Session 2017-19
Internet Publications
Other Bills before Parliament


 
 

Consideration of Bill (Report Stage): 9 May 2018          

50

 

Data Protection Bill-[Lords], continued

 
 

(d)    

paragraph 2 of the entry for the Information Commissioner in

 

Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (asp

 

11);

 

(e)    

section 34X(5) of the Public Services Ombudsman (Wales) Act 2005

 

(disclosure of information by the Ombudsman);

 

(f)    

section 18(8) of the Commissioner for Older People (Wales) Act

 

2006;

 

(g)    

section 22(5) of the Welsh Language (Wales) Measure 2011

 

(nawm 1);

 

(h)    

section 49(5) of the Public Services Ombudsman Act (Northern

 

Ireland) 2016 (c. 4 (N.I.));

 

(i)    

section 44(3)(b) of the Justice Act (Northern Ireland) 2016 (c. 21

 

(N.I.)).

 

      (3)  

In this paragraph, “the relevant time”, in relation to a provision of a section or

 

Schedule listed in sub-paragraph (1) or (2), means the time when the

 

amendment of the section or Schedule by Schedule 18 to this Act comes into

 

force.

 

Codes etc required to be consistent with the Commissioner’s data-sharing code

 

48  (1)  

This paragraph applies in relation to the code of practice issued under each of

 

the following provisions—

 

(a)    

section 19AC of the Registration Service Act 1953 (code of practice

 

about disclosure of information by civil registration officials);

 

(b)    

section 43 of the Digital Economy Act 2017 (code of practice about

 

disclosure of information to improve public service delivery);

 

(c)    

section 52 of that Act (code of practice about disclosure of information

 

to reduce debt owed to the public sector);

 

(d)    

section 60 of that Act (code of practice about disclosure of information

 

to combat fraud against the public sector);

 

(e)    

section 70 of that Act (code of practice about disclosure of information

 

for research purposes).

 

      (2)  

During the relevant period, the code of practice does not have effect to the

 

extent that it is inconsistent with the code of practice prepared under section

 

121 of this Act (data-sharing code) and issued under section 124(4) of this Act

 

(as altered or replaced from time to time).

 

      (3)  

In this paragraph, “the relevant period”, in relation to a code issued under a

 

section mentioned in sub-paragraph (1), means the period—

 

(a)    

beginning when the amendments of that section in Schedule 18 to this

 

Act come into force, and

 

(b)    

ending when the code is first reissued under that section.

 

49  (1)  

This paragraph applies in relation to the original statement published under

 

section 45E of the Statistics and Registration Service Act 2007 (statement of

 

principles and procedures in connection with access to information by the

 

Statistics Board).

 

      (2)  

During the relevant period, the statement does not have effect to the extent that

 

it is inconsistent with the code of practice prepared under section 121 of this

 

Act (data-sharing code) and issued under section 124(4) of this Act (as altered

 

or replaced from time to time).

 

      (3)  

In this paragraph, “the relevant period” means the period—

 

(a)    

beginning when the amendments of section 45E of the Statistics and

 

Registration Service Act 2007 in Schedule 18 to this Act come into

 

force, and


 
 

Consideration of Bill (Report Stage): 9 May 2018          

51

 

Data Protection Bill-[Lords], continued

 
 

(b)    

ending when the first revised statement is published under that section.

 

Consumer Credit Act 1974

 

50         

In section 159(1)(a) of the Consumer Credit Act 1974 (correction of wrong

 

information) (as amended by Schedule 18 to this Act), the reference to

 

information given under Article 15(1) to (3) of the GDPR includes information

 

given at any time under section 7 of the 1998 Act.

 

Freedom of Information Act 2000

 

51         

Paragraphs 52 to 55 make provision about the Freedom of Information Act

 

2000 (“the 2000 Act”).

 

52  (1)  

This paragraph applies where a request for information was made to a public

 

authority under the 2000 Act before the relevant time.

 

      (2)  

To the extent that the request is dealt with after the relevant time, the

 

amendments of sections 2 and 40 of the 2000 Act in Schedule 18 to this Act

 

have effect for the purposes of determining whether the authority deals with

 

the request in accordance with Part 1 of the 2000 Act.

 

      (3)  

To the extent that the request was dealt with before the relevant time—

 

(a)    

the amendments of sections 2 and 40 of the 2000 Act in Schedule 18

 

to this Act do not have effect for the purposes of determining whether

 

the authority dealt with the request in accordance with Part 1 of the

 

2000 Act, but

 

(b)    

the powers of the Commissioner and the Tribunal, on an application or

 

appeal under the 2000 Act, do not include power to require the

 

authority to take steps which it would not be required to take in order

 

to comply with Part 1 of the 2000 Act as amended by Schedule 18 to

 

this Act.

