http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/madeThe Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019enKing's Printer of Acts of Parliament2022-02-24EXITING THE EUROPEAN UNIONDATA PROTECTIONELECTRONIC COMMUNICATIONS These Regulations make amendments to legislation in relation to the regulation of the processing of personal data. SCHEDULE 2 Amendments of the Data Protection Act 2018 Schedules 102 After Schedule 20 insert— SCHEDULE21 Further transitional provision etc Section 213 Part 1Interpretation The applied GPDR 1 In this Schedule, “the applied GDPR” means the EU GDPR as applied by Chapter 3 of Part 2 before exit day. Part 2Continuation of existing acts etc Merger of the directly applicable GDPR and the applied GDPR 2 1 On and after exit day, references in an enactment to the UK GDPR (including the reference in the definition of “the data protection legislation” in section 3(9)) include— a the EU GDPR as it was directly applicable to the United Kingdom before exit day, read with Chapter 2 of Part 2 of this Act as it had effect before exit day, and b the applied GDPR, read with Chapter 3 of Part 2 of this Act as it had effect before exit day. 2 On and after exit day, references in an enactment to, or to a provision of, Chapter 2 of Part 2 of this Act (including general references to this Act or to Part 2 of this Act) include that Chapter or that provision as applied by Chapter 3 of Part 2 of this Act as it had effect before exit day. 3 Sub-paragraphs (1) and (2) have effect— a in relation to references in this Act, except as otherwise provided; b in relation to references in other enactments, unless the context otherwise requires. 3 1 Anything done in connection with the EU GDPR as it was directly applicable to the United Kingdom before exit day, the applied GDPR or this Act— a if in force or effective immediately before exit day, continues to be in force or effective on and after exit day, and b if in the process of being done immediately before exit day, continues to be done on and after exit day. 2 References in this paragraph to anything done include references to anything omitted to be done. Part 3Transfers to third countries and international organisations UK GDPR: adequacy decisions and adequacy regulations 4 1 On and after exit day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes— a in the case of a third country, the country or a relevant territory or sector within the country, or b in the case of an international organisation, the organisation. 2 Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1). 3 The Secretary of State may by regulations— a repeal sub-paragraphs (1) and (2) and paragraph 5; b amend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph; c amend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2). 4 Regulations under this paragraph may, among other things—— a identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time; b confer a discretion on a person. 5 Regulations under this paragraph are subject to the negative resolution procedure. 6 Sub-paragraphs (1) and (2) have effect in addition to section 17A(2) and (3). 5 1 The following are specified for the purposes of paragraph 4(1)— a an EEA state; b Gibraltar; c a Union institution, body, office or agency set up by, or on the basis of, the Treaty on the European Union, the Treaty on the Functioning of the European Union or the Euratom Treaty; d an equivalent institution, body, office or agency set up by, or on the basis of, the Treaties establishing the European Economic Area; e a third country which is the subject of a decision listed in sub-paragraph (2), other than a decision that, immediately before exit day, had been repealed or was suspended; f a third country, territory or sector within a third country or international organisation which is the subject of an adequacy decision made by the European Commission before exit day on the basis of Article 45(3) of the EU GDPR, other than a decision that, immediately before exit day, had been repealed or was suspended. 2 The decisions mentioned in sub-paragraph (1)(e) are the following— a Commission Decision 2000/518/EC of 26th July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland; b Commission Decision 2002/2/EC of 20th December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act; c Commission Decision 2003/490/EC of 30th June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina; d Commission Decision 2003/821/EC of 21st November 2003 on the adequate protection of personal data in Guernsey; e Commission Decision 2004/411/EC of 28th April 2004 on the adequate protection of personal data in the Isle of Man; f Commission Decision 2008/393/EC of 8th May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey; g Commission Decision 2010/146/EU of 5th March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data; h Commission Decision 2010/625/EU of 19th October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra; i Commission Decision 2011/61/EU of 31st January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data; j Commission Implementing Decision 2012/484/EU of 21st August 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data; k Commission Implementing Decision 2013/65/EU of 19th December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand; l Commission Implementing Decision (EU) 2016/1250 of 12th July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield. 3 Where a decision described in sub-paragraph (1)(e) or (f) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 4(1). 4 The references to a decision in sub-paragraphs (1)(e) and (f) and (2) are to the decision as it had effect in EU law immediately before exit day, subject to sub-paragraphs (5) and (6). 5 For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(e) or (f) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer. 6 For the purposes of this paragraph, where a decision described in sub-paragraph (1)(e) or (f) relates to— a transfers from the European Union (or the European Community) or the European Economic Area, or b transfers to which the EU GDPR applies, it is to be treated as relating to equivalent transfers to or from the United Kingdom or transfers to which the UK GDPR applies (as appropriate). 6 1 In the provisions listed in sub-paragraph (2)— a references to regulations made under section 17A (other than references to making such regulations) include the provision made in paragraph 5; b references to the revocation of such regulations include the repeal of all or part of paragraph 5. 2 Those provisions are— a Articles 13(1)(f), 14(1)(f), 45(1) and (7), 46(1) and 49(1) of the UK GDPR; b sections 17B(1), (3), (6) and (7) and 18(2) of this Act. UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses 7 1 Subject to paragraph 8, the appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after exit day as described in this paragraph. 2 The safeguards may be provided for by any standard data protection clauses included in an arrangement which, if the arrangement had been entered into immediately before exit day, would have provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR. 3 The safeguards may be provided for by a version of standard data protection clauses described in sub-paragraph (2) incorporating changes where— a all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), and b none of the changes alters the effect of the clauses. 4 The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)— a changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule; b changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom. 5 In the case of a transfer of personal data made under arrangements entered into before exit day, the safeguards may be provided for on and after exit day by standard data protection clauses not falling within sub-paragraph (2) which— a formed part of the arrangements immediately before exit day, and b at that time, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR. 6 The Secretary of State and the Commissioner must keep the operation of this paragraph under review. 