|
|
| |
| |
|
| |
| |
| Data Protection Bill [Lords]
|
|
| [Seventh and Eighth Sittings]
|
|
| |
| This document shows the fate of each clause, schedule, amendment and new clause. |
|
| The following terms are used: |
|
| Agreed to: agreed without a vote. |
|
| Agreed to on division: agreed following a vote. |
|
| Negatived: rejected without a vote. |
|
| Negatived on division: rejected following a vote. |
|
| Not called: debated in a group of amendments, but not put to a decision. |
|
| Not moved: not debated or put to a decision. |
|
| Question proposed: debate underway but not concluded. |
|
| Withdrawn after debate: moved and debated but then withdrawn, so not put to a decision. |
|
| Not selected: not chosen for debate by the Chair. |
|
| |
| |
| |
| | |
| Schedule 17, page 206, line 15, leave out paragraph (a) and insert— |
|
| | “(a) | a relevant health record (see paragraph 1A),” |
|
| |
| | |
| Schedule 17, page 206, line 21, at end insert— |
|
| | |
| | 1A | “Relevant health record” means a health record which has been or is to be |
|
| | obtained by a data subject in the exercise of a data subject access right.” |
|
|
|
| |
| |
|
| |
| | |
| Schedule 17, page 207, line 22, leave out sub-paragraph (iii) and insert— |
|
| | “(iii) | Article 45 of the Criminal Justice (Children) (Northern |
|
| | Ireland) Order 1998 (S.I. 1998/1504 (N.I. 9));” |
|
| | Schedule, as amended, Agreed to. |
|
| |
| | |
| |
| | |
| Clause 183, page 105, line 42, leave out “80” and insert “80(1)” |
|
| |
| | |
| Clause 183, page 105, line 44, leave out “certain rights” and insert “the data |
|
| subject’s rights under Articles 77, 78 and 79 of the GDPR (rights to lodge complaints and |
|
| to an effective judicial remedy)” |
|
| |
| | |
| Clause 183, page 106, line 7, leave out “under the following provisions” and insert |
|
| |
| |
| | |
| Clause 183, page 106, line 9, at beginning insert “rights under” |
|
| |
| | |
| Clause 183, page 106, line 10, at beginning insert “rights under” |
|
| |
| | |
| Clause 183, page 106, line 11, at beginning insert “rights under” |
|
| |
| |
| |
| |
| | |
| Clause 183, page 106, line 24, at end insert— |
|
| | “(4A) | In accordance with Article 80(2) of the GDPR, a person who satisfies the |
|
| | conditions in Article 80(1) and who considers that the rights of a data subject |
|
| | under the GDPR have been infringed as a result of data processing, may bring |
|
| | proceedings, on behalf of the data subject and independently of the data subject’s |
|
| | |
| | (a) | pursuant to Article 77 (right to lodge a complaint with a supervisory |
|
| | |
|
|
| |
| |
|
| | (b) | to exercise the rights referred to in Article 78 (right to an effective |
|
| | judicial remedy against a supervisory authority), |
|
| | (c) | to exercise the rights referred to in Article 79 (right to an effective |
|
| | judicial remedy against a controller or processor). |
|
| | (4B) | An individual who considers that rights under the GDPR, this Act or any other |
|
| | enactment relating to data protection have been infringed in respect of a class of |
|
| | individuals of which he or she forms part may bring proceedings in respect of the |
|
| | infringement as a representative of the class (independently of the mandate of |
|
| | other members of the class), and— |
|
| | (a) | for the purposes of this subsection “proceedings” includes proceedings |
|
| | for damages, and any damages recovered are to be distributed or |
|
| | otherwise applied as directed by the court, |
|
| | (b) | in the case of a class consisting of or including children under the age of |
|
| | 18, an individual may bring proceedings as a representative of the class |
|
| | whether or not the individual’s own rights have been infringed, |
|
| | (c) | the court in which proceedings are brought may direct that the individual |
|
| | may not act as a representative, or may act as a representative only to a |
|
| | specified extent, for a specified purpose or subject to specified |
|
| | |
| | (d) | a direction under paragraph (c) may (subject to any provision of rules of |
|
| | court relating to proceedings under this subsection) be made on the |
|
| | application of a party or a member of the class, or of the court’s own |
|
| | |
| | (e) | subject to any direction of the court, a judgment or order given in |
|
| | proceedings in which a party is acting as a representative under this |
