some default text...

Session 2017-19
Internet Publications
Other Bills before Parliament


 
 

1

 

House of Commons

 
 

Notices of Amendments

 

given up to and including

 

Tuesday 20 March 2018

 

New Amendments handed in are marked thus Parliamentary Star

 

Parliamentary Star - whiteAmendments which will comply with the required notice period at their next appearance

 

Public Bill Committee


 

Data Protection Bill [Lords]


 

Note

 

This document includes all amendments remaining before the Committee and

 

includes any withdrawn amendments at the end. The amendments have been

 

arranged in accordance with the Order of the Committee [13 March 2018].

 

 


 

Margot James

 

127

 

Schedule  17,  page  206,  line  15,  leave out paragraph (a) and insert—

 

“(a)    

a relevant health record (see paragraph 1A),”

 

Member’s explanatory statement

 

This amendment, with Amendment 128, limits the types of health records (defined in Clause 198)

 

which count as “relevant records” for the purposes of Clause 181 (prohibition of requirement to

 

produce relevant records) to those obtained by a data subject in the exercise of a data subject

 

access right (defined in paragraph 4 of Schedule 17).


 
 

Notices of Amendments: 20 March 2018                  

2

 

Data Protection Bill-[Lords], continued

 
 

Margot James

 

128

 

Schedule  17,  page  206,  line  21,  at end insert—

 

“Relevant health records

 

1A         

“Relevant health record” means a health record which has been or is to be

 

obtained by a data subject in the exercise of a data subject access right.”

 

Member’s explanatory statement

 

See the explanatory statement for Amendment 127.

 

Margot James

 

181

 

Schedule  17,  page  207,  line  22,  leave out sub-paragraph (iii) and insert—

 

“(iii)    

Article 45 of the Criminal Justice (Children) (Northern

 

Ireland) Order 1998 (S.I. 1998/1504 (N.I. 9));”

 

Member’s explanatory statement

 

In a list of functions of the Secretary of State in relation to people sentenced to detention, this

 

amendment removes a reference to section 73 of the Children and Young Persons Act 1968 (which

 

has been repealed) and inserts a reference to Article 45 of the Criminal Justice (Children)

 

(Northern Ireland) Order 1998 (which replaced it).

 


 

Margot James

 

63

 

Clause  183,  page  105,  line  42,  leave out “80” and insert “80(1)”

 

Member’s explanatory statement

 

This amendment changes a reference to Article 80 of the GDPR into a reference to Article 80(1)

 

and is consequential on NC2.

 

Margot James

 

64

 

Clause  183,  page  105,  line  44,  leave out “certain rights” and insert “the data

 

subject’s rights under Articles 77, 78 and 79 of the GDPR (rights to lodge complaints and

 

to an effective judicial remedy)”

 

Member’s explanatory statement

 

In words summarising Article 80(1) of the GDPR, this amendment adds information about the

 

rights of data subjects that may be exercised by representative bodies under that provision.

 

Margot James

 

65

 

Clause  183,  page  106,  line  7,  leave out “under the following provisions” and insert

 

“of a data subject”

 

Member’s explanatory statement

 

This amendment and Amendments 66, 67 and 68 tidy up Clause 183(2).

 

Margot James

 

66

 

Clause  183,  page  106,  line  9,  at beginning insert “rights under”

 

Member’s explanatory statement

 

See the explanatory statement for Amendment 65.


 
 

Notices of Amendments: 20 March 2018                  

3

 

Data Protection Bill-[Lords], continued

 
 

Margot James

 

67

 

Clause  183,  page  106,  line  10,  at beginning insert “rights under”

 

Member’s explanatory statement

 

See the explanatory statement for Amendment 65.

 

Margot James

 

68

 

Clause  183,  page  106,  line  11,  at beginning insert “rights under”

 

Member’s explanatory statement

 

See the explanatory statement for Amendment 65.

 

Liam Byrne

 

Louise Haigh

 

Chris Elmore

 

Darren Jones

 

154

 

Clause  183,  page  106,  line  24,  at end insert—

 

“(4A)    

In accordance with Article 80(2) of the GDPR, a person who satisfies the

 

conditions in Article 80(1) and who considers that the rights of a data subject

 

under the GDPR have been infringed as a result of data processing, may bring

 

proceedings, on behalf of the data subject and independently of the data subject’s

 

mandate—

 

(a)    

pursuant to Article 77 (right to lodge a complaint with a supervisory

 

authority),

 

(b)    

to exercise the rights referred to in Article 78 (right to an effective

 

judicial remedy against a supervisory authority),

 

(c)    

to exercise the rights referred to in Article 79 (right to an effective

 

judicial remedy against a controller or processor).