7 In this paragraph, “adequacy decision” means a decision made on the basis of— a Article 45(3) of the EU GDPR, or b Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. 8 This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR. 8 1 Paragraph 7 does not apply to the extent that it has been disapplied by— a regulations made by the Secretary of State, or b a document issued by the Commissioner. 2 Regulations under this paragraph are subject to the negative resolution procedure. 3 Subsections (3) to (8) and (10) to (12) of section 119A apply in relation to a document issued by the Commissioner under this paragraph as they apply to a document issued by the Commissioner under section 119A(2). UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules 9 1 The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after exit day as described sub-paragraphs (2) to (4), subject to sub-paragraph (5). 2 The safeguards may be provided for by any binding corporate rules authorised by the Commissioner which, immediately before exit day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR. 3 The safeguards may be provided for by a version of binding corporate rules described in sub-paragraph (2) incorporating changes where— a all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), and b none of the changes alters the effect of the rules. 4 The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)— a changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule; b changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom. 5 Sub-paragraphs (2) to (4) cease to apply in relation to binding corporate rules if, on or after exit day, the Commissioner withdraws the authorisation of the rules (or, where sub-paragraph (3) is relied on, the authorisation of the rules mentioned in sub-paragraph (2)). 6 The Commissioner must keep the operation of this paragraph under review. 7 In this paragraph— “adequacy decision” means a decision made on the basis of— Article 45(3) of the EU GDPR, or Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; “binding corporate rules” has the meaning given in Article 4(20) of the UK GDPR. 8 This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR. Part 3 (law enforcement processing): adequacy decisions and adequacy regulations 10 1 On and after exit day, for the purposes of Part 3 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 11 specifies, or specifies a description which includes— a in the case of a third country, the country or a relevant territory or sector within the country, or b in the case of an international organisation, the organisation. 2 Sub-paragraph (1) has effect subject to provision in paragraph 11 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 11 for the purposes of sub-paragraph (1). 3 The Secretary of State may by regulations— a repeal sub-paragraphs (1) and (2) and paragraph 11; b amend paragraph 11 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph; c amend paragraph 11 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and by making provision described in sub-paragraph (2). 4 Regulations under this paragraph may, among other things— a identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time; b confer a discretion on a person. 5 Regulations under this paragraph are subject to the negative resolution procedure. 6 Sub-paragraphs (1) and (2) have effect in addition to section 74A(2) and (3). 11 1 The following are specified for the purposes of paragraph 10(1)— a a member State; b Gibraltar; c a third country, a territory or sector within a third country or an international organisation which is the subject of an adequacy decision made by the European Commission before exit day on the basis of Article 36(3) of the Law Enforcement Directive, other than a decision that, immediately before exit day, had been repealed or was suspended. 2 Where a decision described in sub-paragraph (1)(c) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 10(1). 3 The reference to a decision in sub-paragraph (1)(c) is to the decision as it had effect in EU law immediately before exit day, subject to sub-paragraphs (4) and (5). 4 For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(c) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer. 5 For the purposes of this paragraph, where a decision described in sub-paragraph (1)(c) relates to— a transfers from the European Union (or the European Community) or the European Economic Area, or b transfers to which the Law Enforcement Directive applies, it is to be treated as relating to equivalent transfers from the United Kingdom or transfers to which Part 3 of this Act applies (as appropriate). 12 In section 74B(1), (3), (6) and (7)— a references to regulations made under section 74A (other than references to making such regulations) include the provision made in paragraph 11; b references to the revocation of such regulations include the repeal of all or part of paragraph 11. Part 4Repeal of provisions in Chapter 3 of Part 2 Applied GDPR: power to make provision in consequence of GDPR regulations 13 1 Regulations made under section 23 before exit day continue in force until they are revoked, despite the repeal of that section by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. 2 The provisions listed in section 186(3) include regulations made under section 23 before exit day (and not revoked). 3 Sub-paragraphs (1) and (2) do not have effect so far as otherwise provided by the law of England and Wales, Scotland or Northern Ireland. Applied GDPR: national security certificates 14 1 This paragraph applies to a certificate issued under section 27 of this Act which has effect immediately before exit day. 2 A reference in the certificate to a provision of the applied GDPR has effect, on and after exit day, as it if were a reference to the corresponding provision of the UK GDPR or this Act. Part 5The Information Commissioner Confidentiality of information 15 The repeal of section 132(2)(d) by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 has effect only in relation to a disclosure of information made on or after exit day. Part 6Enforcement GDPR: maximum amount of penalties 16 In relation to an infringement, before exit day, of a provision of the EU GDPR (as it was directly applicable to the United Kingdom) or the applied GDPR— a Article 83(5) and (6) of the UK GDPR and section 157(5)(a) and (b) of this Act have effect as if for “£17,500,000” there were substituted “20 million Euros”; b Article 83(4) of the UK GDPR and section 157(6)(a) and (b) of this Act have effect as if for “£8,700,000” there were substituted “10 million Euros”; c the maximum amount of a penalty in sterling must be determined by applying the spot rate of exchange set by the Bank of England on the day on which the penalty notice is given under section 155 of this Act. GDPR: right to an effective remedy against the Commissioner 17 1 This paragraph applies where— a proceedings are brought against a decision made by the Commissioner before exit day, and b the Commissioner’s decision was preceded by an opinion or decision of the European Data Protection Board in accordance with the consistency mechanism referred to in Article 63 of the EU GDPR. 2 The Commissioner must forward the Board’s opinion or decision to the court or tribunal dealing with the proceedings. . OJ L 215, 25.8.2000, p. 1-3. OJ L 2, 4.1.2002, p. 13-16. OJ L 168, 05.07.2003, p. 19-22. OJ L 308, 25.11.2003 p. 27-28. OJ L 151, 30.4.2004. , p. 48-51. OJ L 138, 28.5.2008, p. 21-23. OJ L 58, 9.3.2010, p. 17-19. OJ L 277, 21.10.2010, p. 27-29. OJ L 27, 1.2.2011, p. 39-42 OJ L 227, 23.8.2012, p. 11-14. OJ L 28, 30.1.2013, p. 12-14. OJ L 207, 1.8.2016, p. 1-112.
This XML file does not appear to have any style information associated with it. The document tree is shown below.
