1

House of Commons

Tuesday 13 March 2018

Public Bill Committee Proceedings

Data Protection Bill [Lords]

[First and SEcond Sittings]

Glossary

This document shows the fate of each clause, schedule, amendment and new clause.

The following terms are used:

Agreed to: agreed without a vote.

Agreed to on division: agreed following a vote.

Negatived: rejected without a vote.

Negatived on division: rejected following a vote.

Not called: debated in a group of amendments, but not put to a decision.

Not moved: not debated or put to a decision.

Question proposed: debate underway but not concluded.

Withdrawn after debate: moved and debated but then withdrawn, so not put to a decision.

Not selected: not chosen for debate by the Chair.

Margot James

Agreed to

That—

(1)  

the Committee shall (in addition to its first meeting at 9.25 am on Tuesday 13

March) meet—

(a)  

at 2.00 pm on Tuesday 13 March;

(b)  

at 11.30 am and 2.00 pm on Thursday 15 March;

(c)  

at 9.25 am and 2.00 pm on Tuesday 20 March;

(d)  

at 11.30 am and 2.00 pm on Thursday 22 March;

(e)  

at 9.25 am and 2.00 pm on Tuesday 27 March.

(2)  

the proceedings shall be taken in the following order: Clauses 1 to 10;

Schedule 1; Clauses 11 to 15; Schedules 2 to 4; Clauses 16 and 17; Schedule

5; Clauses 18 to 22; Schedule 6; Clauses 23 to 30; Schedule 7; Clauses 31 to

35; Schedule 8; Clauses 36 to 86; Schedules 9 and 10; Clauses 87 to 112;

Schedule 11; Clauses 113 and 114; Schedule 12; Clauses 115 and 116;

Schedule 13; Clauses 117 and 118; Schedule 14; Clauses 119 to 153;

Public Bill Committee Proceedings: 13 March 2018          

2

Data Protection Bill-[Lords], continued

Schedule 15; Clause 154; Schedule 16; Clauses 155 to 181; Schedule 17;

Clauses 182 to 204; Schedule 18; Clauses 205 to 208; new Clauses; new

Schedules; remaining proceedings on the Bill;

(3)  

the proceedings shall (so far as not previously concluded) be brought to a

conclusion at 5.00 pm on Tuesday 27 March.

Margot James

That, subject to the discretion of the Chair, any written evidence received by the

Committee shall be reported to the House for publication.

Agreed to

Clauses 1 and 2 Agreed to.

Margot James

Agreed to  1

Clause  3,  page  2,  line  25,  leave out “personal data” and insert “information”

Margot James

Agreed to  2

Clause  3,  page  2,  line  26,  leave out “personal data, or on sets of personal data” and

insert “information, or on sets of information”

Margot James

Agreed to  3

Clause  3,  page  2,  line  41,  after “83” insert “and see also subsection (14)(c)”

Margot James

Agreed to  4

Clause  3,  page  3,  line  27,  at end insert —

“(aa)    

references to Chapter 2 of Part 2, or to a provision of that Chapter, include

that Chapter or that provision as applied by Chapter 3 of Part 2;”

Margot James

Agreed to  5

Clause  3,  page  3,  line  28,  leave out “processing and personal data are to processing

and personal data” and insert “personal data, and the processing of personal data, are to

personal data and processing”

Public Bill Committee Proceedings: 13 March 2018          

3

Data Protection Bill-[Lords], continued

Margot James

Agreed to  6

Clause  3,  page  3,  line  29,  at end insert —

“(c)    

references to a controller or processor are to a controller or processor in

relation to the processing of personal data to which Chapter 2 or 3 of Part

2, Part 3 or Part 4 applies.”

Clause, as amended, Agreed to.

Clauses 4 to 6 Agreed to.

Margot James

Agreed to  7

Clause  7,  page  5,  line  8,  leave out “a body specified” and insert “body specified or

described”

Margot James

Agreed to  8

Clause  7,  page  5,  line  13,  after “specified” insert “or described”

Clause, as amended, Agreed to.

Daniel Zeichner

Negatived on division  140

Clause  8,  page  5,  line  23,  after “includes” insert “but is not limited to,”.

Margot James

Agreed to  9

Clause  8,  page  5,  line  29,  at end insert—

“( )    

an activity that supports or promotes democratic engagement.”