 

(4B)    

An individual who considers that rights under the GDPR, this Act or any other

 

enactment relating to data protection have been infringed in respect of a class of

 

individuals of which he or she forms part may bring proceedings in respect of the

 

infringement as a representative of the class (independently of the mandate of

 

other members of the class), and—

 

(a)    

for the purposes of this subsection “proceedings” includes proceedings

 

for damages, and any damages recovered are to be distributed or

 

otherwise applied as directed by the court,

 

(b)    

in the case of a class consisting of or including children under the age of

 

18, an individual may bring proceedings as a representative of the class

 

whether or not the individual’s own rights have been infringed,

 

(c)    

the court in which proceedings are brought may direct that the individual

 

may not act as a representative, or may act as a representative only to a

 

specified extent, for a specified purpose or subject to specified

 

conditions,

 

(d)    

a direction under paragraph (c) may (subject to any provision of rules of

 

court relating to proceedings under this subsection) be made on the

 

application of a party or a member of the class, or of the court’s own

 

motion, and

 

(e)    

subject to any direction of the court, a judgment or order given in

 

proceedings in which a party is acting as a representative under this

 

subsection is binding on all individuals represented in the proceedings,

 

but may only be enforced by or against a person who is not a party to the

 

proceedings with the permission of the court.


 
 

Notices of Amendments: 20 March 2018                  

4

 

Data Protection Bill-[Lords], continued

 
 

(4C)    

Subsections (4A) and (4B)—

 

(a)    

apply in respect of infringements occurring (or alleged to have occurred)

 

whether before or after the commencement of this section,

 

(b)    

apply to proceedings begun before the commencement of this section as

 

if references in subsections (4A) and (4B) to bringing proceedings

 

included a reference to continuing proceedings, and

 

(c)    

are without prejudice to the generality of any other enactment or rule of

 

law which permits the bringing of representative proceedings.”

 

Member’s explanatory statement

 

This amendment would create a collective redress mechanism whereby a not-for-profit body,

 

organisation or association can represent multiple individuals for infringement of their rights

 

under the General Data Protection Regulation.

 


 

Margot James

 

69

 

Clause  184,  page  106,  line  41,  leave out “(including as applied by Chapter 3 of that

 

Part)”.

 

Member’s explanatory statement

 

This amendment is consequential on Amendment 4.

 

Margot James

 

That Clause 184 be transferred to the end of line 39 on page 105

 


 

Louise Haigh

 

Liam Byrne

 

Chris Elmore

 

231

 

Parliamentary Star    

Clause  190,  page  109,  line  33,  leave out “personal data” and insert “information”

 

Member’s explanatory statement

 

This amendment is consequential on Amendment 230.

 


 

Margot James

 

70

 

Clause  198,  page  114,  line  25,  at end insert “the following (except in the

 

expression “United Kingdom government department”)”

 

Member’s explanatory statement

 

This amendment makes clear that the definition of “government department” does not operate on

 

references to a “United Kingdom government department” (which can be found in Clause 185 and

 

paragraph 1 of Schedule 7).


 
 

Notices of Amendments: 20 March 2018                  

5

 

Data Protection Bill-[Lords], continued

 
 

Margot James

 

71

 

Clause  198,  page  115,  line  8,  at end insert—

 

“(2)    

References in this Act to a period expressed in hours, days, weeks, months or

 

years are to be interpreted in accordance with Article 3 of Regulation (EEC,

 

Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules

 

applicable to periods, dates and time limits, except in—

 

(a)    

section 125(4), (7) and (8);

 

(b)    

section 160(3), (5) and (6);

 

(c)    

section 176(2);

 

(d)    

section 179(8) and (9);

 

(e)    

section 180(4);

 

(f)    

section 186(3), (5) and (6);

 

(g)    

section 190(3) and (4);

 

(h)    

paragraph 18(4) and (5) of Schedule 1;

 

(i)    

paragraphs 5(4) and 6(4) of Schedule 3;

 

(j)    

Schedule 5;

 

(k)    

paragraph 11(5) of Schedule 12;

 

(l)    

Schedule 15;

 

    

(and the references in section 5 to terms used in Chapter 2 or 3 of Part 2 do not

 

include references to a period expressed in hours, days, weeks, months or years).”

 

Member’s explanatory statement

 

This amendment provides that periods of time referred to in the bill are generally to be interpreted

 

in accordance with Article 3 of EC Regulation 1182/71, which makes provision about the

 

calculation of periods of hours, days, weeks, months and years.

 

Margot James

 

182

 

Clause  198,  page  115,  line  8,  at end insert—

 

“( )    

Section 3(14)(aa) (interpretation of references to Chapter 2 of Part 2 in Parts 5 to

 

7) and the amendments in Schedule 18 which make equivalent provision are not

 

to be treated as implying a contrary intention for the purposes of section 20(2) of

 

the Interpretation Act 1978, or any similar provision in another enactment, as it

 

applies to other references to, or to a provision of, Chapter 2 of Part 2 of this Act.”

 

Member’s explanatory statement

 

Clause 3(14)(aa) (inserted by amendment 4) and equivalent provision contained in amendments

 

in Schedule 18 state expressly that references to Chapter 2 of Part 2 of the bill in Parts 5 to 7 of

 

the bill, and in certain amendments in Schedule 18, include that Chapter as applied by Chapter 3

 

of Part 2. This amendment secures that they are not to be treated as implying a contrary intention

 

for the purposes of section 20(2) of the Interpretation Act 1978. Section 20(2) provides that where

 

an Act refers to an enactment that reference includes that enactment as applied, unless the

 

contrary intention appears.

