4.—(1) Commission Regulation (EU) No 611/2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications is amended as follows.
(2) In Article 2—
(a)in the heading, for “competent national authority” substitute “ Information Commissioner ”;
(b)in paragraph 1, for “competent national authority” substitute “ Information Commissioner ”;
(c)in paragraph 2, for “competent national authority” (in both places) substitute “ Information Commissioner ”;
(d)in paragraph 3, for “competent national authority” (in each place it occurs) substitute “ Information Commissioner ”;
(e)in paragraph 4—
(i)for “competent national authority” substitute “ Information Commissioner ”;
(ii)for “Member State concerned” substitute “ United Kingdom ”;
(iii)omit the final sentence;
(f)omit paragraph 5.
(3) In Article 3—
(a)in paragraph 3, for “competent national authority” substitute “ Information Commissioner ”;
(b)in paragraph 5, for “competent national authority” (in both places) substitute “ Information Commissioner ”;
(c)in paragraph 7, for “, in the relevant Member States,” substitute “ in the United Kingdom ”.
(4) In Article 4—
(a)in paragraph 1, for “competent national authority” substitute “ Information Commissioner ”;
(b)omit paragraph 3.
(5) Omit Article 6.
(6) Omit the sentence following Article 7.
(7) In Annex 1—
(a)in the heading, for “competent national authority” substitute “ Information Commissioner ”;
(b)omit points 16 and 17 (and the italic heading before them).
Commencement Information
I1Reg. 4 in force at 31.12.2020 on IP completion day (in accordance with 2020 c. 1, Sch. 5 para. 1(1)), see reg. 1(2)