Citation, commencement and extent

1.—(1) These Regulations may be cited as the Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023.

(2) These Regulations come into force immediately before the end of 2023, or on the day after the day on which they are made, whichever is later.

(3) These Regulations extend to England and Wales, Scotland and Northern Ireland.

Amendment of the United Kingdom General Data Protection Regulation

2.—(1)  Regulation (EU) 2016/679of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation)( 3) is amended as follows.

(2) In Article 1 (subject-matter and objectives), for paragraph (2) substitute—

“2.   This Regulation contributes to the protection of individuals’ fundamental rights and freedoms. ”.

(3) In Article 4 (definitions), for point (28) substitute—

“(28)  references to fundamental rights or fundamental freedoms (however expressed) are to the Convention rights within the meaning of the Human Rights Act 1998. ”.

(4) In Article 9(2)(g) (processing of special categories of personal data), omit “, respect the essence of the right to data protection”.

(5) In Article 9(2)(j) (processing of special categories of personal data), omit “, respect the essence of the right to data protection”.

(6) In Article 50(b) (international cooperation for the protection of personal data), omit “other”.

(7) In Article 85(2) (processing and freedom of expression and information), omit “the right to”.

(8) In Article 86(1) (processing and public access to official documents), omit “the right to”.

Amendment of the Data Protection Act 2018

3.—(1) The Data Protection Act 2018( 4) is amended as follows.

(2) In section 120(1)(b) (further international role), omit “other”.

(3) In section 205 (general interpretation)( 5), for subsection (1A) substitute—

“(1A)  In this Act, references to fundamental rights or fundamental freedoms (however expressed) are to the Convention rights within the meaning of the Human Rights Act 1998. ”.

EXPLANATORY NOTE

(This note is not part of the Regulations)

These Regulations revoke and replace Article 4(28) of the UK General Data Protection Regulation (EUR 2016/679) (UK GDPR) and section 205(1A) of the Data Protection Act 2018 (DPA 2018) which relate to the meaning of references to fundamental rights and fundamental freedoms in data protection legislation.

Article 4(28) and section 205(1A) are secondary retained EU law within the meaning of section 11(2) of the Retained EU Law (Revocation and Reform) Act 2023 (the 2023 Act) (c. 28). These provisions define references to fundamental rights and fundamental freedoms in the UK GDPR and DPA 2018 as rights which were retained by virtue of section 4 of the European Union (Withdrawal) Act 2018 (EUWA 2018). Section 2 of the 2023 Act repeals section 4 of EUWA 2018 at the end of 2023 and anything which is retained EU law by virtue of that section will not be recognised or available in domestic law after that time.

These Regulations insert new definitions of fundamental rights and fundamental freedoms into the UK GDPR and DPA 2018 so that after the end of 2023 references to fundamental rights and fundamental freedoms in this legislation will be references to rights under the European Convention on Human Rights within the meaning of the Human Rights Act 1998. These Regulations also make consequential amendments to the UK GDPR and DPA 2018 as a result of the new definitions and amend provisions of the UK GDPR which refer to EU concepts of fundamental rights and fundamental freedoms which are redundant in UK law.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.