1

House of Commons

Notices of Amendments

given up to and including

Thursday 3 May 2018

New Amendments handed in are marked thus

Amendments which will comply with the required notice period at their next appearance

Amendments tabled since the last publication: 139 to 151, NC18 to NC26, NC7 (a), NC8 (a) and

NS3

Consideration of Bill (Report Stage)

Data Protection Bill [Lords], As Amended

Note

This document includes all amendments tabled to date and includes any

withdrawn amendments at the end. The amendments have been arranged in the

order in which they relate to the Bill.

Secretary Matt Hancock

NC13

To move the following Clause—

“Information orders

(1)    

This section applies if, on an application by the Commissioner, a court is satisfied

that a person has failed to comply with a requirement of an information notice.

(2)    

The court may make an order requiring the person to provide to the

Commissioner some or all of the following—

(a)    

information referred to in the information notice;

(b)    

other information which the court is satisfied the Commissioner requires,

having regard to the statement included in the notice in accordance with

section 141(2)(b).

(3)    

The order—

(a)    

may specify the form in which the information must be provided,

Notices of Amendments: 3 May 2018                      

2

Data Protection Bill-[Lords], continued

(b)    

must specify the time at which, or the period within which, the

information must be provided, and

(c)    

may specify the place where the information must be provided.”

Member’s explanatory statement

This new clause would be inserted after Clause 143. It provides that, where a person has failed to

comply with an information notice (given under Clause 141), the Information Commissioner may

seek a court order requiring the person to provide the information referred to in the notice or other

information which the Commissioner requires for a reason specified in the notice. See also

Amendments 57, 58 and 60.

Secretary Matt Hancock

NC14

To move the following Clause—

“Destroying or falsifying information and documents etc

(1)    

This section applies where a person—

(a)    

has been given an information notice requiring the person to provide the

Commissioner with information, or

(b)    

has been given an assessment notice requiring the person to direct the

Commissioner to a document, equipment or other material or to assist the

Commissioner to view information.

(2)    

It is an offence for the person—

(a)    

to destroy or otherwise dispose of, conceal, block or (where relevant)

falsify all or part of the information, document, equipment or material, or

(b)    

to cause or permit the destruction, disposal, concealment, blocking or

(where relevant) falsification of all or part of the information, document,

equipment or material,

with the intention of preventing the Commissioner from viewing, or being

provided with or directed to, all or part of the information, document, equipment

or material.

(3)    

It is a defence for a person charged with an offence under subsection (2) to prove

that the destruction, disposal, concealment, blocking or falsification would have

occurred in the absence of the person being given the notice.”

Member’s explanatory statement

This new clause would be inserted after Clause 145. It provides that, where the Information

Commissioner has given an information notice (see Clause 141) or an assessment notice (see

Clause 144) requiring access to information, a document, equipment or material, it is an offence

to destroy or otherwise dispose of, conceal, block or (where relevant) falsify it.

Secretary Matt Hancock

NC15

To move the following Clause—

“Applications in respect of urgent notices

(1)    

This section applies where an information notice, an assessment notice or an

enforcement notice given to a person contains an urgency statement.

Notices of Amendments: 3 May 2018                      

3

Data Protection Bill-[Lords], continued

(2)    

The person may apply to the court for either or both of the following—

(a)    

the disapplication of the urgency statement in relation to some or all of

the requirements of the notice;

(b)    

a change to the time at which, or the period within which, a requirement

of the notice must be complied with.

(3)    

On an application under subsection (2), the court may do any of the following—

(a)    

direct that the notice is to have effect as if it did not contain the urgency

statement;

(b)    

direct that the inclusion of the urgency statement is not to have effect in

relation to a requirement of the notice;

(c)    

vary the notice by changing the time at which, or the period within which,

a requirement of the notice must be complied with;

(d)    

vary the notice by making other changes required to give effect to a

direction under paragraph (a) or (b) or in consequence of a variation

under paragraph (c).

(4)    

The decision of the court on an application under this section is final.

(5)    

In this section, “urgency statement” means—

(a)    

in relation to an information notice, a statement under section 141(7)(a),

(b)    

in relation to an assessment notice, a statement under section 144(8)(a) or

(8A)(d), and

(c)    

in relation to an enforcement notice, a statement under section

147(8)(a).”

Member’s explanatory statement

This new clause would be inserted after Clause 160. It enables a person who is given an

information notice, assessment notice or enforcement which requires the person to comply with it

urgently to apply to the court for variation of the timetable for compliance. It replaces the

provision in Clauses 159(2) and 160(5) for appeals to the Tribunal. See also Amendments 54, 56

and 60.