|
| | subsection is binding on all individuals represented in the proceedings, |
|
| | but may only be enforced by or against a person who is not a party to the |
|
| | proceedings with the permission of the court. |
|
| | (4C) | Subsections (4A) and (4B)— |
|
| | (a) | apply in respect of infringements occurring (or alleged to have occurred) |
|
| | whether before or after the commencement of this section, |
|
| | (b) | apply to proceedings begun before the commencement of this section as |
|
| | if references in subsections (4A) and (4B) to bringing proceedings |
|
| | included a reference to continuing proceedings, and |
|
| | (c) | are without prejudice to the generality of any other enactment or rule of |
|
| | law which permits the bringing of representative proceedings.” |
|
| | Clause, as amended, Agreed to. |
|
| |
| |
| | |
| Clause 184, page 106, line 41, leave out “(including as applied by Chapter 3 of that |
|
| |
| | Clause, as amended, Agreed to. |
|
|
|
| |
| |
|
| |
| That Clause 184, as amended, be transferred to the end of line 39 on page 105 |
|
|
| |
| |
| | Clauses 185 to 189 Agreed to. |
|
| |
| |
| |
| | |
| Clause 190, page 109, line 33, leave out “personal data” and insert “information” |
|
| | |
| | Clauses 191 to 197 Agreed to. |
|
| |
| |
| | |
| Clause 198, page 114, line 25, at end insert “the following (except in the |
|
| expression “United Kingdom government department”)” |
|
| |
| | |
| Clause 198, page 115, line 8, at end insert— |
|
| | “(2) | References in this Act to a period expressed in hours, days, weeks, months or |
|
| | years are to be interpreted in accordance with Article 3 of Regulation (EEC, |
|
| | Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules |
|
| | applicable to periods, dates and time limits, except in— |
|
| | (a) | section 125(4), (7) and (8); |
|
| | (b) | section 160(3), (5) and (6); |
|
| | |
| | (d) | section 179(8) and (9); |
|
| | |
| | (f) | section 186(3), (5) and (6); |
|
| | (g) | section 190(3) and (4); |
|
| | (h) | paragraph 18(4) and (5) of Schedule 1; |
|
| | (i) | paragraphs 5(4) and 6(4) of Schedule 3; |
|
| | |
| | (k) | paragraph 11(5) of Schedule 12; |
|
| | |
| | | (and the references in section 5 to terms used in Chapter 2 or 3 of Part 2 do not |
|
| | include references to a period expressed in hours, days, weeks, months or years).” |
|
|
|
| |
| |
|
| |
| | |
| Clause 198, page 115, line 8, at end insert— |
|
| | “( ) | Section 3(14)(aa) (interpretation of references to Chapter 2 of Part 2 in Parts 5 to |
|
| | 7) and the amendments in Schedule 18 which make equivalent provision are not |
|
| | to be treated as implying a contrary intention for the purposes of section 20(2) of |
|
| | the Interpretation Act 1978, or any similar provision in another enactment, as it |
|
| | applies to other references to, or to a provision of, Chapter 2 of Part 2 of this Act.” |
|
| | Clause, as amended, Agreed to. |
|
| | |
| |
| |
| | |
| Clause 200, page 117, line 15, leave out subsections (1) to (4) and insert— |
|
| | “(1) | This Act applies only to processing of personal data described in subsections (2) |
|
| | |
| | (2) | It applies to the processing of personal data in the context of the activities of an |
|
| | establishment of a controller or processor in the United Kingdom, whether or not |
|
| | the processing takes place in the United Kingdom. |
|
| | (3) | It also applies to the processing of personal data to which Chapter 2 of Part 2 (the |
|
| | |
| | (a) | the processing is carried out in the context of the activities of an |
|
| | establishment of a controller or processor in a country or territory that is |
|
| | not a member State, whether or not the processing takes place in such a |
|
| | |
| | (b) | the personal data relates to a data subject who is in the United Kingdom |
|
| | when the processing takes place, and |
|
| | (c) | the processing activities are related to— |
|
| | (i) | the offering of goods or services to data subjects in the United |
|
| | Kingdom, whether or not for payment, or |
|
| | (ii) | the monitoring of data subjects’ behaviour in the United |
|
| | |
| |
| | |
| Clause 200, page 118, line 8, leave out “(4)” and insert “(3)” |
|
| |
| | |
| Clause 200, page 118, leave out line 10 and insert “processing of personal data” |
|
| |
| | |
| Clause 200, page 118, line 10, at end insert— |
|
