Notices of Amendments: 4 May 2018                      

15

Data Protection Bill-[Lords], continued

Christine Jardine

Layla Moran

NC11

To move the following Clause—

“Education: safe use of personal data

(1)    

The Children and Social Work Act 2017 is amended as follows.

(2)    

In section 35 (other personal, social, health and economic education), after

subsection (1)(b) insert—

“(1A)    

In this section, “personal, social, health and economic education” shall

include education relating to the safe use of personal data.”

Member’s explanatory statement

This new clause would enable the Secretary of State to require that personal information safety be

taught as a mandatory part of the national PSHE curriculum.

Dr Sarah Wollaston

Dr Paul Williams

Dr Dan Poulter

Dr Rosena Allin-Khan

Dr Philippa Whitford

Johnny Mercer

Mr Ben Bradshaw

Rosie Cooper

Luciana Berger

Diana Johnson

Norman Lamb

Mr Ian Liddell-Granger

Lucy Allan

Heidi Allen

Sir David Amess

Jeremy Lefroy

Antionette Sandbach

Anna Soubry

Giles Watling

Debbie Abrahams

Rushanara Ali

Dr Roberta Blackman-Woods

Mr Ronnie Campbell

Stella Creasy

Alex Cunningham

Stephen Doughty

Clive Efford

Darren Jones

Mike Gapes

Mike Hill

Kate Green

Grahame Morris

Matt Western

NC12

To move the following Clause—

“Health bodies: disclosure of personal data

(1)    

In section 261 of the Health and Social Care Act 2012 (Health and Social Care

Information Centre: dissemination of information) after subsection (5) insert—

“(5A)    

A disclosure of personal data may be made under subsection (5)(e) only

if it is made—

(a)    

to and at the request of a member of a police force, and

(b)    

for the purpose of investigating a serious offence.

(5B)    

In subsection (5A)—

“personal data” has the meaning given by section 3 of the Data

Protection Act 2018;

“police force” means—

(a)    

a police force within the meaning of section 101 of the

Police Act 1996, and

Notices of Amendments: 4 May 2018                      

16

Data Protection Bill-[Lords], continued

(b)    

an equivalent force operating under the law of any Part

of the United Kingdom or of another country; and

“serious offence” means—

(a)    

a serious offence within the meaning of Part 1 of

Schedule 1 to the Serious Crime Act 2007,

(b)    

an offence under the Offences Against the Person Act

1861, the Sexual Offences Act 2003, the Explosive

Substances Act 1883, the Terrorism Act 2000 or the

Terrorism Act 2006, and

(c)    

the equivalent of any of those offences under the law of

any Part of the United Kingdom or of another country.”

(2)    

In section 13Z3 of the National Health Service Act 2006 (National Health Service

Commissioning Board: permitted disclosure of information) at the end insert—

“(3)    

A disclosure of personal data may be made under subsection (1)(g) only

if it is made—

(a)    

to and at the request of a member of a police force, and

(b)    

for the purpose of investigating a serious offence.

(4)    

In subsection (3)—

“personal data” has the meaning given by section 3 of the Data

Protection Act 2018;

“police force” means—

(a)    

a police force within the meaning of section 101 of the

Police Act 1996, and

(b)    

an equivalent force operating under the law of any Part

of the United Kingdom or of another country; and

“serious offence” means—

(a)    

a serious offence within the meaning of Part 1 of

Schedule 1 to the Serious Crime Act 2007,

(b)    

an offence under the Offences against the Person Act

1861, the Sexual Offences Act 2003, the Explosive

Substances Act 1883, the Terrorism Act 2000 or the

Terrorism Act 2006, and

(c)    

the equivalent of any of those offences under the law of

any Part of the United Kingdom or of another country.”

(3)    

In section 14Z23 of the National Health Service Act 2006 (clinical

commissioning groups: permitted disclosure of information) at the end insert—

“(3)    

A disclosure of personal data may be made under subsection (1)(g) only

if it is made—

(a)    

to and at the request of a member of a police force, and

(b)    

for the purpose of investigating a serious offence.

(4)    

In subsection (3)—

“personal data” has the meaning given by section 3 of the Data

Protection Act 2018;

“police force” means—

(a)    

a police force within the meaning of section 101 of the

Police Act 1996, and

(b)    

an equivalent force operating under the law of any Part

of the United Kingdom or of another country; and

“serious offence” means—

Notices of Amendments: 4 May 2018                      

17

Data Protection Bill-[Lords], continued

(a)    

a serious offence within the meaning of Part 1 of

Schedule 1 to the Serious Crime Act 2007,

(b)    

an offence under the Offences against the Person Act

1861, the Sexual Offences Act 2003, the Explosive

Substances Act 1883, the Terrorism Act 2000 or the

Terrorism Act 2006, and

(c)    

the equivalent of any of those offences under the law of

any Part of the United Kingdom or of another country.”

(4)    

In section 79 of the Health and Social Care Act 2008 (Care Quality Commission:

permitted disclosures) after subsection (3) insert—

“(3A)    

A disclosure of personal data may be made under subsection (3)(g) only

if it is made—

(a)    

to and at the request of a member of a police force, and

(b)    

for the purpose of investigating a serious offence.