Secretary Matt Hancock

NC16

To move the following Clause—

“Post-review powers to make provision about representation of data subjects

(1)    

After the report under section 182(1) is laid before Parliament, the Secretary of

State may by regulations—

(a)    

exercise the powers under Article 80(2) of the GDPR in relation to

England and Wales and Northern Ireland,

(b)    

make provision enabling a body or other organisation which meets the

conditions in Article 80(1) of the GDPR to exercise a data subject’s rights

under Article 82 of the GDPR in England and Wales and Northern

Ireland without being authorised to do so by the data subject, and

(c)    

make provision described in section 182(2)(e) in relation to the exercise

in England and Wales and Northern Ireland of the rights of a data subject

who is a child.

(2)    

The powers under subsection (1) include power—

(a)    

to make provision enabling a data subject to prevent a body or other

organisation from exercising, or continuing to exercise, the data subject’s

rights;

Notices of Amendments: 3 May 2018                      

4

Data Protection Bill-[Lords], continued

(b)    

to make provision about proceedings before a court or tribunal where a

body or organisation exercises a data subject’s rights;

(c)    

to make provision for bodies or other organisations to bring proceedings

before a court or tribunal combining two or more claims in respect of a

right of a data subject;

(d)    

to confer functions on a person, including functions involving the

exercise of a discretion;

(e)    

to amend sections 162 to 164, 173, 180, 194, 196 and 197;

(f)    

to insert new sections and Schedules into Part 6 or 7;

(g)    

to make different provision in relation to England and Wales and in

relation to Northern Ireland.

(3)    

The powers under subsection (1)(a) and (b) include power to make provision in

relation to data subjects who are children or data subjects who are not children or

both.

(4)    

The provision mentioned in subsection (2)(b) and (c) includes provision about—

(a)    

the effect of judgments and orders;

(b)    

agreements to settle claims;

(c)    

the assessment of the amount of compensation;

(d)    

the persons to whom compensation may or must be paid, including

compensation not claimed by the data subject;

(e)    

costs.

(5)    

Regulations under this section are subject to the affirmative resolution

procedure.”

Member’s explanatory statement

This new clause would be inserted after Clause 182. It contains the provisions currently in

subsections (4) to (7) of Clause 182, modified to take account of the changes made to that Clause

by Amendments 61 and 62 (see subsections (1)(c) and (3) of this new Clause).

Secretary Matt Hancock

NC17

To move the following Clause—

“Reserve forces: data-sharing by HMRC

(1)    

The Reserve Forces Act 1996 is amended as follows.

(2)    

After section 125 insert—

“125A

Supply of contact details by HMRC

(1)    

This subsection applies to contact details for—

(a)    

a member of an ex-regular reserve force, or

(b)    

a person to whom section 66 (officers and former servicemen

liable to recall) applies,

which are held by HMRC in connection with a function of HMRC.

(2)    

HMRC may supply contact details to which subsection (1) applies to the

Secretary of State for the purpose of enabling the Secretary of State—

(a)    

to contact a member of an ex-regular reserve force in connection

with the person’s liability, or potential liability, to be called out

for service under Part 6;

Notices of Amendments: 3 May 2018                      

5

Data Protection Bill-[Lords], continued

(b)    

to contact a person to whom section 66 applies in connection

with the person’s liability, or potential liability, to be recalled for

service under Part 7.

(3)    

Where a person’s contact details are supplied under subsection (2) for a

purpose described in that subsection, they may also be used for defence

purposes connected with the person’s service (whether past, present or

future) in the reserve forces or regular services.

(4)    

In this section, “HMRC” means Her Majesty’s Revenue and Customs.

125B  

Prohibition on disclosure of contact details supplied under section

125A

(1)    

A person who receives information supplied under section 125A may not

disclose it except with the consent of the Commissioners for Her

Majesty’s Revenue and Customs (which may be general or specific).

(2)    

A person who contravenes subsection (1) is guilty of an offence.

(3)    

It is a defence for a person charged with an offence under this section to

prove that the person reasonably believed—

(a)    

that the disclosure was lawful, or

(b)    

that the information had already lawfully been made available to

the public.

(4)    

Subsections (4) to (7) of section 19 of the Commissioners for Revenue

and Customs Act 2005 apply to an offence under this section as they

apply to an offence under that section.

