some default text...

Session 2017-19
Internet Publications
Other Bills before Parliament


 
 

1

 

House of Commons

 
 

Tuesday 13 March 2018

 

Public Bill Committee Proceedings

 

Data Protection Bill [Lords]


 

[First and SEcond Sittings]


 

Glossary

 

This document shows the fate of each clause, schedule, amendment and new clause.

 

The following terms are used:

 

Agreed to: agreed without a vote.

 

Agreed to on division: agreed following a vote.

 

Negatived: rejected without a vote.

 

Negatived on division: rejected following a vote.

 

Not called: debated in a group of amendments, but not put to a decision.

 

Not moved: not debated or put to a decision.

 

Question proposed: debate underway but not concluded.

 

Withdrawn after debate: moved and debated but then withdrawn, so not put to a decision.

 

Not selected: not chosen for debate by the Chair.

 

 

Margot James

 

Agreed to

 

That—

 

(1)  

the Committee shall (in addition to its first meeting at 9.25 am on Tuesday 13

 

March) meet—

 

(a)  

at 2.00 pm on Tuesday 13 March;

 

(b)  

at 11.30 am and 2.00 pm on Thursday 15 March;

 

(c)  

at 9.25 am and 2.00 pm on Tuesday 20 March;

 

(d)  

at 11.30 am and 2.00 pm on Thursday 22 March;

 

(e)  

at 9.25 am and 2.00 pm on Tuesday 27 March.

 

(2)  

the proceedings shall be taken in the following order: Clauses 1 to 10;

 

Schedule 1; Clauses 11 to 15; Schedules 2 to 4; Clauses 16 and 17; Schedule

 

5; Clauses 18 to 22; Schedule 6; Clauses 23 to 30; Schedule 7; Clauses 31 to

 

35; Schedule 8; Clauses 36 to 86; Schedules 9 and 10; Clauses 87 to 112;

 

Schedule 11; Clauses 113 and 114; Schedule 12; Clauses 115 and 116;

 

Schedule 13; Clauses 117 and 118; Schedule 14; Clauses 119 to 153;


 
 

Public Bill Committee Proceedings: 13 March 2018          

2

 

Data Protection Bill-[Lords], continued

 
 

Schedule 15; Clause 154; Schedule 16; Clauses 155 to 181; Schedule 17;

 

Clauses 182 to 204; Schedule 18; Clauses 205 to 208; new Clauses; new

 

Schedules; remaining proceedings on the Bill;

 

(3)  

the proceedings shall (so far as not previously concluded) be brought to a

 

conclusion at 5.00 pm on Tuesday 27 March.

 


 

Margot James

 

That, subject to the discretion of the Chair, any written evidence received by the

 

Committee shall be reported to the House for publication.

 

Agreed to

 


 

Clauses 1 and 2 Agreed to.

 

Margot James

 

Agreed to  1

 

Clause  3,  page  2,  line  25,  leave out “personal data” and insert “information”

 

Margot James

 

Agreed to  2

 

Clause  3,  page  2,  line  26,  leave out “personal data, or on sets of personal data” and

 

insert “information, or on sets of information”

 

Margot James

 

Agreed to  3

 

Clause  3,  page  2,  line  41,  after “83” insert “and see also subsection (14)(c)”

 

Margot James

 

Agreed to  4

 

Clause  3,  page  3,  line  27,  at end insert —

 

“(aa)    

references to Chapter 2 of Part 2, or to a provision of that Chapter, include

 

that Chapter or that provision as applied by Chapter 3 of Part 2;”

 

Margot James

 

Agreed to  5

 

Clause  3,  page  3,  line  28,  leave out “processing and personal data are to processing

 

and personal data” and insert “personal data, and the processing of personal data, are to

 

personal data and processing”


 
 

Public Bill Committee Proceedings: 13 March 2018          

3

 

Data Protection Bill-[Lords], continued

 
 

Margot James

 

Agreed to  6

 

Clause  3,  page  3,  line  29,  at end insert —

 

“(c)    

references to a controller or processor are to a controller or processor in

 

relation to the processing of personal data to which Chapter 2 or 3 of Part

 

2, Part 3 or Part 4 applies.”

 

Clause, as amended, Agreed to.

 

Clauses 4 to 6 Agreed to.

 


 

Margot James

 

Agreed to  7

 

Clause  7,  page  5,  line  8,  leave out “a body specified” and insert “body specified or

 

described”

 

Margot James

 

Agreed to  8

 

Clause  7,  page  5,  line  13,  after “specified” insert “or described”

 

Clause, as amended, Agreed to.

 


 

Daniel Zeichner

 

Negatived on division  140

 

Clause  8,  page  5,  line  23,  after “includes” insert “but is not limited to,”.

 

Margot James

 

Agreed to  9

 

Clause  8,  page  5,  line  29,  at end insert—

 

“( )    

an activity that supports or promotes democratic engagement.”

