Christine Jardine (Edinburgh West) (LD)

- Hansard -

Copy Link

- - Excerpts

Does the Minister agree that the retention and enhancement of public trust in data is a major issue, that sharing data is a major issue for the public, and that the Government must do more—perhaps she can tell us whether they intend to do more—to educate the public about how and where our data is used, and what powers individuals have to find out this information?

Sir Julian Lewis (New Forest East) (Con)

- Hansard -

Copy Link

- - Excerpts

My hon. Friend gave a long list of people who found the rules we had inherited from outside the UK challenging. She might add to that list Members of Parliament themselves. I am sure I am not alone in having been exasperated by being complained about to the Information Commissioner, in this case by a constituent who had written to me complaining about a local parish council. When I shared his letter with the parish council so that it could show how bogus his long-running complaint had been, he proceeded to file a complaint with the Information Commissioner’s Office because I had shared his phone number—which he had not marked as private—with the parish council, with which he had been in correspondence for several years. The Information Commissioner’s Office took that seriously. This sort of nonsense shows how over-restrictive regulations can be abused by people who are out to stir up trouble unjustifiably.

John Penrose (Weston-super-Mare) (Con)

- Hansard -

Copy Link

- - Excerpts

I am delighted to hear the Secretary of State talk about reducing regulatory burdens without compromising the standards that we are none the less delivering—that is the central distinction, and greatly to be welcomed for its benefits for the entrepreneurialism and fleetness of foot of British industry. Does she agree, however, that while the part of the Bill that deals with open data, or smart data, goes further than that and creates fresh opportunities for, in particular, the small challenger businesses of the kind she has described to take on the big incumbents that own the data lakes in many sectors, those possibilities will be greatly reduced if we take our time and move too slowly? Could it not potentially take 18 months to two years for us to start opening up those other sectors of our economy?

Ben Lake (Ceredigion) (PC)

- Hansard -

Copy Link

- - Excerpts

I am grateful to the Minister for being so generous with her time. May I ask whether the Government intend to maintain data adequacy with the EU? I only ask because I have been contacted by some business owners who are concerned about the possible loss of EU data adequacy and the cost that might be levied on them as a result.

Rebecca Long Bailey (Salford and Eccles) (Lab)

- Hansard -

Copy Link

- - Excerpts

I was concerned to hear from the British Medical Association that if the EU were to conclude that data protection legislation in the UK was inadequate, that would present a significant problem for organisations conducting medical research in the UK. Given that so many amazing medical researchers across the UK currently work in collaboration with EU counterparts, can the Minister assure the House that the Bill will not represent an inadequacy in comparison with EU legislation as it stands?

Jim Shannon (Strangford) (DUP)

- Hansard -

Copy Link

- - Excerpts

The Minister always delivers a very solid message and we all appreciate that. In relation to the high data protection standards that she is outlining, there is also a balance to be achieved when it comes to ensuring that there are no unnecessary barriers for individuals and businesses. Can she assure the House that that will be exactly what happens?

Mike Amesbury (Weaver Vale) (Lab)

- Hansard -

Copy Link

- - Excerpts

I thank the Minster for being so generous with her time. With regard to the independent commissioner, the regulator, who will set the terms of reference? Will it be genuinely independent? It seems to me that a lot of power will fall on the shoulders of the Secretary of State, whoever that might be in the not-too-distant future.

Jane Hunt (Loughborough) (Con)

- Hansard -

Copy Link

- - Excerpts

Hear, hear.

Damian Collins (Folkestone and Hythe) (Con)

- View Speech - Hansard -

Copy Link

- - Excerpts

I am delighted to speak in support of this long-awaited Bill. It is a necessary piece of legislation to learn the lessons from GDPR and look at how we can improve the system, both to make it easier for businesses to work with and to give users and citizens the certainty they need about how their data will be processed and used.

In bringing forward new measures, the Bill in no way suggests that we are looking to move away from our data adequacy agreements with the European Union. Around the world, in north America, Europe, Australia and elsewhere in the far east, we see Governments looking at developing trusted systems for sharing and using data and for allowing businesses to process data across international borders, knowing that those systems may not be exactly the same, but they work to the same standards and with similar levels of integrity. That is clearly the direction that the whole world wants to move in and we should play a leading role in that.