<Legislation xmlns="http://www.legislation.gov.uk/namespaces/legislation" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" DocumentURI="http://www.legislation.gov.uk/uksi/2019/419/made" IdURI="http://www.legislation.gov.uk/id/uksi/2019/419" NumberOfProvisions="351" xsi:schemaLocation="http://www.legislation.gov.uk/namespaces/legislation http://www.legislation.gov.uk/schema/legislation.xsd" SchemaVersion="1.0">
<ukm:Metadata xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dct="http://purl.org/dc/terms/" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:ukm="http://www.legislation.gov.uk/namespaces/metadata">
<dc:identifier>http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/made</dc:identifier>
<dc:title>The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019</dc:title>
<dc:language>en</dc:language>
<dc:publisher>King's Printer of Acts of Parliament</dc:publisher>
<dc:modified>2022-02-24</dc:modified>
<dc:subject scheme="SIheading">EXITING THE EUROPEAN UNION</dc:subject>
<dc:subject scheme="SIheading">DATA PROTECTION</dc:subject>
<dc:subject scheme="SIheading">ELECTRONIC COMMUNICATIONS</dc:subject>
<dc:description>These Regulations make amendments to legislation in relation to the regulation of the processing of personal data.</dc:description>
<atom:link rel="self" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/made/data.xml" type="application/xml"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/resources" href="http://www.legislation.gov.uk/uksi/2019/419/resources" title="More Resources"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/memorandum" href="http://www.legislation.gov.uk/uksi/2019/419/memorandum" title="Explanatory Memorandum"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/memorandum/toc" href="http://www.legislation.gov.uk/uksi/2019/419/memorandum/contents" title="Explanatory Memorandum Table of Contents"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/act" href="http://www.legislation.gov.uk/uksi/2019/419/made" title="whole act"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/introduction" href="http://www.legislation.gov.uk/uksi/2019/419/introduction/made" title="introduction"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/signature" href="http://www.legislation.gov.uk/uksi/2019/419/signature/made" title="signature"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/note" href="http://www.legislation.gov.uk/uksi/2019/419/note/made" title="note"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/body" href="http://www.legislation.gov.uk/uksi/2019/419/body/made" title="body"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/schedules" href="http://www.legislation.gov.uk/uksi/2019/419/schedules/made" title="schedules"/>
<atom:link rel="alternate" type="application/rdf+xml" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/made/data.rdf" title="RDF/XML"/>
<atom:link rel="alternate" type="application/akn+xml" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/made/data.akn" title="AKN"/>
<atom:link rel="alternate" type="application/xhtml+xml" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/made/data.xht" title="HTML snippet"/>
<atom:link rel="alternate" type="text/html" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/made/data.htm" title="Website (XHTML) Default View"/>
<atom:link rel="alternate" type="text/csv" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/made/data.csv" title="CSV"/>
<atom:link rel="alternate" type="application/pdf" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/made/data.pdf" title="PDF"/>
<atom:link rel="alternate" type="application/akn+xhtml" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/made/data.html" title="HTML5 snippet"/>
<atom:link rel="http://purl.org/dc/terms/tableOfContents" hreflang="en" href="http://www.legislation.gov.uk/uksi/2019/419/contents/made" title="Table of Contents"/>
<atom:link rel="http://purl.org/dc/terms/hasVersion" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/2020-12-31" title="2020-12-31"/>
<atom:link rel="http://purl.org/dc/terms/hasVersion" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102" title="current"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/supersedes" href="http://www.legislation.gov.uk/id/ukdsi/2019/9780111178300" title="The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019"/>
<atom:link rel="up" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/made" title="Schedule 2"/>
<atom:link rel="prev" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/made" title="Paragraph; Schedule 2 Paragraph 101"/>
<atom:link rel="prevInForce" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/101/made" title="Paragraph; Schedule 2 Paragraph 101"/>
<atom:link rel="next" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/3/paragraph/1/made" title="Paragraph; Schedule 3 Paragraph 1"/>
<atom:link rel="nextInForce" href="http://www.legislation.gov.uk/uksi/2019/419/schedule/3/paragraph/1/made" title="Paragraph; Schedule 3 Paragraph 1"/>
<ukm:SecondaryMetadata>
<ukm:DocumentClassification>
<ukm:DocumentCategory Value="secondary"/>
<ukm:DocumentMainType Value="UnitedKingdomStatutoryInstrument"/>
<ukm:DocumentStatus Value="final"/>
<ukm:DocumentMinorType Value="regulation"/>
</ukm:DocumentClassification>
<ukm:Year Value="2019"/>
<ukm:Number Value="419"/>
<ukm:Made Date="2019-02-28"/>
<ukm:ISBN Value="9780111182680"/>
<ukm:UnappliedEffects>
<ukm:UnappliedEffect AffectedClass="UnitedKingdomStatutoryInstrument" AffectingNumber="485" AffectingClass="UnitedKingdomStatutoryInstrument" AffectingYear="2019" AffectingEffectsExtent="E+W+S+N.I." AppendedCommentary="2020 c. 1, Sch. 5 para. 1(1)" AffectedURI="http://www.legislation.gov.uk/id/uksi/2019/419" AffectedNumber="419" Modified="2021-06-17T11:32:22Z" URI="http://www.legislation.gov.uk/id/effect/key-e133fd60a00502a55d9f97840bc796b0" AffectingURI="http://www.legislation.gov.uk/id/uksi/2019/485" AffectedYear="2019" Notes="This amendment not applied to legislation.gov.uk. S.I. 2019/485 revoked (18.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(3), 7" Type="words inserted" AffectingProvisions="reg. 2(2)" EffectId="key-ce773afa6d0ffb3b05298316e7238aa3" AffectedProvisions="Sch. 2 para. 102" Row="207" Comments="IP completion day - Amendment should not be applied - Regulations revoked (18.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(3), 7" RequiresApplied="false">
<ukm:AffectedTitle>The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019</ukm:AffectedTitle>
<ukm:AffectedProvisions>
<ukm:Section Ref="schedule-2" URI="http://www.legislation.gov.uk/id/uksi/2019/419/schedule/2">Sch. 2 </ukm:Section>
<ukm:Section Ref="schedule-2-paragraph-102" URI="http://www.legislation.gov.uk/id/uksi/2019/419/schedule/2/paragraph/102">para. 102</ukm:Section>
</ukm:AffectedProvisions>
<ukm:AffectingTitle>The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No. 2) Regulations 2019</ukm:AffectingTitle>
<ukm:AffectingProvisions>
<ukm:Section Ref="regulation-2-2" URI="http://www.legislation.gov.uk/id/uksi/2019/485/regulation/2/2">reg. 2(2)</ukm:Section>
</ukm:AffectingProvisions>
<ukm:CommencementAuthority>
<ukm:Section Ref="regulation-1" URI="http://www.legislation.gov.uk/id/uksi/2019/485/regulation/1">reg. 1</ukm:Section>
</ukm:CommencementAuthority>
<ukm:InForceDates>
<ukm:InForce Date="2020-12-31" Qualification="Other" OtherQualification="immediately before IP completion day"/>
</ukm:InForceDates>
</ukm:UnappliedEffect>