 

Daniel Zeichner

 

Not called  141

 

Clause  8,  page  5,  line  29,  at end insert “or

 

(e)    

the exercise of research functions by public bodies.”

 

Clause, as amended, Agreed to.

 

Clause 9 Agreed to.

 



 
 

Public Bill Committee Proceedings: 13 March 2018          

4

 

Data Protection Bill-[Lords], continued

 
 

Brendan O’Hara

 

Stuart C. McDonald

 

Liam Byrne

 

Louise Haigh

 

Chris Elmore

 

Darren Jones

 

Negatived on division  129

 

Clause  10,  page  6,  line  19,  leave out subsections (6) and (7).

 

Clause Agreed to.

 


 

Margot James

 

Agreed to  76

 

Schedule  1,  page  123,  line  21,  at beginning insert “Except as otherwise provided,”

 

Margot James

 

Agreed to  77

 

Schedule  1,  page  124,  line  24,  leave out from “subject” to end of line 25

 

Margot James

 

Agreed to  78

 

Schedule  1,  page  124,  line  36,  at end insert—

 

“Racial and ethnic diversity at senior levels of organisations

 

8A  (1)  

This condition is met if the processing—

 

(a)    

is of personal data revealing racial or ethnic origin,

 

(b)    

is carried out as part of a process of identifying suitable individuals to

 

hold senior positions in a particular organisation, a type of

 

organisation or organisations generally,

 

(c)    

is necessary for the purposes of promoting or maintaining diversity in

 

the racial and ethnic origins of individuals who hold senior positions

 

in the organisation or organisations, and

 

(d)    

can reasonably be carried out without the consent of the data subject,

 

            

subject to the exception in sub-paragraph (3).

 

      (2)  

For the purposes of sub-paragraph (1)(d), processing can reasonably be carried

 

out without the consent of the data subject only where—

 

(a)    

the controller cannot reasonably be expected to obtain the consent of

 

the data subject, and

 

(b)    

the controller is not aware of the data subject withholding consent.

 

      (3)  

Processing does not meet the condition in sub-paragraph (1) if it is likely to

 

cause substantial damage or substantial distress to an individual.

 

      (4)  

For the purposes of this paragraph, an individual holds a senior position in an

 

organisation if the individual—

 

(a)    

holds a position listed in sub-paragraph (5), or

 

(b)    

does not hold such a position but is a senior manager of the

 

organisation.

 

      (5)  

Those positions are—

 

(a)    

a director, secretary or other similar officer of a body corporate;

 

(b)    

a member of a limited liability partnership;


 
 

Public Bill Committee Proceedings: 13 March 2018          

5

 

Data Protection Bill-[Lords], continued

 
 

(c)    

a partner in a partnership within the Partnership Act 1890, a limited

 

partnership registered under the Limited Partnerships Act 1907 or an

 

entity of a similar character formed under the law of a country or

 

territory outside the United Kingdom.

 

      (6)  

In this paragraph, “senior manager”, in relation to an organisation, means a

 

person who plays a significant role in—

 

(a)    

the making of decisions about how the whole or a substantial part of

 

the organisation’s activities are to be managed or organised, or

 

(b)    

the actual managing or organising of the whole or a substantial part of

 

those activities.

 

      (7)  

The reference in sub-paragraph (2)(b) to a data subject withholding consent

 

does not include a data subject merely failing to respond to a request for

 

consent.”

 

Margot James

 

Agreed to  79

 

Schedule  1,  page  125,  line  3,  at end insert—

 

    “( )  

If the processing consists of the disclosure of personal data to a competent

 

authority, or is carried out in preparation for such disclosure, the condition in

 

sub-paragraph (1) is met even if, when the processing is carried out, the

 

controller does not have an appropriate policy document in place (see

 

paragraph 5 of this Schedule).

 

Margot James

 

Agreed to  80

 

Schedule  1,  page  125,  line  4,  at end insert—

 

““competent authority” has the same meaning as in Part 3 of this Act (see

 

section 30).”

 

Margot James

 

Agreed to  81

 

Schedule  1,  page  125,  line  16,  at end insert—

 

“Regulatory requirements relating to unlawful acts and dishonesty etc

 

10A(1)  

This condition is met if—

 

(a)    

the processing is necessary for the purposes of complying with, or

 

assisting other persons to comply with, a regulatory requirement

 

which involves a person taking steps to establish whether another

 

person has—

 

(i)    

committed an unlawful act, or

 

(ii)    

been involved in dishonesty, malpractice or other seriously

 

improper conduct,

 

(b)    

in the circumstances, the controller cannot reasonably be expected to

 

obtain the consent of the data subject to the processing, and

 

(c)    

the processing is necessary for reasons of substantial public interest.

 

      (2)  

In this paragraph—

 

“act” includes a failure to act;

 

“regulatory requirement” means—

 

(a)    

a requirement imposed by legislation or by a person in exercise

 

of a function conferred by legislation, or

 

(b)    

a requirement forming part of generally accepted principles of

 

good practice relating to a type of body or an activity.”


