR but which were authorised other than by the Commissioner are to be treated as authorised by the Commissioner where—

(a) a valid notification of the rules has been made to the Commissioner,

(b) the Commissioner has approved them, and

(c) that approval has not been withdrawn.

(5B) A notification is valid if it—

(a) is made by a controller or processor established in the United Kingdom,

(b) is made to the Commissioner before the end of the period of 6 months beginning with IP completion day, and

(c) includes—

(i) the name and contact details of the data protection officer or other contact point for the controller or processor, and

(ii) such other information as the Commissioner may reasonably require.

(5C) Where a valid notification is made the Commissioner must, without undue delay—

(a) decide whether or not to approve the rules, and

(b) notify the controller or processor of that decision. ” ;

(h) in paragraph 10(1), for “exit day” substitute “IP completion day”;

(i) in paragraph 11(1)—

(i) for sub-paragraph (1)(a) substitute—

“ (a) an EEA state;

(aa) Switzerland; ” ;

(ii) in sub-paragraph (1)(c), for “exit day”, in both places where it appears, substitute “IP completion day”;

(j) in paragraph 11(3), for “exit day” substitute “IP completion day”;

(k) in paragraph 13—

(i) in sub-paragraph (1), for “exit day” substitute “IP completion day”;

(ii) in sub-paragraph (2), for “exit day” substitute “IP completion day”;

(l) in paragraph 14—

(i) in sub-paragraph (1), for “exit day” substitute “IP completion day”;

(ii) in sub-paragraph (2), for “exit day” substitute “IP completion day”;

(m) in paragraph 15, for “exit day” substitute “IP completion day”;

(n) in paragraph 16, for “exit day” substitute “IP completion day”;

(o) in paragraph 17(1)(a), for “exit day” substitute “IP completion day”.

6. —(1) Schedule 3 is amended as follows.

(2) In paragraph 1—

(a) after sub-paragraph (a) insert—

“ (aa) Commission Decision 2000/519/EC 4 ) of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Hungary; ” ;

(b) after sub-paragraph (f) insert—

“ (fa) Council Decision 2004/644/EC 5 ) of 13th September 2004 adopting implementing rules concerning Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data; ” ;

(c) after sub-paragraph (h) insert—

“ (ha) Commission Decision 2008/597/EC 6 ) of 3rd June 2008 adopting implementing rules concerning the Data Protection Officer pursuant to Article 24(8) of Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data; ” ;

(d) at the end insert—

“ (s) Commission Decision (EU) 2019/165 ( 7 ) of 1st February 2019 laying down internal rules concerning the provision of information to data subjects and the restriction of certain of their data protection rights by the Commission in the context of administrative inquiries, pre-disciplinary, disciplinary and suspension proceedings;

(t) Commission Implementing Decision (EU) 2019/419 of 23rd January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information;

(u) Regulation (EU, Euratom) 2019/493 ( 8 ) of the European Parliament and of the Council of 25th March 2019 amending Regulation (EU, Euratom) No 1141/2014 as regards a verification procedure related to infringements of rules on the protection of personal data in the context of elections to the European Parliament. ” .

(3) In paragraph 2—

(a) for “and 5eq” substitute “, 5eq, 5er and 5es”;

(b) for “exit day” substitute “IP completion day”.

(4) In paragraph 111—

(a) in sub-paragraph (1), for “exit day” substitute “IP completion day”;

(b) in sub-paragraph (2), for “exit day”, in both places where it appears, substitute “IP completion day”.

Revocation of the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No. 2) Regulations 2019

7.The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No.2) Regulations 2019( 9 ) are revoked.