Data Protection Act 2018

Valid from 25/05/2018

Chapter V of the GDPR (transfers of data to third countries or international organisations) U.K.

35 U.K. In Article 45 (transfers on the basis of an adequacy decision)—

(a) in paragraph 1, after “decided” insert “ in accordance with Article 45 of the GDPR ”;

(b) after paragraph 1 insert—

“1A But a transfer of personal data to a third country or international organisation must not take place under paragraph 1, if the Commission's decision in relation to the third country (including a territory or sector within it) or the international organisation—

(a) is suspended,

(b) has been amended, or

(c) has been repealed,

by the Commission under Article 45(5) of the GDPR.”;

(c) omit paragraphs 2 to 8;

(d) in paragraph 9, for “of this Article” substitute “ of Article 45 of the GDPR ”.

36 U.K. In Article 46 (transfers subject to appropriate safeguards)—

(a) in paragraph 1, for “Article 45(3)” substitute “ Article 45(3) of the GDPR ”;

(b) in paragraph 2, omit point (c);

(c) in paragraph 2, in point (d), omit “and approved by the Commission pursuant to the examination procedure referred to in Article 93(2)”;

(d) omit paragraph 4;

(e) in paragraph 5—

(i) in the first sentence, for “a Member State or supervisory authority” substitute “ the Commissioner ”;

(ii) in the second sentence, for “this Article” substitute “ Article 46 of the GDPR ”.

37 U.K. In Article 47 (binding corporate rules)—

(a) in paragraph 1, in the first sentence, omit “in accordance with the consistency mechanism set out in Article 63”;

(b) in paragraph 2, in point (e), for “the competent courts of the Member States” substitute “ a court ”;

(c) in paragraph 2, in point (f), for “on the territory of a Member State” substitute “ in the United Kingdom ”;

(d) omit paragraph 3.

38 U.K. In Article 49 (derogations for specific situations)—

(a) in paragraph 1, in the first sentence—

(i) for “Article 45(3)” substitute “ Article 45(3) of the GDPR ”;

(ii) for “Article 46” substitute “ Article 46 of this Regulation ”;

(b) in paragraph 4, for “Union law or in the law of the Member State to which the controller is subject” substitute “ domestic law (see section 18 of the 2018 Act which makes certain provision about the public interest) ”;

(c) for paragraph 5 substitute—

“5 Paragraph 1 is subject to any regulations made under section 18(2) of the 2018 Act.”

39 U.K. In Article 50 (international co-operation for the protection of personal data), omit “the Commission and”.