|
|
| |
| |
|
| |
| given up to and including |
|
| |
| New Amendments handed in are marked thus  |
|
| Amendments which will comply with the required notice period at their next appearance
|
|
| |
| Data Protection Bill [Lords]
|
|
| |
| | This document includes all amendments remaining before the Committee and |
|
| | includes any withdrawn amendments at the end. The amendments have been |
|
| | arranged in accordance with the Order of the Committee [13 March 2018].
|
|
| | |
| |
| |
| | |
| Schedule 17, page 206, line 15, leave out paragraph (a) and insert— |
|
| | “(a) | a relevant health record (see paragraph 1A),” |
|
| | Member’s explanatory statement
|
|
| | This amendment, with Amendment 128, limits the types of health records (defined in Clause 198) |
|
| | which count as “relevant records” for the purposes of Clause 181 (prohibition of requirement to |
|
| | produce relevant records) to those obtained by a data subject in the exercise of a data subject |
|
| | access right (defined in paragraph 4 of Schedule 17). |
|
|
|
| |
| |
|
| |
| | |
| Schedule 17, page 206, line 21, at end insert— |
|
| | |
| | 1A | “Relevant health record” means a health record which has been or is to be |
|
| | obtained by a data subject in the exercise of a data subject access right.” |
|
| | Member’s explanatory statement
|
|
| | See the explanatory statement for Amendment 127. |
|
| |
| | |
| Schedule 17, page 207, line 22, leave out sub-paragraph (iii) and insert— |
|
| | “(iii) | Article 45 of the Criminal Justice (Children) (Northern |
|
| | Ireland) Order 1998 (S.I. 1998/1504 (N.I. 9));” |
|
| | Member’s explanatory statement
|
|
| | In a list of functions of the Secretary of State in relation to people sentenced to detention, this |
|
| | amendment removes a reference to section 73 of the Children and Young Persons Act 1968 (which |
|
| | has been repealed) and inserts a reference to Article 45 of the Criminal Justice (Children) |
|
| | (Northern Ireland) Order 1998 (which replaced it). |
|
| |
| |
| | |
| Clause 183, page 105, line 42, leave out “80” and insert “80(1)” |
|
| | Member’s explanatory statement
|
|
| | This amendment changes a reference to Article 80 of the GDPR into a reference to Article 80(1) |
|
| | and is consequential on NC2. |
|
| |
| | |
| Clause 183, page 105, line 44, leave out “certain rights” and insert “the data |
|
| subject’s rights under Articles 77, 78 and 79 of the GDPR (rights to lodge complaints and |
|
| to an effective judicial remedy)” |
|
| | Member’s explanatory statement
|
|
| | In words summarising Article 80(1) of the GDPR, this amendment adds information about the |
|
| | rights of data subjects that may be exercised by representative bodies under that provision. |
|
| |
| | |
| Clause 183, page 106, line 7, leave out “under the following provisions” and insert |
|
| |
| | Member’s explanatory statement
|
|
| | This amendment and Amendments 66, 67 and 68 tidy up Clause 183(2). |
|
| |
| | |
| Clause 183, page 106, line 9, at beginning insert “rights under” |
|
| | Member’s explanatory statement
|
|
| | See the explanatory statement for Amendment 65. |
|
|
|
| |
| |
|
| |
| | |
| Clause 183, page 106, line 10, at beginning insert “rights under” |
|
| | Member’s explanatory statement
|
|
| | See the explanatory statement for Amendment 65. |
|
| |
| | |
| Clause 183, page 106, line 11, at beginning insert “rights under” |
|
| | Member’s explanatory statement
|
|
| | See the explanatory statement for Amendment 65. |
|
| |
| |
| |
| |
| | |
| Clause 183, page 106, line 24, at end insert— |
|
| | “(4A) | In accordance with Article 80(2) of the GDPR, a person who satisfies the |
|
| | conditions in Article 80(1) and who considers that the rights of a data subject |
|
| | under the GDPR have been infringed as a result of data processing, may bring |
|
| | proceedings, on behalf of the data subject and independently of the data subject’s |
|
| | |
| | (a) | pursuant to Article 77 (right to lodge a complaint with a supervisory |
|
| | |
| | (b) | to exercise the rights referred to in Article 78 (right to an effective |
|
| | judicial remedy against a supervisory authority), |
|
| | (c) | to exercise the rights referred to in Article 79 (right to an effective |
|
| | judicial remedy against a controller or processor). |
|
| | (4B) | An individual who considers that rights under the GDPR, this Act or any other |
|
| | enactment relating to data protection have been infringed in respect of a class of |
|
| | individuals of which he or she forms part may bring proceedings in respect of the |
|
| | infringement as a representative of the class (independently of the mandate of |
|
| | other members of the class), and— |
|
| | (a) | for the purposes of this subsection “proceedings” includes proceedings |
|
| | for damages, and any damages recovered are to be distributed or |
|
| | otherwise applied as directed by the court, |
|
| | (b) | in the case of a class consisting of or including children under the age of |
|
| | 18, an individual may bring proceedings as a representative of the class |
