|
|
| |
| |
|
| |
| given up to and including |
|
| |
| New Amendments handed in are marked thus  |
|
| Amendments which will comply with the required notice period at their next appearance
|
|
| Amendments tabled since the last publication: 17 to 19 and NC7 to NC11 |
|
| |
| Data Protection Bill [Lords], As Amended
|
|
| |
| | This document includes all amendments tabled to date and includes any |
|
| | withdrawn amendments at the end. The amendments have been arranged in the |
|
| | order in which they relate to the Bill.
|
|
| | |
| |
| |
| | |
| | To move the following Clause— |
|
| | | “Social security benefits: disclosure of personal data |
|
| | (1) | The Secretary of State shall authorise the disclosure of personal data specified |
|
| | under subsection (2) to a person or body on a register maintained under |
|
| | |
| | (2) | Personal data under this section shall be data relating to a new or existing claim |
|
| | by an individual to one or more of the following benefits— |
|
| | |
| | (b) | income-based Jobseeker’s Allowance, |
|
| | (c) | income-related Employment and Support Allowance, |
|
| | (d) | support under Part VI of the Immigration and Asylum Act 1999, |
|
| | (e) | the guaranteed element of Pension Credit, |
|
| | |
|
|
| |
| |
|
| | (g) | Working Tax Credit and Working Tax Credit run-on, |
|
| | |
| | (i) | Disability Living Allowance, |
|
| | (j) | Personal independence payment, and |
|
| | (k) | any other benefit or credit which may be designated by regulations made |
|
| | by the Secretary of State. |
|
| | (3) | The Secretary of State shall, by regulations— |
|
| | (a) | provide for the establishment of a register of persons or bodies to whom |
|
| | personal data may be disclosed under this section, and |
|
| | (b) | specify who those persons or bodies shall be. |
|
| | (4) | Personal data may be disclosed under this section without the claimant having to |
|
| | provide explicit consent for such disclosure. |
|
| | (5) | Regulations under this section shall be made by statutory instrument and may not |
|
| | be made unless a draft of the instrument has been laid before, and approved by a |
|
| | resolution of, each House of Parliament.” |
|
| | Member’s explanatory statement
|
|
| | This new clause would require the Secretary of State to disclose data on individuals’ eligibility for |
|
| | benefits, as well as the management of their claim, to registered third parties (which would be |
|
| | other specified public bodies, including local authorities, and third sector bodies, including advice |
|
| | agencies). Disclosure would not need the individual’s consent. |
|
| |
| |
| | |
| | To move the following Clause— |
|
| | | “Eligibility for benefits: duty to share data |
|
| | (1) | It shall be a legal obligation within the meaning of point 1(c) of Article 6 of the |
|
| | GDPR for the Secretary of State to share with a local authority, on request by that |
|
| | local authority, data relating to eligibility of individuals for social security |
|
| | |
| | (2) | The social security benefits for which data on eligibility of individuals shall be |
|
| | shared under subsection (1) are— |
|
| | |
| | (b) | income-based Jobseeker’s Allowance, |
|
| | (c) | income-related Employment and Support Allowance, |
|
| | (d) | support under Part VI of the Immigration and Asylum Act 1999, |
|
| | (e) | the guaranteed element of Pension Credit, |
|
| | |
| | (g) | Working Tax Credit and Working Tax Credit run-on, |
|
| | |
| | (i) | Disability Living Allowance, |
|
| | (j) | Personal independence payment, and |
|
| | (k) | any other benefit or credit which may be designated by regulations made |
|
| | by the Secretary of State. |
|
| | (3) | The obligation under subsection (1) shall apply only in relation to a person who |
|
| | qualifies for one or more of the benefits listed under subsection (2). |
|
|
|
| |
| |
|
| | (4) | A local authority may use data shared under subsection (1) only for— |
|
| | (a) | the purpose of registering a child as being eligible for free school meals, |
|
| | and notifying the person responsible for care of the child that the child |
|
| | |
| | (b) | the purpose of registering a child or any other person as being eligible for |
|
| | Healthy Start vouchers, and notifying the person registered or notifying |
|
| | the person responsible for care of the child that the child has been |
|
| | |
| | (c) | the purpose of registering a child for free early years education and |
|
| | childcare, and notifying the person responsible for care of the child that |
|
| | the child has been registered, or |
|
| | (d) | any other purpose which may be designated by regulations made by the |
|
| | |
| | (5) | Regulations under this section shall be made by statutory instrument and may not |
|
| | be made unless a draft of the instrument has been laid before, and approved by a |
|
| | resolution of, each House of Parliament.” |
|
| |
| |
| |
| |
| |
| | |
| | To move the following Clause— |
|
| | | “Bill of Data Rights in the Digital Environment |
|
| | Schedule [Bill of Data Rights in the Digital Environment] shall have effect.” |
|
| | Member’s explanatory statement
|
|
| | This new clause would introduce a Schedule containing a Bill of Data Rights in the Digital |
|
| | |
| |
| |
| |
| |
| |
| | |
