Miscellaneous Retention of personal data under the Market Abuse Regulation
The legal background relevant to MAR more broadly is explained in paragraphs 296 and 297.
	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (‘EU GDPR’) is an EU regulation which came into effect from 25 May 2018, repealing and replacing Directive 95/46/EC of the European Parliament and of the Council of 24 October 2005 (General Data Protection Regulation). The EU GDPR set out the key principles, rights and obligations for most processing of personal data in the EU.
	Following the end of the Transition Period the EU GDPR forms part of retained EU law, by operation of the EUWA. The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419) deliver the necessary amendments to ensure that the EU Regulation continues to function appropriately and effectively following the end of the Transition Period. The EU Regulation as amended and forming part of retained EU law is referred to as the GDPR.
	Alongside the GDPR, the DPA 2018 sets out the data protection framework in the UK. It contains three separate data protection regimes: a general processing regime (the GDPR); a separate regime for law enforcement authorities; and a separate regime for the three intelligence services.
	The Act amends Article 28 of MAR. Article 28 of MAR appears in Chapter Four of MAR, which makes provision for co-operation, professional secrecy and data protection by the FCA. Article 28 provides that nothing in MAR authorises the FCA to disclose personal data in a way that would contravene any provision of the GDPR or theDPA2018.
	In particular, Article 5(1)(c) of the GDPR requires that personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed: this is known as the principle of ‘data minimisation’.
	Personal data is not defined in MAR, but the Government considers that the correct definition of personal data for these purposes is that contained within the GDPR Article 4(1), that is "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person".