INHALT

Commission Implementing Decision (EU) 2021/1772 of 28 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (notified under document C(2021)4800) (Text with EEA relevance)

COMMISSION IMPLEMENTING REGULATION (EU) 2021/1772
of 28 June 2021
pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom
(notified under document C(2021)4800)
(Text with EEA relevance)
1.
INTRODUCTION
2.
RULES APPLYING TO THE PROCESSING OF PERSONAL DATA
2.1.
The constitutional framework
2.2.
The data protection framework of the United Kingdom
2.3.
Material and territorial scope
2.4.
Definitions of personal data and concepts of controller and processor
2.5.
Safeguards, rights and obligations
2.5.1.
Lawfulness and fairness of processing
2.5.2.
Processing of special categories of personal data
2.5.3.
Purpose limitation, accuracy, data minimisation, storage limitation and data security
2.5.4.
Transparency
2.5.5.
Individual rights
2.5.5.1.
The substantive rights
2.5.5.2.
Restrictions to individual rights and other provisions
2.5.6.
Restrictions for personal data processed for journalistic, artistic, academic and literary purposes as well as archiving and research
2.5.7.
Restrictions on onward transfers
2.5.8.
Accountability
2.6.
Oversight and enforcement
2.6.1.
Independent Oversight
2.6.2.
Enforcement, including sanctions
2.6.3.
Oversight over the judiciary
2.6.4.
Redress
3.
ACCESS AND USE OF PERSONAL DATA TRANSFERRED FROM THE EUROPEAN UNION BY PUBLIC AUTHORITIES IN THE UNITED KINGDOM
3.1.
General legal framework
3.2.
Access and use by United Kingdom public authorities for criminal law enforcement purposes
3.2.1.
Legal bases and applicable limitations/safeguards
3.2.1.1.
Search warrants and production orders
3.2.1.2.
Investigatory powers for law enforcement purposes
3.2.2.
Further use of the information collected
3.2.3.
Oversight
3.2.3.1.
Oversight over Part 3 of the DPA 2018
3.2.3.2.
Other oversight bodies in the area of criminal law enforcement
3.2.3.3. Parliamentary oversight in the area of criminal law enforcement
3.2.4.
Redress
3.2.4.1.
Redress mechanisms available under the IPA 2016
3.3.
Access and use by United Kingdom public authorities for national security purposes
3.3.1.
Legal bases, limitations and safeguards
3.3.1.1.
Investigatory powers exercised in the context of national security
3.3.1.1.1 Targeted interception and examination
3.3.1.1.2 Targeted acquisition and retention of communications data
(i)
Authorisation for obtaining communications data
(ii)
Notice requiring the retention of communication data
3.3.1.1.3 Equipment interference
3.3.1.1.4 Exercise of bulk powers
3.3.1.1.4.1 Bulk interception and bulk equipment interference
(i)
Conditions and criteria for the issuance of the warrant
(ii)
Additional safeguards
3.3.1.1.4.2 Bulk acquisition of communications data
3.3.1.1.4.3 Retention and examination of bulk personal datasets
3.3.2.
Further use of the information collected
3.3.3.
Oversight
3.3.3.1.
Oversight under Part 4 of the DPA
3.3.3.2.
Oversight of the use of investigatory powers under the IPA 2016
3.3.3.3.
Parliamentary oversight of Intelligence services
3.3.4.
Redress
3.3.4.1
Redress mechanisms available under Part 4 of the DPA
3.3.4.2
Redress mechanisms available under the IPA 2016
3.3.4.3
Other available redress mechanisms
4.
CONCLUSION
5.
EFFECTS OF THIS DECISION AND ACTION OF DATA PROTECTION AUTHORITIES
6.
MONITORING, SUSPENSION, REPEAL OR AMENDMENT OF THIS DECISION
7.
DURATION AND RENEWAL OF THIS DECISION
8.
FINAL CONSIDERATIONS
Article 1
Article 2
Article 3
Article 4
Article 5