(3B)    

In subsection (3A)—

“personal data” has the meaning given by section 3 of the Data

Protection Act 2018;

“police force” means—

(a)    

a police force within the meaning of section 101 of the

Police Act 1996, and

(b)    

an equivalent force operating under the law of any Part

of the United Kingdom or of another country; and

“serious offence” means—

(a)    

a serious offence within the meaning of Part 1 of

Schedule 1 to the Serious Crime Act 2007,

(b)    

an offence under the Offences against the Person Act

1861, the Sexual Offences Act 2003, the Explosive

Substances Act 1883, the Terrorism Act 2000 or the

Terrorism Act 2006, and

(c)    

the equivalent of any of those offences under the law of

any Part of the United Kingdom or of another

country.”.”.

Member’s explanatory statement

This new clause would prevent personal data held by the NHS from being disclosed for the purpose

of the investigation of a criminal offence unless the offence concerned is serious, which is

consistent with the NHS Code of Confidentiality and GMC guidance on confidentiality. It would

also mean that any such disclosure could only be made to the police, and not, for example, to Home

Office immigration enforcement officials.

Notices of Amendments: 4 May 2018                      

18

Data Protection Bill-[Lords], continued

Edward Miliband

Mr Kenneth Clarke

Brendan O’Hara

Christine Jardine

Liz Saville Roberts

Caroline Lucas

NC18

To move the following Clause—

“Data protection breaches by national news publishers

(1)    

The Secretary of State must, within the period of three months beginning with the

day on which this Act is passed, establish an inquiry under the Inquiries Act 2005

into allegations of data protection breaches committed by or on behalf of national

news publishers and other media organisations.

(2)    

Before setting the terms of reference of and other arrangements for the inquiry the

Secretary of State must—

(a)    

consult the Scottish Ministers with a view to ensuring, in particular, that

the inquiry will consider the separate legal context and other

circumstances of Scotland;

(b)    

consult Northern Ireland Ministers and members of the Northern Ireland

Assembly with a view to ensuring, in particular, that the inquiry will

consider the separate legal context and other circumstances of Northern

Ireland;

(c)    

consult persons appearing to the Secretary of State to represent the

interests of victims of data protection breaches committed by, on behalf

of or in relation to, national news publishers and other media

organisations; and

(d)    

consult persons appearing to the Secretary of State to represent the

interests of news publishers and other media organisations (having

regard in particular to organisations representing journalists).

(3)    

The terms of reference for the inquiry must include requirements—

(a)    

to inquire into the extent of unlawful or improper conduct by or on behalf

of national news publishers and other organisations within the media in

respect of personal data;

(b)    

to inquire into the extent of corporate governance and management

failures and the role, if any, of politicians, public servants and others in

relation to failures to investigate wrongdoing at media organisations

within the scope of the inquiry;

(c)    

to review the protections and provisions around media coverage of

individuals subject to police inquiries, including the policy and practice

of naming suspects of crime prior to any relevant charge or conviction;

(d)    

to investigate the dissemination of information and news, including false

news stories, by social media organisations using personal data;

(e)    

to consider the adequacy of the current regulatory arrangements and the

resources, powers and approach of the Information Commissioner and

any other relevant authorities in relation to—

(i)    

the news publishing industry (except in relation to entities

regulated by Ofcom) across all platforms and in the light of

experience since 2012;

(ii)    

social media companies;

(f)    

to make such recommendations as appear to the inquiry to be appropriate

for the purpose of ensuring that the privacy rights of individuals are

balanced with the right to freedom of expression.

Notices of Amendments: 4 May 2018                      

19

Data Protection Bill-[Lords], continued

(4)    

In setting the terms of reference for the inquiry the Secretary of State must—

(a)    

have regard to the current context of the news, publishing and general

media industry;

(b)    

must set appropriate parameters for determining which allegations are to

be considered;

(c)    

determine the meaning and scope of references to national news

publishers and other media organisations for the purposes of the inquiry.

(5)    

Before complying with subsection (4) the Secretary of State must consult the

judge or other person who is likely to be invited to chair the inquiry.

(6)    

The inquiry may, so far as it considers appropriate—

(a)    

consider evidence given to previous public inquiries; and

(b)    

take account of the findings of and evidence given to previous public

inquiries (and the inquiry must consider using this power for the purpose

of avoiding the waste of public resources).

(7)    

This section comes into force on Royal Assent.”

Tom Watson

Liam Byrne

NC20

To move the following Clause—

“Publishers of news-related material: damages and costs (No. 2)

(1)    

This section applies where—

(a)    

a relevant claim for breach of the data protection legislation is made

against a person (“the defendant”),

(b)    

the defendant was a relevant publisher at the material time, and

(c)    

the claim is related to the publication of news-related material.

