Notices of Amendments: 4 May 2018                      

36

Data Protection Bill-[Lords], continued

subject to any reservations, objections or interpretative declarations by

the United Kingdom for the time being in force.”

Member’s explanatory statement

This amendment requires the Secretary of State to consider and analyse specified matters relating

to children when carrying out the review under Clause 182. It also imposes an obligation on the

Secretary of State to consult specified persons before preparing the report under that clause.

Secretary Matt Hancock

63

Clause  182,  page  106,  line  37,  leave out subsections (4) to (7)

Member’s explanatory statement

This amendment is consequential on NC16, which reproduces subsections (4) to (7) of Clause 182

with modifications.

Secretary Matt Hancock

64

Clause  187,  page  109,  line  24,  after “143” insert “, (Destroying or falsifying

information and documents etc)”

Member’s explanatory statement

This amendment provides for a person who commits an offence under NC14 to be liable to a fine,

on summary conviction or on conviction on indictment.

Secretary Matt Hancock

65

Clause  190,  page  111,  line  12,  at end insert—

“( )    

section (Destroying or falsifying information and documents etc);”

Member’s explanatory statement

This amendment provides for convictions for the offence under NC14 to be recorded on the Police

National Computer. People who are arrested for a recordable offence may have their fingerprints

and DNA samples taken.

Secretary Matt Hancock

145

Clause  196,  page  115,  line  42,  at end insert—

“( )    

section (Review of processing of personal data for the purposes of

journalism)(2);”

Member’s explanatory statement

This amendment provides that EU Regulation No. 1182/71 determining the rules applicable to

periods, dates and time limits does not apply for the purposes of the 4 year period described in

subsection (2) of NC22.

Notices of Amendments: 4 May 2018                      

37

Data Protection Bill-[Lords], continued

Secretary Matt Hancock

66

Clause  198,  page  118,  line  36,  after “provision” insert “in or”

Member’s explanatory statement

Subsections (1) to (3) of Clause 198 (territorial application) set out when the Bill applies to the

processing of personal data. Subsection (4) provides that subsections (1) to (3) have effect subject

to provision made “under” Clause 120. This amendment amends subsection (4) so that it also

refers to provision made “in” Clause 120 (see Clause 120(4)).

Christine Jardine

17

Clause  203,  page  121,  line  32,  at end insert—

“(aa)    

sections [Publishers of news-related material: damages and costs] and

[Publishers of news-related material: interpretive provisions].”

Secretary Matt Hancock

67

Clause  203,  page  121,  line  36,  for “204” substitute “204(2)”

Member’s explanatory statement

This amendment is consequential on Amendment 68.

Secretary Matt Hancock

68

Clause  204,  page  122,  line  1,  at end insert—

“(1)    

Schedule (Transitional provision etc) contains transitional, transitory and saving

provision.

(2)    

”

Member’s explanatory statement

This amendment is consequential on NS3.

Secretary Matt Hancock

69

Clause  204,  page  122,  line  4,  at end insert “or with the GDPR beginning to apply,

including provision amending or repealing a provision of Schedule (Transitional

provision etc).

( )    

Regulations under this section that amend or repeal a provision of Schedule

(Transitional provision etc) are subject to the negative resolution procedure.”

Member’s explanatory statement

This amendment enables the Secretary of State, by regulations, to make transitional, transitory or

saving provision in connection with the GDPR beginning to apply. It also enables regulations,

subject to the negative resolution procedure, to amend NS3.

Notices of Amendments: 4 May 2018                      

38

Data Protection Bill-[Lords], continued

Tom Watson

Liam Byrne

144

Clause  205,  page  122,  line  10,  leave out “Section 190 extends” and insert “Sections

[Publishers of news-related material: damages and costs (No. 2)], [Publishers of news-

related material: interpretive provisions (No. 2)] and 190 extend”.

Secretary Matt Hancock

70

Clause  205,  page  122,  line  11,  leave out “and 182” insert “, 182 and (Post-review

powers to make provision about representation of data subjects)”

Member’s explanatory statement

This amendment is consequential on NC16. It provides that the new Clause extends to England and

Wales and Northern Ireland only.

Secretary Matt Hancock

71

Clause  205,  page  122,  line  16,  for “204” substitute “204(2)”

Member’s explanatory statement

This amendment is consequential on Amendment 68.

Secretary Matt Hancock

NS3

To move the following Schedule—

“Transitional provision etc

Part 1

General

Interpretation

1    (1)  

In this Schedule—

“the 1984 Act” means the Data Protection Act 1984;

“the 1998 Act” means the Data Protection Act 1998;

“the 2014 Regulations” means the Criminal Justice and Data Protection

(Protocol No. 36) Regulations 2014 (S.I. 2014/3141);

“data controller” has the same meaning as in the 1998 Act (see section 1

of that Act);

“the old data protection principles” means the principles set out in—

(a)    

Part 1 of Schedule 1 to the 1998 Act, and

(b)    

regulation 30 of the 2014 Regulations.

