Notices of Amendments: 4 May 2018                      

29

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

34

Clause  144,  page  80,  line  27,  at end insert—

“( )    

provide the Commissioner with an explanation of such documents,

information, equipment or material;”

Member’s explanatory statement

This amendment enables an assessment notice given by the Information Commissioner to require

a person to provide an explanation of documents, information, equipment or material.

Secretary Matt Hancock

35

Clause  144,  page  80,  line  39,  leave out “(8)” and insert “(8A)”

Member’s explanatory statement

See the explanatory statement for Amendment 38.

Secretary Matt Hancock

36

Clause  144,  page  80,  line  40,  leave out “the rights of appeal under section 159” and

insert “—

(a)    

the consequences of failure to comply with it, and

(b)    

the rights under sections 159 and (Applications in respect of urgent

notices) (appeals etc).”

Member’s explanatory statement

This amendment adds a requirement for assessment notices to include information about the

consequences of failure to comply. The reference in paragraph (b) to applications in respect of

urgent notices is consequential on NC15.

Secretary Matt Hancock

37

Clause  144,  page  81,  line  8,  at end insert “, and

( )    

does not meet the conditions in subsection (8A)(a) to (d),”

Member’s explanatory statement

This amendment makes clear that, where an assessment notice is given under Clause 144 and

compliance is required urgently, the notice cannot fall within both subsection (8) and new

subsection (8A) (see Amendment 38).

Damian Collins

Ian C. Lucas

Julie Elliott

Christian Matheson

Jo Stevens

Simon Hart

Giles Watling

Brendan O’Hara

20

Clause  144,  page  81,  line  11,  leave out “7 days” and insert “24 hours”

Member’s explanatory statement

This amendment would reduce from 7 days to 24 hours the minimum period which must elapse

before a controller or processor has to comply with an assessment notice which has been issued

by the Commissioner and which the Commissioner has stated should be complied with urgently.

Notices of Amendments: 4 May 2018                      

30

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

38

Clause  144,  page  81,  line  11,  at end insert—

“(8A)    

If an assessment notice—

(a)    

states that, in the Commissioner’s opinion, there are reasonable grounds

for suspecting that a controller or processor has failed or is failing as

described in section 146(2) or that an offence under this Act has been or

is being committed,

(b)    

indicates the nature of the suspected failure or offence,

(c)    

does not specify domestic premises,

(d)    

states that, in the Commissioner’s opinion, it is necessary for the

controller or processor to comply with a requirement in the notice in less

than 7 days, and

(e)    

gives the Commissioner’s reasons for reaching that opinion,

subsections (6) and (7) do not apply.”

Member’s explanatory statement

This amendment and Amendments 35 and 39 provide that, in the circumstances described in the

new subsection (8A), the Commissioner may require a person to comply with an assessment notice

with immediate effect.

Secretary Matt Hancock

39

Clause  144,  page  81,  line  17,  after “section” insert “—

“domestic premises” means premises, or a part of premises, used as a

dwelling;”

Member’s explanatory statement

See the explanatory statement for Amendment 38.

Secretary Matt Hancock

40

Clause  146,  page  82,  line  22,  after “GDPR” insert “or section 64 or 65 of this Act”

Member’s explanatory statement

This amendment enables the Information Commissioner to give an enforcement notice or a penalty

notice (see Clause 152(1)(a)) in respect of a failure to comply with Clause 64 or 65 of the Bill (law

enforcement processing: data protection impact assessments and prior consultation with the

Commissioner).

Secretary Matt Hancock

41

Clause  146,  page  83,  line  8,  leave out “enforcement notices” and insert “an

enforcement notice”

Member’s explanatory statement

This amendment is made for drafting consistency with the provision inserted by Amendment 43.

Secretary Matt Hancock

42

Clause  146,  page  83,  line  9,  at end insert “, including by amending this section and

sections 147 to 149,”

Member’s explanatory statement

This amendment is consequential on Amendment 43.

Notices of Amendments: 4 May 2018                      

31

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

43

Clause  146,  page  83,  line  10,  leave out paragraph (b) and insert—

“( )    

may make provision about the giving of an information notice, an

assessment notice or a penalty notice, or about powers of entry and

inspection, in connection with the failure, including by amending

sections 141, 142, 144, 145 and 152 to 154 and Schedules 15 and 16,

and”

Member’s explanatory statement

This amendment enables the Secretary of State, when making regulations enabling the Information

Commissioner to give enforcement notices in respect of further failures, to make provision about

the exercise of the Information Commissioner’s other enforcement powers in connection with the

failure.

