Session 2017-19
Internet Publications
Other Bills before Parliament


 
 

Notices of Amendments: 4 May 2018                      

36

 

Data Protection Bill-[Lords], continued

 
 

subject to any reservations, objections or interpretative declarations by

 

the United Kingdom for the time being in force.”

 

Member’s explanatory statement

 

This amendment requires the Secretary of State to consider and analyse specified matters relating

 

to children when carrying out the review under Clause 182. It also imposes an obligation on the

 

Secretary of State to consult specified persons before preparing the report under that clause.

 

Secretary Matt Hancock

 

63

 

Clause  182,  page  106,  line  37,  leave out subsections (4) to (7)

 

Member’s explanatory statement

 

This amendment is consequential on NC16, which reproduces subsections (4) to (7) of Clause 182

 

with modifications.

 


 

Secretary Matt Hancock

 

64

 

Clause  187,  page  109,  line  24,  after “143” insert “, (Destroying or falsifying

 

information and documents etc)”

 

Member’s explanatory statement

 

This amendment provides for a person who commits an offence under NC14 to be liable to a fine,

 

on summary conviction or on conviction on indictment.

 


 

Secretary Matt Hancock

 

65

 

Clause  190,  page  111,  line  12,  at end insert—

 

“( )    

section (Destroying or falsifying information and documents etc);”

 

Member’s explanatory statement

 

This amendment provides for convictions for the offence under NC14 to be recorded on the Police

 

National Computer. People who are arrested for a recordable offence may have their fingerprints

 

and DNA samples taken.

 


 

Secretary Matt Hancock

 

145

 

Parliamentary Star - white    

Clause  196,  page  115,  line  42,  at end insert—

 

“( )    

section (Review of processing of personal data for the purposes of

 

journalism)(2);”

 

Member’s explanatory statement

 

This amendment provides that EU Regulation No. 1182/71 determining the rules applicable to

 

periods, dates and time limits does not apply for the purposes of the 4 year period described in

 

subsection (2) of NC22.

 



 
 

Notices of Amendments: 4 May 2018                      

37

 

Data Protection Bill-[Lords], continued

 
 

Secretary Matt Hancock

 

66

 

Clause  198,  page  118,  line  36,  after “provision” insert “in or”

 

Member’s explanatory statement

 

Subsections (1) to (3) of Clause 198 (territorial application) set out when the Bill applies to the

 

processing of personal data. Subsection (4) provides that subsections (1) to (3) have effect subject

 

to provision made “under” Clause 120. This amendment amends subsection (4) so that it also

 

refers to provision made “in” Clause 120 (see Clause 120(4)).

 


 

Christine Jardine

 

17

 

Clause  203,  page  121,  line  32,  at end insert—

 

“(aa)    

sections [Publishers of news-related material: damages and costs] and

 

[Publishers of news-related material: interpretive provisions].”

 

Secretary Matt Hancock

 

67

 

Clause  203,  page  121,  line  36,  for “204” substitute “204(2)”

 

Member’s explanatory statement

 

This amendment is consequential on Amendment 68.

 


 

Secretary Matt Hancock

 

68

 

Clause  204,  page  122,  line  1,  at end insert—

 

“(1)    

Schedule (Transitional provision etc) contains transitional, transitory and saving

 

provision.

 

(2)    

 

Member’s explanatory statement

 

This amendment is consequential on NS3.

 

Secretary Matt Hancock

 

69

 

Clause  204,  page  122,  line  4,  at end insert “or with the GDPR beginning to apply,

 

including provision amending or repealing a provision of Schedule (Transitional

 

provision etc).

 

( )    

Regulations under this section that amend or repeal a provision of Schedule

 

(Transitional provision etc) are subject to the negative resolution procedure.”

 

Member’s explanatory statement

 

This amendment enables the Secretary of State, by regulations, to make transitional, transitory or

 

saving provision in connection with the GDPR beginning to apply. It also enables regulations,

 

subject to the negative resolution procedure, to amend NS3.

