Data Protection Bill [HL] - Commons Amendments

Part of the debate – in the House of Lords at 6:45 pm on 14th May 2018.

Alert me about debates like this

Moved by Lord Ashton of Hyde

That this House do agree with the Commons in their Amendments 116 to 152.

116: Clause 183, page 105, line 44, leave out “certain rights” and insert “the data subject’s rights under Articles 77, 78 and 79 of the GDPR (rights to lodge complaints and to an effective judicial remedy)”

117: Clause 183, page 106, line 7, leave out “under the following provisions” and insert “of a data subject”

118: Clause 183, page 106, line 9, at beginning insert “rights under”

119: Clause 183, page 106, line 10, at beginning insert “rights under”

120: Clause 183, page 106, line 11, at beginning insert “rights under”

121: After Clause 183, insert the following new Clause—“Representation of data subjects with their authority: collective proceedings(1) The Secretary of State may by regulations make provision for representative bodies to bring proceedings before a court or tribunal in England and Wales or Northern Ireland combining two or more relevant claims.(2) In this section, “relevant claim”, in relation to a representative body, means a claim in respect of a right of a data subject which the representative body is authorised to exercise on the data subject’s behalf under Article 80(1) of the GDPR or section 183. (3) The power under subsection (1) includes power— (a) to make provision about the proceedings;(b) to confer functions on a person, including functions involving the exercise of a discretion;(c) to make different provision in relation to England and Wales and in relation to Northern Ireland.(4) The provision mentioned in subsection (3)(a) includes provision about— (a) the effect of judgments and orders;(b) agreements to settle claims;(c) the assessment of the amount of compensation;(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;(e) costs.(5) Regulations under this section are subject to the negative resolution procedure.”

122: After Clause 183, insert the following new Clause—“Duty to review provision for representation of data subjects(1) Before the end of the review period, the Secretary of State must—(a) review the matters listed in subsection (2) in relation to England and Wales and Northern Ireland,(b) prepare a report of the review, and(c) lay a copy of the report before Parliament.(2) Those matters are—(a) the operation of Article 80(1) of the GDPR, (b) the operation of section 183,(c) the merits of exercising the power under Article 80(2) of the GDPR (power to enable a body or other organisation which meets the conditions in Article 80(1) of the GDPR to exercise some or all of a data subject’s rights under Articles 77, 78 and 79 of the GDPR without being authorised to do so by the data subject),(d) the merits of making equivalent provision in relation to data subjects’ rights under Article 82 of the GDPR (right to compensation), and(e) the merits of making provision for a children’s rights organisation to exercise some or all of a data subject’s rights under Articles 77, 78, 79 and 82 of the GDPR on behalf of a data subject who is a child, with or without being authorised to do so by the data subject.(3) “The review period” is the period of 30 months beginning when section 183 comes into force.(4) In carrying out the review, the Secretary of State must—(a) consider the particular needs of children separately from the needs of adults,(b) have regard to the fact that children have different needs at different stages of development,(c) carry out an analysis of the particular challenges that children face in authorising, and deciding whether to authorise, other persons to act on their behalf under Article 80(1) of the GDPR or section 183,(d) consider the support and advice available to children in connection with the exercise of their rights under Articles 77, 78, 79 and 82 of the GDPR by another person on their behalf and the merits of making available other support or advice, and(e) have regard to the United Kingdom’s obligations under the United Nations Convention on the Rights of the Child.(5) Before preparing the report under subsection (1), the Secretary of State must consult the Commissioner and such other persons as the Secretary of State considers appropriate, including—(a) persons active in the field of protection of data subjects’ rights and freedoms with regard to the protection of their personal data,(b) children and parents,(c) children’s rights organisations and other persons who appear to the Secretary of State to represent the interests of children, (d) child development experts, and(e) trade associations.(6) In this section—“children’s rights organisation” means a body or other organisation which—(a) is active in representing the interests of children, and(b) has objectives which are in the public interest;“trade association” includes a body representing controllers or processors;“the United Nations Convention on the Rights of the Child” means the Convention on the Rights of the Child adopted by the General Assembly of the United Nations on 20 November 1989 (including any Protocols to that Convention which are in force in relation to the United Kingdom), subject to any reservations, objections or interpretative declarations by the United Kingdom for the time being in force.”