| | To move the following Clause— |
|
| | | “Bill of Data Rights in the Digital Environment (No. 2) |
|
| | (1) | The Secretary of State shall, by regulations, establish a Bill of Data Rights in the |
|
| | |
| | (2) | Before making regulations under this section, the Secretary of State shall— |
|
| | |
| | |
| | |
| | |
|
|
| |
| |
|
| | (iv) | persons who appear to the Commissioner or the Secretary of |
|
| | State to represent the interests of data subjects; and |
|
| | (b) | publish a draft of the Bill of Data Rights. |
|
| | (3) | The Bill of Data Rights in the Digital Environment shall enshrine— |
|
| | (a) | a right for a data subject to have privacy from commercial or personal |
|
| | |
| | (b) | a right for a data subject to own, curate, move, revise or review their |
|
| | identity as founded upon personal data (whether directly or as a result of |
|
| | processing of that data), |
|
| | (c) | a right for a data subject to have their access to their data profiles or |
|
| | personal data protected, and |
|
| | (d) | a right for a data subject to object to any decision made solely on |
|
| | automated decision-making, including a decision relating to education |
|
| | and employment of the data subject. |
|
| | (4) | Regulations under this section are subject to the affirmative resolution |
|
| | |
| | Member’s explanatory statement
|
|
| | This new clause would empower the Secretary of State to introduce a Bill of Data Rights in the |
|
| | |
| |
| |
| |
| |
| |
| | |
| | To move the following Clause— |
|
| | | “Targeted dissemination disclosure notice for third parties and others (No. 2) |
|
| | In Schedule 19B of the Political Parties, Elections and Referendums Act 2000 |
|
| | (Power to require disclosure), after paragraph 10 (documents in electronic form) |
|
| | |
| | “10A (1) | This paragraph applies to the following organisations and |
|
| | |
| | (a) | a recognised third party (within the meaning of Part 6); |
|
| | (b) | a permitted participant (within the meaning of Part 7); |
|
| | (c) | a regulated donee (within the meaning of Schedule 7); |
|
| | (d) | a regulated participant (within the meaning of Schedule 7A); |
|
| | (e) | a candidate at an election (other than a local government |
|
| | |
| | (f) | the election agent for such a candidate; |
|
| | (g) | an organisation or individual formerly falling within any of |
|
| | paragraphs (a) to (f); or |
|
| | (h) | the treasurer, director, or another officer of an organisation to |
|
| | which this paragraph applies, or has been at any time in the |
|
| | period of five years ending with the day on which the notice |
|
| | |
|
|
| |
| |
|
| | (2) | The Commission may under this paragraph issue at any time a targeted |
|
| | dissemination disclosure notice, requiring disclosure of any settings |
|
| | used to disseminate material which it believes were intended to have |
|
| | the effect, or were likely to have the effect, of influencing public |
|
| | opinion in any part of the United Kingdom, ahead of a specific election |
|
| | or referendum, where the platform for dissemination allows for |
|
| | targeting based on demographic or other information about |
|
| | individuals, including information gathered by information society |
|
| | |
| | (3) | This power shall not be available in respect of registered parties or |
|
| | their officers, save where they separately and independently fall into |
|
| | one or more of categories (a) to (h) of sub-paragraph (1). |
|
| | (4) | A person or organisation to whom such a targeted dissemination |
|
| | disclosure notice is given shall comply with it within such time as is |
|
| | specified in the notice.”” |
|
| | Member’s explanatory statement
|
|
| | This new clause would amend the Political Parties, Elections and Referendums Act 2000 to allow |
|
| | the Electoral Commission to require disclosure of settings used to disseminate material where the |
|
| | platform for dissemination allows for targeting based on demographic or other information about |
|
| | |
| |
| |
| | |
| |
| To move the following Clause— |
|
| | | “Publishers of news-related material: damages and costs |
|
| | (1) | This section applies where— |
|
| | (a) | a relevant claim for breach of the data protection legislation is made |
|
| | against a person (“the defendant”), |
|
| | (b) | the defendant was a relevant publisher at the material time, and |
|
| | (c) | the claim is related to the publication of news-related material. |
|
| | (2) | If the defendant was a member of an approved regulator at the time when the |
|
| | claim was commenced (or was unable to be a member at that time for reasons |
|
| | beyond the defendant’s control or it would have been unreasonable in the |
|
| | circumstances for the defendant to have been a member at that time), the court |
|
| | must not award costs against the defendant unless satisfied that— |
|
| | (a) | the issues raised by the claim could not have been resolved by using an |
|
| | arbitration scheme of the approved regulator, or |
|
| | (b) | it is just and equitable in all the circumstances of the case to award costs |
|
| | |
| | (3) | If the defendant was not a member of an approved regulator at the time when the |
|
| | claim was commenced (but would have been able to be a member at that time and |
|