      (2)  

A provision of the 1998 Act that has effect by virtue of this Schedule is not, by

virtue of that, part of the data protection legislation (as defined in section 3).

Notices of Amendments: 4 May 2018                      

39

Data Protection Bill-[Lords], continued

Part 2

Rights of data subjects

Right of access to personal data under the 1998 Act

2    (1)  

The repeal of sections 7 to 9A of the 1998 Act (right of access to personal data)

does not affect the application of those sections after the relevant time in a case

in which a data controller received a request under section 7 of that Act (right

of access to personal data) before the relevant time.

      (2)  

The repeal of sections 7 and 8 of the 1998 Act and the revocation of regulation

44 of the 2014 Regulations (which applies those sections with modifications)

do not affect the application of those sections and that regulation after the

relevant time in a case in which a UK competent authority received a request

under section 7 of the 1998 Act (as applied by that regulation) before the

relevant time.

      (3)  

The revocation of the relevant regulations, or their amendment by Schedule 18

to this Act, and the repeals and revocation mentioned in sub-paragraphs (1) and

(2), do not affect the application of the relevant regulations after the relevant

time in a case described in those sub-paragraphs.

      (4)  

In this paragraph—

“the relevant regulations” means—

(a)    

the Data Protection (Subject Access) (Fees and Miscellaneous

Provisions) Regulations 2000 (S.I. 2000/191);

(b)    

regulation 4 of, and Schedule 1 to, the Consumer Credit (Credit

Reference Agency) Regulations 2000 (S.I. 2000/290);

(c)    

regulation 3 of the Freedom of Information and Data Protection

(Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/

3244);

“the relevant time” means the time when the repeal of section 7 of the

1998 Act comes into force;

“UK competent authority” has the same meaning as in Part 4 of the 2014

Regulations (see regulation 27 of those Regulations).

Right to prevent processing likely to cause damage or distress under the 1998 Act

3    (1)  

The repeal of section 10 of the 1998 Act (right to prevent processing likely to

cause damage or distress) does not affect the application of that section after

the relevant time in a case in which an individual gave notice in writing to a

data controller under that section before the relevant time.

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

section 10 of the 1998 Act comes into force.

Right to prevent processing for purposes of direct marketing under the 1998 Act

4    (1)  

The repeal of section 11 of the 1998 Act (right to prevent processing for

purposes of direct marketing) does not affect the application of that section

after the relevant time in a case in which an individual gave notice in writing

to a data controller under that section before the relevant time.

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

section 11 of the 1998 Act comes into force.

Notices of Amendments: 4 May 2018                      

40

Data Protection Bill-[Lords], continued

Automated processing under the 1998 Act

5    (1)  

The repeal of section 12 of the 1998 Act (rights in relation to automated

decision-taking) does not affect the application of that section after the relevant

time in relation to a decision taken by a person before that time if—

(a)    

in taking the decision the person failed to comply with section 12(1)

of the 1998 Act, or

(b)    

at the relevant time—

(i)    

the person had not taken all of the steps required under section

12(2) or (3) of the 1998 Act, or

(ii)    

the period specified in section 12(2)(b) of the 1998 Act (for an

individual to require a person to reconsider a decision) had not

expired.

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

section 12 of the 1998 Act comes into force.

Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations

6    (1)  

The repeal of section 13 of the 1998 Act (compensation for failure to comply

with certain requirements) does not affect the application of that section after

the relevant time in relation to damage or distress suffered at any time by

reason of an act or omission before the relevant time.

      (2)  

The revocation of regulation 45 of the 2014 Regulations (right to

compensation) does not affect the application of that regulation after the

relevant time in relation to damage or distress suffered at any time by reason

of an act or omission before the relevant time.

      (3)  

“The relevant time” means—

(a)    

in sub-paragraph (1), the time when the repeal of section 13 of the

1998 Act comes into force;

(b)    

in sub-paragraph (2), the time when the revocation of regulation 45 of

the 2014 Regulation comes into force.

Rectification, blocking, erasure and destruction under the 1998 Act

7    (1)  

The repeal of section 14(1) to (3) and (6) of the 1998 Act (rectification,

blocking, erasure and destruction of inaccurate personal data) does not affect

the application of those provisions after the relevant time in a case in which an

application was made under subsection (1) of that section before the relevant

time.

      (2)  

The repeal of section 14(4) to (6) of the 1998 Act (rectification, blocking,

erasure and destruction: risk of further contravention in circumstances entitling

data subject to compensation under section 13 of the 1998 Act) does not affect

the application of those provisions after the relevant time in a case in which an

application was made under subsection (4) of that section before the relevant

time.

      (3)  

In this paragraph, “the relevant time” means the time when the repeal of

section 14 of the 1998 Act comes into force.

