1

House of Commons

Notices of Amendments

given up to and including

Tuesday 20 March 2018

New Amendments handed in are marked thus

Amendments which will comply with the required notice period at their next appearance

Public Bill Committee

Data Protection Bill [Lords]

Note

This document includes all amendments remaining before the Committee and

includes any withdrawn amendments at the end. The amendments have been

arranged in accordance with the Order of the Committee [13 March 2018].

Margot James

127

Schedule  17,  page  206,  line  15,  leave out paragraph (a) and insert—

“(a)    

a relevant health record (see paragraph 1A),”

Member’s explanatory statement

This amendment, with Amendment 128, limits the types of health records (defined in Clause 198)

which count as “relevant records” for the purposes of Clause 181 (prohibition of requirement to

produce relevant records) to those obtained by a data subject in the exercise of a data subject

access right (defined in paragraph 4 of Schedule 17).

Notices of Amendments: 20 March 2018                  

2

Data Protection Bill-[Lords], continued

Margot James

128

Schedule  17,  page  206,  line  21,  at end insert—

“Relevant health records

1A         

“Relevant health record” means a health record which has been or is to be

obtained by a data subject in the exercise of a data subject access right.”

Member’s explanatory statement

See the explanatory statement for Amendment 127.

Margot James

181

Schedule  17,  page  207,  line  22,  leave out sub-paragraph (iii) and insert—

“(iii)    

Article 45 of the Criminal Justice (Children) (Northern

Ireland) Order 1998 (S.I. 1998/1504 (N.I. 9));”

Member’s explanatory statement

In a list of functions of the Secretary of State in relation to people sentenced to detention, this

amendment removes a reference to section 73 of the Children and Young Persons Act 1968 (which

has been repealed) and inserts a reference to Article 45 of the Criminal Justice (Children)

(Northern Ireland) Order 1998 (which replaced it).

Margot James

63

Clause  183,  page  105,  line  42,  leave out “80” and insert “80(1)”

Member’s explanatory statement

This amendment changes a reference to Article 80 of the GDPR into a reference to Article 80(1)

and is consequential on NC2.

Margot James

64

Clause  183,  page  105,  line  44,  leave out “certain rights” and insert “the data

subject’s rights under Articles 77, 78 and 79 of the GDPR (rights to lodge complaints and

to an effective judicial remedy)”

Member’s explanatory statement

In words summarising Article 80(1) of the GDPR, this amendment adds information about the

rights of data subjects that may be exercised by representative bodies under that provision.

Margot James

65

Clause  183,  page  106,  line  7,  leave out “under the following provisions” and insert

“of a data subject”

Member’s explanatory statement

This amendment and Amendments 66, 67 and 68 tidy up Clause 183(2).

Margot James

66

Clause  183,  page  106,  line  9,  at beginning insert “rights under”

Member’s explanatory statement

See the explanatory statement for Amendment 65.

Notices of Amendments: 20 March 2018                  

3

Data Protection Bill-[Lords], continued

Margot James

67

Clause  183,  page  106,  line  10,  at beginning insert “rights under”

Member’s explanatory statement

See the explanatory statement for Amendment 65.

Margot James

68

Clause  183,  page  106,  line  11,  at beginning insert “rights under”

Member’s explanatory statement

See the explanatory statement for Amendment 65.

Liam Byrne

Louise Haigh

Chris Elmore

Darren Jones

154

Clause  183,  page  106,  line  24,  at end insert—

“(4A)    

In accordance with Article 80(2) of the GDPR, a person who satisfies the

conditions in Article 80(1) and who considers that the rights of a data subject

under the GDPR have been infringed as a result of data processing, may bring

proceedings, on behalf of the data subject and independently of the data subject’s

mandate—

(a)    

pursuant to Article 77 (right to lodge a complaint with a supervisory

authority),

(b)    

to exercise the rights referred to in Article 78 (right to an effective

judicial remedy against a supervisory authority),

(c)    

to exercise the rights referred to in Article 79 (right to an effective

judicial remedy against a controller or processor).