<ukm:UnappliedEffect AffectedProvisions="Sch. 2 para. 102" RequiresApplied="false" Modified="2021-06-17T11:32:22Z" AffectedURI="http://www.legislation.gov.uk/id/uksi/2019/419" AffectingURI="http://www.legislation.gov.uk/id/uksi/2019/485" AffectedYear="2019" AppendedCommentary="2020 c. 1, Sch. 5 para. 1(1)" AffectingClass="UnitedKingdomStatutoryInstrument" AffectingEffectsExtent="E+W+S+N.I." AffectingProvisions="reg. 2(3)" AffectedClass="UnitedKingdomStatutoryInstrument" Notes="This amendment not applied to legislation.gov.uk. S.I. 2019/485 revoked (18.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(3), 7" AffectedNumber="419" Comments="IP completion day - Amendment should not be applied - Regulations revoked (18.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(3), 7" EffectId="key-3e6c27b496afacb344e8a9922aa090e4" AffectingYear="2019" Type="words substituted" Row="208" URI="http://www.legislation.gov.uk/id/effect/key-0691d9c12cbec99d8806891e48e3ab88" AffectingNumber="485">
<ukm:AffectedTitle>The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019</ukm:AffectedTitle>
<ukm:AffectedProvisions>
<ukm:Section Ref="schedule-2" URI="http://www.legislation.gov.uk/id/uksi/2019/419/schedule/2">Sch. 2 </ukm:Section>
<ukm:Section Ref="schedule-2-paragraph-102" URI="http://www.legislation.gov.uk/id/uksi/2019/419/schedule/2/paragraph/102">para. 102</ukm:Section>
</ukm:AffectedProvisions>
<ukm:AffectingTitle>The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No. 2) Regulations 2019</ukm:AffectingTitle>
<ukm:AffectingProvisions>
<ukm:Section Ref="regulation-2-3" URI="http://www.legislation.gov.uk/id/uksi/2019/485/regulation/2/3">reg. 2(3)</ukm:Section>
</ukm:AffectingProvisions>
<ukm:CommencementAuthority>
<ukm:Section Ref="regulation-1" URI="http://www.legislation.gov.uk/id/uksi/2019/485/regulation/1">reg. 1</ukm:Section>
</ukm:CommencementAuthority>
<ukm:InForceDates>
<ukm:InForce Date="2020-12-31" Qualification="Other" OtherQualification="immediately before IP completion day"/>
</ukm:InForceDates>
</ukm:UnappliedEffect>
<ukm:UnappliedEffect Modified="2021-06-17T11:32:22Z" AppendedCommentary="2020 c. 1, Sch. 5 para. 1(1)" AffectedURI="http://www.legislation.gov.uk/id/uksi/2019/419" AffectingClass="UnitedKingdomStatutoryInstrument" AffectingURI="http://www.legislation.gov.uk/id/uksi/2019/485" AffectingYear="2019" AffectingNumber="485" AffectingProvisions="reg. 2(4)" AffectedYear="2019" Type="words substituted" AffectedNumber="419" Notes="This amendment not applied to legislation.gov.uk. S.I. 2019/485 revoked (18.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(3), 7" AffectedProvisions="Sch. 2 para. 102" AffectedClass="UnitedKingdomStatutoryInstrument" URI="http://www.legislation.gov.uk/id/effect/key-2cdc9159b02a6df45934f8508f375ab3" AffectingEffectsExtent="E+W+S+N.I." EffectId="key-2dbb00f2c588ee6f692cc635a1c991a0" Comments="IP completion day - Amendment should not be applied - Regulations revoked (18.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 (S.I. 2020/1586), regs. 1(3), 7" Row="209" RequiresApplied="false">
<ukm:AffectedTitle>The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019</ukm:AffectedTitle>
<ukm:AffectedProvisions>
<ukm:Section Ref="schedule-2" URI="http://www.legislation.gov.uk/id/uksi/2019/419/schedule/2">Sch. 2 </ukm:Section>
<ukm:Section Ref="schedule-2-paragraph-102" URI="http://www.legislation.gov.uk/id/uksi/2019/419/schedule/2/paragraph/102">para. 102</ukm:Section>
</ukm:AffectedProvisions>
<ukm:AffectingTitle>The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No. 2) Regulations 2019</ukm:AffectingTitle>
<ukm:AffectingProvisions>
<ukm:Section Ref="regulation-2-4" URI="http://www.legislation.gov.uk/id/uksi/2019/485/regulation/2/4">reg. 2(4)</ukm:Section>
</ukm:AffectingProvisions>
<ukm:CommencementAuthority>
<ukm:Section Ref="regulation-1" URI="http://www.legislation.gov.uk/id/uksi/2019/485/regulation/1">reg. 1</ukm:Section>
</ukm:CommencementAuthority>
<ukm:InForceDates>
<ukm:InForce Date="2020-12-31" Qualification="Other" OtherQualification="immediately before IP completion day"/>
</ukm:InForceDates>
</ukm:UnappliedEffect>
</ukm:UnappliedEffects>
</ukm:SecondaryMetadata>
<ukm:Supersedes URI="http://www.legislation.gov.uk/id/ukdsi/2019/9780111178300">
<dc:title>The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019</dc:title>
<ukm:DocumentMainType Value="UnitedKingdomDraftStatutoryInstrument"/>
<ukm:Year Value="2019"/>
<ukm:ISBN Value="9780111178300"/>
</ukm:Supersedes>
<ukm:Notes>
<ukm:Note IdURI="http://www.legislation.gov.uk/id/uksi/2019/419/notes"/>
<ukm:Alternatives>
<ukm:Alternative URI="http://www.legislation.gov.uk/uksi/2019/419/pdfs/uksiem_20190419_en.pdf" Date="2019-03-06" Title="UK Explanatory Memorandum" Size="113817"/>
</ukm:Alternatives>
</ukm:Notes>
<ukm:CorrectionSlips>
<ukm:CorrectionSlip URI="http://www.legislation.gov.uk/uksi/2019/419/pdfs/uksics_20190419_en_001.pdf" Date="2022-02-24" Title="Correction Slip 1" Size="106835"/>
</ukm:CorrectionSlips>
<ukm:Alternatives>
<ukm:Alternative URI="http://www.legislation.gov.uk/uksi/2019/419/pdfs/uksi_20190419_en.pdf" Date="2019-03-06" Size="302808"/>
</ukm:Alternatives>
<ukm:Statistics>
<ukm:TotalParagraphs Value="353"/>
<ukm:BodyParagraphs Value="8"/>
<ukm:ScheduleParagraphs Value="345"/>
<ukm:AttachmentParagraphs Value="0"/>
<ukm:TotalImages Value="0"/>
</ukm:Statistics>
</ukm:Metadata>
<Secondary>
<Schedules>
<Schedule DocumentURI="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/made" IdURI="http://www.legislation.gov.uk/id/uksi/2019/419/schedule/2" NumberOfProvisions="125" id="schedule-2">
<Number>SCHEDULE 2</Number>
<TitleBlock>
<Title>Amendments of the Data Protection Act 2018</Title>
</TitleBlock>
<ScheduleBody>
<P1group>
<Title>Schedules</Title>
<P1 DocumentURI="http://www.legislation.gov.uk/uksi/2019/419/schedule/2/paragraph/102/made" IdURI="http://www.legislation.gov.uk/id/uksi/2019/419/schedule/2/paragraph/102" id="schedule-2-paragraph-102">
<Pnumber>102</Pnumber>
<P1para>
<Text>After Schedule 20 insert—</Text>
<BlockAmendment Context="schedule" TargetSubClass="unknown" Format="double" TargetClass="unknown">
<Schedule>
<Number>
SCHEDULE
<Character Name="NonBreakingSpace"/>
21
</Number>
<TitleBlock>
<Title>Further transitional provision etc</Title>
</TitleBlock>
<Reference>Section 213</Reference>
<ScheduleBody>
<Part>
<Number>Part 1</Number>
<Title>Interpretation</Title>
<P1group>
<Title>The applied GPDR</Title>
<P1>
<Pnumber PuncAfter=".">1</Pnumber>
<P1para>
<Text>In this Schedule, “the applied GDPR” means the EU GDPR as applied by Chapter 3 of Part 2 before exit day.</Text>
</P1para>
</P1>
</P1group>
</Part>
<Part>
<Number>Part 2</Number>
<Title>Continuation of existing acts etc</Title>
<P1group>
<Title>Merger of the directly applicable GDPR and the applied GDPR</Title>
<P1>
<Pnumber PuncAfter=".">2</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>On and after exit day, references in an enactment to the UK GDPR (including the reference in the definition of “the data protection legislation” in section 3(9)) include—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>the EU GDPR as it was directly applicable to the United Kingdom before exit day, read with Chapter 2 of Part 2 of this Act as it had effect before exit day, and</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>the applied GDPR, read with Chapter 3 of Part 2 of this Act as it had effect before exit day.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>On and after exit day, references in an enactment to, or to a provision of, Chapter 2 of Part 2 of this Act (including general references to this Act or to Part 2 of this Act) include that Chapter or that provision as applied by Chapter 3 of Part 2 of this Act as it had effect before exit day.</Text>