 

      (4)  

In this paragraph—

 

“public authority” has the same meaning as in the 2000 Act;

 

“the relevant time” means the time when the amendments of sections 2

 

and 40 of the 2000 Act in Schedule 18 to this Act come into force.

 

53  (1)  

Tribunal Procedure Rules made under paragraph 7(1)(b) of Schedule 6 to the

 

1998 Act (appeal rights under the 2000 Act) and in force immediately before

 

the relevant time have effect after that time as if they were also made under

 

section 61 of the 2000 Act (as inserted by Schedule 18 to this Act).

 

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

 

paragraph 7(1)(b) of Schedule 6 to the 1998 Act comes into force.

 

54  (1)  

The repeal of paragraph 8 of Schedule 6 to the 1998 Act (obstruction etc in

 

proceedings before the Tribunal) does not affect the application of that

 

paragraph after the relevant time in relation to an act or omission before that

 

time in relation to an appeal under the 2000 Act.

 

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

 

paragraph 8 of Schedule 6 to the 1998 Act comes into force.

 

55  (1)  

The amendment of section 77 of the 2000 Act in Schedule 18 to this Act

 

(offence of altering etc record with intent to prevent disclosure: omission of

 

reference to section 7 of the 1998 Act) does not affect the application of that

 

section after the relevant time in relation to a case in which—

 

(a)    

the request for information mentioned in section 77(1) of the 2000 Act

 

was made before the relevant time, and

 

(b)    

when the request was made, section 77(1)(b) of the 2000 Act was

 

satisfied by virtue of section 7 of the 1998 Act.


 
 

Consideration of Bill (Report Stage): 9 May 2018          

52

 

Data Protection Bill-[Lords], continued

 
 

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

 

section 7 of the 1998 Act comes into force.

 

Freedom of Information (Scotland) Act 2002

 

56  (1)  

This paragraph applies where a request for information was made to a Scottish

 

public authority under the Freedom of Information (Scotland) Act 2002 (“the

 

2002 Act”) before the relevant time.

 

      (2)  

To the extent that the request is dealt with after the relevant time, the

 

amendments of the 2002 Act in Schedule 18 to this Act have effect for the

 

purposes of determining whether the authority deals with the request in

 

accordance with Part 1 of the 2002 Act.

 

      (3)  

To the extent that the request was dealt with before the relevant time—

 

(a)    

the amendments of the 2002 Act in Schedule 18 to this Act do not have

 

effect for the purposes of determining whether the authority dealt with

 

the request in accordance with Part 1 of the 2002 Act, but

 

(b)    

the powers of the Scottish Information Commissioner and the Court of

 

Session, on an application or appeal under the 2002 Act, do not include

 

power to require the authority to take steps which it would not be

 

required to take in order to comply with Part 1 of the 2002 Act as

 

amended by Schedule 18 to this Act.

 

      (4)  

In this paragraph—

 

“Scottish public authority” has the same meaning as in the 2002 Act;

 

“the relevant time” means the time when the amendments of the 2002 Act

 

in Schedule 18 to this Act come into force.

 

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))

 

57         

Until the first regulations under Article 5(4)(a) of the Access to Health Records

 

(Northern Ireland) Order 1993 (as amended by Schedule 18 to this Act) come

 

into force, the maximum amount of a fee that may be required for giving access

 

under that Article is £10.

 

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/

 

2450)

 

58  (1)  

The repeal of a provision of the 1998 Act does not affect its operation for the

 

purposes of the Privacy and Electronic Communications (EC Directive)

 

Regulations 2003 (“the PECR 2003”) (see regulations 2, 31 and 31B of, and

 

Schedule 1 to, those Regulations).

 

      (2)  

Where subordinate legislation made under a provision of the 1998 Act is in

 

force immediately before the repeal of that provision, neither the revocation of

 

the subordinate legislation nor the repeal of the provision of the 1998 Act

 

affect the application of the subordinate legislation for the purposes of the

 

PECR 2003 after that time.

 

      (3)  

Part 3 of Schedule 18 to this Act (modifications) does not have effect in

 

relation to the PECR 2003.