I want to talk briefly about an important area of the Bill: getting the balance between data rights and data safety and what the Bill refers to as the “legitimate interest” of a particular business. I should also note that this Bill, while important in its own right, sits alongside other legislation—some of it to be introduced in this Session and some of it already well on its way through the Parliamentary processes—dealing with other aspects of the digital world. The regulation of data is an aspect of digital regulation; it is in some ways the fuel that powers the digital experience and is relevant to other areas of digital life as well.

To take one example, we have already established and implemented the age-appropriate design code for children, which principally addresses the way data is gathered from children online and used to design services and products that they use. As this Bill goes through its parliamentary stages, it is important that we understand how the age-appropriate design code is applied as part of the new data regime, and that the safeguards set out in that code are guaranteed through the Bill as well.

There has been a lot of debate, as has already been mentioned, about companies such as TikTok. There is a concern that engineers who work for TikTok in China, some of whom may be members of the Chinese Communist party, have access to UK user data that may not be stored in China, but is accessed from China, and are using that data to develop products. There is legitimate concern about oversight of that process and what that data might be used for, particularly in a country such as China.

However, there is also a question about data, because one reason the TikTok app is being withdrawn from Government devices around the world is that it is incredibly data-acquisitive. It does not just analyse how people use TikTok and from that create data profiles of users to determine what content to recommend to them, although that is a fundamental part of the experience of using it; it is also gathering, as other big apps do, data from what people do on other apps on the same device. People may not realise that they have given consent, and it is certainly not informed consent, for companies such as TikTok to access data from what they do on other apps, not just when they are TikTok.

It is a question of having trusted systems for how data can be gathered, and giving users the right to opt out of such data systems more easily. Some users might say, “I’m quite happy for TikTok or Meta to have that data gathered about what I do across a range of services.” Others may say, “No, I only want them to see data about what I do when I am using their particular service, not other people’s.”

The Online Safety Bill is one of the principal ways in which we are seeking to regulate AI now. There is debate among people in the tech sectors; a letter was published recently, co-signed by a number of tech executives, including Elon Musk, to say that we should have a six-month pause in the development of AI systems, particularly for large language models. That suggests a problem in the near future of very sophisticated data systems that can make decisions faster than a human can analyse them.

People such as Eric Schmidt have raised concerns about AI in defence systems, where an aggressive system could make decisions faster than a human could respond to them, to which we would need an AI system to respond and where there is potentially no human oversight. That is a frightening scenario in which we might want to consider moratoriums and agreements, as we have in other areas of warfare such as the use of chemical weapons, that we will not allow such systems to be developed because they are so difficult to control.

If we look at the application of that sort of technology closer to home and some of the cases most referenced in the Online Safety Bill, for example the tragic death of the teenager Molly Russell, we see that what was driving the behaviour of concern was data gathered about a user to make recommendations to that person that were endangering their life. The Online Safety Bill seeks to regulate that practice by creating codes and responsibilities for businesses, but that behaviour is only possible because of the collection of data and decisions made by the company on how the data is processed.

This is where the Bill also links to the Government’s White Paper on AI, and this is particularly important: there must be an onus on companies to demonstrate that their systems are safe. The onus must not just be on the user to demonstrate that they have somehow suffered as a consequence of that system’s design. The company should have to demonstrate that they are designing systems with people’s safety and their rights in mind—be that their rights as a worker and a citizen, or their rights to have certain safeguards and protections over how their data is used.

Companies creating datasets should be able to demonstrate to the regulator what data they have gathered, how that data is being trained and what it is being used for. It should be easy for the regulator to see and, if the regulator has concerns up-front, it should be able to raise them with the company. We must try to create that shift, particularly on AI systems, in how systems are tested before they are deployed, with both safety and the principles set out in the legislation in mind.

Stephanie Peacock

- Hansard -

Copy Link

- - Excerpts

I beg to move amendment 77, in clause 11, page 19, line 12, at end insert

“and about the safeguards available to the subject in accordance with this paragraph and any regulations under Article 22D(4);”.

This amendment would require controllers proactively to provide data subjects with information about their rights in relation to automated decision-making.