</P2para>
</P2>
<P2>
<Pnumber>3</Pnumber>
<P2para>
<Text>Sub-paragraphs (1) and (2) have effect—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>in relation to references in this Act, except as otherwise provided;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>in relation to references in other enactments, unless the context otherwise requires.</Text>
</P3para>
</P3>
</P2para>
</P2>
</P1para>
</P1>
<P1>
<Pnumber PuncAfter=".">3</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>Anything done in connection with the EU GDPR as it was directly applicable to the United Kingdom before exit day, the applied GDPR or this Act—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>if in force or effective immediately before exit day, continues to be in force or effective on and after exit day, and</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>if in the process of being done immediately before exit day, continues to be done on and after exit day.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>References in this paragraph to anything done include references to anything omitted to be done.</Text>
</P2para>
</P2>
</P1para>
</P1>
</P1group>
</Part>
<Part>
<Number>Part 3</Number>
<Title>Transfers to third countries and international organisations</Title>
<P1group>
<Title>UK GDPR: adequacy decisions and adequacy regulations</Title>
<P1>
<Pnumber PuncAfter=".">4</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>On and after exit day, for the purposes of the UK GDPR and Part 2 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 5 specifies, or specifies a description which includes—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>in the case of a third country, the country or a relevant territory or sector within the country, or</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>in the case of an international organisation, the organisation.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>Sub-paragraph (1) has effect subject to provision in paragraph 5 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 5 for the purposes of sub-paragraph (1).</Text>
</P2para>
</P2>
<P2>
<Pnumber>3</Pnumber>
<P2para>
<Text>The Secretary of State may by regulations—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>repeal sub-paragraphs (1) and (2) and paragraph 5;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>amend paragraph 5 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;</Text>
</P3para>
</P3>
<P3>
<Pnumber>c</Pnumber>
<P3para>
<Text>amend paragraph 5 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and making provision described in sub-paragraph (2).</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>4</Pnumber>
<P2para>
<Text>Regulations under this paragraph may, among other things——</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>confer a discretion on a person.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>5</Pnumber>
<P2para>
<Text>Regulations under this paragraph are subject to the negative resolution procedure.</Text>
</P2para>
</P2>
<P2>
<Pnumber>6</Pnumber>
<P2para>
<Text>Sub-paragraphs (1) and (2) have effect in addition to section 17A(2) and (3).</Text>
</P2para>
</P2>
</P1para>
</P1>
<P1>
<Pnumber PuncAfter=".">5</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>The following are specified for the purposes of paragraph 4(1)—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>an EEA state;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>Gibraltar;</Text>
</P3para>
</P3>
<P3>
<Pnumber>c</Pnumber>
<P3para>
<Text>a Union institution, body, office or agency set up by, or on the basis of, the Treaty on the European Union, the Treaty on the Functioning of the European Union or the Euratom Treaty;</Text>
</P3para>
</P3>
<P3>
<Pnumber>d</Pnumber>
<P3para>
<Text>an equivalent institution, body, office or agency set up by, or on the basis of, the Treaties establishing the European Economic Area;</Text>
</P3para>
</P3>
<P3>
<Pnumber>e</Pnumber>
<P3para>
<Text>a third country which is the subject of a decision listed in sub-paragraph (2), other than a decision that, immediately before exit day, had been repealed or was suspended;</Text>
</P3para>
</P3>
<P3>
<Pnumber>f</Pnumber>
<P3para>
<Text>a third country, territory or sector within a third country or international organisation which is the subject of an adequacy decision made by the European Commission before exit day on the basis of Article 45(3) of the EU GDPR, other than a decision that, immediately before exit day, had been repealed or was suspended.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>The decisions mentioned in sub-paragraph (1)(e) are the following—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>
Commission
<Citation URI="http://www.legislation.gov.uk/european/decision/2000/0518" id="c00008" Class="EuropeanUnionDecision" Year="2000" Number="0518">Decision 2000/518/EC</Citation>
<FootnoteRef Ref="f00017"/>
of 26th July 2000 pursuant to
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00009" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland;
</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>
Commission
<Citation URI="http://www.legislation.gov.uk/european/decision/2002/0002" id="c00010" Class="EuropeanUnionDecision" Year="2002" Number="0002">Decision 2002/2/EC</Citation>
<FootnoteRef Ref="f00018"/>
of 20th December 2001 pursuant to
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00011" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act;
</Text>
</P3para>
</P3>
<P3>
<Pnumber>c</Pnumber>
<P3para>
<Text>
Commission
<Citation URI="http://www.legislation.gov.uk/european/decision/2003/0490" id="c00012" Class="EuropeanUnionDecision" Year="2003" Number="0490">Decision 2003/490/EC</Citation>
<FootnoteRef Ref="f00019"/>
of 30th June 2003 pursuant to
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00013" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council on the adequate protection of personal data in Argentina;
</Text>
</P3para>
</P3>
<P3>
<Pnumber>d</Pnumber>
<P3para>
<Text>
Commission
<Citation URI="http://www.legislation.gov.uk/european/decision/2003/0821" id="c00014" Class="EuropeanUnionDecision" Year="2003" Number="0821">Decision 2003/821/EC</Citation>
<FootnoteRef Ref="f00020"/>
of 21st November 2003 on the adequate protection of personal data in Guernsey;
</Text>
</P3para>
</P3>
<P3>
<Pnumber>e</Pnumber>
<P3para>
<Text>
Commission
<Citation URI="http://www.legislation.gov.uk/european/decision/2004/0411" id="c00015" Class="EuropeanUnionDecision" Year="2004" Number="0411">Decision 2004/411/EC</Citation>
<FootnoteRef Ref="f00021"/>
of 28th April 2004 on the adequate protection of personal data in the Isle of Man;
</Text>
</P3para>
</P3>
<P3>
<Pnumber>f</Pnumber>
<P3para>
<Text>
Commission
<Citation URI="http://www.legislation.gov.uk/european/decision/2008/0393" id="c00016" Class="EuropeanUnionDecision" Year="2008" Number="0393">Decision 2008/393/EC</Citation>
<FootnoteRef Ref="f00022"/>
of 8th May 2008 pursuant to
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00017" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council on the adequate protection of personal data in Jersey;
</Text>
</P3para>
</P3>
<P3>
<Pnumber>g</Pnumber>
