Schedule 6: The applied GDPR and applied Chapter 2
As set out in Article 2(2), the GDPR only applies to the processing of data in the course of an activity which is subject to Union law. Chapter 3 of Part 2 of this Act provides for a separate regime to apply GDPR standards to general processing in the UK which is outside the scope of the GDPR. This Schedule specifies how the GDPR standards will be applied to areas outside the scope of Union law. This Schedule makes the necessary modifications to the provisions to reflect the application to non-Union law activities, creating an applied GDPR and applied Chapter 2 of Part 2. These provisions describe how Union law references should be interpreted in the domestic context.
	In Part 1 of Schedule 6, paragraphs 2 to 6 make general modifications to terms used throughout the GDPR. Paragraphs 7 onwards make more specific provision on an article-by-article basis, for example to remove provision which is irrelevant in a UK-only context. A given article of the GDPR may therefore be modified for the purposes of the applied GDPR by multiple paragraphs contained in this Schedule. In a similar vein, Part 2 of the Schedule concerns the application of Chapter 2 of Part 2 of the Act to general processing in the UK which is outside the scope of the GDPR.
	More specifically, paragraph 2 explains that save as otherwise specified, references in this Schedule to "this Regulation" and to provisions of the GDPR, refer to the applied GDPR.
	Paragraph 3 specifies that references to "Union law", "Member State Law", "the law of a Member State", and "Union or Member State law" should be regarded as meaning domestic law, unless exceptions apply. Paragraph 3(3) explains the meaning of "domestic law".
	Paragraph 4 specifies that references to "the Union", a "member state" and "member states" should be regarded as meaning the United Kingdom unless otherwise specified.
	Paragraph 5 specifies that references to a "supervisory authority", a "competent supervisory authority" or "supervisory authorities" should be regarded as meaning the Information Commissioner save as otherwise specified.
	Paragraph 6 specifies that references to "the national parliament" should be read as references to both Houses of Parliament.
	Paragraph 7 provides for the material scope of the applied GDPR – i.e. processing falling within Chapter 3 of Part 2 of the Act.
	Paragraph 8 specifies that the territorial application of the applied GDPR is the same as the territorial application of the Act, save for minor changes.
	Paragraph 9 modifies Article 4 of the GDPR (definitions) for the applied GDPR to make clear, for example, that references to "Commissioner" should be regarded as meaning the Information Commissioner.
	Paragraph 10 modifies Article 6 of the GDPR (lawfulness of processing) for the applied GDPR, to insert a cross-reference to the power in the Act to make further provision in secondary legislation.
	Paragraph 11 modifies Article 8 of the GDPR (conditions applicable to child's consent in relation to information society services) for the applied GDPR to make clear that the conditions are subject to this Act and that domestic contract law applies, rather than the "general contract law of Member States".
	Paragraph 12 modifies Article 9 of the GDPR (processing special categories of personal data) for the applied GDPR to replace references to "Union or Member State law" and other terms with domestic equivalents.
	Paragraph 13 modifies Article 10 of the GDPR (processing of personal data relating to criminal convictions and offences) for the applied GDPR to make clear that the relevant safeguards are found in domestic law, rather than Union or Member State law.
	Paragraph 14 modifies Article 12 of the GDPR (transparent information etc for the exercise of the rights of the data subject) for the applied GDPR to omit paragraph 8 (ability of the European Commission to provide for standardised icons).
	Paragraph 15 modifies Article 13 of the GDPR (personal data collected from data subject: information to be provided) for the applied GDPR to omit the reference to the "controller’s representative" and insert a cross-reference to Article 45(3) of the GDPR (transfers on the basis of an adequacy decision).
	Paragraph 16 modifies Article 14 of the GDPR (personal data collected other than from data subject: information to be provided) for the applied GDPR to omit the reference to the "controller’s representative", insert a cross-reference to Article 45(3) of the GDPR (transfers on the basis of an adequacy decision) and make clear that the relevant applicable law for Article 14(5)(c) is domestic law.
	Paragraph 17 modifies Article 17 of the GDPR (right to erasure) for the applied GDPR to replace references to "Union or Member State law" with references to domestic law.
