207. The Passports Act 2008 is amended—

(a) in section 2, by—

(i) the deletion of the definitions of “Act of 1988”, “automated data” and “data”,

(ii) the insertion of the following definition:

“ ‘Act of 2018’ means the Data Protection Act 2018;”,

(iii) the substitution of the following definition for the definition of “biometric data”:

“ ‘biometric data’ means biometric data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;”,

(iv) the insertion of the following definition:

“ ‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016³⁵ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

(v) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;”,

and

(vi) the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018.”,

(b) in section 8, by the substitution in subsection (1) of “Subject to the Data Protection Regulation and the Act of 2018” for “Subject to the Data Protection Acts 1988 and 2003”, and

(c) in section 21(1)(b), by the substitution of “personal data” for “data” in each place it occurs.