Consideration of Bill (Report Stage): 9 May 2018          

50

Data Protection Bill-[Lords], continued

(d)    

paragraph 2 of the entry for the Information Commissioner in

Schedule 5 to the Scottish Public Services Ombudsman Act 2002 (asp

11);

(e)    

section 34X(5) of the Public Services Ombudsman (Wales) Act 2005

(disclosure of information by the Ombudsman);

(f)    

section 18(8) of the Commissioner for Older People (Wales) Act

2006;

(g)    

section 22(5) of the Welsh Language (Wales) Measure 2011

(nawm 1);

(h)    

section 49(5) of the Public Services Ombudsman Act (Northern

Ireland) 2016 (c. 4 (N.I.));

(i)    

section 44(3)(b) of the Justice Act (Northern Ireland) 2016 (c. 21

(N.I.)).

      (3)  

In this paragraph, “the relevant time”, in relation to a provision of a section or

Schedule listed in sub-paragraph (1) or (2), means the time when the

amendment of the section or Schedule by Schedule 18 to this Act comes into

force.

Codes etc required to be consistent with the Commissioner’s data-sharing code

48  (1)  

This paragraph applies in relation to the code of practice issued under each of

the following provisions—

(a)    

section 19AC of the Registration Service Act 1953 (code of practice

about disclosure of information by civil registration officials);

(b)    

section 43 of the Digital Economy Act 2017 (code of practice about

disclosure of information to improve public service delivery);

(c)    

section 52 of that Act (code of practice about disclosure of information

to reduce debt owed to the public sector);

(d)    

section 60 of that Act (code of practice about disclosure of information

to combat fraud against the public sector);

(e)    

section 70 of that Act (code of practice about disclosure of information

for research purposes).

      (2)  

During the relevant period, the code of practice does not have effect to the

extent that it is inconsistent with the code of practice prepared under section

121 of this Act (data-sharing code) and issued under section 124(4) of this Act

(as altered or replaced from time to time).

      (3)  

In this paragraph, “the relevant period”, in relation to a code issued under a

section mentioned in sub-paragraph (1), means the period—

(a)    

beginning when the amendments of that section in Schedule 18 to this

Act come into force, and

(b)    

ending when the code is first reissued under that section.

49  (1)  

This paragraph applies in relation to the original statement published under

section 45E of the Statistics and Registration Service Act 2007 (statement of

principles and procedures in connection with access to information by the

Statistics Board).

      (2)  

During the relevant period, the statement does not have effect to the extent that

it is inconsistent with the code of practice prepared under section 121 of this

Act (data-sharing code) and issued under section 124(4) of this Act (as altered

or replaced from time to time).

      (3)  

In this paragraph, “the relevant period” means the period—

(a)    

beginning when the amendments of section 45E of the Statistics and

Registration Service Act 2007 in Schedule 18 to this Act come into

force, and

Consideration of Bill (Report Stage): 9 May 2018          

51

Data Protection Bill-[Lords], continued

(b)    

ending when the first revised statement is published under that section.

Consumer Credit Act 1974

50         

In section 159(1)(a) of the Consumer Credit Act 1974 (correction of wrong

information) (as amended by Schedule 18 to this Act), the reference to

information given under Article 15(1) to (3) of the GDPR includes information

given at any time under section 7 of the 1998 Act.

Freedom of Information Act 2000

51         

Paragraphs 52 to 55 make provision about the Freedom of Information Act

2000 (“the 2000 Act”).

52  (1)  

This paragraph applies where a request for information was made to a public

authority under the 2000 Act before the relevant time.

      (2)  

To the extent that the request is dealt with after the relevant time, the

amendments of sections 2 and 40 of the 2000 Act in Schedule 18 to this Act

have effect for the purposes of determining whether the authority deals with

the request in accordance with Part 1 of the 2000 Act.

      (3)  

To the extent that the request was dealt with before the relevant time—

(a)    

the amendments of sections 2 and 40 of the 2000 Act in Schedule 18

to this Act do not have effect for the purposes of determining whether

the authority dealt with the request in accordance with Part 1 of the

2000 Act, but

(b)    

the powers of the Commissioner and the Tribunal, on an application or

appeal under the 2000 Act, do not include power to require the

authority to take steps which it would not be required to take in order

to comply with Part 1 of the 2000 Act as amended by Schedule 18 to

this Act.