<P3para>
<Text>
Commission
<Citation URI="http://www.legislation.gov.uk/european/decision/2010/0146" id="c00018" Class="EuropeanUnionDecision" Year="2010" Number="0146">Decision 2010/146/EU</Citation>
<FootnoteRef Ref="f00023"/>
of 5th March 2010 pursuant to
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00019" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data;
</Text>
</P3para>
</P3>
<P3>
<Pnumber>h</Pnumber>
<P3para>
<Text>
Commission
<Citation URI="http://www.legislation.gov.uk/european/decision/2010/0625" id="c00020" Class="EuropeanUnionDecision" Year="2010" Number="0625">Decision 2010/625/EU</Citation>
<FootnoteRef Ref="f00024"/>
of 19th October 2010 pursuant to
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00021" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council on the adequate protection of personal data in Andorra;
</Text>
</P3para>
</P3>
<P3>
<Pnumber>i</Pnumber>
<P3para>
<Text>
Commission
<Citation URI="http://www.legislation.gov.uk/european/decision/2011/0061" id="c00022" Class="EuropeanUnionDecision" Year="2011" Number="0061">Decision 2011/61/EU</Citation>
<FootnoteRef Ref="f00025"/>
of 31st January 2011 pursuant to
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00023" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data;
</Text>
</P3para>
</P3>
<P3>
<Pnumber>j</Pnumber>
<P3para>
<Text>
Commission Implementing
<Citation URI="http://www.legislation.gov.uk/european/decision/2012/0484" id="c00024" Class="EuropeanUnionDecision" Year="2012" Number="0484">Decision 2012/484/EU</Citation>
<FootnoteRef Ref="f00026"/>
of 21st August 2012 pursuant to
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00025" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data;
</Text>
</P3para>
</P3>
<P3>
<Pnumber>k</Pnumber>
<P3para>
<Text>
Commission Implementing
<Citation URI="http://www.legislation.gov.uk/european/decision/2013/0065" id="c00026" Class="EuropeanUnionDecision" Year="2013" Number="0065">Decision 2013/65/EU</Citation>
<FootnoteRef Ref="f00027"/>
of 19th December 2012 pursuant to
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00027" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council on the adequate protection of personal data by New Zealand;
</Text>
</P3para>
</P3>
<P3>
<Pnumber>l</Pnumber>
<P3para>
<Text>
Commission Implementing Decision (EU) 2016/1250
<FootnoteRef Ref="f00028"/>
of 12th July 2016 pursuant to
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00028" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield.
</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>3</Pnumber>
<P2para>
<Text>Where a decision described in sub-paragraph (1)(e) or (f) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 4(1).</Text>
</P2para>
</P2>
<P2>
<Pnumber>4</Pnumber>
<P2para>
<Text>The references to a decision in sub-paragraphs (1)(e) and (f) and (2) are to the decision as it had effect in EU law immediately before exit day, subject to sub-paragraphs (5) and (6).</Text>
</P2para>
</P2>
<P2>
<Pnumber>5</Pnumber>
<P2para>
<Text>For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(e) or (f) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.</Text>
</P2para>
</P2>
<P2>
<Pnumber>6</Pnumber>
<P2para>
<Text>For the purposes of this paragraph, where a decision described in sub-paragraph (1)(e) or (f) relates to—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>transfers from the European Union (or the European Community) or the European Economic Area, or</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>transfers to which the EU GDPR applies,</Text>
</P3para>
</P3>
<Text>it is to be treated as relating to equivalent transfers to or from the United Kingdom or transfers to which the UK GDPR applies (as appropriate).</Text>
</P2para>
</P2>
</P1para>
</P1>
<P1>
<Pnumber PuncAfter=".">6</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>In the provisions listed in sub-paragraph (2)—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>references to regulations made under section 17A (other than references to making such regulations) include the provision made in paragraph 5;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>references to the revocation of such regulations include the repeal of all or part of paragraph 5.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>Those provisions are—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>Articles 13(1)(f), 14(1)(f), 45(1) and (7), 46(1) and 49(1) of the UK GDPR;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>sections 17B(1), (3), (6) and (7) and 18(2) of this Act.</Text>
</P3para>
</P3>
</P2para>
</P2>
</P1para>
<P1para>
<Text>
<Emphasis>UK GDPR: transfers subject to appropriate safeguards provided by standard data protection clauses</Emphasis>
</Text>
</P1para>
</P1>
<P1>
<Pnumber PuncAfter=".">7</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>Subject to paragraph 8, the appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after exit day as described in this paragraph.</Text>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>The safeguards may be provided for by any standard data protection clauses included in an arrangement which, if the arrangement had been entered into immediately before exit day, would have provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR.</Text>
</P2para>
</P2>
<P2>
<Pnumber>3</Pnumber>
<P2para>
<Text>The safeguards may be provided for by a version of standard data protection clauses described in sub-paragraph (2) incorporating changes where—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), and</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>none of the changes alters the effect of the clauses.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>4</Pnumber>
<P2para>
<Text>The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>5</Pnumber>
<P2para>
<Text>In the case of a transfer of personal data made under arrangements entered into before exit day, the safeguards may be provided for on and after exit day by standard data protection clauses not falling within sub-paragraph (2) which—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>formed part of the arrangements immediately before exit day, and</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>at that time, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(2)(c) or (d) or (5) of the EU GDPR.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>6</Pnumber>
<P2para>
<Text>The Secretary of State and the Commissioner must keep the operation of this paragraph under review.</Text>
</P2para>
</P2>
<P2>
<Pnumber>7</Pnumber>
<P2para>
<Text>In this paragraph, “adequacy decision” means a decision made on the basis of—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>Article 45(3) of the EU GDPR, or</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>
Article 25(6) of
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00029" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>8</Pnumber>
<P2para>
<Text>This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.</Text>
</P2para>
</P2>
</P1para>
</P1>
<P1>
<Pnumber PuncAfter=".">8</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>Paragraph 7 does not apply to the extent that it has been disapplied by—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>regulations made by the Secretary of State, or</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>a document issued by the Commissioner.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>Regulations under this paragraph are subject to the negative resolution procedure.</Text>