| | it would have been reasonable in the circumstances for the defendant to have been |
|
| | a member at that time), the court must award costs against the defendant unless |
|
| | |
| | (a) | the issues raised by the claim could not have been resolved by using an |
|
| | arbitration scheme of the approved regulator (had the defendant been a |
|
| | |
|
|
| |
| |
|
| | (b) | it is just and equitable in all the circumstances of the case to make a |
|
| | different award of costs or make no award of costs. |
|
| | (4) | This section is not to be read as limiting any power to make rules of court. |
|
| | (5) | This section does not apply until such time as a body is first recognised as an |
|
| | |
| |
| |
| | |
| |
| To move the following Clause— |
|
| | | “Publishers of news-related material: interpretive provisions |
|
| | (1) | This section applies for the purposes of section [Publishers of news-related |
|
| | material: damages and costs] |
|
| | (2) | “Approved regulator” means a body recognised as a regulator of relevant |
|
| | |
| | (3) | For the purposes of subsection (2), a body is “recognised” as a regulator of |
|
| | relevant publishers if it is so recognised by any body established by Royal Charter |
|
| | (whether established before or after the coming into force of this section) with the |
|
| | purpose of carrying on activities relating to the recognition of independent |
|
| | regulators of relevant publishers. |
|
| | (4) | “Relevant claim” means a civil claim made in respect of data protection under the |
|
| | data protection legislation. |
|
| | (5) | The “material time”, in relation to a relevant claim, is the time of the events giving |
|
| | |
| | (6) | “News-related material” means— |
|
| | (a) | news or information about current affairs, |
|
| | (b) | opinion about matters relating to the news or current affairs, or |
|
| | (c) | gossip about celebrities, other public figures or other persons in the news. |
|
| | (7) | A relevant claim is related to the publication of news-related material if the claim |
|
| | |
| | (a) | the publication of news-related material, or |
|
| | (b) | activities carried on in connection with the publication of such material |
|
| | (whether or not the material is in fact published). |
|
| | (8) | A reference to the “publication” of material is a reference to publication— |
|
| | |
| | |
| | |
| | and references to a person who “publishes” material are to be read accordingly. |
|
| | (9) | A reference to “conduct” includes a reference to omissions; and a reference to a |
|
| | person’s conduct includes a reference to a person’s conduct after the events |
|
| | giving rise to the claim concerned. |
|
| | (10) | “Relevant publisher” has the same meaning as in section 41 of the Crime and |
|
| | |
| |
|
|
| |
| |
|
| |
| | |
| |
| To move the following Clause— |
|
| | | “Inquiry into issues arising from data protection breaches committed by or on |
|
| | behalf of news publishers |
|
| | (1) | The Secretary of State must, within the period of three months beginning on the |
|
| | day on which this Act is passed, establish an inquiry under the Inquiries Act 2005 |
|
| | into allegations of data protection breaches committed by, or on behalf of, news |
|
| | |
| | (2) | The inquiry’s terms of reference must include, but are not limited to,— |
|
| | (a) | to inquire, in respect of personal data processing, into the extent of |
|
| | unlawful or improper conduct within news publishers and, as |
|
| | appropriate, other organisations within the media, and by those |
|
| | responsible for holding personal data; |
|
| | (b) | to inquire, in respect of personal data processing, into the extent of |
|
| | corporate governance and management failures at news publishers; |
|
| | (c) | in the light of these inquiries, to consider the implications for personal |
|
| | data protection in relation to freedom of speech; and |
|
| | (d) | to make recommendations on what action, if any, should be taken in the |
|
| | |
| |
| |
| | |
| |
| To move the following Clause— |
|
| | | “Automated decision-making concerning a child |
|
| | (1) | Where a data controller expects to take a significant decision based solely on |
|
| | automated processing which may concern a child, the controller must, before |
|
| | such processing is undertaken— |
|
| | (a) | deposit a data protection impact assessment with the Commissioner, and |
|
| | (b) | consult the Commissioner (within the meaning of Article 36 of the |
|
| | GDPR), regardless of measures taken by the controller to mitigate any |
|
| | |
| | (2) | Where, following prior consultation, the Commissioner does not choose to |
|
| | prevent processing on the basis of Article 58(2)(f) of the GDPR, the |
|
| | Commissioner must publish the part or parts of the data protection impact |
|
| | assessment provided under subsection (1), relevant to the reaching of that |
|
| | |
| | (3) | The Commissioner must produce and publish a list of safeguards to be applied by |
|
| | data controllers where any significant decision based solely on automated |
|
| | processing may concern a child. |
|
| | (4) | For the purposes of this section, the meaning of “child” is determined by the age |
|
| | of lawful processing under Article 8 of the GDPR and section 8 of this Act.” |
|
| |
|