Secretary Matt Hancock

44

Clause  147,  page  83,  line  31,  leave out “the rights of appeal under section 159” and

insert “—

(a)    

the consequences of failure to comply with it, and

(b)    

the rights under sections 159 and (Applications in respect of urgent

notices) (appeals etc).”

Member’s explanatory statement

This amendment adds a requirement for enforcement notices to include information about the

consequences of failure to comply. The reference in paragraph (b) to applications in respect of

urgent notices is consequential on new Clause NC15.

Secretary Matt Hancock

45

Clause  147,  page  83,  line  44,  leave out “7 days” and insert “24 hours”

Member’s explanatory statement

This amendment provides that, in urgent cases, the Information Commissioner must allow a

minimum of 24 hours, rather than 7 days, for a person to comply with an enforcement notice.

Secretary Matt Hancock

46

Clause  155,  page  88,  line  36,  leave out “Secretary of State” and insert

“Commissioner”

Member’s explanatory statement

This amendment provides that the persons to be consulted before the Commissioner produces a

document specifying the penalties for non-compliance with charges regulations are the persons

that the Commissioner, rather than the Secretary of State, considers appropriate.

Notices of Amendments: 4 May 2018                      

32

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

47

Clause  157,  page  89,  line  12,  at end insert—

“( )    

information notices,”

Member’s explanatory statement

This amendment requires the guidance produced under Clause 157 to include guidance about how

the Information Commissioner proposes to exercise her functions in connection with information

notices.

Secretary Matt Hancock

48

Clause  157,  page  89,  line  18,  at end insert—

“( )    

In relation to information notices, the guidance must include—

(a)    

provision specifying factors to be considered in determining the time at

which, or the period within which, information is to be required to be

provided;

(b)    

provision about the circumstances in which the Commissioner would

consider it appropriate to give an information notice to a person in

reliance on section 141(7) (urgent cases);

(c)    

provision about how the Commissioner will determine how to proceed if

a person does not comply with an information notice.”

Member’s explanatory statement

This amendment specifies what the guidance under Clause 157 in relation to information notices

must include.

Secretary Matt Hancock

49

Clause  157,  page  89,  line  21,  at end insert—

“( )    

provision about the circumstances in which the Commissioner would

consider it appropriate to give an assessment notice in reliance on section

144(8) or (8A) (urgent cases);”

Member’s explanatory statement

This amendment provides that the guidance under Clause 157 in relation to assessment notices

must include provision about when the Information Commissioner would consider it appropriate

to give an assessment notice requiring a person to comply with it urgently.

Secretary Matt Hancock

50

Clause  157,  page  89,  line  33,  at end insert—

“( )    

provision about how the Commissioner will determine how to proceed if

a person does not comply with an assessment notice.”

Member’s explanatory statement

This amendment provides that the guidance under Clause 157 in relation to assessment notices

must include provision about how the Information Commissioner will determine how to proceed if

a person does not comply with such a notice.

Secretary Matt Hancock

51

Clause  157,  page  89,  line  39,  at end insert—

“( )    

In relation to enforcement notices, the guidance must include—

(a)    

provision specifying factors to be considered in determining whether to

give an enforcement notice to a person;

Notices of Amendments: 4 May 2018                      

33

Data Protection Bill-[Lords], continued

(b)    

provision about the circumstances in which the Commissioner would

consider it appropriate to give an enforcement notice to a person in

reliance on section 147(8) (urgent cases);

(c)    

provision about how the Commissioner will determine how to proceed if

a person does not comply with an enforcement notice.”

Member’s explanatory statement

This amendment specifies what the guidance under Clause 157 in relation to enforcement notices

must include.

Secretary Matt Hancock

52

Clause  157,  page  90,  line  2,  at end insert—

“( )    

provision about how the Commissioner will determine how to proceed if

a person does not comply with a penalty notice.”

Member’s explanatory statement

This amendment provides that the guidance under Clause 157 in relation to penalty notices must

include provision about how the Information Commissioner will determine how to proceed if a

person does not comply with such a notice.

Secretary Matt Hancock

53

Clause  157,  page  90,  line  9,  leave out “Secretary of State” and insert

“Commissioner”

Member’s explanatory statement

This amendment provides that the persons to be consulted before the Commissioner produces

guidance about regulatory action are the persons that the Commissioner, rather than the Secretary

of State, considers appropriate.

Secretary Matt Hancock

54

Clause  159,  page  91,  line  10,  leave out subsection (2)

Member’s explanatory statement

See the explanatory statement for NC15.

