19.—(1) Article 23 is amended as follows.
(2) In paragraph 1—
(a)for “Union or Member State law to which the data controller or processor is subject may restrict by way of legislative measure” substitute “The Secretary of State may restrict”;
(b)omit points (a) and (b);
(c)in point (e)—
(i)omit “of the Union or of a Member State” in the first place it occurs;
(ii)for “of the Union or of a Member State”, in the second place it occurs, substitute “of the United Kingdom”.
(3) In paragraph 2, for “any legislative measure referred to in” substitute “provision made in exercise of the power under”.
(4) After that paragraph insert—
“3. The Secretary of State may exercise the power under paragraph 1 only by making regulations under section 16 of the 2018 Act.”.