	Paragraph 18 modifies Article 18 of the GDPR (right to restriction of processing) for the applied GDPR to replace the reference to the "reasons of important public interest of the Union or of a Member State" to refer instead to the United Kingdom.
	Paragraph 19 omits the reference to Directive 2002/58/EC (the Privacy and Electronic Communications Directive) in Article 21 of the GDPR (right to object) for the applied GDPR.
	Paragraph 20 modifies Article 22 of the GDPR (automated individual decision-making, including profiling) for the applied GDPR to use the definition of "qualifying significant decision" provided for in section 14 of the Act.
	Paragraph 21 modifies Article 23 of the GDPR (restrictions) for the applied GDPR to omit a reference to the "Union or Member State law to which the data controller or processor is subject" and replace it with a reference to section 15 of, and Schedules 2, 3 and 4 to, the Act, and to make clear that the reference to "of the Union or of a Member State" means the "United Kingdom".
	Paragraph 22 modifies Article 26 of the GDPR (joint controllers) for the applied GDPR to replace references to "Union or Member State law to which controllers are subject" to refer to domestic law.
	Paragraph 23 omits Article 27 of the GDPR (representatives of controllers or processors not established in the Union) from the applied GDPR.
	Paragraph 24 modifies Article 28 of the GDPR (processor) for the applied GDPR to replace references to Union or Member State law with reference to domestic law, and to omit paragraph 7 (ability of the European Commission to lay down standard contractual clauses).
	Paragraph 25 modifies Article 30 of the GDPR (records of processing activities) for the applied GDPR to omit references to the "controller’s representative" and "processor’s representative" and to add cross-references to section 28 of the Act.
	Paragraph 26 modifies Article 31 of the GDPR (cooperation with the supervisory authority) for the applied GDPR to omit reference to controllers’ and processors’ representatives.
	Paragraph 27, in relation to Article 35 of the GDPR (data protection impact assessment), omits from the applied GDPR the requirements on the Information Commissioner found in paragraphs 4, 5, 6 and 10 of that Article in relation to cross-border consistency.
	Paragraph 28 modifies paragraph 4 of Article 36 of the GDPR (prior consultation) for the applied GDPR to make clear that it is for the "Secretary of State" rather than the "Member State" to undertake relevant consultation, and to omit paragraph 5 (ability of Member State law to make further provision).
	Paragraph 29 modifies Article 37 of the GDPR (designation of the data protection officer) for the applied GDPR to omit paragraph 4 (ability of Member State law to make further provision, etc).
	Paragraph 30 modifies Article 39(1) of the GDPR (tasks of the data protection officer) for the applied GDPR to replace references to "other Union or Member State data protection provisions" with references to "other rules of domestic law relating to data protection".
	Paragraph 31 modifies Article 40 of the GDPR (codes of conduct) for the applied GDPR to omit paragraphs 3 (application to controllers not subject to the Regulation) and 7 to 11 (application to cross-border processing activities), and to make clear that it is for the Commissioner to encourage the drawing up of codes of conduct, rather than "the Member States, the supervisory authorities, the Board and the [European] Commission".
	Paragraph 32 modifies Article 41 of the GDPR (monitoring of approved codes of conduct) for the applied GDPR to omit paragraph 3 (cross-border consistency).
	Paragraph 33 modifies Article 42 of the GDPR (certification) for the applied GDPR to omit paragraph 2 (application to controllers not subject to the Regulation) and paragraph 8 (cross-border consistency), and to make clear that it is for the Commissioner to encourage the establishment of data protection certification mechanisms and of data protection seals and marks, rather than "the Member States, the supervisory authorities, the Board and the [European] Commission".
	Paragraph 34 modifies Article 43 of the GDPR (certification bodies) for the applied GDPR to omit provision relating to cross-border consistency. It also omits paragraph 8 (ability of the European Commission to adopt delegated or implementing acts in relation to certification mechanisms).
	Paragraph 35 modifies Article 45 of the GDPR (transfers on the basis of an adequacy decision) for the applied GDPR to make clear that relevant decisions are decisions made by the European Commission in accordance with Article 45 of the GDPR, rather than a separate process.