(2)    

If the defendant was a member of an approved regulator at the time when the

claim was commenced (or was unable to be a member at that time for reasons

beyond the defendant’s control or it would have been unreasonable in the

circumstances for the defendant to have been a member at that time), the court

must award costs against the claimant unless satisfied that—

(a)    

the issues raised by the claim could not have been resolved by using an

arbitration scheme of the approved regulator, or

(b)    

it is just and equitable in all the circumstances of the case, including, for

the avoidance of doubt—

(i)    

the conduct of the defendant, and

(ii)    

whether the defendant pleaded a reasonably arguable defence, to

make a different award of costs or make no award of costs.

(3)    

If the defendant was not an exempt relevant publisher and was not a member of

an approved regulator at the time when the claim was commenced (but would

have been able to be a member at that time and it would have been reasonable in

the circumstances for the defendant to have been a member at that time), the court

must award costs against the defendant unless satisfied that—

(a)    

the issues raised by the claim could not have been resolved by using an

arbitration scheme of the approved regulator (had the defendant been a

member), or

Notices of Amendments: 4 May 2018                      

20

Data Protection Bill-[Lords], continued

(b)    

it is just and equitable in all the circumstances of the case, including, for

the avoidance of doubt—

(i)    

the conduct of the claimant, and

(ii)    

whether the claimant had a reasonably arguable claim, to make a

different award of costs or make no award of costs.

(4)    

This section is not to be read as limiting any power to make rules of court.

(5)    

This section does not apply until such time as a body is first recognised as an

approved regulator.”

Tom Watson

Liam Byrne

NC21

To move the following Clause—

“Publishers of news-related material: interpretive provisions (No. 2)

(1)    

This section applies for the purposes of section (Publishers of news-related

material: damages and costs (No. 2)).

(2)    

“Approved regulator” means a body recognised as a regulator of relevant

publishers.

(3)    

For the purposes of subsection (2), a body is “recognised” as a regulator of

relevant publishers if it is so recognised by any body established by Royal Charter

(whether established before or after the coming into force of this section) with the

purpose of carrying on activities relating to the recognition of independent

regulators of relevant publishers.

(4)    

“Relevant claim” means a civil claim made in respect of data protection under the

data protection legislation, brought in England or Wales by a claimant domiciled

anywhere in the United Kingdom.

(5)    

The “material time”, in relation to a relevant claim, is the time of the events giving

rise to the claim.

(6)    

“News-related material” means—

(a)    

news or information about current affairs,

(b)    

opinion about matters relating to the news or current affairs, or

(c)    

gossip about celebrities, other public figures or other persons in the news.

(7)    

A relevant claim is related to the publication of news-related material if the claim

results from—

(a)    

the publication of news-related material, or

(b)    

activities carried on in connection with the publication of such material

(whether or not the material is in fact published).

(8)    

A reference to the “publication” of material is a reference to publication—

(a)    

on a website,

(b)    

in hard copy, or

(c)    

by any other means,

and references to a person who “publishes” material are to be read accordingly.

(9)    

A reference to “conduct” includes a reference to omissions; and a reference to a

person’s conduct includes a reference to a person’s conduct after the events

giving rise to the claim concerned.

(10)    

“Relevant publisher” has the same meaning as in section 41 of the Crime and

Courts Act 2013.

Notices of Amendments: 4 May 2018                      

21

Data Protection Bill-[Lords], continued

(11)    

A relevant publisher is exempt if it satisfies Condition A or B.

(12)    

Condition A is that the publisher has a constitution which—

(a)    

requires any surplus income or gains to be reinvested in the publisher,

and

(b)    

does not allow the distribution of any of its profits or assets (in cash or in

kind) to members or third parties.

(13)    

Condition B is that the publisher—

(a)    

publishes predominantly in Scotland, or predominantly in Wales, or

predominantly in Northern Ireland or predominantly in specific regions

or localities; and

(b)    

has had an average annual turnover not exceeding £100 million over the

last five complete financial years.”

As an Amendment to Tom Watson’s proposed New Clause (Publishers of news-related

material: interpretive provisions (No. 2)) (NC21):—

Brendan O’Hara

Stuart C. McDonald

(a)

Line  33,  leave out subsection (10) and insert—

“(10)    

“Relevant publisher” has the same meaning as in section 41 of the Crime and

Courts Act 2013, subject to subsection (10A).

(10A)    

For the purposes of this Act, a publisher shall only be a “relevant publisher” if—

(a)    

it has a registered address in England or Wales; and

(b)    

its publications are published in, or in any part of, England or Wales.

(10B)    

A relevant claim may be made under the data protection legislation only in

respect of material which is published by a relevant publisher (as defined by

subsections (10) and (10A)) and which is read or accessed in England or Wales.”

Stuart C. McDonald

NC24

To move the following Clause—

“Safeguards on the transfer of data for lethal force operations overseas

(1)    

A transferring controller may not make any transfer of personal data outside the

United Kingdom under Part 4 of this Act where—

(a)    

the transferring controller knows, or should know, that the data will be

used in an operation or activity that may involve the use of lethal force,

and

(b)    

there is a real risk that the transfer would amount to a breach of domestic

law or an internationally wrongful act under international law.

(2)    

Where the transferring controller determines that there is no real risk under

subsection (1)(b), the transfer is not lawful unless—

(a)    

the transferring controller documents the determination, providing

reasons, and

(b)    

the Secretary of State has approved the transfer in writing.