Notices of Amendments: 4 May 2018                      

22

Data Protection Bill-[Lords], continued

(3)    

Any documentation created under subsection (2) shall be provided to the

Information Commissioner and the Investigatory Powers Commissioner within

90 days of the transfer.

(4)    

A “transferring controller” is a controller who makes a transfer of personal data

outside the United Kingdom under Part 4 of this Act.

(5)    

For the purposes of subsection (1)(b),

(a)    

“domestic law” includes, but is not limited to,

(i)    

soliciting, encouraging, persuading or proposing a murder

contrary to section 4 of the Offences Against the Person Act

1861,

(ii)    

conspiracy to commit murder contrary to section 1 or 1A of the

Criminal Law Act 1977,

(iii)    

aiding, abetting, counselling, or procuring murder contrary to

section 8 of the Accessories and Abettors Act 1861,

(iv)    

offences contrary to section 44, 45 and 46 of the Serious Crime

Act 2007,

(v)    

offences under the International Criminal Court Act 2001.

(b)    

“International law” includes, but is not limited to, Article 16 of the 2001

Draft Articles on the Responsibility of States for Internationally

Wrongful Acts.

(6)    

The Secretary of State must lay before Parliament, within six months of the

coming into force of this Act, guidance for intelligence officers on subsections (1)

and (2).

(7)    

The Secretary of State must lay before Parliament any subsequent changes made

to the guidance reported under subsection (6) within 90 days of any changes being

made.”

Christine Jardine

Alex Cunningham

18

Clause  7,  page  5,  line  24,  after “subsections” insert “(1A),”.

Secretary Matt Hancock

22

Clause  7,  page  5,  line  24,  after “(2)” insert “, (2A)”

Member’s explanatory statement

This amendment is consequential on Amendment 24.

Christine Jardine

Julie Cooper

Alex Cunningham

19

Clause  7,  page  5,  line  24,  at end insert—

“(1A)    

A primary care service provider is not a “public authority” or “public body” for

the purposes of the GDPR merely by virtue of the fact that it is defined as a public

authority by either—

(a)    

any of paragraphs 43A to 45A or paragraph 51 of Schedule 1 to the

Freedom of Information Act 2000, or

(b)    

any of paragraphs 33 to 35 of Schedule 1 to the Freedom of Information

(Scotland) Act 2002 (asp 13).”

Notices of Amendments: 4 May 2018                      

23

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

23

Clause  7,  page  5,  line  26,  after “body”” insert “for the purposes of the GDPR”

Member’s explanatory statement

Subsection (2) of Clause 7 provides that an authority or body is only a “public authority” or a

“public body” if it meets the conditions in that subsection. This amendment makes it clear that

subsection (2) only affects a body or authority’s status for the purposes of the GDPR.

Secretary Matt Hancock

24

Clause  7,  page  5,  line  27,  at end insert—

“(2A)    

The references in subsection (1)(a) and (b) to public authorities and Scottish

public authorities as defined by the Freedom of Information Act 2000 and the

Freedom of Information (Scotland) Act 2002 (asp 13) do not include any of the

following that fall within those definitions—

(a)    

a parish council in England;

(b)    

a community council in Wales;

(c)    

a community council in Scotland;

(d)    

a parish meeting constituted under section 13 of the Local Government

Act 1972;

(e)    

a community meeting constituted under section 27 of that Act;

(f)    

charter trustees constituted—

(i)    

under section 246 of that Act,

(ii)    

under Part 1 of the Local Government and Public Involvement in

Health Act 2007, or

(iii)    

by the Charter Trustees Regulations 1996 (S.I. 1996/263).”

Member’s explanatory statement

This amendment provides that the authorities listed in new subsection (2A) are not “public

authorities” or “public bodies” for the purposes of the GDPR by virtue of being public authorities

or Scottish public authorities as defined in the Freedom of Information Act 2000 and the Freedom

of Information (Scotland) Act 2002.

Brendan O’Hara

Stuart C. McDonald

Caroline Lucas

4

Clause  10,  page  6,  line  37,  leave out subsections (6) and (7)

Member’s explanatory statement

This amendment would remove delegated powers that would allow the Secretary of State to vary

the conditions and safeguards governing the general processing of sensitive personal data.