 



 
 

Notices of Amendments: 4 May 2018                      

38

 

Data Protection Bill-[Lords], continued

 
 

Tom Watson

 

Liam Byrne

 

144

 

Parliamentary Star - white    

Clause  205,  page  122,  line  10,  leave out “Section 190 extends” and insert “Sections

 

[Publishers of news-related material: damages and costs (No. 2)], [Publishers of news-

 

related material: interpretive provisions (No. 2)] and 190 extend”.

 

Secretary Matt Hancock

 

70

 

Clause  205,  page  122,  line  11,  leave out “and 182” insert “, 182 and (Post-review

 

powers to make provision about representation of data subjects)”

 

Member’s explanatory statement

 

This amendment is consequential on NC16. It provides that the new Clause extends to England and

 

Wales and Northern Ireland only.

 

Secretary Matt Hancock

 

71

 

Clause  205,  page  122,  line  16,  for “204” substitute “204(2)”

 

Member’s explanatory statement

 

This amendment is consequential on Amendment 68.

 


 

Secretary Matt Hancock

 

NS3

 

Parliamentary Star - white    

To move the following Schedule—

 

“Transitional provision etc

 

Part 1

 

General

 

Interpretation

 

1    (1)  

In this Schedule—

 

“the 1984 Act” means the Data Protection Act 1984;

 

“the 1998 Act” means the Data Protection Act 1998;

 

“the 2014 Regulations” means the Criminal Justice and Data Protection

 

(Protocol No. 36) Regulations 2014 (S.I. 2014/3141);

 

“data controller” has the same meaning as in the 1998 Act (see section 1

 

of that Act);

 

“the old data protection principles” means the principles set out in—

 

(a)    

Part 1 of Schedule 1 to the 1998 Act, and

 

(b)    

regulation 30 of the 2014 Regulations.

 

      (2)  

A provision of the 1998 Act that has effect by virtue of this Schedule is not, by

 

virtue of that, part of the data protection legislation (as defined in section 3).


 
 

Notices of Amendments: 4 May 2018                      

39

 

Data Protection Bill-[Lords], continued

 
 

Part 2

 

Rights of data subjects

 

Right of access to personal data under the 1998 Act

 

2    (1)  

The repeal of sections 7 to 9A of the 1998 Act (right of access to personal data)

 

does not affect the application of those sections after the relevant time in a case

 

in which a data controller received a request under section 7 of that Act (right

 

of access to personal data) before the relevant time.

 

      (2)  

The repeal of sections 7 and 8 of the 1998 Act and the revocation of regulation

 

44 of the 2014 Regulations (which applies those sections with modifications)

 

do not affect the application of those sections and that regulation after the

 

relevant time in a case in which a UK competent authority received a request

 

under section 7 of the 1998 Act (as applied by that regulation) before the

 

relevant time.

 

      (3)  

The revocation of the relevant regulations, or their amendment by Schedule 18

 

to this Act, and the repeals and revocation mentioned in sub-paragraphs (1) and

 

(2), do not affect the application of the relevant regulations after the relevant

 

time in a case described in those sub-paragraphs.

 

      (4)  

In this paragraph—

 

“the relevant regulations” means—

 

(a)    

the Data Protection (Subject Access) (Fees and Miscellaneous

 

Provisions) Regulations 2000 (S.I. 2000/191);

 

(b)    

regulation 4 of, and Schedule 1 to, the Consumer Credit (Credit

 

Reference Agency) Regulations 2000 (S.I. 2000/290);

 

(c)    

regulation 3 of the Freedom of Information and Data Protection

 

(Appropriate Limit and Fees) Regulations 2004 (S.I. 2004/

 

3244);

 

“the relevant time” means the time when the repeal of section 7 of the

 

1998 Act comes into force;

 

“UK competent authority” has the same meaning as in Part 4 of the 2014

 

Regulations (see regulation 27 of those Regulations).

 

Right to prevent processing likely to cause damage or distress under the 1998 Act

 

3    (1)  

The repeal of section 10 of the 1998 Act (right to prevent processing likely to

 

cause damage or distress) does not affect the application of that section after

 

the relevant time in a case in which an individual gave notice in writing to a

 

data controller under that section before the relevant time.

 

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

 

section 10 of the 1998 Act comes into force.