</P2para>
</P2>
<P2>
<Pnumber>3</Pnumber>
<P2para>
<Text>Subsections (3) to (8) and (10) to (12) of section 119A apply in relation to a document issued by the Commissioner under this paragraph as they apply to a document issued by the Commissioner under section 119A(2).</Text>
</P2para>
</P2>
</P1para>
<P1para>
<Text>
<Emphasis>UK GDPR: transfers subject to appropriate safeguards provided by binding corporate rules</Emphasis>
</Text>
</P1para>
</P1>
<P1>
<Pnumber PuncAfter=".">9</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>The appropriate safeguards referred to in Article 46(1) of the UK GDPR may be provided for on and after exit day as described sub-paragraphs (2) to (4), subject to sub-paragraph (5).</Text>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>The safeguards may be provided for by any binding corporate rules authorised by the Commissioner which, immediately before exit day, provided for the appropriate safeguards referred to in Article 46(1) of the EU GDPR by virtue of Article 46(5) of the EU GDPR.</Text>
</P2para>
</P2>
<P2>
<Pnumber>3</Pnumber>
<P2para>
<Text>The safeguards may be provided for by a version of binding corporate rules described in sub-paragraph (2) incorporating changes where—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>all of the changes are made in consequence of the withdrawal of the United Kingdom from the EU or provision made by regulations under section 8 or 23 of the European Union (Withdrawal) Act 2018 (or both), and</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>none of the changes alters the effect of the rules.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>4</Pnumber>
<P2para>
<Text>The following changes are to be treated as falling within sub-paragraph (3)(a) and (b)—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>changing references to adequacy decisions made by the European Commission into references to equivalent provision made by regulations under section 17A or by or under paragraphs 4 to 6 of this Schedule;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>changing references to transferring personal data outside the European Union or the European Economic Area into references to transferring personal data outside the United Kingdom.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>5</Pnumber>
<P2para>
<Text>Sub-paragraphs (2) to (4) cease to apply in relation to binding corporate rules if, on or after exit day, the Commissioner withdraws the authorisation of the rules (or, where sub-paragraph (3) is relied on, the authorisation of the rules mentioned in sub-paragraph (2)).</Text>
</P2para>
</P2>
<P2>
<Pnumber>6</Pnumber>
<P2para>
<Text>The Commissioner must keep the operation of this paragraph under review.</Text>
</P2para>
</P2>
<P2>
<Pnumber>7</Pnumber>
<P2para>
<Text>In this paragraph—</Text>
<UnorderedList Decoration="none" Class="Definition">
<ListItem>
<Para>
<Text>“adequacy decision” means a decision made on the basis of—</Text>
<OrderedList Decoration="parens" Type="alpha">
<ListItem>
<Para>
<Text>Article 45(3) of the EU GDPR, or</Text>
</Para>
</ListItem>
<ListItem>
<Para>
<Text>
Article 25(6) of
<Citation URI="http://www.legislation.gov.uk/european/directive/1995/0046" id="c00030" Class="EuropeanUnionDirective" Year="1995" Number="0046">Directive 95/46/EC</Citation>
of the European Parliament and of the Council of 24th October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
</Text>
</Para>
</ListItem>
</OrderedList>
</Para>
</ListItem>
<ListItem>
<Para>
<Text>“binding corporate rules” has the meaning given in Article 4(20) of the UK GDPR.</Text>
</Para>
</ListItem>
</UnorderedList>
</P2para>
</P2>
<P2>
<Pnumber>8</Pnumber>
<P2para>
<Text>This paragraph has effect in addition to Article 46(2) and (3) of the UK GDPR.</Text>
</P2para>
</P2>
</P1para>
<P1para>
<Text>
<Emphasis>Part 3 (law enforcement processing): adequacy decisions and adequacy regulations</Emphasis>
</Text>
</P1para>
</P1>
<P1>
<Pnumber PuncAfter=".">10</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>On and after exit day, for the purposes of Part 3 of this Act, a transfer of personal data to a third country or an international organisation is based on adequacy regulations if, at the time of the transfer, paragraph 11 specifies, or specifies a description which includes—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>in the case of a third country, the country or a relevant territory or sector within the country, or</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>in the case of an international organisation, the organisation.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>Sub-paragraph (1) has effect subject to provision in paragraph 11 providing that only particular transfers to the country, territory, sector or organisation may rely on a particular provision of paragraph 11 for the purposes of sub-paragraph (1).</Text>
</P2para>
</P2>
<P2>
<Pnumber>3</Pnumber>
<P2para>
<Text>The Secretary of State may by regulations—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>repeal sub-paragraphs (1) and (2) and paragraph 11;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>amend paragraph 11 so as to omit a third country, territory, sector or international organisation specified, or of a description specified, in that paragraph;</Text>
</P3para>
</P3>
<P3>
<Pnumber>c</Pnumber>
<P3para>
<Text>amend paragraph 11 so as to replace a reference to, or description of, a third country, territory, sector or organisation with a narrower reference or description, including by specifying or describing particular transfers of personal data and by making provision described in sub-paragraph (2).</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>4</Pnumber>
<P2para>
<Text>Regulations under this paragraph may, among other things—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>identify a transfer of personal data by any means, including by reference to the controller or processor, the recipient, the personal data transferred or the means by which the transfer is made or by reference to relevant legislation, lists or other documents, as they have effect from time to time;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>confer a discretion on a person.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>5</Pnumber>
<P2para>
<Text>Regulations under this paragraph are subject to the negative resolution procedure.</Text>
</P2para>
</P2>
<P2>
<Pnumber>6</Pnumber>
<P2para>
<Text>Sub-paragraphs (1) and (2) have effect in addition to section 74A(2) and (3).</Text>
</P2para>
</P2>
</P1para>
</P1>
<P1>
<Pnumber PuncAfter=".">11</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>The following are specified for the purposes of paragraph 10(1)—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>a member State;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>Gibraltar;</Text>
</P3para>
</P3>
<P3>
<Pnumber>c</Pnumber>
<P3para>
<Text>a third country, a territory or sector within a third country or an international organisation which is the subject of an adequacy decision made by the European Commission before exit day on the basis of Article 36(3) of the Law Enforcement Directive, other than a decision that, immediately before exit day, had been repealed or was suspended.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>Where a decision described in sub-paragraph (1)(c) states that an adequate level of protection of personal data is ensured only for a transfer specified or described in the decision, only such a transfer may rely on that provision and that decision for the purposes of paragraph 10(1).</Text>
