1

House of Commons

Thursday 22 March 2018

Public Bill Committee Proceedings

Data Protection Bill [Lords]

[Seventh and Eighth Sittings]

Glossary

This document shows the fate of each clause, schedule, amendment and new clause.

The following terms are used:

Agreed to: agreed without a vote.

Agreed to on division: agreed following a vote.

Negatived: rejected without a vote.

Negatived on division: rejected following a vote.

Not called: debated in a group of amendments, but not put to a decision.

Not moved: not debated or put to a decision.

Question proposed: debate underway but not concluded.

Withdrawn after debate: moved and debated but then withdrawn, so not put to a decision.

Not selected: not chosen for debate by the Chair.

Margot James

Agreed to  127

Schedule  17,  page  206,  line  15,  leave out paragraph (a) and insert—

“(a)    

a relevant health record (see paragraph 1A),”

Margot James

Agreed to  128

Schedule  17,  page  206,  line  21,  at end insert—

“Relevant health records

1A         

“Relevant health record” means a health record which has been or is to be

obtained by a data subject in the exercise of a data subject access right.”

Public Bill Committee Proceedings: 22 March 2018          

2

Data Protection Bill-[Lords], continued

Margot James

Agreed to  181

Schedule  17,  page  207,  line  22,  leave out sub-paragraph (iii) and insert—

“(iii)    

Article 45 of the Criminal Justice (Children) (Northern

Ireland) Order 1998 (S.I. 1998/1504 (N.I. 9));”

Schedule, as amended, Agreed to.

Clause 182 Agreed to.

Margot James

Agreed to  63

Clause  183,  page  105,  line  42,  leave out “80” and insert “80(1)”

Margot James

Agreed to  64

Clause  183,  page  105,  line  44,  leave out “certain rights” and insert “the data

subject’s rights under Articles 77, 78 and 79 of the GDPR (rights to lodge complaints and

to an effective judicial remedy)”

Margot James

Agreed to  65

Clause  183,  page  106,  line  7,  leave out “under the following provisions” and insert

“of a data subject”

Margot James

Agreed to  66

Clause  183,  page  106,  line  9,  at beginning insert “rights under”

Margot James

Agreed to  67

Clause  183,  page  106,  line  10,  at beginning insert “rights under”

Margot James

Agreed to  68

Clause  183,  page  106,  line  11,  at beginning insert “rights under”

Liam Byrne

Louise Haigh

Chris Elmore

Darren Jones

Not called  154

Clause  183,  page  106,  line  24,  at end insert—

“(4A)    

In accordance with Article 80(2) of the GDPR, a person who satisfies the

conditions in Article 80(1) and who considers that the rights of a data subject

under the GDPR have been infringed as a result of data processing, may bring

proceedings, on behalf of the data subject and independently of the data subject’s

mandate—

(a)    

pursuant to Article 77 (right to lodge a complaint with a supervisory

authority),

Public Bill Committee Proceedings: 22 March 2018          

3

Data Protection Bill-[Lords], continued

(b)    

to exercise the rights referred to in Article 78 (right to an effective

judicial remedy against a supervisory authority),

(c)    

to exercise the rights referred to in Article 79 (right to an effective

judicial remedy against a controller or processor).

(4B)    

An individual who considers that rights under the GDPR, this Act or any other

enactment relating to data protection have been infringed in respect of a class of

individuals of which he or she forms part may bring proceedings in respect of the

infringement as a representative of the class (independently of the mandate of

other members of the class), and—

(a)    

for the purposes of this subsection “proceedings” includes proceedings

for damages, and any damages recovered are to be distributed or

otherwise applied as directed by the court,

(b)    

in the case of a class consisting of or including children under the age of

18, an individual may bring proceedings as a representative of the class

whether or not the individual’s own rights have been infringed,

(c)    

the court in which proceedings are brought may direct that the individual

may not act as a representative, or may act as a representative only to a

specified extent, for a specified purpose or subject to specified

conditions,

(d)    

a direction under paragraph (c) may (subject to any provision of rules of

court relating to proceedings under this subsection) be made on the

application of a party or a member of the class, or of the court’s own

motion, and

(e)    

subject to any direction of the court, a judgment or order given in

proceedings in which a party is acting as a representative under this

subsection is binding on all individuals represented in the proceedings,

but may only be enforced by or against a person who is not a party to the

proceedings with the permission of the court.