 


 

Margot James

 

183

 

Clause  200,  page  117,  line  15,  leave out subsections (1) to (4) and insert—

 

“(1)    

This Act applies only to processing of personal data described in subsections (2)

 

and (3).


 
 

Notices of Amendments: 20 March 2018                  

6

 

Data Protection Bill-[Lords], continued

 
 

(2)    

It applies to the processing of personal data in the context of the activities of an

 

establishment of a controller or processor in the United Kingdom, whether or not

 

the processing takes place in the United Kingdom.

 

(3)    

It also applies to the processing of personal data to which Chapter 2 of Part 2 (the

 

GDPR) applies where—

 

(a)    

the processing is carried out in the context of the activities of an

 

establishment of a controller or processor in a country or territory that is

 

not a member State, whether or not the processing takes place in such a

 

country or territory,

 

(b)    

the personal data relates to a data subject who is in the United Kingdom

 

when the processing takes place, and

 

(c)    

the processing activities are related to—

 

(i)    

the offering of goods or services to data subjects in the United

 

Kingdom, whether or not for payment, or

 

(ii)    

the monitoring of data subjects’ behaviour in the United

 

Kingdom.”

 

Member’s explanatory statement

 

This amendment replaces the existing provision on territorial application in clause 200(1) to (4).

 

In the amendment, subsection (2) provides that the bill applies to processing in the context of the

 

activities of an establishment of a controller or processor in the UK. Subsection (3) provides that,

 

in certain circumstances, the bill also applies to processing to which the GDPR applies and which

 

is carried out in the context of activities of an establishment of a controller or processor in a

 

country or territory that is not part of the EU.

 

Margot James

 

184

 

Clause  200,  page  118,  line  8,  leave out “(4)” and insert “(3)”

 

Member’s explanatory statement

 

This amendment is consequential on amendment 183.

 

Margot James

 

185

 

Clause  200,  page  118,  leave out line 10 and insert “processing of personal data”

 

Member’s explanatory statement

 

This amendment is consequential on amendment 183.

 

Margot James

 

186

 

Clause  200,  page  118,  line  10,  at end insert—

 

“(5A)    

Section 3(14)(b) does not apply to the reference to the processing of personal data

 

in subsection (2).

 

(5B)    

The reference in subsection (3) to Chapter 2 of Part 2 (the GDPR) does not

 

include that Chapter as applied by Chapter 3 of Part 2 (the applied GDPR).”

 

Member’s explanatory statement

 

New subsection (5A) secures that the reference to “processing” in the new subsection (2) inserted

 

by amendment 183 includes all types of processing of personal data. It disapplies clause 3(14)(b),

 

which provides that references to processing in Parts 5 to 7 of the bill are usually only to

 

processing to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies. New subsection (5B) secures

 

that the reference in the new subsection (3) to Chapter 2 of Part 2 of the bill does not include that

 

Chapter as applied by Chapter 3 of Part 2.


 
 

Notices of Amendments: 20 March 2018                  

7

 

Data Protection Bill-[Lords], continued

 
 

Margot James

 

187

 

Clause  200,  page  118,  line  11,  leave out “established” and insert “who has an

 

establishment”

 

Member’s explanatory statement

 

This amendment is consequential on amendment 183.

 

Margot James

 

188

 

Clause  200,  page  118,  line  21,  after “to” insert “a person who has an”

 

Member’s explanatory statement

 

This amendment is consequential on amendment 183.

 

Margot James

 

189

 

Clause  200,  page  118,  line  23,  leave out subsection (7)

 

Member’s explanatory statement

 

This amendment is consequential on amendment 183.

 


 

Margot James

 

190

 

Clause  204,  page  120,  line  12,  leave out subsection (1) and insert—

 

“(1)    

In Schedule 18—

 

(a)    

Part 1 contains minor and consequential amendments of primary

 

legislation;

 

(b)    

Part 2 contains minor and consequential amendments of other legislation;

 

(c)    

Part 3 contains consequential modifications of legislation;

 

(d)    

Part 4 contains supplementary provision.”

 

Member’s explanatory statement

 

This amendment sets out the contents of Schedule 18 and is consequential on the amendments

 

being made to Schedule 18 including in particular the insertion of new Parts 3 and 4 into that

 

Schedule by amendment 224.

 


 

Margot James

 

191

 

Schedule  18,  page  208,  line  25,  at end insert—

 

“Registration Service Act 1953 (c. 37)

 

A1  (1)  

Section 19AC of the Registration Service Act 1953 (codes of practice) is

 

amended as follows.

 

      (2)  

In subsection (2), for “section 52B (data-sharing code) of the Data Protection

 

Act 1998” substitute “section 122 of the Data Protection Act 2018 (data-

 

sharing code)”.

 

      (3)  

In subsection (11), for “section 51(3) of the Data Protection Act 1998”

 

substitute “section 128 of the Data Protection Act 2018”.


 
Back to StartNext
 

Revised 21 March 2018