Daniel Zeichner

Not called  141

Clause  8,  page  5,  line  29,  at end insert “or

(e)    

the exercise of research functions by public bodies.”

Clause, as amended, Agreed to.

Clause 9 Agreed to.

Public Bill Committee Proceedings: 13 March 2018          

4

Data Protection Bill-[Lords], continued

Brendan O’Hara

Stuart C. McDonald

Liam Byrne

Louise Haigh

Chris Elmore

Darren Jones

Negatived on division  129

Clause  10,  page  6,  line  19,  leave out subsections (6) and (7).

Clause Agreed to.

Margot James

Agreed to  76

Schedule  1,  page  123,  line  21,  at beginning insert “Except as otherwise provided,”

Margot James

Agreed to  77

Schedule  1,  page  124,  line  24,  leave out from “subject” to end of line 25

Margot James

Agreed to  78

Schedule  1,  page  124,  line  36,  at end insert—

“Racial and ethnic diversity at senior levels of organisations

8A  (1)  

This condition is met if the processing—

(a)    

is of personal data revealing racial or ethnic origin,

(b)    

is carried out as part of a process of identifying suitable individuals to

hold senior positions in a particular organisation, a type of

organisation or organisations generally,

(c)    

is necessary for the purposes of promoting or maintaining diversity in

the racial and ethnic origins of individuals who hold senior positions

in the organisation or organisations, and

(d)    

can reasonably be carried out without the consent of the data subject,

subject to the exception in sub-paragraph (3).

      (2)  

For the purposes of sub-paragraph (1)(d), processing can reasonably be carried

out without the consent of the data subject only where—

(a)    

the controller cannot reasonably be expected to obtain the consent of

the data subject, and

(b)    

the controller is not aware of the data subject withholding consent.

      (3)  

Processing does not meet the condition in sub-paragraph (1) if it is likely to

cause substantial damage or substantial distress to an individual.

      (4)  

For the purposes of this paragraph, an individual holds a senior position in an

organisation if the individual—

(a)    

holds a position listed in sub-paragraph (5), or

(b)    

does not hold such a position but is a senior manager of the

organisation.

      (5)  

Those positions are—

(a)    

a director, secretary or other similar officer of a body corporate;

(b)    

a member of a limited liability partnership;

Public Bill Committee Proceedings: 13 March 2018          

5

Data Protection Bill-[Lords], continued

(c)    

a partner in a partnership within the Partnership Act 1890, a limited

partnership registered under the Limited Partnerships Act 1907 or an

entity of a similar character formed under the law of a country or

territory outside the United Kingdom.

      (6)  

In this paragraph, “senior manager”, in relation to an organisation, means a

person who plays a significant role in—

(a)    

the making of decisions about how the whole or a substantial part of

the organisation’s activities are to be managed or organised, or

(b)    

the actual managing or organising of the whole or a substantial part of

those activities.

      (7)  

The reference in sub-paragraph (2)(b) to a data subject withholding consent

does not include a data subject merely failing to respond to a request for

consent.”

Margot James

Agreed to  79

Schedule  1,  page  125,  line  3,  at end insert—

    “( )  

If the processing consists of the disclosure of personal data to a competent

authority, or is carried out in preparation for such disclosure, the condition in

sub-paragraph (1) is met even if, when the processing is carried out, the

controller does not have an appropriate policy document in place (see

paragraph 5 of this Schedule).

Margot James

Agreed to  80

Schedule  1,  page  125,  line  4,  at end insert—

““competent authority” has the same meaning as in Part 3 of this Act (see

section 30).”

Margot James

Agreed to  81

Schedule  1,  page  125,  line  16,  at end insert—

“Regulatory requirements relating to unlawful acts and dishonesty etc

10A(1)  

This condition is met if—

(a)    

the processing is necessary for the purposes of complying with, or

assisting other persons to comply with, a regulatory requirement

which involves a person taking steps to establish whether another

person has—

(i)    

committed an unlawful act, or

(ii)    

been involved in dishonesty, malpractice or other seriously

improper conduct,

(b)    

in the circumstances, the controller cannot reasonably be expected to

obtain the consent of the data subject to the processing, and

(c)    

the processing is necessary for reasons of substantial public interest.

      (2)  

In this paragraph—

“act” includes a failure to act;

“regulatory requirement” means—

(a)    

a requirement imposed by legislation or by a person in exercise

of a function conferred by legislation, or

(b)    

a requirement forming part of generally accepted principles of

good practice relating to a type of body or an activity.”