The Chair

- Hansard -

Copy Link

Ms Monaghan, do you wish to move amendment 120 formally?

Stephanie Peacock

- Hansard -

Copy Link

- - Excerpts

I beg to move amendment 121, in clause 11, page 19, line 36, at end insert—

“7. When exercising the power to make regulations under this Article, the Secretary of State must have regard to the following statement of principles:

Digital information principles at work

1. People should have access to a fair, inclusive and trustworthy digital environment at work.

2. Algorithmic systems should be designed and used to achieve better outcomes: to make work better, not worse, and not for surveillance. Workers and their representatives should be involved in this process.

3. People should be protected from unsafe, unaccountable and ineffective algorithmic systems at work. Impacts on individuals and groups must be assessed in advance and monitored, with reasonable and proportionate steps taken.

4. Algorithmic systems should not harm workers’ mental or physical health, or integrity.

5. Workers and their representatives should always know when an algorithmic system is being used, how and why it is being used, and what impacts it may have on them or their work.

6. Workers and their representatives should be involved in meaningful consultation before and during use of an algorithmic system that may significantly impact work or people.

7. Workers should have control over their own data and digital information collected about them at work.

8. Workers and their representatives should always have an opportunity for human contact, review and redress when an algorithmic system is used at work where it may significantly impact work or people. This includes a right to a written explanation when a decision is made.

9. Workers and their representatives should be able to use their data and digital technologies for contact and association to improve work quality and conditions.

10. Workers should be supported to build the information, literacy and skills needed to fulfil their capabilities through work transitions.”

This amendment would insert into new Article 22D of the UK GDPR a requirement for the Secretary of State to have regard to the statement of digital information principles at work when making regulations about automated decision-making.

Madam Deputy Speaker (Dame Rosie Winterton)

- Hansard -

Copy Link

- - Excerpts

With this it will be convenient to discuss the following:

Government new clause 48—Processing of personal data revealing political opinions.

Government new clause 7—Searches in response to data subjects’ requests.

Government new clause 8—Notices from the Information Commissioner.

Government new clause 9—Court procedure in connection with subject access requests.

Government new clause 10—Approval of a supplementary code.

Government new clause 11—Designation of a supplementary code.

Government new clause 12—List of recognised supplementary codes.

Government new clause 13—Change to conditions for approval or designation.

Government new clause 14—Revision of a recognised supplementary code.

Government new clause 15—Applications for approval and re-approval.

Government new clause 16—Fees for approval, re-approval and continued approval.

Government new clause 17—Request for withdrawal of approval.

Government new clause 18—Removal of designation.

Government new clause 19—Registration of additional services.

Government new clause 20—Supplementary notes.

Government new clause 21—Addition of services to supplementary notes.

Government new clause 22—Duty to remove services from the DVS register.

Government new clause 23—Duty to remove supplementary notes from the DVS register.

Government new clause 24—Duty to remove services from supplementary notes.

Government new clause 25—Index of defined terms for Part 2.

Government new clause 26—Powers relating to verification of identity or status.

Government new clause 27—Interface bodies.

Government new clause 28—The FCA and financial services interfaces.

Government new clause 29—The FCA and financial services interfaces: supplementary.

Government new clause 30—The FCA and financial services interfaces: penalties and levies.

Government new clause 31—Liability and damages.

Government new clause 32—Other data provision.

Government new clause 33—Duty to notify the Commissioner of personal data breach: time periods.

Government new clause 34—Power to require information for social security purposes.

Government new clause 35—Retention of information by providers of internet services in connection with death of child.

Government new clause 36—Retention of biometric data and recordable offences.

Government new clause 37—Retention of pseudonymised biometric data.

Government new clause 38—Retention of biometric data from INTERPOL.

Government new clause 39—National Underground Asset Register.

Government new clause 40—Information in relation to apparatus.

Government new clause 41—Pre-commencement consultation.

Government new clause 42—Transfer of certain functions of Secretary of State.

New clause 1—Processing of data in relation to a case-file prepared by the police service for submission to the Crown Prosecution Service for a charging decision—

“(1) The 2018 Act is amended in accordance with subsection (2).