      (4)  

In this paragraph—

“public authority” has the same meaning as in the 2000 Act;

“the relevant time” means the time when the amendments of sections 2

and 40 of the 2000 Act in Schedule 18 to this Act come into force.

53  (1)  

Tribunal Procedure Rules made under paragraph 7(1)(b) of Schedule 6 to the

1998 Act (appeal rights under the 2000 Act) and in force immediately before

the relevant time have effect after that time as if they were also made under

section 61 of the 2000 Act (as inserted by Schedule 18 to this Act).

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

paragraph 7(1)(b) of Schedule 6 to the 1998 Act comes into force.

54  (1)  

The repeal of paragraph 8 of Schedule 6 to the 1998 Act (obstruction etc in

proceedings before the Tribunal) does not affect the application of that

paragraph after the relevant time in relation to an act or omission before that

time in relation to an appeal under the 2000 Act.

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

paragraph 8 of Schedule 6 to the 1998 Act comes into force.

55  (1)  

The amendment of section 77 of the 2000 Act in Schedule 18 to this Act

(offence of altering etc record with intent to prevent disclosure: omission of

reference to section 7 of the 1998 Act) does not affect the application of that

section after the relevant time in relation to a case in which—

(a)    

the request for information mentioned in section 77(1) of the 2000 Act

was made before the relevant time, and

(b)    

when the request was made, section 77(1)(b) of the 2000 Act was

satisfied by virtue of section 7 of the 1998 Act.

Consideration of Bill (Report Stage): 9 May 2018          

52

Data Protection Bill-[Lords], continued

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

section 7 of the 1998 Act comes into force.

Freedom of Information (Scotland) Act 2002

56  (1)  

This paragraph applies where a request for information was made to a Scottish

public authority under the Freedom of Information (Scotland) Act 2002 (“the

2002 Act”) before the relevant time.

      (2)  

To the extent that the request is dealt with after the relevant time, the

amendments of the 2002 Act in Schedule 18 to this Act have effect for the

purposes of determining whether the authority deals with the request in

accordance with Part 1 of the 2002 Act.

      (3)  

To the extent that the request was dealt with before the relevant time—

(a)    

the amendments of the 2002 Act in Schedule 18 to this Act do not have

effect for the purposes of determining whether the authority dealt with

the request in accordance with Part 1 of the 2002 Act, but

(b)    

the powers of the Scottish Information Commissioner and the Court of

Session, on an application or appeal under the 2002 Act, do not include

power to require the authority to take steps which it would not be

required to take in order to comply with Part 1 of the 2002 Act as

amended by Schedule 18 to this Act.

      (4)  

In this paragraph—

“Scottish public authority” has the same meaning as in the 2002 Act;

“the relevant time” means the time when the amendments of the 2002 Act

in Schedule 18 to this Act come into force.

Access to Health Records (Northern Ireland) Order 1993 (S.I. 1993/1250 (N.I. 4))

57         

Until the first regulations under Article 5(4)(a) of the Access to Health Records

(Northern Ireland) Order 1993 (as amended by Schedule 18 to this Act) come

into force, the maximum amount of a fee that may be required for giving access

under that Article is £10.

Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/

2450)

58  (1)  

The repeal of a provision of the 1998 Act does not affect its operation for the

purposes of the Privacy and Electronic Communications (EC Directive)

Regulations 2003 (“the PECR 2003”) (see regulations 2, 31 and 31B of, and

Schedule 1 to, those Regulations).

      (2)  

Where subordinate legislation made under a provision of the 1998 Act is in

force immediately before the repeal of that provision, neither the revocation of

the subordinate legislation nor the repeal of the provision of the 1998 Act

affect the application of the subordinate legislation for the purposes of the

PECR 2003 after that time.

      (3)  

Part 3 of Schedule 18 to this Act (modifications) does not have effect in

relation to the PECR 2003.

