The Data Protection and Digital Information Bill has moved to the House of Lords for scrutiny following completion of the Report Stage and Third Reading in the House of Commons. However, its passage was not without controversy.

The Government introduced 240 amendments to the Bill the day prior to the Report Stage. When publishing the amendments, the Government’s press release focus on ‘common sense changes’ which it stated to be focused on issues such as tackling benefit fraud, a preservation process for social media data during child suicide-related inquests and national security.

However, behind the public pronouncements, a number of the amendments were significant covering issues such as the independence of the new Information Commission and the scope of searches carried out in response to subject access requests.

Data adequacy

One of the major concerns presented by the Bill is the prospect of jeopardising the European Commission's finding of "adequacy" in respect of the UK, meaning that personal data can continue to flow freely from the European Union. In an effort to alleviate those concerns Sir John Whittingdale, the Minister for Data and Digital Infrastructure, stated “I can guarantee that there is nothing in the Government’s proposals that we believe puts data adequacy at risk.” The Minister was also keen to emphasise that the Information Commissioner shared this view.

A further issue which led to concern regarding the future of the adequacy arrangement was a perceived movement away from the independence of the Information Commissioner. Initial drafts of the Bill had introduced a requirement for the Secretary of State to be provided with and approve the codes of practice prepared by the Information Commissioner.

The most recent amendments to the Bill include a revision providing that “the Information Commissioner must consider recommendations from the Secretary of State about a code of practice before the code is laid before Parliament for approval (and removes provision included in the Bill which requires a code to be approved by the Secretary of State).” It is hoped that this amendment will negate such concerns.

Other amendments

As highlighted during the Parliamentary discussions, many of the 240 amendments are small and technical in nature, but other changes of note have been made:

  • In responding to subject access requests, controllers are only required to undertake reasonable and proportionate searches for personal data and other information.
  • Clarifying the ways in which the ICO can serve notices, and to remove a requirement for the ICO to obtain consent before serving notices by email.
  • Amendment to the period within which the Information Commissioner must be notified of a personal data breach under Regulation 5A of the PECR from ‘without undue delay’ to ‘without undue delay, and, where feasible, not later than 72 hours after having become aware of it.
  • Provision about courts’ powers to require information to be provided to them, and to a data subject, when determining whether a data subject is entitled to information under certain provisions of the data protection legislation.

Next steps

Irrespective of the recent amendments, many measures within the Bill continue to prompt concerns over how it affect the ability of individuals to both protect and access their data. The Public Law Project has published a detailed assessment of the Bill expressing concerns over measures it believes will weaken existing protections and give the Government broad and unspecified powers.

Following completion of the Bill’s progression through the House of Commons, it will now move to the House of Lords where there will inevitably be further and detailed challenges. Both Conservative and Labour MPs expressed concerns that the introduction of the amendments at such a late hour, and a refusal to recommit the Bill back to Committee Stage for further consideration, was delegating large parts of their work to the House of Lords. Many will remember the extensive consideration of the Data Protection Bill (now the Data Protection Act 2018). We will await the outcome of the progression of the Bill through the House of Lords with great interest.