(2) In the 2018 Act, after section 40 insert—

“40A Processing of data in relation to a case-file prepared by the police service for submission to the Crown Prosecution Service for a charging decision

(1) This section applies to a set of processing operations consisting of the preparation of a case-file by the police service for submission to the Crown Prosecution Service for a charging decision, the making of a charging decision by the Crown Prosecution Service, and the return of the case-file by the Crown Prosecution Service to the police service after a charging decision has been made.

(2) The police service is not obliged to comply with the first data protection principle except insofar as that principle requires processing to be fair, or the third data protection principle, in preparing a case-file for submission to the Crown Prosecution Service for a charging decision.

(3) The Crown Prosecution Service is not obliged to comply with the first data protection principle except insofar as that principle requires processing to be fair, or the third data protection principle, in making a charging decision on a case-file submitted for that purpose by the police service.

(4) If the Crown Prosecution Service decides that a charge will not be pursued when it makes a charging decision on a case-file submitted for that purpose by the police service it must take all steps reasonably required to destroy and delete all copies of the case-file in its possession.

(5) If the Crown Prosecution Service decides that a charge will be pursued when it makes a charging decision on a case-file submitted for that purpose by the police service it must return the case-file to the police service and take all steps reasonably required to destroy and delete all copies of the case-file in its possession.

(6) Where the Crown Prosecution Service decides that a charge will be pursued when it makes a charging decision on a case-file submitted for that purpose by the police service and returns the case-file to the police service under subsection (5), the police service must comply with the first data protection principle and the third data protection principle in relation to any subsequent processing of the data contained in the case-file.

(7) For the purposes of this section—

(a) The police service means—

(i) constabulary maintained by virtue of an enactment, or

(ii) subject to section 126 of the Criminal Justice and Public Order Act 1994 (prison staff not to be regarded as in police service), any other service whose members have the powers or privileges of a constable.

(b) The preparation of, or preparing, a case-file by the police service for submission to the Crown Prosecution Service for a charging decision includes the submission of the file.

(c) A case-file includes all information obtained by the police service for the purpose of preparing a case-file for submission to the Crown Prosecution Service for a charging decision.””

This new clause adjusts Section 40 of the Data Protection Act 2018 to exempt the police service and the Crown Prosecution Service from the first and third data protection principles contained within the 2018 Act so that they can share unredacted data with one another when making a charging decision.

New clause 2—Common standards and timeline for implementation—

“(1) Within one month of the passage of this Act, the Secretary of State must by regulations require those appointed as decision-makers to create, publish and update as required open and common standards for access to customer data and business data.

(2) Standards created by virtue of subsection (1) must be interoperable with those created as a consequence of Part 2 of the Retail Banking Market Investigation Order 2017, made by the Competition and Markets Authority.

(3) Regulations under section 66 and 68 must ensure interoperability of customer data and business data with standards created by virtue of subsection (1).

(4) Within one month of the passage of this Act, the Secretary of State must publish a list of the sectors to which regulations under section 66 and section 68 will apply within three years of the passage of the Act, and the date by which those regulations will take effect in each case.”

This new clause, which is intended to be placed in Part 3 (Customer data and business data) of the Bill, would require interoperability across all sectors of the economy in smart data standards, including the Open Banking standards already in effect, and the publication of a timeline for implementation.

New clause 3—Provision about representation of data subjects—

“(1) Section 190 of the Data Protection Act 2018 is amended as follows.

(2) In subsection (1), leave out “After the report under section 189(1) is laid before Parliament, the Secretary of State may” and insert “The Secretary of State must, within three months of the passage of the Data Protection and Digital Information Act 2024,”.”

This new clause would require the Secretary of State to exercise powers under s190 DPA2018 to allow organisations to raise data breach complaints on behalf of data subjects generally, in the absence of a particular subject who wishes to bring forward a claim about misuse of their own personal data.

New clause 4—Review of notification of changes of circumstances legislation—

“(1) The Secretary of State must commission a review of the operation of the Social Security (Notification of Changes of Circumstances) Regulations 2010.

(2) In conducting the review, the designated reviewer must—

(a) consider the current operation and effectiveness of the legislation;

(b) identify any gaps in its operation and provisions;

(c) consider and publish recommendations as to how the scope of the legislation could be expanded to include non-public sector, voluntary and private sector holders of personal data.