123: After Clause 183, insert the following new Clause—“Post-review powers to make provision about representation of data subjects(1) After the report under section (Duty to review provision for representation of data subjects)(1) is laid before Parliament, the Secretary of State may by regulations—(a) exercise the powers under Article 80(2) of the GDPR in relation to England and Wales and Northern Ireland,(b) make provision enabling a body or other organisation which meets the conditions in Article 80(1) of the GDPR to exercise a data subject’s rights under Article 82 of the GDPR in England and Wales and Northern Ireland without being authorised to do so by the data subject, and(c) make provision described in section (Duty to review provision for representation of data subjects)(2)(e) in relation to the exercise in England and Wales and Northern Ireland of the rights of a data subject who is a child.(2) The powers under subsection (1) include power—(a) to make provision enabling a data subject to prevent a body or other organisation from exercising, or continuing to exercise, the data subject’s rights;(b) to make provision about proceedings before a court or tribunal where a body or organisation exercises a data subject’s rights;(c) to make provision for bodies or other organisations to bring proceedings before a court or tribunal combining two or more claims in respect of a right of a data subject;(d) to confer functions on a person, including functions involving the exercise of a discretion;(e) to amend sections 164 to 166, 177, 183, 196, 198 and 199; (f) to insert new sections and Schedules into Part 6 or 7;(g) to make different provision in relation to England and Wales and in relation to Northern Ireland.(3) The powers under subsection (1)(a) and (b) include power to make provision in relation to data subjects who are children or data subjects who are not children or both.(4) The provision mentioned in subsection (2)(b) and (c) includes provision about—(a) the effect of judgments and orders; (b) agreements to settle claims;(c) the assessment of the amount of compensation;(d) the persons to whom compensation may or must be paid, including compensation not claimed by the data subject;(e) costs.(5) Regulations under this section are subject to the affirmative resolution procedure.”

124: Clause 184, page 106, line 41, leave out “(including as applied by Chapter 3 of that Part)”

125: Transpose Clause 184 to after Clause 182

126: After Clause 188, insert the following new Clause— “Reserve forces: data-sharing by HMRC(1) The Reserve Forces Act 1996 is amended as follows. (2) After section 125 insert—“125A Supply of contact details by HMRC(1) This subsection applies to contact details for—(a) a member of an ex-regular reserve force, or(b) a person to whom section 66 (officers and former servicemen liable to recall) applies, which are held by HMRC in connection with a function of HMRC.(2) HMRC may supply contact details to which subsection (1) applies to the Secretary of State for the purpose of enabling the Secretary of State—(a) to contact a member of an ex-regular reserve force in connection with the person’s liability, or potential liability, to be called out for service under Part 6;(b) to contact a person to whom section 66 applies in connection with the person’s liability, or potential liability, to be recalled for service under Part 7.(3) Where a person’s contact details are supplied under subsection (2) for a purpose described in that subsection, they may also be used for defence purposes connected with the person’s service (whether past, present or future) in the reserve forces or regular services.(4) In this section, “HMRC” means Her Majesty’s Revenue and Customs.125B Prohibition on disclosure of contact details supplied under section 125A(1) A person who receives information supplied under section 125A may not disclose it except with the consent of the Commissioners for Her Majesty’s Revenue and Customs (which may be general or specific).(2) A person who contravenes subsection (1) is guilty of an offence.(3) It is a defence for a person charged with an offence under this section to prove that the person reasonably believed—(a) that the disclosure was lawful, or(b) that the information had already lawfully been made available to the public.(4) Subsections (4) to (7) of section 19 of the Commissioners for Revenue and Customs Act 2005 apply to an offence under this section as they apply to an offence under that section.(5) Nothing in section 107 or 108 (institution of proceedings and evidence) applies in relation to an offence under this section.125C Data protection(1) Nothing in section 125A or 125B authorises the making of a disclosure which contravenes the data protection legislation.(2) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

127: Clause 189, page 109, line 4, after “145” insert “, (Destroying or falsifying information and documents etc)”

128: Clause 192, page 110, line 33, at end insert—“( ) section (Destroying or falsifying information and documents etc);”

129: Clause 198, page 114, line 25, at end insert “the following (except in the expression “United Kingdom government department”)”

130: Clause 198, page 115, line 8, at end insert—“(2) References in this Act to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits, except in—(a) section 125(4), (7) and (8); (b) section 160(3), (5) and (6); (c) section 176(2); (d) section (Review of processing of personal data for the purposes of journalism)(2);(e) section 179(8) and (9); (f) section 180(4);(g) section 186(3), (5) and (6);(h) section 190(3) and (4);(i) paragraph 18(4) and (5) of Schedule 1; (j) paragraphs 5(4) and 6(4) of Schedule 3; (k) Schedule 5;(l) paragraph 11(5) of Schedule 12; (m) Schedule 15;(and the references in section 5 to terms used in Chapter 2 or 3 of Part 2 do not include references to a period expressed in hours, days, weeks, months or years).”