Notices of Amendments: 4 May 2018                      

24

Data Protection Bill-[Lords], continued

Brendan O’Hara

Stuart C. McDonald

Caroline Lucas

5

Clause  14,  page  8,  line  11,  at end insert—

“(2A)    

A decision that engages an individual’s rights under the Human Rights Act 1998

does not fall within Article 22(2)(b) of the GDPR (exception from prohibition on

taking significant decisions based solely on automated processing for decisions

that are authorised by law and subject to safeguards for the data subject’s rights,

freedoms and legitimate interests).

(2B)    

A decision is “based solely on automated processing” for the purposes of this

section if, in relation to a data subject, there is no meaningful input by a natural

person in the decision-making process.”

Member’s explanatory statement

This amendment would ensure that where human rights are engaged by automated decisions these

are human decisions and provides clarification that purely administrative human approval of an

automated decision does make an automated decision a ‘human’ one.

Brendan O’Hara

Stuart C. McDonald

Caroline Lucas

6

Page  9,  line  36,  leave out Clause 16

Member’s explanatory statement

This amendment would remove delegated powers that would allow the Secretary of State to add

further exemptions.

Secretary Matt Hancock

143

Clause  21,  page  13,  line  10,  leave out “to which Part 3 (law enforcement

processing) or” and insert “by a competent authority for any of the law enforcement

purposes (as defined in Part 3) or processing to which”

Member’s explanatory statement

This amendment clarifies the description of the types of processing excluded from Chapter 3 of

Part 2 (other general processing).

Notices of Amendments: 4 May 2018                      

25

Data Protection Bill-[Lords], continued

Brendan O’Hara

Stuart C. McDonald

Caroline Lucas

7

Clause  35,  page  22,  line  14,  leave out subsections (6) and (7)

Member’s explanatory statement

This amendment would remove delegated powers that would allow the Secretary of State to vary

the conditions and safeguards governing the general processing of sensitive personal data.

Brendan O’Hara

Stuart C. McDonald

151

Clause  49,  page  30,  line  19,  at end insert—

“, subject to subsection (1A).

(1A)    

A controller may not take a significant decision based solely on automated

processing if that decision affects the rights of the data subject under the Human

Rights Act 1998.”

Brendan O’Hara

Stuart C. McDonald

Caroline Lucas

2

Clause  50,  page  30,  line  28,  at end insert—

“and

(c)    

it does not engage the rights of the data subject under the Human Rights

Act 1998.”

Member’s explanatory statement

This amendment would ensure that automated decisions should not be authorised by law if they

engage an individual’s human rights.

Brendan O’Hara

Stuart C. McDonald

Caroline Lucas

8

Clause  86,  page  51,  line  21,  leave out subsections (3) and (4)

Member’s explanatory statement

This amendment would remove delegated powers that would allow the Secretary of State to vary

the conditions and safeguards governing the general processing of sensitive personal data.

Notices of Amendments: 4 May 2018                      

26

Data Protection Bill-[Lords], continued

Brendan O’Hara

Stuart C. McDonald

3

Clause  96,  page  56,  line  38,  after “law” insert “unless the decision engages an

individual’s rights under the Human Rights Act 1998”

Member’s explanatory statement

This amendment would ensure that automated decisions should not be authorised by law if they

engage an individual’s human rights.

Brendan O’Hara

Stuart C. McDonald

Caroline Lucas

9

Page  63,  line  27,  leave out Clause 113

Member’s explanatory statement

This amendment would remove delegated powers that would allow the Secretary of State to create

new exemptions to Part 4 of the Bill.

Secretary Matt Hancock

25

Clause  119,  page  66,  line  12,  at end insert—

“( )    

Paragraphs (c) and (d) of section 3(14) do not apply to references in this section

to personal data, the processing of personal data, a controller or a processor.”

Member’s explanatory statement

This amendment secures that the references to personal data, the processing of personal data, a

controller or a processor in Clause 119 include all types of personal data etc. It disapplies Clause

3(14)(c) and (d), which provide that references to personal data etc in Parts 5 to 7 of the Bill are

usually to personal data etc to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies.

