The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, SI 2019/419. The Explanatory note attached to the Regulations states as follows:
'Regulations 1 and 2 cover citation, commencement, extent and interpretation.
Regulation 3 introduces Schedule 1, which amends Regulation (EU) 2016/679 of the European Parliament and of the Council (“the GDPR”) as it forms part of domestic law by virtue of section 3 of the EUWA 2018.
Regulation 4 introduces Schedule 2, which amends the DPA 2018. Among other things, changes made by Schedules 1 and 2 have the effect of merging two pre-existing regimes for the regulation of the processing of personal data – namely that established by the GDPR as supplemented by Chapter 2 of Part 2 of the DPA 2018 as originally enacted, and that established in Chapter 3 of Part 2 of the DPA 2018 as originally enacted (“the applied GDPR”). The applied GDPR extended GDPR standards to certain processing out of scope of EU law and the GDPR.
Regulation 5 makes provision concerning interpretation in relation to processing that prior to exit day was subject to the applied GDPR.
Regulation 6 introduces Schedule 3, which makes amendments to other legislation. Part 1 of Schedule 3 revokes certain EU data protection law that forms part of domestic law by virtue of section 3 of the EUWA 2018. Parts 2 and 3 of Schedule 3 make amendments to other legislation consequential to the amendments made in Schedules 1 and 2. Part 4 of Schedule 3 makes general provision for references to the GDPR (that are not otherwise amended by Parts 2 or 3) to have effect as references to the UK GDPR on and after exit day. Part 5 of Schedule 3 makes supplementary provision in respect of Parts 2, 3 and 4.
Regulation 7 introduces Schedule 4 which makes amendments consequential to the DPA 2018 to the Anti-terrorism, Crime and Security Act 2001 (c.24) and to the Investigatory Powers Act 2016 (c.25). Related amendments appear in paragraphs 76 and 201 (respectively) of schedule 19 to the DPA but have not been commenced. Regulation 7 repeals those provisions.
Regulation 8 makes amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2002/2013) in light of provision made by the GDPR relating to the meaning of “consent”.'
See Keeling Schedules showing the amendments.
The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) (No. 2) Regulations 2019, SI 2019/485. The Explanatory note attached to the Regulations states as follows:
UK Brexit guidance:
Government Guidance: Data protection law — EU exit, which includes a Keeling Schedule for the Data Protection Act 2018 and a Keeling Schedule for the GDPR showing the amendments made by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.
‘Communication’, Preparing for the withdrawal of the United Kingdom from the European Union on 30 March 2019: a Contingency Action Plan by the EU - see page 12 regarding personal data:
"In the case of a no deal scenario, as of the withdrawal date, the transfer of personal data to the United Kingdom will become subject to the rules on international transfers in application of the General Data Protection Regulation (EU) 2016/679, Directive (EU) 2016/680 for the law enforcement sector and Regulation (EC) 45/2001 26 for the institutions and bodies of the European Union. The General Data Protection Regulation, Directive 2016/680 and Regulation 45/2001 contain a broad toolbox for data transfers to third countries. This includes in particular the so-called ʻappropriate safeguardsʼ (e.g. the Commission's approved Standard Contractual Clauses, Binding Corporate Rules, administrative arrangements) that can be used both by the private sector and public authorities. In addition, the three legislative acts mentioned above contain a number of derogations for specific situations that allow data transfers even in the absence of appropriate safeguards, for instance if the data subject provides explicit consent, for the performance of a contract, for exercise of legal claims or for important reasons of public interest. These are the same tools that are used with most countries in the world for which no adequacy decision exists. In view of the options available under the legislative acts mentioned, the adoption of an adequacy decision is not part of the Commission's contingency planning."