|
| | whether or not the individual’s own rights have been infringed, |
|
| | (c) | the court in which proceedings are brought may direct that the individual |
|
| | may not act as a representative, or may act as a representative only to a |
|
| | specified extent, for a specified purpose or subject to specified |
|
| | |
| | (d) | a direction under paragraph (c) may (subject to any provision of rules of |
|
| | court relating to proceedings under this subsection) be made on the |
|
| | application of a party or a member of the class, or of the court’s own |
|
| | |
| | (e) | subject to any direction of the court, a judgment or order given in |
|
| | proceedings in which a party is acting as a representative under this |
|
| | subsection is binding on all individuals represented in the proceedings, |
|
| | but may only be enforced by or against a person who is not a party to the |
|
| | proceedings with the permission of the court. |
|
|
|
| |
| |
|
| | (4C) | Subsections (4A) and (4B)— |
|
| | (a) | apply in respect of infringements occurring (or alleged to have occurred) |
|
| | whether before or after the commencement of this section, |
|
| | (b) | apply to proceedings begun before the commencement of this section as |
|
| | if references in subsections (4A) and (4B) to bringing proceedings |
|
| | included a reference to continuing proceedings, and |
|
| | (c) | are without prejudice to the generality of any other enactment or rule of |
|
| | law which permits the bringing of representative proceedings.” |
|
| | Member’s explanatory statement
|
|
| | This amendment would create a collective redress mechanism whereby a not-for-profit body, |
|
| | organisation or association can represent multiple individuals for infringement of their rights |
|
| | under the General Data Protection Regulation. |
|
| |
| |
| | |
| Clause 184, page 106, line 41, leave out “(including as applied by Chapter 3 of that |
|
| |
| | Member’s explanatory statement
|
|
| | This amendment is consequential on Amendment 4. |
|
| |
| That Clause 184 be transferred to the end of line 39 on page 105 |
|
| |
| |
| |
| |
| | |
|
| Clause 190, page 109, line 33, leave out “personal data” and insert “information” |
|
| | Member’s explanatory statement
|
|
| | This amendment is consequential on Amendment 230. |
|
| |
| |
| | |
| Clause 198, page 114, line 25, at end insert “the following (except in the |
|
| expression “United Kingdom government department”)” |
|
| | Member’s explanatory statement
|
|
| | This amendment makes clear that the definition of “government department” does not operate on |
|
| | references to a “United Kingdom government department” (which can be found in Clause 185 and |
|
| | paragraph 1 of Schedule 7). |
|
|
|
| |
| |
|
| |
| | |
| Clause 198, page 115, line 8, at end insert— |
|
| | “(2) | References in this Act to a period expressed in hours, days, weeks, months or |
|
| | years are to be interpreted in accordance with Article 3 of Regulation (EEC, |
|
| | Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules |
|
| | applicable to periods, dates and time limits, except in— |
|
| | (a) | section 125(4), (7) and (8); |
|
| | (b) | section 160(3), (5) and (6); |
|
| | |
| | (d) | section 179(8) and (9); |
|
| | |
| | (f) | section 186(3), (5) and (6); |
|
| | (g) | section 190(3) and (4); |
|
| | (h) | paragraph 18(4) and (5) of Schedule 1; |
|
| | (i) | paragraphs 5(4) and 6(4) of Schedule 3; |
|
| | |
| | (k) | paragraph 11(5) of Schedule 12; |
|
| | |
| | | (and the references in section 5 to terms used in Chapter 2 or 3 of Part 2 do not |
|
| | include references to a period expressed in hours, days, weeks, months or years).” |
|
| | Member’s explanatory statement
|
|
| | This amendment provides that periods of time referred to in the bill are generally to be interpreted |
|
| | in accordance with Article 3 of EC Regulation 1182/71, which makes provision about the |
|
| | calculation of periods of hours, days, weeks, months and years. |
|
| |
| | |
| Clause 198, page 115, line 8, at end insert— |
|
| | “( ) | Section 3(14)(aa) (interpretation of references to Chapter 2 of Part 2 in Parts 5 to |
|
| | 7) and the amendments in Schedule 18 which make equivalent provision are not |
|
| | to be treated as implying a contrary intention for the purposes of section 20(2) of |
|
| | the Interpretation Act 1978, or any similar provision in another enactment, as it |
|
| | applies to other references to, or to a provision of, Chapter 2 of Part 2 of this Act.” |
|
| | Member’s explanatory statement
|
|
| | Clause 3(14)(aa) (inserted by amendment 4) and equivalent provision contained in amendments |
|
| | in Schedule 18 state expressly that references to Chapter 2 of Part 2 of the bill in Parts 5 to 7 of |
|
| | the bill, and in certain amendments in Schedule 18, include that Chapter as applied by Chapter 3 |
|
| | of Part 2. This amendment secures that they are not to be treated as implying a contrary intention |
|
| | for the purposes of section 20(2) of the Interpretation Act 1978. Section 20(2) provides that where |