Secretary Matt Hancock

55

Clause  159,  page  91,  line  20,  after “appeal” insert “to the Tribunal”

Member’s explanatory statement

This amendment adds a reference to the Tribunal in Clause 159(4) for consistency with Clause

159(3) and (5).

Notices of Amendments: 4 May 2018                      

34

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

56

Clause  160,  page  91,  line  39,  leave out subsection (5)

Member’s explanatory statement

See the explanatory statement for NC15.

Secretary Matt Hancock

57

Clause  173,  page  100,  line  38,  for “subsection (3)” substitute “subsections (3) and

(4)”

Member’s explanatory statement

See the explanatory statement for Amendment 58.

Secretary Matt Hancock

58

Clause  173,  page  100,  line  39,  at end insert—

“( )    

section (Information orders) (information orders);”

Member’s explanatory statement

This amendment and Amendments 57 and 60 provide that information orders under new Clause

NC13 can normally be made by the High Court or county court or, in Scotland, by the Court of

Session or the sheriff. There is an exception for cases in which the information notice contains an

urgency statement, when only the High Court or, in Scotland, the Court of Session can make an

information order.

Secretary Matt Hancock

59

Clause  173,  page  101,  line  2,  after “jurisdiction” insert “conferred by the

provisions listed in subsection (2)”

Member’s explanatory statement

This amendment adds words to make clear that the jurisdiction referred to in Clause 173(3) is the

jurisdiction conferred on a court by the provisions listed in subsection (2) of that clause.

Secretary Matt Hancock

60

Clause  173,  page  101,  line  3,  at end insert—

“(4)    

In relation to an information notice which contains a statement under section

141(7), the jurisdiction conferred on a court by section (Information orders) is

exercisable only by the High Court or, in Scotland, the Court of Session.

(5)    

The jurisdiction conferred on a court by section (Applications in respect of urgent

notices) (applications in respect of urgent notices) is exercisable only by the High

Court or, in Scotland, the Court of Session.”

Member’s explanatory statement

See the explanatory statement for Amendment 58. This amendment also provides that applications

under NC15 are to be dealt with by the High Court or, in Scotland, by the Court of Session.

Notices of Amendments: 4 May 2018                      

35

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

61

Clause  182,  page  106,  line  34,  at end insert “, and

(e)    

the merits of making provision for a children’s rights organisation to

exercise some or all of a data subject’s rights under Articles 77, 78, 79

and 82 of the GDPR on behalf of a data subject who is a child, with or

without being authorised to do so by the data subject.”

Member’s explanatory statement

This amendment requires the Secretary of State’s review under Clause 182 to include a review of

the merits of making provision for children’s rights organisations (defined in Amendment 62) to

act on behalf of children in respect of their rights to complain to the Information Commissioner,

to a judicial remedy and to compensation under the GDPR.

Secretary Matt Hancock

62

Clause  182,  page  106,  line  36,  at end insert—

“( )    

In carrying out the review, the Secretary of State must—

(a)    

consider the particular needs of children separately from the needs of

adults,

(b)    

have regard to the fact that children have different needs at different

stages of development,

(c)    

carry out an analysis of the particular challenges that children face in

authorising, and deciding whether to authorise, other persons to act on

their behalf under Article 80(1) of the GDPR or section 180,

(d)    

consider the support and advice available to children in connection with

the exercise of their rights under Articles 77, 78, 79 and 82 of the GDPR

by another person on their behalf and the merits of making available

other support or advice, and

(e)    

have regard to the United Kingdom’s obligations under the United

Nations Convention on the Rights of the Child.

( )    

Before preparing the report under subsection (1), the Secretary of State must

consult the Commissioner and such other persons as the Secretary of State

considers appropriate, including—

(a)    

persons active in the field of protection of data subjects’ rights and

freedoms with regard to the protection of their personal data,

(b)    

children and parents,

(c)    

children’s rights organisations and other persons who appear to the

Secretary of State to represent the interests of children,

(d)    

child development experts, and

(e)    

trade associations.

( )    

In this section—

“children’s rights organisation” means a body or other organisation

which—

(a)    

is active in representing the interests of children, and

(b)    

has objectives which are in the public interest;

“trade association” includes a body representing controllers or processors;

“the United Nations Convention on the Rights of the Child” means the

Convention on the Rights of the Child adopted by the General Assembly

of the United Nations on 20 November 1989 (including any Protocols to

that Convention which are in force in relation to the United Kingdom),