(5)    

Nothing in section 107 or 108 (institution of proceedings and evidence)

applies in relation to an offence under this section.

125C  

Data protection

(1)    

Nothing in section 125A or 125B authorises the making of a disclosure

which contravenes the data protection legislation.

(2)    

In this section, “the data protection legislation” has the same meaning as

in the Data Protection Act 2018 (see section 3 of that Act).”

Member’s explanatory statement

This new clause would be inserted after Clause 186. It provides for HMRC to supply the Secretary

of State with the contact details of members of the ex-regular reserve force and former members

of the armed forces so that they may be contacted regarding their liability to be called out or

recalled for service under the Reserved Forces Act 1996. The details supplied may also be used

for defence purposes connected with their service in the forces (whether past, present or future).

It is an offence for the details supplied to be disclosed without the consent of the Commissioners

for Revenue and Customs.

Notices of Amendments: 3 May 2018                      

6

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

NC19

To move the following Clause—

“Guidance about how to seek redress against media organisations

(1)    

The Commissioner must produce and publish guidance about the steps that may

be taken where an individual considers that a media organisation is failing or has

failed to comply with the data protection legislation.

(2)    

In this section, “media organisation” means a body or other organisation whose

activities consist of or include journalism.

(3)    

The guidance must include provision about relevant complaints procedures,

including—

(a)    

who runs them,

(b)    

what can be complained about, and

(c)    

how to make a complaint.

(4)    

For the purposes of subsection (3), relevant complaints procedures include

procedures for making complaints to the Commissioner, the Office of

Communications, the British Broadcasting Corporation and other persons who

produce or enforce codes of practice for media organisations.

(5)    

The guidance must also include provision about—

(a)    

the powers available to the Commissioner in relation to a failure to

comply with the data protection legislation,

(b)    

when a claim in respect of such a failure may be made before a court and

how to make such a claim,

(c)    

alternative dispute resolution procedures,

(d)    

the rights of bodies and other organisations to make complaints and

claims on behalf of data subjects, and

(e)    

the Commissioner’s power to provide assistance in special purpose

proceedings.

(6)    

The Commissioner—

(a)    

may alter or replace the guidance, and

(b)    

must publish any altered or replacement guidance.

(7)    

The Commissioner must produce and publish the first guidance under this section

before the end of the period of 1 year beginning when this Act is passed.”

Member’s explanatory statement

This new clause would be inserted after Clause 172. It requires the Information Commissioner to

produce guidance about how individuals can seek redress where a media organisation (defined in

subsection (2) of the new clause) fails to comply with the data protection legislation, including

guidance about making complaints and bringing claims before a court.

Notices of Amendments: 3 May 2018                      

7

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

NC22

To move the following Clause—

“Review of processing of personal data for the purposes of journalism

(1)    

The Commissioner must—

(a)    

review the extent to which the processing of personal data for the

purposes of journalism complied with the data protection legislation

during the review period,

(b)    

prepare a report of the review, and

(c)    

submit the report to the Secretary of State.

(2)    

“The review period” means the period of 4 years beginning with the day on which

Chapter 2 of Part 2 of this Act comes into force.

(3)    

The Commissioner must—

(a)    

start the review within the period of 6 months beginning when the review

period ends, and

(b)    

submit the report to the Secretary of State before the end of the period of

18 months beginning when the Commissioner started the review.

(4)    

The report must include consideration of the extent of compliance (as described

in subsection (1)(a)) in each part of the United Kingdom.

(5)    

The Secretary of State must—

(a)    

lay the report before Parliament, and

(b)    

send a copy of the report to—

(i)    

the Scottish Ministers,

(ii)    

the Welsh Ministers, and

(iii)    

the Office of the First Minister and deputy First Minister in

Northern Ireland.”

Member’s explanatory statement

This new Clause would be inserted after Clause 172. It requires the Information Commissioner to

carry out a review of, and report on, the extent to which the processing of personal data for the

purposes of journalism complied with the data protection legislation during the first 4 years of its

operation.

Secretary Matt Hancock

NC23

To move the following Clause—

“Data protection and journalism code

(1)    

The Commissioner must prepare a code of practice which contains—

(a)    

practical guidance in relation to the processing of personal data for the

purposes of journalism in accordance with the requirements of the data

protection legislation, and

(b)    

such other guidance as the Commissioner considers appropriate to

promote good practice in the processing of personal data for the purposes

of journalism.

(2)    

Where a code under this section is in force, the Commissioner may prepare

amendments of the code or a replacement code.