1

House of Commons

Notices of Amendments

given up to and including

Tuesday 6 March 2018

New Amendments handed in are marked thus

Amendments which will comply with the required notice period at their next appearance

Amendments tabled since the last publication: 1 to 128 and NC1 to NC2

Public Bill Committee

Data Protection Bill [Lords]

Note

This document includes all amendments tabled to date and includes any

withdrawn amendments at the end. The amendments have been arranged in the

order in which they relate to the Bill.

Margot James

1

Clause  3,  page  2,  line  25,  leave out “personal data” and insert “information”

Member’s explanatory statement

This amendment and Amendment 2 enable the definition of “processing” to be used in relation to

any information, not just personal data.

Margot James

2

Clause  3,  page  2,  line  26,  leave out “personal data, or on sets of personal data” and

insert “information, or on sets of information”

Member’s explanatory statement

See the explanatory statement for Amendment 1.

Notices of Amendments: 6 March 2018                     

2

Data Protection Bill-[Lords], continued

Margot James

3

Clause  3,  page  2,  line  41,  after “83” insert “and see also subsection (14)(c)”

Member’s explanatory statement

This amendment is consequential on Amendment 6.

Margot James

4

Clause  3,  page  3,  line  27,  at end insert —

“(aa)    

references to Chapter 2 of Part 2, or to a provision of that Chapter, include

that Chapter or that provision as applied by Chapter 3 of Part 2;”

Member’s explanatory statement

This amendment makes clear that references to Chapter 2 of Part 2 in Parts 5 to 7 of the bill

include that Chapter as applied by Chapter 3 of Part 2.

Margot James

5

Clause  3,  page  3,  line  28,  leave out “processing and personal data are to processing

and personal data” and insert “personal data, and the processing of personal data, are to

personal data and processing”

Member’s explanatory statement

This amendment is consequential on Amendment 1.

Margot James

6

Clause  3,  page  3,  line  29,  at end insert —

“(c)    

references to a controller or processor are to a controller or processor in

relation to the processing of personal data to which Chapter 2 or 3 of Part

2, Part 3 or Part 4 applies.”

Member’s explanatory statement

This amendment and Amendment 3 make clear that references to controllers and processors in

Parts 5 to 7 of the bill are to controllers and processors in relation to processing to which the

GDPR, the applied GDPR or Part 3 or 4 of the bill applies.

Margot James

7

Clause  7,  page  5,  line  8,  leave out “a body specified” and insert “body specified or

described”

Member’s explanatory statement

This amendment and Amendment 8 make clear that regulations under Clause 7 may identify an

authority or body by describing a type of authority or body, as well as by specifying an authority

or body.

Notices of Amendments: 6 March 2018                     

3

Data Protection Bill-[Lords], continued

Margot James

8

Clause  7,  page  5,  line  13,  after “specified” insert “or described”

Member’s explanatory statement

See the explanatory statement for Amendment 7.

Margot James

9

Clause  8,  page  5,  line  29,  at end insert—

“( )    

an activity that supports or promotes democratic engagement.”

Member’s explanatory statement

This amendment adds a reference to processing of personal data that is necessary for activities

that support or promote democratic engagement to Clause 8 (lawfulness of processing: public

interest etc).

Margot James

10

Clause  14,  page  8,  line  4,  leave out “21 days” and insert “1 month”

Member’s explanatory statement

Clause 14(4)(b) provides that where a controller notifies a data subject under Clause 14(4)(a) that

the controller has taken a “qualifying significant decision” in relation to the data subject based

solely on automated processing, the data subject has 21 days to request the controller to

reconsider or take a new decision not based solely on automated processing. This amendment

extends that period to one month.

Margot James

11

Clause  14,  page  8,  leave out line 10 and insert “within the period described in Article

12(3) of the GDPR—”

Member’s explanatory statement

This amendment removes provision from Clause 14(5) dealing with the time by which a controller

has to respond to a data subject’s request under Clause 14(4)(b) and replaces it with a requirement

for the controller to respond within the time periods set out in Article 12(3) of the GDPR, which is

directly applicable.

Margot James

12

Clause  14,  page  8,  line  16,  at end insert—

“(5A)    

In connection with this section, a controller has the powers and obligations under

Article 12 of the GDPR (transparency, procedure for extending time for acting on

Notices of Amendments: 6 March 2018                     

4

Data Protection Bill-[Lords], continued

request, fees, manifestly unfounded or excessive requests etc) that apply in

connection with Article 22 of the GDPR.”

Member’s explanatory statement

This amendment inserts a signpost to Article 12 of the GDPR which is directly applicable and

which confers powers and places obligations on controllers to whom Clause 14 applies.

Margot James

13

Clause  15,  page  8,  line  31,  after “21” insert “and 34”

Member’s explanatory statement

This amendment is consequential on Amendment 94.

Margot James

14

Clause  15,  page  8,  line  34,  after “21” insert “and 34”

Member’s explanatory statement

This amendment is consequential on an amendment made in the Lords which added Article 34 of

the GDPR (communication of personal data breach to the data subject) to the list of GDPR

provisions that are disapplied by paragraph 11 of Schedule 2 to the Bill.

Margot James

15

Clause  17,  page  10,  line  16,  leave out “authority” and insert “body”

Member’s explanatory statement

This amendment corrects the reference in Clause 17(7) to the “national accreditation authority”

by amending it to refer to the “national accreditation body”, which is defined in Clause 17(8).