(4C)    

Subsections (4A) and (4B)—

(a)    

apply in respect of infringements occurring (or alleged to have occurred)

whether before or after the commencement of this section,

(b)    

apply to proceedings begun before the commencement of this section as

if references in subsections (4A) and (4B) to bringing proceedings

included a reference to continuing proceedings, and

(c)    

are without prejudice to the generality of any other enactment or rule of

law which permits the bringing of representative proceedings.”

Clause, as amended, Agreed to.

Margot James

Agreed to  69

Clause  184,  page  106,  line  41,  leave out “(including as applied by Chapter 3 of that

Part)”.

Clause, as amended, Agreed to.

Public Bill Committee Proceedings: 22 March 2018          

4

Data Protection Bill-[Lords], continued

Margot James

That Clause 184, as amended, be transferred to the end of line 39 on page 105 

                                              Agreed to

Clauses 185 to 189 Agreed to.

Louise Haigh

Liam Byrne

Chris Elmore

Not selected  231

Clause  190,  page  109,  line  33,  leave out “personal data” and insert “information”

Clause Agreed to.

Clauses 191 to 197 Agreed to.

Margot James

Agreed to  70

Clause  198,  page  114,  line  25,  at end insert “the following (except in the

expression “United Kingdom government department”)”

Margot James

Agreed to  71

Clause  198,  page  115,  line  8,  at end insert—

“(2)    

References in this Act to a period expressed in hours, days, weeks, months or

years are to be interpreted in accordance with Article 3 of Regulation (EEC,

Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules

applicable to periods, dates and time limits, except in—

(a)    

section 125(4), (7) and (8);

(b)    

section 160(3), (5) and (6);

(c)    

section 176(2);

(d)    

section 179(8) and (9);

(e)    

section 180(4);

(f)    

section 186(3), (5) and (6);

(g)    

section 190(3) and (4);

(h)    

paragraph 18(4) and (5) of Schedule 1;

(i)    

paragraphs 5(4) and 6(4) of Schedule 3;

(j)    

Schedule 5;

(k)    

paragraph 11(5) of Schedule 12;

(l)    

Schedule 15;

(and the references in section 5 to terms used in Chapter 2 or 3 of Part 2 do not

include references to a period expressed in hours, days, weeks, months or years).”

Public Bill Committee Proceedings: 22 March 2018          

5

Data Protection Bill-[Lords], continued

Margot James

Agreed to  182

Clause  198,  page  115,  line  8,  at end insert—

“( )    

Section 3(14)(aa) (interpretation of references to Chapter 2 of Part 2 in Parts 5 to

7) and the amendments in Schedule 18 which make equivalent provision are not

to be treated as implying a contrary intention for the purposes of section 20(2) of

the Interpretation Act 1978, or any similar provision in another enactment, as it

applies to other references to, or to a provision of, Chapter 2 of Part 2 of this Act.”

Clause, as amended, Agreed to.

Clause 199 Agreed to.

Margot James

Agreed to  183

Clause  200,  page  117,  line  15,  leave out subsections (1) to (4) and insert—

“(1)    

This Act applies only to processing of personal data described in subsections (2)

and (3).

(2)    

It applies to the processing of personal data in the context of the activities of an

establishment of a controller or processor in the United Kingdom, whether or not

the processing takes place in the United Kingdom.

(3)    

It also applies to the processing of personal data to which Chapter 2 of Part 2 (the

GDPR) applies where—

(a)    

the processing is carried out in the context of the activities of an

establishment of a controller or processor in a country or territory that is

not a member State, whether or not the processing takes place in such a

country or territory,

(b)    

the personal data relates to a data subject who is in the United Kingdom

when the processing takes place, and

(c)    

the processing activities are related to—

(i)    

the offering of goods or services to data subjects in the United

Kingdom, whether or not for payment, or

(ii)    

the monitoring of data subjects’ behaviour in the United

Kingdom.”

Margot James

Agreed to  184

Clause  200,  page  118,  line  8,  leave out “(4)” and insert “(3)”

Margot James

Agreed to  185

Clause  200,  page  118,  leave out line 10 and insert “processing of personal data”

Margot James

Agreed to  186

Clause  200,  page  118,  line  10,  at end insert—

“(5A)    

Section 3(14)(b) does not apply to the reference to the processing of personal data

in subsection (2).