 

Right to prevent processing for purposes of direct marketing under the 1998 Act

 

4    (1)  

The repeal of section 11 of the 1998 Act (right to prevent processing for

 

purposes of direct marketing) does not affect the application of that section

 

after the relevant time in a case in which an individual gave notice in writing

 

to a data controller under that section before the relevant time.

 

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

 

section 11 of the 1998 Act comes into force.


 
 

Notices of Amendments: 4 May 2018                      

40

 

Data Protection Bill-[Lords], continued

 
 

Automated processing under the 1998 Act

 

5    (1)  

The repeal of section 12 of the 1998 Act (rights in relation to automated

 

decision-taking) does not affect the application of that section after the relevant

 

time in relation to a decision taken by a person before that time if—

 

(a)    

in taking the decision the person failed to comply with section 12(1)

 

of the 1998 Act, or

 

(b)    

at the relevant time—

 

(i)    

the person had not taken all of the steps required under section

 

12(2) or (3) of the 1998 Act, or

 

(ii)    

the period specified in section 12(2)(b) of the 1998 Act (for an

 

individual to require a person to reconsider a decision) had not

 

expired.

 

      (2)  

In this paragraph, “the relevant time” means the time when the repeal of

 

section 12 of the 1998 Act comes into force.

 

Compensation for contravention of the 1998 Act or Part 4 of the 2014 Regulations

 

6    (1)  

The repeal of section 13 of the 1998 Act (compensation for failure to comply

 

with certain requirements) does not affect the application of that section after

 

the relevant time in relation to damage or distress suffered at any time by

 

reason of an act or omission before the relevant time.

 

      (2)  

The revocation of regulation 45 of the 2014 Regulations (right to

 

compensation) does not affect the application of that regulation after the

 

relevant time in relation to damage or distress suffered at any time by reason

 

of an act or omission before the relevant time.

 

      (3)  

“The relevant time” means—

 

(a)    

in sub-paragraph (1), the time when the repeal of section 13 of the

 

1998 Act comes into force;

 

(b)    

in sub-paragraph (2), the time when the revocation of regulation 45 of

 

the 2014 Regulation comes into force.

 

Rectification, blocking, erasure and destruction under the 1998 Act

 

7    (1)  

The repeal of section 14(1) to (3) and (6) of the 1998 Act (rectification,

 

blocking, erasure and destruction of inaccurate personal data) does not affect

 

the application of those provisions after the relevant time in a case in which an

 

application was made under subsection (1) of that section before the relevant

 

time.

 

      (2)  

The repeal of section 14(4) to (6) of the 1998 Act (rectification, blocking,

 

erasure and destruction: risk of further contravention in circumstances entitling

 

data subject to compensation under section 13 of the 1998 Act) does not affect

 

the application of those provisions after the relevant time in a case in which an

 

application was made under subsection (4) of that section before the relevant

 

time.

 

      (3)  

In this paragraph, “the relevant time” means the time when the repeal of

 

section 14 of the 1998 Act comes into force.

 

Jurisdiction and procedure under the 1998 Act

 

8          

The repeal of section 15 of the 1998 Act (jurisdiction and procedure) does not

 

affect the application of that section in connection with sections 7 to 14 of the

 

1998 Act as they have effect by virtue of this Schedule.


 
 

Notices of Amendments: 4 May 2018                      

41

 

Data Protection Bill-[Lords], continued

 
 

Exemptions under the 1998 Act

 

9    (1)  

The repeal of Part 4 of the 1998 Act (exemptions) does not affect the

 

application of that Part after the relevant time in connection with a provision

 

of Part 2 of the 1998 Act as it has effect after that time by virtue of paragraphs

 

2 to 7 of this Schedule.

 

      (2)  

The revocation of the relevant Orders, and the repeal mentioned in sub-

 

paragraph (1), do not affect the application of the relevant Orders after the

 

relevant time in connection with a provision of Part 2 of the 1998 Act as it has

 

effect as described in sub-paragraph (1).

 

      (3)  

In this paragraph—

 

“the relevant Orders” means—

 

(a)    

the Data Protection (Corporate Finance Exemption) Order 2000

 

(S.I. 2000/184);

 

(b)    

the Data Protection (Subject Access Modification) (Health)

 

Order 2000 (S.I. 2000/413);

 

(c)    

the Data Protection (Subject Access Modification) (Education)

 

Order 2000 (S.I. 2000/414);

 

(d)    

the Data Protection (Subject Access Modification) (Social

 

Work) Order 2000 (S.I. 2000/415);

 

(e)    

the Data Protection (Crown Appointments) Order 2000 (S.I.