	Paragraph 36 modifies Article 46 of the GDPR (transfers subject to appropriate safeguards) for the applied GDPR to omit paragraph 2(c) (ability of the European Commission to lay down standard contractual clauses) and the second half of 2(d) (requirement for the European Commission to approve standard data protection clauses). It also omits paragraph 4 (cross-border consistency).
	Paragraph 37 modifies Article 47 of the GDPR (binding corporate rules) to omit provision relating to cross-border consistency and to replace references to "the competent courts of the Member States" and "on the territory of a Member State" with references to "a court" and "United Kingdom" respectively.
	Paragraph 38 modifies Article 49 of the GDPR (derogations for specific situations) for the applied GDPR to make clear that an adequacy decision is a decision under Article 45(3) of the GDPR; replace references to "Union law or in the law of the Member State to which the controller is subject" with references to "domestic law" and clarify that paragraph 1 is subject to domestic law, through section 18(2) of this Act.
	Paragraph 39 modifies Article 50 of the GDPR (international co-operation for the protection of personal data) for the applied GDPR to omit reference to obligations being placed on the Commission.
	Paragraph 40 modifies Article 51 of the GDPR (supervisory authority) for the applied GDPR to replace references to a supervisory authority with specific references to the Commissioner. It also omits paragraphs 2 to 4 (cross-border consistency), and the requirement on the Commissioner to facilitate the free flow of personal data covered by the applied GDPR "within the Union".
	Paragraph 41 modifies Article 52 of the GDPR (independence) for the applied GDPR to replace references to a supervisory authority with specific references to the Commissioner. It also omits paragraphs 4 to 6 (obligations on Member States).
	Paragraph 42 omits Article 53 of the GDPR (general conditions for the members of the supervisory authority) from the applied GDPR.
	Paragraph 43 omits Article 54 of the GDPR (rules on the establishment of the supervisory authority) from the applied GDPR.
	Paragraph 44 modifies Article 55 of the GDPR (competence) for the applied GDPR to omit references to competence in relation to cross-border processing activities.
	Paragraph 45 omits Article 56 of the GDPR (competence of the lead supervisory authority) from the applied GDPR.
	Paragraph 46 modifies Article 57 of the GDPR (tasks) for the applied GDPR to remove references to cross-border processing activities and the need for cross-border consistency. It also introduces a cross-reference to section 28 (national security and defence: modifications to Articles 9 and 32 of the applied GDPR).
	Paragraph 47 modifies Article 58 of the GDPR (powers) for the applied GDPR to omits the reference to the controller or processor’s representative and replace references to "Union or Member State procedural law" and "the Member State government" with references to "domestic law" and "the Secretary of State" respectively. It also omits paragraphs 3(c) (power in relation to Article 36(5)) (see paragraph 28 of this Schedule), 4 (requirement on Member States to provide appropriate safeguards), 5 (requirement on Member States to provide for judicial remedies) and 6 (ability of Member States to provide the supervisory authority with additional powers).
	Paragraph 48 modifies Article 59 of the GDPR (activity reports) to replace the reference to "the Government and other authorities as designated by Member State law" with a reference to the Secretary of State; and to omit references to the European Commission and European Data Protection Board.
	Paragraph 49 replaces Articles 60 to 76 of the GDPR (co-operation and consistency) with a much shorter replacement Article (new Article 61) in the applied GDPR. This Article explains how the Commissioner can cooperate with other supervisory authorities, including by conducting joint operations, and how the Commissioner should have regard to the activities of the European Data Protection Board under Article 68 of the GDPR, and any implementing acts adopted by the European Commission under Article 67 of the GDPR (exchange of information).
	Paragraph 50 modifies Article 77 of the GDPR (right to lodge a complaint with a supervisory authority) for the applied GDPR to remove references to cross-border application.
	Paragraph 51 modifies Article 78 of the GDPR (right to an effective judicial remedy against a supervisory authority) for the applied GDPR to remove provision relating to cross-border application and to omit paragraph 4 (requirement to forward opinions and decisions of the European Data Protection Board).
	Paragraph 52 modifies Article 79 of the GDPR (right to an effective judicial remedy against a controller or processor) for the applied GDPR to remove the reference to cross-border application.