      (4)  

Part 7 of this Schedule does not have effect in relation to the provisions of the

1998 Act as applied by the PECR 2003.

Health and Personal Social Services (Quality, Improvement and Regulation) (Northern

Ireland) Order 2003 (S.I. 2003/431 (N.I. 9))

59         

Part 3 of Schedule 18 to this Act (modifications) does not have effect in

relation to the reference to an accessible record within the meaning of section

Consideration of Bill (Report Stage): 9 May 2018          

53

Data Protection Bill-[Lords], continued

68 of the 1998 Act in regulation 43 of the Health and Personal Social Services

(Quality, Improvement and Regulation) (Northern Ireland) Order 2003.

Environmental Information Regulations 2004 (S.I. 2004/3391)

60  (1)  

This paragraph applies where a request for information was made to a public

authority under the Environmental Information Regulations 2004 (“the 2004

Regulations”) before the relevant time.

      (2)  

To the extent that the request is dealt with after the relevant time, the

amendments of the 2004 Regulations in Schedule 18 to this Act have effect for

the purposes of determining whether the authority deals with the request in

accordance with Parts 2 and 3 of those Regulations.

      (3)  

To the extent that the request was dealt with before the relevant time—

(a)    

the amendments of the 2004 Regulations in Schedule 18 to this Act do

not have effect for the purposes of determining whether the authority

dealt with the request in accordance with Parts 2 and 3 of those

Regulations, but

(b)    

the powers of the Commissioner and the Tribunal, on an application or

appeal under the 2000 Act (as applied by the 2004 Regulations), do not

include power to require the authority to take steps which it would not

be required to take in order to comply with Parts 2 and 3 of those

Regulations as amended by Schedule 18 to this Act.

      (4)  

In this paragraph—

“public authority” has the same meaning as in the 2004 Regulations;

“the relevant time” means the time when the amendments of the 2004

Regulations in Schedule 18 to this Act come into force.

Environmental Information (Scotland) Regulations 2004 (S.S.I. 2004/520)

61  (1)  

This paragraph applies where a request for information was made to a Scottish

public authority under the Environmental Information (Scotland) Regulations

2004 (“the 2004 Regulations”) before the relevant time.

      (2)  

To the extent that the request is dealt with after the relevant time, the

amendments of the 2004 Regulations in Schedule 18 to this Act have effect for

the purposes of determining whether the authority deals with the request in

accordance with those Regulations.

      (3)  

To the extent that the request was dealt with before the relevant time—

(a)    

the amendments of the 2004 Regulations in Schedule 18 to this Act do

not have effect for the purposes of determining whether the authority

dealt with the request in accordance with those Regulations, but

(b)    

the powers of the Scottish Information Commissioner and the Court of

Session, on an application or appeal under the 2002 Act (as applied by

the 2004 Regulations), do not include power to require the authority to

take steps which it would not be required to take in order to comply

with those Regulations as amended by Schedule 18 to this Act.

      (4)  

In this paragraph—

“Scottish public authority” has the same meaning as in the 2004

Regulations;

“the relevant time” means the time when the amendments of the 2004

Regulations in Schedule 18 to this Act come into force.”

Member’s explanatory statement

This amendment inserts a Schedule making transitional, transitory and saving provision in

connection with the coming into force of the Bill, including provision about subject access requests

Consideration of Bill (Report Stage): 9 May 2018          

54

Data Protection Bill-[Lords], continued

(see Part 2 of the Schedule) and about the Information Commissioner’s enforcement powers (see

Parts 7 and 8 of the Schedule).

Tom Watson

Liam Byrne

Louise Haigh

Chris Elmore

NS1

To move the following Schedule—

“Bill of Data Rights in the Digital Environment

The UK recognises the following Data Rights:

Article 1 —Equality of Treatment

Every data subject has the right to fair and equal treatment in the processing of

his or her personal data.

Article 2 — Security

Every data subject has the right to security and protection of their personal data

and information systems.

Access requests by government must be for the purpose of combating serious

crime and subject to independent authorisation.

Article 3 — Free Expression

Every data subject has the right to deploy his or her personal data in pursuit of

their fundamental rights to freedom of expression, thought and conscience.

Article 4 — Equality of Access

Every data subject has the right to access and participate in the digital

environment on equal terms.