Public Bill Committee Proceedings: 13 March 2018          

6

Data Protection Bill-[Lords], continued

Margot James

Agreed to  82

Schedule  1,  page  125,  line  35,  at end insert—

    “( )  

The condition in sub-paragraph (1) is met even if, when the processing is

carried out, the controller does not have an appropriate policy document in

place (see paragraph 5 of this Schedule).”

Margot James

Agreed to  83

Schedule  1,  page  126,  line  22,  at end insert—

“Support for individuals with a particular disability or medical condition

13A(1)  

This condition is met if the processing—

(a)    

is carried out by a not-for-profit body which provides support to

individuals with a particular disability or medical condition,

(b)    

is of a type of personal data falling within sub-paragraph (2) which

relates to an individual falling within sub-paragraph (3),

(c)    

is necessary for the purposes of—

(i)    

raising awareness of the disability or medical condition, or

(ii)    

providing support to individuals falling within sub-paragraph

(3) or enabling such individuals to provide support to each

other,

(d)    

can reasonably be carried out without the consent of the data subject,

and

(e)    

is necessary for reasons of substantial public interest.

      (2)  

The following types of personal data fall within this sub-paragraph—

(a)    

personal data revealing racial or ethnic origin;

(b)    

genetic data or biometric data;

(c)    

data concerning health;

(d)    

personal data concerning an individual’s sex life or sexual orientation.

      (3)  

An individual falls within this sub-paragraph if the individual is or has been a

member of the body mentioned in sub-paragraph (1)(a) and—

(a)    

has the disability or condition mentioned there, has had that disability

or condition or has a significant risk of developing that disability or

condition, or

(b)    

is a relative or carer of an individual who satisfies paragraph (a) of this

sub-paragraph.

      (4)  

For the purposes of sub-paragraph (1)(d), processing can reasonably be carried

out without the consent of the data subject only where—

(a)    

the controller cannot reasonably be expected to obtain the consent of

the data subject, and

(b)    

the controller is not aware of the data subject withholding consent.

      (5)  

In this paragraph—

“carer” means an individual who provides or intends to provide care for

another individual other than—

(a)    

under or by virtue of a contract, or

(b)    

as voluntary work;

“disability” has the same meaning as in the Equality Act 2010 (see

section 6 of, and Schedule 1 to, that Act).

Public Bill Committee Proceedings: 13 March 2018          

7

Data Protection Bill-[Lords], continued

      (6)  

The reference in sub-paragraph (4)(b) to a data subject withholding consent

does not include a data subject merely failing to respond to a request for

consent.”

Margot James

Agreed to  84

Schedule  1,  page  126,  line  27,  leave out “a reason” and insert “one of the reasons”

Margot James

Agreed to  85

Schedule  1,  page  126,  line  38,  at end insert—

“Safeguarding of children and of individuals at risk

14A(1)  

This condition is met if—

(a)    

the processing is necessary for the purposes of—

(i)    

protecting an individual from neglect or physical, mental or

emotional harm, or

(ii)    

protecting the physical, mental or emotional well-being of an

individual,

(b)    

the individual is—

(i)    

aged under 18, or

(ii)    

aged 18 or over and at risk,

(c)    

the processing is carried out without the consent of the data subject for

one of the reasons listed in sub-paragraph (2), and

(d)    

the processing is necessary for reasons of substantial public interest.

      (2)  

The reasons mentioned in sub-paragraph (1)(c) are—

(a)    

in the circumstances, consent to the processing cannot be given by the

data subject;

(b)    

in the circumstances, the controller cannot reasonably be expected to

obtain the consent of the data subject to the processing;

(c)    

the processing must be carried out without the consent of the data

subject because obtaining the consent of the data subject would

prejudice the provision of the protection mentioned in sub-paragraph

(1)(a).

      (3)  

For the purposes of this paragraph, an individual aged 18 or over is “at risk” if

the controller has reasonable cause to suspect that the individual—

(a)    

has needs for care and support,

(b)    

is experiencing, or at risk of, neglect or physical, mental or emotional

harm, and

(c)    

as a result of those needs is unable to protect himself or herself against

the neglect or harm or the risk of it.

      (4)  

In sub-paragraph (1)(a), the reference to the protection of an individual or of

the well-being of an individual includes both protection relating to a particular

individual and protection relating to a type of individual.”