| | “(5A) | Section 3(14)(b) does not apply to the reference to the processing of personal data |
|
| | |
| | (5B) | The reference in subsection (3) to Chapter 2 of Part 2 (the GDPR) does not |
|
| | include that Chapter as applied by Chapter 3 of Part 2 (the applied GDPR).” |
|
|
|
| |
| |
|
| |
| | |
| Clause 200, page 118, line 11, leave out “established” and insert “who has an |
|
| |
| |
| | |
| Clause 200, page 118, line 21, after “to” insert “a person who has an” |
|
| |
| | |
| Clause 200, page 118, line 23, leave out subsection (7) |
|
| | Clause, as amended, Agreed to. |
|
| | Clauses 201 to 203 Agreed to. |
|
| |
| |
| | |
| Clause 204, page 120, line 12, leave out subsection (1) and insert— |
|
| | |
| | (a) | Part 1 contains minor and consequential amendments of primary |
|
| | |
| | (b) | Part 2 contains minor and consequential amendments of other legislation; |
|
| | (c) | Part 3 contains consequential modifications of legislation; |
|
| | (d) | Part 4 contains supplementary provision.” |
|
| | Clause, as amended, Agreed to. |
|
| |
| |
| | |
| Schedule 18, page 208, line 25, at end insert— |
|
| | “Registration Service Act 1953 (c. 37) |
|
| | A1 (1) | Section 19AC of the Registration Service Act 1953 (codes of practice) is |
|
| | |
| | (2) | In subsection (2), for “section 52B (data-sharing code) of the Data Protection |
|
| | Act 1998” substitute “section 122 of the Data Protection Act 2018 (data- |
|
| | |
| | (3) | In subsection (11), for “section 51(3) of the Data Protection Act 1998” |
|
| | substitute “section 128 of the Data Protection Act 2018”. |
|
|
|
| |
| |
|
| | Veterinary Surgeons Act 1966 (c. 36) |
|
| | A2 (1) | Section 1A of the Veterinary Surgeons Act 1966 (functions of the Royal |
|
| | College of Veterinary Surgeons as competent authority) is amended as |
|
| | |
| | |
| | (a) | omit “personal data protection legislation in the United Kingdom that |
|
| | |
| | (b) | for paragraph (a) substitute— |
|
| | |
| | (c) | in paragraph (b), at the beginning insert “legislation in the United |
|
| | Kingdom that implements”. |
|
| | (3) | In subsection (9), after “section” insert “— |
|
| | “the GDPR” means Regulation (EU) 2016/679 of the European |
|
| | Parliament and of the Council of 27 April 2016 on the protection of |
|
| | natural persons with regard to the processing of personal data and on |
|
| | the free movement of such data (General Data Protection Regulation), |
|
| | read with Chapter 2 of Part 2 of the Data Protection Act 2018;”.” |
|
| |
| | |
| Schedule 18, page 210, line 4, at end insert— |
|
| | “Pharmacy (Northern Ireland) Order 1976 (S.I. 1976/1213 (N.I. 22)) |
|
| | 8A | The Pharmacy (Northern Ireland) Order 1976 is amended as follows. |
|
| | 8B | In article 2(2) (interpretation), omit the definition of “Directive 95/46/EC”. |
|
| | 8C | In article 8D (European professional card), after paragraph (3) insert— |
|
| | “(4) | In Schedule 2C, “the GDPR” means Regulation (EU) 2016/679 of the |
|
| | European Parliament and of the Council of 27 April 2016 on the |
|
| | protection of natural persons with regard to the processing of personal |
|
| | data and on the free movement of such data (General Data Protection |
|
| | Regulation), read with Chapter 2 of Part 2 of the Data Protection Act |
|
| | |
| | 8D | In article 22A(6) (Directive 2005/36/EC: functions of competent authority |
|
| | etc.), before sub-paragraph (a) insert— |
|
| | “(za) | “the GDPR” means Regulation (EU) 2016/679 of the |
|
| | European Parliament and of the Council of 27 April 2016 on |
|
| | the protection of natural persons with regard to the processing |
|
| | of personal data and on the free movement of such data |
|
| | (General Data Protection Regulation), read with Chapter 2 of |
|
| | Part 2 of the Data Protection Act 2018;”. |
|
| | 8E (1) | Schedule 2C (Directive 2005/36/EC: European professional card) is amended |
|
| | |
| | (2) | In paragraph 8(1) (access to data), for “Directive 95/46/EC” substitute “the |
|
| | |
| | (3) | In paragraph 9 (processing data), omit sub-paragraph (2) (deeming the Society |
|
| | to be the controller for the purposes of Directive 95/46/EC). |
|
| | 8F (1) | The table in Schedule 2D (functions of the Society under Directive 2005/36/ |
|
| | EC) is amended as follows. |
|
| | (2) | In the entry for Article 56(2), in the second column, for “Directive 95/46/EC” |
|
| | |
|