Jurisdiction and procedure under the 1998 Act

8          

The repeal of section 15 of the 1998 Act (jurisdiction and procedure) does not

affect the application of that section in connection with sections 7 to 14 of the

1998 Act as they have effect by virtue of this Schedule.

Notices of Amendments: 4 May 2018                      

41

Data Protection Bill-[Lords], continued

Exemptions under the 1998 Act

9    (1)  

The repeal of Part 4 of the 1998 Act (exemptions) does not affect the

application of that Part after the relevant time in connection with a provision

of Part 2 of the 1998 Act as it has effect after that time by virtue of paragraphs

2 to 7 of this Schedule.

      (2)  

The revocation of the relevant Orders, and the repeal mentioned in sub-

paragraph (1), do not affect the application of the relevant Orders after the

relevant time in connection with a provision of Part 2 of the 1998 Act as it has

effect as described in sub-paragraph (1).

      (3)  

In this paragraph—

“the relevant Orders” means—

(a)    

the Data Protection (Corporate Finance Exemption) Order 2000

(S.I. 2000/184);

(b)    

the Data Protection (Subject Access Modification) (Health)

Order 2000 (S.I. 2000/413);

(c)    

the Data Protection (Subject Access Modification) (Education)

Order 2000 (S.I. 2000/414);

(d)    

the Data Protection (Subject Access Modification) (Social

Work) Order 2000 (S.I. 2000/415);

(e)    

the Data Protection (Crown Appointments) Order 2000 (S.I.

2000/416);

(f)    

Data Protection (Miscellaneous Subject Access Exemptions)

Order 2000 (S.I. 2000/419);

(g)    

Data Protection (Designated Codes of Practice) (No. 2) Order

2000 (S.I. 2000/1864);

“the relevant time” means the time when the repeal of the provision of

Part 2 of the 1998 Act in question comes into force.

      (4)  

As regards certificates issued under section 28(2) of the 1998 Act, see Part 5

of this Schedule.

Prohibition by this Act of requirement to produce relevant records

10  (1)  

In Schedule 17 to this Act, references to a record obtained in the exercise of a

data subject access right include a record obtained at any time in the exercise

of a right under section 7 of the 1998 Act.

      (2)  

In section 177 of this Act, references to a “relevant record” include a record

which does not fall within the definition in Schedule 17 to this Act (read with

sub-paragraph (1)) but which, immediately before the relevant time, was a

“relevant record” for the purposes of section 56 of the 1998 Act.

      (3)  

In this paragraph, “the relevant time” means the time when the repeal of

section 56 of the 1998 Act comes into force.

Avoidance under this Act of certain contractual terms relating to health records

11         

In section 178 of this Act, references to a record obtained in the exercise of a

data subject access right include a record obtained at any time in the exercise

of a right under section 7 of the 1998 Act.

Notices of Amendments: 4 May 2018                      

42

Data Protection Bill-[Lords], continued

Part 3

The GDPR and Part 2 of this Act

Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR

12         

In paragraph 20(2) of Schedule 2 to this Act (self-incrimination), the reference

to an offence under this Act includes an offence under the 1998 Act or the 1984

Act.

Manual unstructured data held by FOI public authorities

13         

Until the first regulations under section 24(8) of this Act come into force, “the

appropriate maximum” for the purposes of that section is—

(a)    

where the controller is a public authority listed in Part 1 of Schedule 1

to the Freedom of Information Act 2000, £600, and

(b)    

otherwise, £450.

Part 4

Law enforcement and intelligence services processing

Logging

14  (1)  

In relation to an automated processing system set up before 6 May 2016,

subsections (1) to (3) of section 62 of this Act do not apply if and to the extent

that compliance with them would involve disproportionate effort.

      (2)  

Sub-paragraph (1) ceases to have effect at the beginning of 6 May 2023.

Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)

15         

Nothing in this Schedule, read with the revocation of regulation 50 of the 2014

Regulations, has the effect of applying a provision of the 1998 Act to the

processing of personal data to which Part 4 of the 2014 Regulations applies in

a case in which that provision did not apply before the revocation of that

regulation.

Maximum fee for data subject access requests to intelligence services

16         

Until the first regulations under section 94(4)(b) of this Act come into force,

the maximum amount of a fee that may be required by a controller under that

section is £10.

Part 5

National security certificates

National security certificates: processing of personal data under the 1998 Act

17  (1)  

The repeal of section 28(2) to (12) of the 1998 Act does not affect the

application of those provisions after the relevant time with respect to the

processing of personal data to which the 1998 Act (including as it has effect by

virtue of this Schedule) applies.

      (2)  

A certificate issued under section 28(2) of the 1998 Act continues to have

effect after the relevant time with respect to the processing of personal data to

which the 1998 Act (including as it has effect by virtue of this Schedule)

applies.