|
| | an Act refers to an enactment that reference includes that enactment as applied, unless the |
|
| | contrary intention appears. |
|
| |
| |
| | |
| Clause 200, page 117, line 15, leave out subsections (1) to (4) and insert— |
|
| | “(1) | This Act applies only to processing of personal data described in subsections (2) |
|
| | |
|
|
| |
| |
|
| | (2) | It applies to the processing of personal data in the context of the activities of an |
|
| | establishment of a controller or processor in the United Kingdom, whether or not |
|
| | the processing takes place in the United Kingdom. |
|
| | (3) | It also applies to the processing of personal data to which Chapter 2 of Part 2 (the |
|
| | |
| | (a) | the processing is carried out in the context of the activities of an |
|
| | establishment of a controller or processor in a country or territory that is |
|
| | not a member State, whether or not the processing takes place in such a |
|
| | |
| | (b) | the personal data relates to a data subject who is in the United Kingdom |
|
| | when the processing takes place, and |
|
| | (c) | the processing activities are related to— |
|
| | (i) | the offering of goods or services to data subjects in the United |
|
| | Kingdom, whether or not for payment, or |
|
| | (ii) | the monitoring of data subjects’ behaviour in the United |
|
| | |
| | Member’s explanatory statement
|
|
| | This amendment replaces the existing provision on territorial application in clause 200(1) to (4). |
|
| | In the amendment, subsection (2) provides that the bill applies to processing in the context of the |
|
| | activities of an establishment of a controller or processor in the UK. Subsection (3) provides that, |
|
| | in certain circumstances, the bill also applies to processing to which the GDPR applies and which |
|
| | is carried out in the context of activities of an establishment of a controller or processor in a |
|
| | country or territory that is not part of the EU. |
|
| |
| | |
| Clause 200, page 118, line 8, leave out “(4)” and insert “(3)” |
|
| | Member’s explanatory statement
|
|
| | This amendment is consequential on amendment 183. |
|
| |
| | |
| Clause 200, page 118, leave out line 10 and insert “processing of personal data” |
|
| | Member’s explanatory statement
|
|
| | This amendment is consequential on amendment 183. |
|
| |
| | |
| Clause 200, page 118, line 10, at end insert— |
|
| | “(5A) | Section 3(14)(b) does not apply to the reference to the processing of personal data |
|
| | |
| | (5B) | The reference in subsection (3) to Chapter 2 of Part 2 (the GDPR) does not |
|
| | include that Chapter as applied by Chapter 3 of Part 2 (the applied GDPR).” |
|
| | Member’s explanatory statement
|
|
| | New subsection (5A) secures that the reference to “processing” in the new subsection (2) inserted |
|
| | by amendment 183 includes all types of processing of personal data. It disapplies clause 3(14)(b), |
|
| | which provides that references to processing in Parts 5 to 7 of the bill are usually only to |
|
| | processing to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies. New subsection (5B) secures |
|
| | that the reference in the new subsection (3) to Chapter 2 of Part 2 of the bill does not include that |
|
| | Chapter as applied by Chapter 3 of Part 2. |
|
|
|
| |
| |
|
| |
| | |
| Clause 200, page 118, line 11, leave out “established” and insert “who has an |
|
| |
| | Member’s explanatory statement
|
|
| | This amendment is consequential on amendment 183. |
|
| |
| | |
| Clause 200, page 118, line 21, after “to” insert “a person who has an” |
|
| | Member’s explanatory statement
|
|
| | This amendment is consequential on amendment 183. |
|
| |
| | |
| Clause 200, page 118, line 23, leave out subsection (7) |
|
| | Member’s explanatory statement
|
|
| | This amendment is consequential on amendment 183. |
|
| |
| |
| | |
| Clause 204, page 120, line 12, leave out subsection (1) and insert— |
|
| | |
| | (a) | Part 1 contains minor and consequential amendments of primary |
|
| | |
| | (b) | Part 2 contains minor and consequential amendments of other legislation; |
|
| | (c) | Part 3 contains consequential modifications of legislation; |
|
| | (d) | Part 4 contains supplementary provision.” |
|
| | Member’s explanatory statement
|
|
| | This amendment sets out the contents of Schedule 18 and is consequential on the amendments |
|
| | being made to Schedule 18 including in particular the insertion of new Parts 3 and 4 into that |
|
| | Schedule by amendment 224. |
|
| |
| |
| | |
| Schedule 18, page 208, line 25, at end insert— |
|
| | “Registration Service Act 1953 (c. 37) |
|
| | A1 (1) | Section 19AC of the Registration Service Act 1953 (codes of practice) is |
|
| | |
| | (2) | In subsection (2), for “section 52B (data-sharing code) of the Data Protection |
|
| | Act 1998” substitute “section 122 of the Data Protection Act 2018 (data- |
|
| | |
| | (3) | In subsection (11), for “section 51(3) of the Data Protection Act 1998” |
|
| | substitute “section 128 of the Data Protection Act 2018”. |
|
|