(4B)    

An individual who considers that rights under the GDPR, this Act or any other

enactment relating to data protection have been infringed in respect of a class of

individuals of which he or she forms part may bring proceedings in respect of the

infringement as a representative of the class (independently of the mandate of

other members of the class), and—

(a)    

for the purposes of this subsection “proceedings” includes proceedings

for damages, and any damages recovered are to be distributed or

otherwise applied as directed by the court,

(b)    

in the case of a class consisting of or including children under the age of

18, an individual may bring proceedings as a representative of the class

whether or not the individual’s own rights have been infringed,

(c)    

the court in which proceedings are brought may direct that the individual

may not act as a representative, or may act as a representative only to a

specified extent, for a specified purpose or subject to specified

conditions,

(d)    

a direction under paragraph (c) may (subject to any provision of rules of

court relating to proceedings under this subsection) be made on the

application of a party or a member of the class, or of the court’s own

motion, and

(e)    

subject to any direction of the court, a judgment or order given in

proceedings in which a party is acting as a representative under this

subsection is binding on all individuals represented in the proceedings,

but may only be enforced by or against a person who is not a party to the

proceedings with the permission of the court.

Notices of Amendments: 20 March 2018                  

4

Data Protection Bill-[Lords], continued

(4C)    

Subsections (4A) and (4B)—

(a)    

apply in respect of infringements occurring (or alleged to have occurred)

whether before or after the commencement of this section,

(b)    

apply to proceedings begun before the commencement of this section as

if references in subsections (4A) and (4B) to bringing proceedings

included a reference to continuing proceedings, and

(c)    

are without prejudice to the generality of any other enactment or rule of

law which permits the bringing of representative proceedings.”

Member’s explanatory statement

This amendment would create a collective redress mechanism whereby a not-for-profit body,

organisation or association can represent multiple individuals for infringement of their rights

under the General Data Protection Regulation.

Margot James

69

Clause  184,  page  106,  line  41,  leave out “(including as applied by Chapter 3 of that

Part)”.

Member’s explanatory statement

This amendment is consequential on Amendment 4.

Margot James

That Clause 184 be transferred to the end of line 39 on page 105

Louise Haigh

Liam Byrne

Chris Elmore

231

Clause  190,  page  109,  line  33,  leave out “personal data” and insert “information”

Member’s explanatory statement

This amendment is consequential on Amendment 230.

Margot James

70

Clause  198,  page  114,  line  25,  at end insert “the following (except in the

expression “United Kingdom government department”)”

Member’s explanatory statement

This amendment makes clear that the definition of “government department” does not operate on

references to a “United Kingdom government department” (which can be found in Clause 185 and

paragraph 1 of Schedule 7).

Notices of Amendments: 20 March 2018                  

5

Data Protection Bill-[Lords], continued

Margot James

71

Clause  198,  page  115,  line  8,  at end insert—

“(2)    

References in this Act to a period expressed in hours, days, weeks, months or

years are to be interpreted in accordance with Article 3 of Regulation (EEC,

Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules

applicable to periods, dates and time limits, except in—

(a)    

section 125(4), (7) and (8);

(b)    

section 160(3), (5) and (6);

(c)    

section 176(2);

(d)    

section 179(8) and (9);

(e)    

section 180(4);

(f)    

section 186(3), (5) and (6);

(g)    

section 190(3) and (4);

(h)    

paragraph 18(4) and (5) of Schedule 1;

(i)    

paragraphs 5(4) and 6(4) of Schedule 3;

(j)    

Schedule 5;

(k)    

paragraph 11(5) of Schedule 12;

(l)    

Schedule 15;

(and the references in section 5 to terms used in Chapter 2 or 3 of Part 2 do not

include references to a period expressed in hours, days, weeks, months or years).”

Member’s explanatory statement

This amendment provides that periods of time referred to in the bill are generally to be interpreted

in accordance with Article 3 of EC Regulation 1182/71, which makes provision about the

calculation of periods of hours, days, weeks, months and years.

Margot James

182

Clause  198,  page  115,  line  8,  at end insert—

“( )    

Section 3(14)(aa) (interpretation of references to Chapter 2 of Part 2 in Parts 5 to

7) and the amendments in Schedule 18 which make equivalent provision are not

to be treated as implying a contrary intention for the purposes of section 20(2) of

the Interpretation Act 1978, or any similar provision in another enactment, as it

applies to other references to, or to a provision of, Chapter 2 of Part 2 of this Act.”

Member’s explanatory statement

Clause 3(14)(aa) (inserted by amendment 4) and equivalent provision contained in amendments

in Schedule 18 state expressly that references to Chapter 2 of Part 2 of the bill in Parts 5 to 7 of

the bill, and in certain amendments in Schedule 18, include that Chapter as applied by Chapter 3

of Part 2. This amendment secures that they are not to be treated as implying a contrary intention

for the purposes of section 20(2) of the Interpretation Act 1978. Section 20(2) provides that where

an Act refers to an enactment that reference includes that enactment as applied, unless the

contrary intention appears.