 

      (4)  

Part 7 of this Schedule does not have effect in relation to the provisions of the

 

1998 Act as applied by the PECR 2003.

 

Health and Personal Social Services (Quality, Improvement and Regulation) (Northern

 

Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))

 

59         

Part 3 of Schedule 18 to this Act (modifications) does not have effect in

 

relation to the reference to an accessible record within the meaning of section


 
 

Consideration of Bill (Report Stage): 9 May 2018          

53

 

Data Protection Bill-[Lords], continued

 
 

68 of the 1998 Act in regulation 43 of the Health and Personal Social Services

 

(Quality, Improvement and Regulation) (Northern Ireland) Order 2003.

 

Environmental Information Regulations 2004 (S.I. 2004/3391)

 

60  (1)  

This paragraph applies where a request for information was made to a public

 

authority under the Environmental Information Regulations 2004 (“the 2004

 

Regulations”) before the relevant time.

 

      (2)  

To the extent that the request is dealt with after the relevant time, the

 

amendments of the 2004 Regulations in Schedule 18 to this Act have effect for

 

the purposes of determining whether the authority deals with the request in

 

accordance with Parts 2 and 3 of those Regulations.

 

      (3)  

To the extent that the request was dealt with before the relevant time—

 

(a)    

the amendments of the 2004 Regulations in Schedule 18 to this Act do

 

not have effect for the purposes of determining whether the authority

 

dealt with the request in accordance with Parts 2 and 3 of those

 

Regulations, but

 

(b)    

the powers of the Commissioner and the Tribunal, on an application or

 

appeal under the 2000 Act (as applied by the 2004 Regulations), do not

 

include power to require the authority to take steps which it would not

 

be required to take in order to comply with Parts 2 and 3 of those

 

Regulations as amended by Schedule 18 to this Act.

 

      (4)  

In this paragraph—

 

“public authority” has the same meaning as in the 2004 Regulations;

 

“the relevant time” means the time when the amendments of the 2004

 

Regulations in Schedule 18 to this Act come into force.

 

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

 

61  (1)  

This paragraph applies where a request for information was made to a Scottish

 

public authority under the Environmental Information (Scotland) Regulations

 

2004 (“the 2004 Regulations”) before the relevant time.

 

      (2)  

To the extent that the request is dealt with after the relevant time, the

 

amendments of the 2004 Regulations in Schedule 18 to this Act have effect for

 

the purposes of determining whether the authority deals with the request in

 

accordance with those Regulations.

 

      (3)  

To the extent that the request was dealt with before the relevant time—

 

(a)    

the amendments of the 2004 Regulations in Schedule 18 to this Act do

 

not have effect for the purposes of determining whether the authority

 

dealt with the request in accordance with those Regulations, but

 

(b)    

the powers of the Scottish Information Commissioner and the Court of

 

Session, on an application or appeal under the 2002 Act (as applied by

 

the 2004 Regulations), do not include power to require the authority to

 

take steps which it would not be required to take in order to comply

 

with those Regulations as amended by Schedule 18 to this Act.

 

      (4)  

In this paragraph—

 

“Scottish public authority” has the same meaning as in the 2004

 

Regulations;

 

“the relevant time” means the time when the amendments of the 2004

 

Regulations in Schedule 18 to this Act come into force.”

 

Member’s explanatory statement

 

This amendment inserts a Schedule making transitional, transitory and saving provision in

 

connection with the coming into force of the Bill, including provision about subject access requests


 
 

Consideration of Bill (Report Stage): 9 May 2018          

54

 

Data Protection Bill-[Lords], continued

 
 

(see Part 2 of the Schedule) and about the Information Commissioner’s enforcement powers (see

 

Parts 7 and 8 of the Schedule).

 


 

Tom Watson

 

Liam Byrne

 

Louise Haigh

 

Chris Elmore

 

NS1

 

To move the following Schedule—

 

“Bill of Data Rights in the Digital Environment

 

            

The UK recognises the following Data Rights:

 

Article 1 —Equality of Treatment

 

            

Every data subject has the right to fair and equal treatment in the processing of

 

his or her personal data.

 

Article 2 — Security

 

            

Every data subject has the right to security and protection of their personal data

 

and information systems.

 

            

Access requests by government must be for the purpose of combating serious

 

crime and subject to independent authorisation.

 

Article 3 — Free Expression

 

            

Every data subject has the right to deploy his or her personal data in pursuit of

 

their fundamental rights to freedom of expression, thought and conscience.

 

Article 4 — Equality of Access

 

            

Every data subject has the right to access and participate in the digital

 

environment on equal terms.

 

            

Internet access should be open.

 

Article 5 — Privacy

 

            

Every data subject has the right to respect for their personal data and

 

information systems and as part of his or her fundamental right to private and

 

family life, home and communications.

 

            

 

Article 6 — Ownership

 

            

Every data subject has the right to own and control his or her personal data.