 
 

Public Bill Committee Proceedings: 13 March 2018          

6

 

Data Protection Bill-[Lords], continued

 
 

Margot James

 

Agreed to  82

 

Schedule  1,  page  125,  line  35,  at end insert—

 

    “( )  

The condition in sub-paragraph (1) is met even if, when the processing is

 

carried out, the controller does not have an appropriate policy document in

 

place (see paragraph 5 of this Schedule).”

 

Margot James

 

Agreed to  83

 

Schedule  1,  page  126,  line  22,  at end insert—

 

“Support for individuals with a particular disability or medical condition

 

13A(1)  

This condition is met if the processing—

 

(a)    

is carried out by a not-for-profit body which provides support to

 

individuals with a particular disability or medical condition,

 

(b)    

is of a type of personal data falling within sub-paragraph (2) which

 

relates to an individual falling within sub-paragraph (3),

 

(c)    

is necessary for the purposes of—

 

(i)    

raising awareness of the disability or medical condition, or

 

(ii)    

providing support to individuals falling within sub-paragraph

 

(3) or enabling such individuals to provide support to each

 

other,

 

(d)    

can reasonably be carried out without the consent of the data subject,

 

and

 

(e)    

is necessary for reasons of substantial public interest.

 

      (2)  

The following types of personal data fall within this sub-paragraph—

 

(a)    

personal data revealing racial or ethnic origin;

 

(b)    

genetic data or biometric data;

 

(c)    

data concerning health;

 

(d)    

personal data concerning an individual’s sex life or sexual orientation.

 

      (3)  

An individual falls within this sub-paragraph if the individual is or has been a

 

member of the body mentioned in sub-paragraph (1)(a) and—

 

(a)    

has the disability or condition mentioned there, has had that disability

 

or condition or has a significant risk of developing that disability or

 

condition, or

 

(b)    

is a relative or carer of an individual who satisfies paragraph (a) of this

 

sub-paragraph.

 

      (4)  

For the purposes of sub-paragraph (1)(d), processing can reasonably be carried

 

out without the consent of the data subject only where—

 

(a)    

the controller cannot reasonably be expected to obtain the consent of

 

the data subject, and

 

(b)    

the controller is not aware of the data subject withholding consent.

 

      (5)  

In this paragraph—

 

“carer” means an individual who provides or intends to provide care for

 

another individual other than—

 

(a)    

under or by virtue of a contract, or

 

(b)    

as voluntary work;

 

“disability” has the same meaning as in the Equality Act 2010 (see

 

section 6 of, and Schedule 1 to, that Act).


 
 

Public Bill Committee Proceedings: 13 March 2018          

7

 

Data Protection Bill-[Lords], continued

 
 

      (6)  

The reference in sub-paragraph (4)(b) to a data subject withholding consent

 

does not include a data subject merely failing to respond to a request for

 

consent.”

 

Margot James

 

Agreed to  84

 

Schedule  1,  page  126,  line  27,  leave out “a reason” and insert “one of the reasons”

 

Margot James

 

Agreed to  85

 

Schedule  1,  page  126,  line  38,  at end insert—

 

“Safeguarding of children and of individuals at risk

 

14A(1)  

This condition is met if—

 

(a)    

the processing is necessary for the purposes of—

 

(i)    

protecting an individual from neglect or physical, mental or

 

emotional harm, or

 

(ii)    

protecting the physical, mental or emotional well-being of an

 

individual,

 

(b)    

the individual is—

 

(i)    

aged under 18, or

 

(ii)    

aged 18 or over and at risk,

 

(c)    

the processing is carried out without the consent of the data subject for

 

one of the reasons listed in sub-paragraph (2), and

 

(d)    

the processing is necessary for reasons of substantial public interest.

 

      (2)  

The reasons mentioned in sub-paragraph (1)(c) are—

 

(a)    

in the circumstances, consent to the processing cannot be given by the

 

data subject;

 

(b)    

in the circumstances, the controller cannot reasonably be expected to

 

obtain the consent of the data subject to the processing;

 

(c)    

the processing must be carried out without the consent of the data

 

subject because obtaining the consent of the data subject would

 

prejudice the provision of the protection mentioned in sub-paragraph

 

(1)(a).

 

      (3)  

For the purposes of this paragraph, an individual aged 18 or over is “at risk” if

 

the controller has reasonable cause to suspect that the individual—

 

(a)    

has needs for care and support,

 

(b)    

is experiencing, or at risk of, neglect or physical, mental or emotional

 

harm, and

 

(c)    

as a result of those needs is unable to protect himself or herself against

 

the neglect or harm or the risk of it.

 

      (4)  

In sub-paragraph (1)(a), the reference to the protection of an individual or of

 

the well-being of an individual includes both protection relating to a particular

 

individual and protection relating to a type of individual.”


 
Back to StartNext
 

Revised 13 March 2018