Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (the EU Exit Regulations) are a key piece of legislation that transposes EU law into UK domestic law following the United Kingdoms departure from the European Union. They primarily amend existing statutes principally the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and the Telecommunications (Lawful Interception) (Amendment) Regulations 2003 to ensure continuity of legal obligations after the Brexit transition period.

Why the Regulations Were Needed

When the UK left the EU, the European Union law that applied domestically ceased to have effect. To avoid a legal vacuum, the EU Exit Regulations:

• Convert directly applicable EU regulations and EUderived UK law into domestic law.
• Replace references to EU law with UK law where appropriate.
• Preserve the substantive rights and duties that organisations and individuals enjoy under dataprotection and electroniccommunications rules.

Key Areas Affected

1. Data Protection Act 2018 (DPA 2018)

The DPA 2018 implements the EU General Data Protection Regulation (GDPR) in the UK. The EU Exit Regulations amend the DPA 2018 by:

• Changing the definition of European Union law to UK law where the text makes that reference.
• Ensuring the Information Commissioners (ICO) powers remain intact, including the ability to issue enforcement notices, fines and to order the deletion of data.
• Preserving the adequacy decision framework that governs data transfers from the UK to the EU, until a separate decision is made by the European Commission.

2. Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR)

PECR regulates electronic marketing, cookie usage, and the security of public electronic communications services. The amendments:

• Replace references to EU law with UK law.
• Maintain the requirement for prior consent before placing cookies or similar tracking technologies on devices.
• Continue to require reasonable security for electronic communications networks and services.

3. Telecommunications (Lawful Interception) (Amendment) Regulations 2003

These regulations give law enforcement agencies powers to intercept communications lawfully. The EU Exit Regulations confirm that:

• The legal basis for interception remains unchanged.
• Any references to European Union are substituted with United Kingdom.

How the Regulations Affect Organisations

Business operators, charities, public bodies and any entity that processes personal data or provides electronic communications services must continue to comply with the same substantive standards that applied before Brexit. The main practical implications are:

• Continuity of obligations: No new compliance regime is introduced; existing duties under the DPA 2018 and PECR persist.
• Documentation updates: Contracts, privacy notices and internal policies that cite EU law must be revised to reference the UK law equivalents.
• Datatransfer mechanisms: Organisations relying on Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs) for transfers between the UK and the EU should verify that those mechanisms remain valid under the European Commissions adequacy decision (currently in force) and anticipate any future changes.
• Enforcement landscape: The ICO retains its enforcement powers; fines of up to 17.5million or 4% of global turnover (whichever is higher) remain applicable for serious breaches.

Compliance Checklist

The following list can help organisations confirm that they are aligned with the EU Exit Regulations:

1. Review legal references: Search policies, terms of service and contracts for EU law or European Union and replace with UK law.
2. Validate datatransfer safeguards: Confirm that any crossborder transfers to the EU rely on a valid adequacy decision, SCCs, BCRs or other recognised mechanisms.
3. Cookie consent mechanisms: Ensure that cookie banners and consent records comply with PECR requirements.
4. Security assessments: Conduct regular technical and organisational security reviews to meet the reasonable security standard for electronic communications.
5. Recordkeeping: Maintain uptodate records of processing activities (RoPA) as required by the DPA 2018.
6. Datasubject rights process: Verify that procedures for handling access, rectification, erasure and portability requests are fully operational.
7. Training and awareness: Provide staff training on the updated legal terminology and any changes to internal reporting lines.

Future Developments

Although the EU Exit Regulations provide a stable bridge, the regulatory landscape will continue to evolve:

• UKEU datatransfer framework: The European Commission may review the adequacy decision; organisations should monitor announcements and be prepared to adopt alternative safeguards if needed.
• Domestic reforms: The UK government has indicated an intention to review dataprotection law to tailor it to the UK context, potentially diverging from the GDPR over time.
• International standards: The UK may align with other nonEU regimes (e.g., the US CLOUD Act) which could affect crossborder data requests.

Resources and Further Reading

• Original text of the EU Exit Regulations (legislation.gov.uk)
• ICOs guide to data protection
• ICOs guide to PECR
• EUUK adequacy decision (European Commission)

Conclusion

The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 ensure that the United Kingdoms dataprotection and electroniccommunications regime remains largely unchanged after Brexit. By converting EU references into UK references, the Regulations create continuity for businesses and individuals while preserving the substantive rights established under the GDPR and PECR. Organisations should focus on updating documentation, confirming the validity of crossborder transfer mechanisms and maintaining robust security and governance practices. Ongoing monitoring of both UKspecific reforms and EU decisions will be essential to stay compliant in a postBrexit data landscape.