Chapter 3: Delegated powers
9.The Bill creates many delegated powers, including Henry VIII powers, which although subject to affirmative procedure are very broad. For example:
- Article 9 of the GDPR prohibits the processing of “special categories of data” but permits states to create exemptions in certain circumstances. Clause 9 gives effect to these exemptions and the conditions permitting the processing of exempt data are set out in schedule 1. Clause 9(6) gives the Secretary of State regulation-making powers to amend schedule 1 by adding, varying or omitting processing conditions or safeguards. This is a very broad Henry VIII power, potentially affecting all of the conditions and safeguards in schedule 1. The Secretary of State also has power to make consequential amendments to the clause.
- Clause 15 provides that the Secretary of State may, by regulations, alter exemptions in relation to data protection principles and rights beyond those provided for by the GDPR. This is a potentially extensive power, as it would allow the Secretary of State to alter the application of the GDPR, creating new legal bases for the performance of tasks in the public interest or in the exercise of official authority, and to alter significantly the range of data that are exempt from the protections in the Bill.
- Schedule 11 sets out a range of exemptions to the data protection principles and the rights of data subjects, covering matters such as parliamentary privilege and legal professional privilege. Clause 111 creates a Henry VIII power enabling the Secretary of State by regulations to add to, amend or repeal the exemptions prescribed by schedule 11. The power is as potentially expansive as the equivalent power in clause 15.
- Clauses 142 and 148 provide the Secretary of State with regulation-making powers to confer powers on the Information Commissioner to issue enforcement and penalty notices respectively. Penalties under the Bill and the GDPR are potentially very high and the discretion provided by both provisions is broad, including a Henry VIII power to amend provisions of the Bill itself.
- Clause 170 gives the Secretary of State power by regulations to make such provision as the Secretary of State considers necessary or appropriate in connection with an amendment or replacement of the Council of Europe Data Protection Convention 108. This includes amending the Bill itself. This is a very extensive power granting broad discretion.
10.The foregoing represents a sample of some of the more extensive delegated powers in the Bill. The Delegated Powers and Regulatory Reform Committee has reported on the powers in the Bill in detail.7
11.We draw attention to the number and breadth of the delegated powers in this Bill. This is an increasingly common feature of legislation which, as we have repeatedly stated, causes considerable concern. The Government’s desire to future-proof legislation, both in light of Brexit and the rapidly changing nature of digital technologies, must be balanced against the need for Parliament to scrutinise and, where necessary, constrain executive power.
7 Delegated Powers and Regulatory Reform Committee, 6th Report (Session 2017–19, HL Paper 29)