</P2para>
</P2>
<P2>
<Pnumber>3</Pnumber>
<P2para>
<Text>The reference to a decision in sub-paragraph (1)(c) is to the decision as it had effect in EU law immediately before exit day, subject to sub-paragraphs (4) and (5).</Text>
</P2para>
</P2>
<P2>
<Pnumber>4</Pnumber>
<P2para>
<Text>For the purposes of this paragraph, where a reference to legislation, a list or another document in a decision described in sub-paragraph (1)(c) is a reference to the legislation, list or document as it has effect from time to time, it is to be treated as a reference to the legislation, list or other document as it has effect at the time of the transfer.</Text>
</P2para>
</P2>
<P2>
<Pnumber>5</Pnumber>
<P2para>
<Text>For the purposes of this paragraph, where a decision described in sub-paragraph (1)(c) relates to—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>transfers from the European Union (or the European Community) or the European Economic Area, or</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>transfers to which the Law Enforcement Directive applies,</Text>
</P3para>
</P3>
<Text>it is to be treated as relating to equivalent transfers from the United Kingdom or transfers to which Part 3 of this Act applies (as appropriate).</Text>
</P2para>
</P2>
</P1para>
</P1>
<P1>
<Pnumber PuncAfter=".">12</Pnumber>
<P1para>
<Text>In section 74B(1), (3), (6) and (7)—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>references to regulations made under section 74A (other than references to making such regulations) include the provision made in paragraph 11;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>references to the revocation of such regulations include the repeal of all or part of paragraph 11.</Text>
</P3para>
</P3>
</P1para>
</P1>
</P1group>
</Part>
<Part>
<Number>Part 4</Number>
<Title>Repeal of provisions in Chapter 3 of Part 2</Title>
<P1group>
<Title>Applied GDPR: power to make provision in consequence of GDPR regulations</Title>
<P1>
<Pnumber PuncAfter=".">13</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>Regulations made under section 23 before exit day continue in force until they are revoked, despite the repeal of that section by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.</Text>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>The provisions listed in section 186(3) include regulations made under section 23 before exit day (and not revoked).</Text>
</P2para>
</P2>
<P2>
<Pnumber>3</Pnumber>
<P2para>
<Text>Sub-paragraphs (1) and (2) do not have effect so far as otherwise provided by the law of England and Wales, Scotland or Northern Ireland.</Text>
</P2para>
</P2>
</P1para>
<P1para>
<Text>
<Emphasis>Applied GDPR: national security certificates</Emphasis>
</Text>
</P1para>
</P1>
<P1>
<Pnumber PuncAfter=".">14</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>This paragraph applies to a certificate issued under section 27 of this Act which has effect immediately before exit day.</Text>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>A reference in the certificate to a provision of the applied GDPR has effect, on and after exit day, as it if were a reference to the corresponding provision of the UK GDPR or this Act.</Text>
</P2para>
</P2>
</P1para>
</P1>
</P1group>
</Part>
<Part>
<Number>Part 5</Number>
<Title>The Information Commissioner</Title>
<P1group>
<Title>Confidentiality of information</Title>
<P1>
<Pnumber PuncAfter=".">15</Pnumber>
<P1para>
<Text>The repeal of section 132(2)(d) by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 has effect only in relation to a disclosure of information made on or after exit day.</Text>
</P1para>
</P1>
</P1group>
</Part>
<Part>
<Number>Part 6</Number>
<Title>Enforcement</Title>
<P1group>
<Title>GDPR: maximum amount of penalties</Title>
<P1>
<Pnumber PuncAfter=".">16</Pnumber>
<P1para>
<Text>In relation to an infringement, before exit day, of a provision of the EU GDPR (as it was directly applicable to the United Kingdom) or the applied GDPR—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>Article 83(5) and (6) of the UK GDPR and section 157(5)(a) and (b) of this Act have effect as if for “£17,500,000” there were substituted “20 million Euros”;</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>Article 83(4) of the UK GDPR and section 157(6)(a) and (b) of this Act have effect as if for “£8,700,000” there were substituted “10 million Euros”;</Text>
</P3para>
</P3>
<P3>
<Pnumber>c</Pnumber>
<P3para>
<Text>the maximum amount of a penalty in sterling must be determined by applying the spot rate of exchange set by the Bank of England on the day on which the penalty notice is given under section 155 of this Act.</Text>
</P3para>
</P3>
</P1para>
<P1para>
<Text>
<Emphasis>GDPR: right to an effective remedy against the Commissioner</Emphasis>
</Text>
</P1para>
</P1>
<P1>
<Pnumber PuncAfter=".">17</Pnumber>
<P1para>
<P2>
<Pnumber>1</Pnumber>
<P2para>
<Text>This paragraph applies where—</Text>
<P3>
<Pnumber>a</Pnumber>
<P3para>
<Text>proceedings are brought against a decision made by the Commissioner before exit day, and</Text>
</P3para>
</P3>
<P3>
<Pnumber>b</Pnumber>
<P3para>
<Text>the Commissioner’s decision was preceded by an opinion or decision of the European Data Protection Board in accordance with the consistency mechanism referred to in Article 63 of the EU GDPR.</Text>
</P3para>
</P3>
</P2para>
</P2>
<P2>
<Pnumber>2</Pnumber>
<P2para>
<Text>The Commissioner must forward the Board’s opinion or decision to the court or tribunal dealing with the proceedings.</Text>
</P2para>
</P2>
</P1para>
</P1>
</P1group>
</Part>
</ScheduleBody>
</Schedule>
</BlockAmendment>
<AppendText>.</AppendText>
</P1para>
</P1>
</P1group>
</ScheduleBody>
</Schedule>
</Schedules>
</Secondary>
<Footnotes>
<Footnote id="f00017">
<FootnoteText>
<Para>
<Text>OJ L 215, 25.8.2000, p. 1-3.</Text>
</Para>
</FootnoteText>
</Footnote>
<Footnote id="f00018">
<FootnoteText>
<Para>
<Text>OJ L 2, 4.1.2002, p. 13-16.</Text>
</Para>
</FootnoteText>
</Footnote>
<Footnote id="f00019">
<FootnoteText>
<Para>
<Text>OJ L 168, 05.07.2003, p. 19-22.</Text>
</Para>
</FootnoteText>
</Footnote>
<Footnote id="f00020">
<FootnoteText>
<Para>
<Text>OJ L 308, 25.11.2003 p. 27-28.</Text>
</Para>
</FootnoteText>
</Footnote>
<Footnote id="f00021">
<FootnoteText>
<Para>
<Text>OJ L 151, 30.4.2004. , p. 48-51.</Text>
</Para>
</FootnoteText>
</Footnote>
<Footnote id="f00022">
<FootnoteText>
<Para>
<Text>OJ L 138, 28.5.2008, p. 21-23.</Text>
</Para>
</FootnoteText>
</Footnote>
<Footnote id="f00023">
<FootnoteText>
<Para>
<Text>OJ L 58, 9.3.2010, p. 17-19.</Text>
</Para>
</FootnoteText>
</Footnote>
<Footnote id="f00024">
<FootnoteText>
<Para>
<Text>OJ L 277, 21.10.2010, p. 27-29.</Text>
</Para>
</FootnoteText>
</Footnote>
<Footnote id="f00025">
<FootnoteText>
<Para>
<Text>OJ L 27, 1.2.2011, p. 39-42</Text>
</Para>
</FootnoteText>
</Footnote>
<Footnote id="f00026">
<FootnoteText>
<Para>
<Text>OJ L 227, 23.8.2012, p. 11-14.</Text>
</Para>
</FootnoteText>
</Footnote>
<Footnote id="f00027">
<FootnoteText>
<Para>
<Text>OJ L 28, 30.1.2013, p. 12-14.</Text>
</Para>
</FootnoteText>
</Footnote>
<Footnote id="f00028">
<FootnoteText>
<Para>
<Text>OJ L 207, 1.8.2016, p. 1-112.</Text>
</Para>
</FootnoteText>
</Footnote>
</Footnotes>
</Legislation>