Margot James

183

Clause  200,  page  117,  line  15,  leave out subsections (1) to (4) and insert—

“(1)    

This Act applies only to processing of personal data described in subsections (2)

and (3).

Notices of Amendments: 20 March 2018                  

6

Data Protection Bill-[Lords], continued

(2)    

It applies to the processing of personal data in the context of the activities of an

establishment of a controller or processor in the United Kingdom, whether or not

the processing takes place in the United Kingdom.

(3)    

It also applies to the processing of personal data to which Chapter 2 of Part 2 (the

GDPR) applies where—

(a)    

the processing is carried out in the context of the activities of an

establishment of a controller or processor in a country or territory that is

not a member State, whether or not the processing takes place in such a

country or territory,

(b)    

the personal data relates to a data subject who is in the United Kingdom

when the processing takes place, and

(c)    

the processing activities are related to—

(i)    

the offering of goods or services to data subjects in the United

Kingdom, whether or not for payment, or

(ii)    

the monitoring of data subjects’ behaviour in the United

Kingdom.”

Member’s explanatory statement

This amendment replaces the existing provision on territorial application in clause 200(1) to (4).

In the amendment, subsection (2) provides that the bill applies to processing in the context of the

activities of an establishment of a controller or processor in the UK. Subsection (3) provides that,

in certain circumstances, the bill also applies to processing to which the GDPR applies and which

is carried out in the context of activities of an establishment of a controller or processor in a

country or territory that is not part of the EU.

Margot James

184

Clause  200,  page  118,  line  8,  leave out “(4)” and insert “(3)”

Member’s explanatory statement

This amendment is consequential on amendment 183.

Margot James

185

Clause  200,  page  118,  leave out line 10 and insert “processing of personal data”

Member’s explanatory statement

This amendment is consequential on amendment 183.

Margot James

186

Clause  200,  page  118,  line  10,  at end insert—

“(5A)    

Section 3(14)(b) does not apply to the reference to the processing of personal data

in subsection (2).

(5B)    

The reference in subsection (3) to Chapter 2 of Part 2 (the GDPR) does not

include that Chapter as applied by Chapter 3 of Part 2 (the applied GDPR).”

Member’s explanatory statement

New subsection (5A) secures that the reference to “processing” in the new subsection (2) inserted

by amendment 183 includes all types of processing of personal data. It disapplies clause 3(14)(b),

which provides that references to processing in Parts 5 to 7 of the bill are usually only to

processing to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies. New subsection (5B) secures

that the reference in the new subsection (3) to Chapter 2 of Part 2 of the bill does not include that

Chapter as applied by Chapter 3 of Part 2.

Notices of Amendments: 20 March 2018                  

7

Data Protection Bill-[Lords], continued

Margot James

187

Clause  200,  page  118,  line  11,  leave out “established” and insert “who has an

establishment”

Member’s explanatory statement

This amendment is consequential on amendment 183.

Margot James

188

Clause  200,  page  118,  line  21,  after “to” insert “a person who has an”

Member’s explanatory statement

This amendment is consequential on amendment 183.

Margot James

189

Clause  200,  page  118,  line  23,  leave out subsection (7)

Member’s explanatory statement

This amendment is consequential on amendment 183.

Margot James

190

Clause  204,  page  120,  line  12,  leave out subsection (1) and insert—

“(1)    

In Schedule 18—

(a)    

Part 1 contains minor and consequential amendments of primary

legislation;

(b)    

Part 2 contains minor and consequential amendments of other legislation;

(c)    

Part 3 contains consequential modifications of legislation;

(d)    

Part 4 contains supplementary provision.”

Member’s explanatory statement

This amendment sets out the contents of Schedule 18 and is consequential on the amendments

being made to Schedule 18 including in particular the insertion of new Parts 3 and 4 into that

Schedule by amendment 224.

Margot James

191

Schedule  18,  page  208,  line  25,  at end insert—

“Registration Service Act 1953 (c. 37)

A1  (1)  

Section 19AC of the Registration Service Act 1953 (codes of practice) is

amended as follows.

      (2)  

In subsection (2), for “section 52B (data-sharing code) of the Data Protection

Act 1998” substitute “section 122 of the Data Protection Act 2018 (data-

sharing code)”.

      (3)  

In subsection (11), for “section 51(3) of the Data Protection Act 1998”

substitute “section 128 of the Data Protection Act 2018”.