Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community

TITLE VII U.K. DATA AND INFORMATION PROCESSED OR OBTAINED BEFORE THE END OF THE TRANSITION PERIOD, OR ON THE BASIS OF THIS AGREEMENT

Article 70 U.K. Definition

For the purposes of this Title, "Union law on the protection of personal data" means:

(a)

Regulation (EU) 2016/679, with the exception of Chapter VII thereof;

(b)

Directive (EU) 2016/680 of the European Parliament and of the Council(1);

(c)

Directive 2002/58/EC of the European Parliament and of the Council(2);

(d)

any other provisions of Union law governing the protection of personal data.

Article 71 U.K. Protection of personal data

1. Union law on the protection of personal data shall apply in the United Kingdom in respect of the processing of personal data of data subjects outside the United Kingdom, provided that the personal data:

(a) were processed under Union law in the United Kingdom before the end of the transition period; or

(b) are processed in the United Kingdom after the end of the transition period on the basis of this Agreement.

2. Paragraph 1 shall not apply to the extent the processing of the personal data referred to therein is subject to an adequate level of protection as established in applicable decisions under Article 45(3) of Regulation (EU) 2016/679 or Article 36(3) of Directive (EU) 2016/680.

3. To the extent that a decision referred to in paragraph 2 has ceased to be applicable, the United Kingdom shall ensure a level of protection of personal data essentially equivalent to that under Union law on the protection of personal data in respect of the processing of personal data of data subjects referred to in paragraph 1.

Article 72 U.K. Confidential treatment and restricted use of data and information in the United Kingdom

Without prejudice to Article 71, in addition to Union law on the protection of personal data, the provisions of Union law on confidential treatment, restriction of use, storage limitation and requirement to erase data and information shall apply in respect of data and information obtained by authorities or official bodies of or in the United Kingdom or by contracting entities, as defined in Article 4 of Directive 2014/25/EU of the European Parliament and of the Council(3), that are of or in the United Kingdom:

(a)

before the end of the transition period; or

(b)

on the basis of this Agreement.

Article 73 U.K. Treatment of data and information obtained from the United Kingdom

The Union shall not treat data and information obtained from the United Kingdom before the end of the transition period, or obtained after the end of the transition period on the basis of this Agreement, differently from data and information obtained from a Member State, on the sole ground of the United Kingdom having withdrawn from the Union.

Article 74 U.K. Information security

1. The provisions of Union law on the protection of EU classified information and Euratom classified information shall apply in respect of classified information that was obtained by the United Kingdom either before the end of the transition period or on the basis of this Agreement or that was obtained from the United Kingdom by the Union or a Member State either before the end of the transition period or on the basis of this Agreement.

2. The obligations resulting from Union law regarding industrial security shall apply to the United Kingdom in cases where the tendering, contracting or grant award procedure for the classified contract, classified subcontract or classified grant agreement was launched before the end of the transition period.

3. The United Kingdom shall ensure that cryptographic products that use classified cryptographic algorithms developed under the control of, and evaluated and approved by the Crypto Approval Authority of a Member State or of the United Kingdom, which have been approved by the Union by the end of the transition period and that are present in the United Kingdom, are not transferred to a third country.

4. Any requirements, limitations and conditions set out in the Union approval of cryptographic products shall apply to those products.

(1)

Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

(2)

Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37).

(3)

Directive 2014/25/EU of the European Parliament and of the Council of 26 February 2014 on procurement by entities operating in the water, energy, transport and postal services sectors and repealing Directive 2004/17/EC (OJ L 94, 28.3.2014, p. 243).