 

2000/416);

 

(f)    

Data Protection (Miscellaneous Subject Access Exemptions)

 

Order 2000 (S.I. 2000/419);

 

(g)    

Data Protection (Designated Codes of Practice) (No. 2) Order

 

2000 (S.I. 2000/1864);

 

“the relevant time” means the time when the repeal of the provision of

 

Part 2 of the 1998 Act in question comes into force.

 

      (4)  

As regards certificates issued under section 28(2) of the 1998 Act, see Part 5

 

of this Schedule.

 

Prohibition by this Act of requirement to produce relevant records

 

10  (1)  

In Schedule 17 to this Act, references to a record obtained in the exercise of a

 

data subject access right include a record obtained at any time in the exercise

 

of a right under section 7 of the 1998 Act.

 

      (2)  

In section 177 of this Act, references to a “relevant record” include a record

 

which does not fall within the definition in Schedule 17 to this Act (read with

 

sub-paragraph (1)) but which, immediately before the relevant time, was a

 

“relevant record” for the purposes of section 56 of the 1998 Act.

 

      (3)  

In this paragraph, “the relevant time” means the time when the repeal of

 

section 56 of the 1998 Act comes into force.

 

Avoidance under this Act of certain contractual terms relating to health records

 

11         

In section 178 of this Act, references to a record obtained in the exercise of a

 

data subject access right include a record obtained at any time in the exercise

 

of a right under section 7 of the 1998 Act.


 
 

Notices of Amendments: 4 May 2018                      

42

 

Data Protection Bill-[Lords], continued

 
 

Part 3

 

The GDPR and Part 2 of this Act

 

Exemptions from the GDPR: restrictions of rules in Articles 13 to 15 of the GDPR

 

12         

In paragraph 20(2) of Schedule 2 to this Act (self-incrimination), the reference

 

to an offence under this Act includes an offence under the 1998 Act or the 1984

 

Act.

 

Manual unstructured data held by FOI public authorities

 

13         

Until the first regulations under section 24(8) of this Act come into force, “the

 

appropriate maximum” for the purposes of that section is—

 

(a)    

where the controller is a public authority listed in Part 1 of Schedule 1

 

to the Freedom of Information Act 2000, £600, and

 

(b)    

otherwise, £450.

 

Part 4

 

Law enforcement and intelligence services processing

 

Logging

 

14  (1)  

In relation to an automated processing system set up before 6 May 2016,

 

subsections (1) to (3) of section 62 of this Act do not apply if and to the extent

 

that compliance with them would involve disproportionate effort.

 

      (2)  

Sub-paragraph (1) ceases to have effect at the beginning of 6 May 2023.

 

Regulation 50 of the 2014 Regulations (disapplication of the 1998 Act)

 

15         

Nothing in this Schedule, read with the revocation of regulation 50 of the 2014

 

Regulations, has the effect of applying a provision of the 1998 Act to the

 

processing of personal data to which Part 4 of the 2014 Regulations applies in

 

a case in which that provision did not apply before the revocation of that

 

regulation.

 

Maximum fee for data subject access requests to intelligence services

 

16         

Until the first regulations under section 94(4)(b) of this Act come into force,

 

the maximum amount of a fee that may be required by a controller under that

 

section is £10.

 

Part 5

 

National security certificates

 

National security certificates: processing of personal data under the 1998 Act

 

17  (1)  

The repeal of section 28(2) to (12) of the 1998 Act does not affect the

 

application of those provisions after the relevant time with respect to the

 

processing of personal data to which the 1998 Act (including as it has effect by

 

virtue of this Schedule) applies.

 

      (2)  

A certificate issued under section 28(2) of the 1998 Act continues to have

 

effect after the relevant time with respect to the processing of personal data to

 

which the 1998 Act (including as it has effect by virtue of this Schedule)

 

applies.


 
PreviousBack to StartNext
 

Revised 04 May 2018