	Paragraph 53 modifies Article 80 of the GDPR (representation of data subjects) for the applied GDPR to omit the reference to "where provided for by Member State law" from paragraph 1 and to replace the reference to "Member States" in paragraph 2 (ability of Member States to make additional provision) with a reference to the Secretary of State. Paragraph 53(c) clarifies that the Secretary of State may only exercise that power by making regulations under section 190 of the Act (see above).
	Paragraph 54 omits Article 81 of the GDPR (suspension of proceedings) from the applied GDPR.
	Paragraph 55 modifies Article 82 of the GDPR (right to compensation and liability) for the applied GDPR to replace the reference to "the courts competent under the law of the Member State" with reference to "a court".
	Paragraph 56 modifies Article 83 of the GDPR (general conditions for imposing administrative fines) for the applied GDPR to replace references to "Member States" and "Member State law" with references to this Act, "the Secretary of State" or "the United Kingdom" as appropriate. It also replaces paragraph 8 (requirement on Member States to provide appropriate procedural safeguards) with a cross reference to relevant provision of this Act, and omits paragraph 9 (provision in respect of Member States whose legal systems do not provide for administrative fines).
	Paragraph 57 modifies Article 84 (penalties) for the applied GDPR to replace paragraph 1 (requirement on Member States to lay down rules on other others) with a reference to the Act. It also omits paragraph 2 (requirement to notify to the European Commission).
	Paragraph 58 modifies Article 85 of the GDPR (processing and freedom of expression and information) for the applied GDPR to omit paragraphs 1 (requirement on Member States to reconcile the right to the protection of personal data with the right to freedom of expression and information) and 3 (requirement to notify to the European Commission), replace references to "Member States shall" with references to "the Secretary of State may", and add a cross reference to relevant provisions in this Act.
	Paragraph 59 modifies Article 86 of the GDPR (processing and public access to official documents) for the applied GDPR to replace the reference to "Union or Member State law to which the public authority or body is subject" with reference to "domestic law".
	Paragraph 60 omits Article 87 (processing of national identification number) from the applied GDPR.
	Paragraph 61 omits Article 88 of the GDPR (processing in the context of employment) from the applied GDPR.
	Paragraph 62 modifies Article 89 of the GDPR (safeguards and derogations relating processing for archiving purposes etc) for the applied GDPR to replace references to "Union or Member State law" with references to "the Secretary of State", and to replace the reference to "relevant provisions" with references to this Act.
	Paragraph 63 omits Article 90 of the GDPR (obligations of secrecy) from the applied GDPR.
	Paragraph 64 omits Article 91 of the GDPR (existing data protection rules of churches and religious associations) from the applied GDPR.
	Paragraph 65 omits Article 92 (exercise of the delegation) from the applied GDPR.
	Paragraph 66 omits Article 93 (committee procedure) from the applied GDPR.
	Paragraph 67 omits Article 94 (repeal of Directive 95/46/EC) from the applied GDPR.
	Paragraph 68 omits Article 95 (relationship with Directive 2002/58/EC) from the applied GDPR.
	Paragraph 69 modifies Article 96 of the GDPR (relationship with previously concluded Agreements) for the applied GDPR to replace references to "Member States" with references to "the United Kingdom or the Commissioner".
	Paragraph 70 omits Article 97 (Commission reports) from the applied GDPR.
	Paragraph 71 omits Article 98 (Commission reviews) from the applied GDPR.
	Paragraph 72 omits Article 99 (entry into force and application) from the applied GDPR.
	In Part 2, paragraph 73 introduces paragraphs 74 and 75 (modifications to Chapter 2 of Part 2).
	Paragraph 74 provides that the applied Chapter 2 should be interpreted identically to the regular Chapter 2, except that references to Chapter 2 are to be read as references to the applied Chapter 2; references to the GDPR are to be read as references to the applied GDPR; and references to data which is in-scope of Chapter 2 of Part 2 are to be read as references to data which is in-scope of Chapter 3 of Part 2. One exception is provided: the reference in section 18 to Article 45(3) of the GDPR should continue to be interpreted as a reference to the GDPR and not the applied GDPR.
	Paragraph 75 establishes one further difference between Chapter 2 and the applied Chapter 2. It provides that, in the applied Chapter 2, the reference in section 16 to "Member State law" should be replaced with a reference to "the Secretary of State".