 

            

Every data subject is entitled to proportionate share of income or other benefit

 

derived from his or her personal data as part of the right to own.


 
 

Consideration of Bill (Report Stage): 9 May 2018          

55

 

Data Protection Bill-[Lords], continued

 
 

Article 7— Control

 

            

Every data subject is entitled to know the purpose for which personal data is

 

being processed. Data controllers should not deliberately extend the gathering

 

of personal data solely for their own purposes. Government, corporations,

 

public authorities and other data controllers must obtain meaningful consent

 

for the use of people’s personal data. Every data subject has the right to own

 

curate, move, revise or review their personal data.

 

Article 8— Algorithms

 

            

Every data subject has the right to transparent and equal treatment in the

 

processing of his or her personal data by an algorithm or automated system.

 

            

Every data subject is entitled to meaningful human control in making

 

significant decisions – algorithms and automated systems must not be

 

deployed to make significant decisions.

 

Article 9— Participation

 

            

Every data subject has the right to deploy his or her personal data and

 

information systems to communicate in pursuit of the fundamental right to

 

freedom of association.

 

Article 10— Protection

 

            

Every data subject has the right to safety and protection from harassment and

 

other targeting through use of personal data whether sexual, social or

 

commercial.

 

Article 11 — Removal

 

            

Every data subject is entitled to revise and remove their personal data.

 

Compensation

 

            

Breach of any right in this Bill will entitle the data subject to fair and equitable

 

compensation under existing enforcement provisions. If none apply, the Centre

 

for Data Ethics will establish and administer a compensation scheme to ensure

 

just remedy for any breaches.

 

Application to Children

 

            

The application of these rights to a person less than 18 years of age must be

 

read in conjunction with the rights set out in the United Nations Convention on

 

the Rights of the Child. Where an information society service processes data

 

of persons less than 18 years of age it must do so under the age appropriate

 

design code set out in section 123 of this Act.”

 

 


 

Caroline Lucas

 

152

 

Parliamentary Star    

Schedule  1,  page  132,  line  42,  leave out paragraph 22


 
 

Consideration of Bill (Report Stage): 9 May 2018          

56

 

Data Protection Bill-[Lords], continued

 
 

Secretary Matt Hancock

 

72

 

Schedule  1,  page  134,  line  11,  at end insert —

 

“( )    

a mayor for the area of a combined authority established under section

 

103 of the Local Democracy, Economic Development and

 

Construction Act 2009;”

 

Member’s explanatory statement

 

This amendment adds mayors of combined authorities in England to the list of elected

 

representatives for the purposes of paragraphs 23 and 24 of Schedule 1, which authorise certain

 

processing of special categories of personal data by such representatives.

 

Secretary Matt Hancock

 

73

 

Schedule  1,  page  134,  line  19,  at end insert —

 

“( )    

a police and crime commissioner.”

 

Member’s explanatory statement

 

This amendment adds police and crime commissioners established under section 1 of the Police

 

Reform and Social Responsibility Act 2011 to the list of elected representatives for the purposes of

 

paragraphs 23 and 24 of Schedule 1, which authorise certain processing of special categories of

 

personal data by such representatives.

 


 

Caroline Lucas

 

16

 

Schedule  2,  page  140,  line  15,  at end insert—

 

“(1A)    

The exemption in sub-paragraph (1) may not be invoked in relation to offences

 

under—

 

(a)    

sections 24, 24A, 24B or 24C of the Immigration Act 1971,

 

(b)    

section 21 of the Immigration, Asylum and Nationality Act 2006, or

 

(c)    

sections 33A and 33B of the Immigration Act 2014.”

 

Tom Watson

 

Liam Byrne

 

Louise Haigh

 

Chris Elmore

 

Sir Edward Davey

 

Layla Moran

Tim Farron

Christine Jardine

Caroline Lucas

Jamie Stone

Jo Swinson

Tom Brake

Stephen Lloyd

Wera Hobhouse

Mr Alistair Carmichael

Stuart C. McDonald

Dr Paul Williams

 

15

 

Schedule  2,  page  141,  line  17,  leave out paragraph 4

 

Secretary Matt Hancock

 

141

 

Schedule  2,  page  141,  line  39,  leave out from “(vi)” to end of line 44

 

Member’s explanatory statement

 

Paragraph 4(2) of Schedule 2 lists provisions of the GDPR which do not apply to the extent that

 

their application would be likely to prejudice certain matters relating to immigration. This

 

amendment removes Articles 5(1)(a) and (b) from the list (except so far as they correspond to


 
PreviousBack to StartNext
 

Revised 09 May 2018