Margot James

16

Clause  19,  page  12,  line  2,  leave out “(d)” and insert “(e)”

Member’s explanatory statement

This amendment amends the definition of “relevant NHS body” in this Clause by adding special

health and social care agencies established under Article 3 of the Health and Personal Social

Services (Special Agencies) (Northern Ireland) Order 1990 (which fall within paragraph (e) of

section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009).

Notices of Amendments: 6 March 2018                     

5

Data Protection Bill-[Lords], continued

Margot James

17

Clause  25,  page  15,  line  40,  leave out “individual” and insert “data subject”

Member’s explanatory statement

Clause 25 makes provision about the processing of manual unstructured data used in longstanding

historical research. This amendment aligns Clause 25(1)(b)(i) with similar provision in Clause

19(2).

Margot James

18

Clause  30,  page  19,  line  4,  after “specified” insert “or described”

Member’s explanatory statement

This amendment changes a reference to persons specified in Schedule 7 into a reference to persons

specified or described there.

Margot James

19

Clause  30,  page  19,  line  10,  leave out from “add” to end of line and insert “or

remove a person or description of person”

Member’s explanatory statement

This amendment makes clear that regulations under Clause 30 may identify a person by describing

a type of person, as well as by specifying a person.

Margot James

20

Clause  41,  page  23,  line  34,  leave out “an individual” and insert “a data subject”

Member’s explanatory statement

Clause 41 makes provision about the processing of personal data for archiving purposes, for

scientific or historical research purposes or for statistical purposes. This amendment aligns

Clause 41(2)(b) with similar provision in Clause 19(2).

Margot James

21

Clause  42,  page  24,  line  29,  leave out “with the day” and insert “when”

Member’s explanatory statement

This amendment is consequential on Amendment 71.

Notices of Amendments: 6 March 2018                     

6

Data Protection Bill-[Lords], continued

Margot James

22

Clause  47,  page  28,  line  20,  leave out second “data”

Member’s explanatory statement

This amendment changes a reference to a “data controller” into a reference to a “controller” (as

defined in Clauses 3 and 32).

Margot James

23

Clause  50,  page  30,  line  11,  leave out “21 days” and insert “1 month”

Member’s explanatory statement

Clause 50(2)(b) provides that where a controller notifies a data subject under Clause 50(2)(a) that

the controller has taken a “qualifying significant decision” in relation to the data subject based

solely on automated processing, the data subject has 21 days to request the controller to

reconsider or take a new decision not based solely on automated processing. This amendment

extends that period to one month.

Margot James

24

Clause  50,  page  30,  line  17,  leave out “21 days” and insert “1 month”

Member’s explanatory statement

Clause 50(3) provides that where a data subject makes a request to a controller under Clause

50(2)(b) to reconsider or retake a decision based solely on automated processing, the controller

has 21 days to respond. This amendment extends that period to one month.

Margot James

25

Clause  51,  page  31,  line  2,  leave out from first “the” to end of line 3 and insert

“restriction imposed by the controller was lawful;”

Member’s explanatory statement

This amendment changes the nature of the request that a data subject may make to the

Commissioner in cases where rights to information are restricted under Clause 44(4) or 45(4). The

effect is that a data subject will be able to request the Commissioner to check that the restriction

was lawful.

Margot James

26

Clause  51,  page  31,  line  11,  leave out from first “the” to end of line 12 and insert

“restriction imposed by the controller was lawful;”

Member’s explanatory statement

This amendment is consequential on Amendment 25.

Notices of Amendments: 6 March 2018                     

7

Data Protection Bill-[Lords], continued

Margot James

27

Clause  53,  page  31,  line  39,  leave out “or 47” and insert “, 47 or 50”

Member’s explanatory statement

Clause 53(1) provides that where a request from a data subject under Clause 45, 46 or 47 is

manifestly unfounded or excessive, the controller may charge a reasonable fee for dealing with the

request or refuse to act on the request. This amendment applies Clause 53(1) to requests under

Clause 50 (automated decision making). See also Amendment 28.

Margot James

28

Clause  53,  page  32,  line  4,  leave out “or 47” and insert “, 47 or 50”

Member’s explanatory statement

Clause 53(3) provides that where there is an issue as to whether a request under Clause 45, 46 or

47 is manifestly unfounded or excessive, it is for the controller to show that it is. This amendment

applies Clause 53(3) to requests under Clause 50 (automated decision making). See also

Amendment 27.

Margot James

29

Clause  54,  page  32,  line  14,  leave out “day” and insert “time”

Member’s explanatory statement

This amendment is consequential on Amendment 71.

Margot James

30

Clause  54,  page  32,  line  15,  leave out “day” and insert “time”

Member’s explanatory statement

This amendment is consequential on Amendment 71.

Margot James

31

Clause  54,  page  32,  line  15,  leave out “days”

Member’s explanatory statement

This amendment is consequential on Amendment 71.

Margot James

32

Clause  54,  page  32,  line  16,  leave out “the day on which” and insert “when”

Member’s explanatory statement

This amendment is consequential on Amendment 71.

Margot James

33

Clause  54,  page  32,  line  17,  leave out “the day on which” and insert “when”

Member’s explanatory statement

This amendment is consequential on Amendment 71.