Internet access should be open.

Article 5 — Privacy

Every data subject has the right to respect for their personal data and

information systems and as part of his or her fundamental right to private and

family life, home and communications.

Article 6 — Ownership

Every data subject has the right to own and control his or her personal data.

Every data subject is entitled to proportionate share of income or other benefit

derived from his or her personal data as part of the right to own.

Consideration of Bill (Report Stage): 9 May 2018          

55

Data Protection Bill-[Lords], continued

Article 7— Control

Every data subject is entitled to know the purpose for which personal data is

being processed. Data controllers should not deliberately extend the gathering

of personal data solely for their own purposes. Government, corporations,

public authorities and other data controllers must obtain meaningful consent

for the use of people’s personal data. Every data subject has the right to own

curate, move, revise or review their personal data.

Article 8— Algorithms

Every data subject has the right to transparent and equal treatment in the

processing of his or her personal data by an algorithm or automated system.

Every data subject is entitled to meaningful human control in making

significant decisions – algorithms and automated systems must not be

deployed to make significant decisions.

Article 9— Participation

Every data subject has the right to deploy his or her personal data and

information systems to communicate in pursuit of the fundamental right to

freedom of association.

Article 10— Protection

Every data subject has the right to safety and protection from harassment and

other targeting through use of personal data whether sexual, social or

commercial.

Article 11 — Removal

Every data subject is entitled to revise and remove their personal data.

Compensation

Breach of any right in this Bill will entitle the data subject to fair and equitable

compensation under existing enforcement provisions. If none apply, the Centre

for Data Ethics will establish and administer a compensation scheme to ensure

just remedy for any breaches.

Application to Children

The application of these rights to a person less than 18 years of age must be

read in conjunction with the rights set out in the United Nations Convention on

the Rights of the Child. Where an information society service processes data

of persons less than 18 years of age it must do so under the age appropriate

design code set out in section 123 of this Act.”

Caroline Lucas

152

Schedule  1,  page  132,  line  42,  leave out paragraph 22

Consideration of Bill (Report Stage): 9 May 2018          

56

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

72

Schedule  1,  page  134,  line  11,  at end insert —

“( )    

a mayor for the area of a combined authority established under section

103 of the Local Democracy, Economic Development and

Construction Act 2009;”

Member’s explanatory statement

This amendment adds mayors of combined authorities in England to the list of elected

representatives for the purposes of paragraphs 23 and 24 of Schedule 1, which authorise certain

processing of special categories of personal data by such representatives.

Secretary Matt Hancock

73

Schedule  1,  page  134,  line  19,  at end insert —

“( )    

a police and crime commissioner.”

Member’s explanatory statement

This amendment adds police and crime commissioners established under section 1 of the Police

Reform and Social Responsibility Act 2011 to the list of elected representatives for the purposes of

paragraphs 23 and 24 of Schedule 1, which authorise certain processing of special categories of

personal data by such representatives.

Caroline Lucas

16

Schedule  2,  page  140,  line  15,  at end insert—

“(1A)    

The exemption in sub-paragraph (1) may not be invoked in relation to offences

under—

(a)    

sections 24, 24A, 24B or 24C of the Immigration Act 1971,

(b)    

section 21 of the Immigration, Asylum and Nationality Act 2006, or

(c)    

sections 33A and 33B of the Immigration Act 2014.”

Tom Watson

Liam Byrne

Louise Haigh

Chris Elmore

Sir Edward Davey

Layla Moran

Tim Farron

Christine Jardine

Caroline Lucas

Jamie Stone

Jo Swinson

Tom Brake

Stephen Lloyd

Wera Hobhouse

Mr Alistair Carmichael

Stuart C. McDonald

Dr Paul Williams

15

Schedule  2,  page  141,  line  17,  leave out paragraph 4

Secretary Matt Hancock

141

Schedule  2,  page  141,  line  39,  leave out from “(vi)” to end of line 44

Member’s explanatory statement

Paragraph 4(2) of Schedule 2 lists provisions of the GDPR which do not apply to the extent that

their application would be likely to prejudice certain matters relating to immigration. This

amendment removes Articles 5(1)(a) and (b) from the list (except so far as they correspond to