131: Clause 198, page 115, line 8, at end insert—“( ) Section 3(14)(aa) (interpretation of references to Chapter 2 of Part 2 in Parts 5 to 7) and the amendments in Schedule 18 which make equivalent provision are not to be treated as implying a contrary intention for the purposes of section 20(2) of the Interpretation Act 1978, or any similar provision in another enactment, as it applies to other references to, or to a provision of, Chapter 2 of Part 2 of this Act.”

132: Clause 200, page 117, line 15, leave out subsections (1) to (4) and insert—“(1) This Act applies only to processing of personal data described in subsections (2) and (3).(2) It applies to the processing of personal data in the context of the activities of an establishment of a controller or processor in the United Kingdom, whether or not the processing takes place in the United Kingdom.(3) It also applies to the processing of personal data to which Chapter 2 of Part 2 (the GDPR) applies where—(a) the processing is carried out in the context of the activities of an establishment of a controller or processor in a country or territory that is not a member State, whether or not the processing takes place in such a country or territory,(b) the personal data relates to a data subject who is in the United Kingdom when the processing takes place, and(c) the processing activities are related to—(i) the offering of goods or services to data subjects in the United Kingdom, whether or not for payment, or(ii) the monitoring of data subjects’ behaviour in the United Kingdom.”

133: Clause 200, page 118, line 8, leave out “(4)” and insert “(3)”

134: Clause 200, page 118, line 8, after “provision” insert “in or”

135: Clause 200, page 118, leave out line 10 and insert “processing of personal data”

136: Clause 200, page 118, line 10, at end insert—“(5A) Section 3(14)(b) does not apply to the reference to the processing of personal data in subsection (2).(5B) The reference in subsection (3) to Chapter 2 of Part 2 (the GDPR) does not include that Chapter as applied by Chapter 3 of Part 2 (the applied GDPR).”

137: Clause 200, page 118, line 11, leave out “established” and insert “who has an establishment”

138: Clause 200, page 118, line 21, after “to” insert “a person who has an”

139: Clause 200, page 118, line 23, leave out subsection (7)

140: Clause 204, page 120, line 12, leave out subsection (1) and insert— “(1) In Schedule 18—(a) Part 1 contains minor and consequential amendments of primary legislation; (b) Part 2 contains minor and consequential amendments of other legislation;(c) Part 3 contains consequential modifications of legislation; (d) Part 4 contains supplementary provision.”

141: Clause 205, page 120, line 37, leave out paragraph (b)

142: Clause 205, page 120, line 41, for “206” substitute “206(2)”

143: Clause 205, page 121, line 4, at end insert—“( ) Regulations under this section may make different provision for different areas.”

144: Clause 206, page 121, line 5, at end insert—“(1) Schedule (Transitional provision etc) contains transitional, transitory and saving provision.(2) ”

145: Clause 206, page 121, line 8, at end insert “or with the GDPR beginning to apply, including provision amending or repealing a provision of Schedule (Transitional provision etc).( ) Regulations under this section that amend or repeal a provision of Schedule (Transitional provision etc) are subject to the negative resolution procedure.”

146: Clause 207, page 121, line 12, after “(2)” insert “, (2A)”

147: Clause 207, page 121, line 12, leave out “and (3)” and insert “, (3) and (3A)”

148: Clause 207, page 121, line 14, at end insert—“(2A) Sections (Representation of data subjects with their authority: collective proceedings), (Duty to review provision for representation of data subjects) and (Post-review powers to make provision about representation of data subjects) extend to England and Wales and Northern Ireland only.”

149: Clause 207, page 121, line 15, after “extent” insert “in the United Kingdom”

150: Clause 207, page 121, line 16, leave out “(ignoring extent by virtue of an Order in Council)”

151: Clause 207, page 121, line 17, at end insert—“(3A) This subsection and the following provisions also extend to the Isle of Man—(a) paragraphs 200O and 205 of Schedule 18;(b) sections 204(1), 205(1) and 206(2), so far as relating to those paragraphs.”

152: Clause 208, page 121, line 24, leave out subsection (2)

Motion on Amendments 116 to 152 agreed.