Secretary Matt Hancock

26

Clause  120,  page  67,  line  4,  at end insert—

“( )    

Section 3(14)(c) does not apply to references to personal data and the processing

of personal data in this section.”

Member’s explanatory statement

This amendment secures that the references to personal data and the processing of personal data

in Clause 120 include all types of personal data and the processing of personal data. It disapplies

Clause 3(14)(c), which provides that references to personal data etc in Parts 5 to 7 of the Bill are

usually to personal data etc to which Chapter 2 or 3 of Part 2, Part 3 or Part 4 applies.

Notices of Amendments: 4 May 2018                      

27

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

146

Clause  124,  page  69,  line  21,  leave out “or 123” and insert “, 123 or (Data

protection and journalism code)”

Member’s explanatory statement

See the explanatory statement for NC23.

Secretary Matt Hancock

147

Clause  124,  page  69,  line  32,  leave out “or 123” and insert “, 123 or (Data

protection and journalism code)”

Member’s explanatory statement

See the explanatory statement for NC23.

Secretary Matt Hancock

148

Clause  124,  page  69,  line  39,  leave out “or 123” and insert “, 123 or (Data

protection and journalism code)”

Member’s explanatory statement

See the explanatory statement for NC23.

Secretary Matt Hancock

149

Clause  124,  page  70,  line  5,  leave out “and 123” and insert “, 123 and (Data

protection and journalism code)”

Member’s explanatory statement

See the explanatory statement for NC23.

Secretary Matt Hancock

150

Clause  125,  page  70,  line  18,  leave out “or 123(2)” and insert “, 123(2) or (Data

protection and journalism code)(2)”

Member’s explanatory statement

See the explanatory statement NC23.

Secretary Matt Hancock

27

Clause  141,  page  78,  line  2,  after “of” insert “—

(i)    

investigating a suspected failure of a type described in section

146(2) or a suspected offence under this Act, or

(ii)    

”

Member’s explanatory statement

This amendment enables the Information Commissioner to obtain information from any person for

the purposes of investigating failures to comply with the data protection legislation that are listed

in Clause 146(2) or suspected offences under the Bill.

Notices of Amendments: 4 May 2018                      

28

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

28

Clause  141,  page  78,  line  5,  after “state” insert “—

(a)    

whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and

(b)    

”

Member’s explanatory statement

This amendment requires information notices given by the Information Commissioner to state

whether they are given under Clause 141(1)(a), (b)(i) or (b)(ii). See also Amendment 27.

Secretary Matt Hancock

29

Clause  141,  page  78,  line  15,  leave out “the rights of appeal under section 159” and

insert “—

(a)    

the consequences of failure to comply with it, and

(b)    

the rights under sections 159 and (Applications in respect of urgent

notices) (appeals etc).”

Member’s explanatory statement

This amendment adds a requirement for information notices to include information about the

consequences of failure to comply. The reference in paragraph (b) to applications in respect of

urgent notices is consequential on NC15.

Secretary Matt Hancock

30

Clause  141,  page  78,  line  26,  leave out “7 days” and insert “24 hours”

Member’s explanatory statement

This amendment provides that, in urgent cases, the Information Commissioner must allow a

minimum of 24 hours, rather than 7 days, for a person to provide information requested in an

information notice.

Secretary Matt Hancock

31

Clause  144,  page  80,  line  19,  after “for” insert “a copy (in such form as may be

requested) of”

Member’s explanatory statement

This amendment and Amendments 32 and 33 tidy up Clause 144(2)(d) and make clear that the

Commissioner may ask for copies of documents, as well as information viewed, to be provided in

a particular form.

Secretary Matt Hancock

32

Clause  144,  page  80,  line  20,  leave out “a copy of”

Member’s explanatory statement

See the explanatory statement for Amendment 31.

Secretary Matt Hancock

33

Clause  144,  page  80,  line  21,  leave out “a copy (in such form as may be requested)

of”

Member’s explanatory statement

See the explanatory statement for Amendment 31.