(5B)    

The reference in subsection (3) to Chapter 2 of Part 2 (the GDPR) does not

include that Chapter as applied by Chapter 3 of Part 2 (the applied GDPR).”

Public Bill Committee Proceedings: 22 March 2018          

6

Data Protection Bill-[Lords], continued

Margot James

Agreed to  187

Clause  200,  page  118,  line  11,  leave out “established” and insert “who has an

establishment”

Margot James

Agreed to  188

Clause  200,  page  118,  line  21,  after “to” insert “a person who has an”

Margot James

Agreed to  189

Clause  200,  page  118,  line  23,  leave out subsection (7)

Clause, as amended, Agreed to.

Clauses 201 to 203 Agreed to.

Margot James

Agreed to  190

Clause  204,  page  120,  line  12,  leave out subsection (1) and insert—

“(1)    

In Schedule 18—

(a)    

Part 1 contains minor and consequential amendments of primary

legislation;

(b)    

Part 2 contains minor and consequential amendments of other legislation;

(c)    

Part 3 contains consequential modifications of legislation;

(d)    

Part 4 contains supplementary provision.”

Clause, as amended, Agreed to.

Margot James

Agreed to  191

Schedule  18,  page  208,  line  25,  at end insert—

“Registration Service Act 1953 (c. 37)

A1  (1)  

Section 19AC of the Registration Service Act 1953 (codes of practice) is

amended as follows.

      (2)  

In subsection (2), for “section 52B (data-sharing code) of the Data Protection

Act 1998” substitute “section 122 of the Data Protection Act 2018 (data-

sharing code)”.

      (3)  

In subsection (11), for “section 51(3) of the Data Protection Act 1998”

substitute “section 128 of the Data Protection Act 2018”.

Public Bill Committee Proceedings: 22 March 2018          

7

Data Protection Bill-[Lords], continued

Veterinary Surgeons Act 1966 (c. 36)

A2  (1)  

Section 1A of the Veterinary Surgeons Act 1966 (functions of the Royal

College of Veterinary Surgeons as competent authority) is amended as

follows.

      (2)  

In subsection (8)—

(a)    

omit “personal data protection legislation in the United Kingdom that

implements”,

(b)    

for paragraph (a) substitute—

“(a)    

the GDPR; and”, and

(c)    

in paragraph (b), at the beginning insert “legislation in the United

Kingdom that implements”.

      (3)  

In subsection (9), after “section” insert “—

“the GDPR” means Regulation (EU) 2016/679 of the European

Parliament and of the Council of 27 April 2016 on the protection of

natural persons with regard to the processing of personal data and on

the free movement of such data (General Data Protection Regulation),

read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.”

Margot James

Agreed to  192

Schedule  18,  page  210,  line  4,  at end insert—

“Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22))

8A         

The Pharmacy (Northern Ireland) Order 1976 is amended as follows.

8B         

In article 2(2) (interpretation), omit the definition of “Directive 95/46/EC”.

8C         

In article 8D (European professional card), after paragraph (3) insert—

“(4)    

In Schedule 2C, “the GDPR” means Regulation (EU) 2016/679 of the

European Parliament and of the Council of 27 April 2016 on the

protection of natural persons with regard to the processing of personal

data and on the free movement of such data (General Data Protection

Regulation), read with Chapter 2 of Part 2 of the Data Protection Act

2018.”

8D         

In article 22A(6) (Directive 2005/36/EC: functions of competent authority

etc.), before sub-paragraph (a) insert—

“(za)    

“the GDPR” means Regulation (EU) 2016/679 of the

European Parliament and of the Council of 27 April 2016 on

the protection of natural persons with regard to the processing

of personal data and on the free movement of such data

(General Data Protection Regulation), read with Chapter 2 of

Part 2 of the Data Protection Act 2018;”.

8E  (1)  

Schedule 2C (Directive 2005/36/EC: European professional card) is amended

as follows.

      (2)  

In paragraph 8(1) (access to data), for “Directive 95/46/EC” substitute “the

GDPR”.

      (3)  

In paragraph 9 (processing data), omit sub-paragraph (2) (deeming the Society

to be the controller for the purposes of Directive 95/46/EC).

8F  (1)  

The table in Schedule 2D (functions of the Society under Directive 2005/36/

EC) is amended as follows.

      (2)  

In the entry for Article 56(2), in the second column, for “Directive 95/46/EC”

substitute “the GDPR”.