(3) In undertaking the review, the reviewer must consult—

(a) specialists in data sharing;

(b) people and organisations who campaign for the interests of people affected by the legislation;

(c) people and organisations who use the legislation;

(d) any other persons and organisations the review considers appropriate.

(4) The Secretary of State must lay a report of the review before each House of Parliament within six months of this Act coming into force.”

This new clause requires a review of the operation of the “Tell Us Once” programme, which seeks to provide simpler mechanisms for citizens to pass information regarding births and deaths to government, and consideration of whether the progress of “Tell Us Once” could be extended to non-public sector holders of data.

New clause 5—Definition of “biometric data”—

“Article 9 of the UK GDPR is amended by the omission, in paragraph 1, of the words “for the purpose of uniquely identifying a natural person”.”

This new clause would amend the UK General Data Protection Regulation to extend the protections currently in place for biometric data for identification to include biometric data for the purpose of classification.

New clause 43—Right to use non-digital verification services—

“(1) This section applies when an organisation—

(a) requires an individual to use a verification service, and

(b) uses a digital verification service for that purpose.

(2) The organisation—

(a) must make a non-digital alternative method of verification available to any individual required to use a verification service, and

(b) must provide information about digital and non-digital methods of verification to those individuals before verification is required.”

This new clause, which is intended for insertion into Part 2 of the Bill (Digital verification services), creates the right for data subjects to use non-digital identity verification services as an alternative to digital verification services, thereby preventing digital verification from becoming mandatory in certain settings.

New clause 44—Transfer of functions to the Investigatory Powers Commissioner’s Office—

“The functions of the Surveillance Camera Commissioner are transferred to the Investigatory Powers Commissioner.”

New clause 45—Interoperability of data and collection of comparable healthcare statistics across the UK—

“(1) The Health and Social Care Act 2012 is amended as follows.

(2) After section 250, insert the following section—

“250A Interoperability of data and collection of comparable healthcare statistics across the UK

(1) The Secretary of State must prepare and publish an information standard specifying binding data interoperability requirements which apply across the whole of the United Kingdom.

(2) An information standard prepared and published under this section—

(a) must include guidance about the implementation of the standard;

(b) may apply to any public body which exercises functions in connection with the provision of health services anywhere in the United Kingdom.

(3) A public body to which an information standard prepared and published under this section applies must have regard to the standard.

(4) The Secretary of State must report to Parliament each year on progress on the implementation of an information standard prepared in accordance with this section.

(5) For the purposes of this section—

“health services” has the same meaning as in section 250 of this Act, except that for “in England” there is substituted “anywhere in the United Kingdom”, and “the health service” in parts of the United Kingdom other than England has the meaning given by the relevant statute of that part of the United Kingdom;

“public body” has the same meaning as in section 250 of this Act.”

(3) In section 254 (Powers to direct NHS England to establish information systems), after subsection (2), insert—

“(2A) The Secretary of State must give a direction under subsection (1) directing NHS England to collect and publish information about healthcare performance and outcomes in all parts of the United Kingdom in a way which enables comparison between different parts of the United Kingdom.

(2B) Before giving a direction by virtue of subsection (2A), the Secretary of State must consult—

(a) the bodies responsible for the collection and publication of official statistics in each part of the United Kingdom,

(b) Scottish Ministers,

(c) Welsh Ministers, and

(d) Northern Ireland departments.

(2C) The Secretary of State may not give a direction by virtue of subsection (2A) unless a copy of the direction has been laid before, and approved by resolution of, both Houses of Parliament.

(2D) Scottish Ministers, Welsh Ministers and Northern Ireland departments must arrange for the information relating to the health services for which they have responsibility described in the direction given by virtue of subsection (2A) to be made available to NHS England in accordance with the direction.

(2E) For the purposes of a direction given by virtue of subsection (2A), the definition of “health and social care body” given in section 259(11) applies as if for “England” there were substituted “the United Kingdom”.””

New clause 46—Assessment of impact of Act on EU adequacy—

“(1) Within six months of the passage of this Act, the Secretary of State must carry out an assessment of the impact of the Act on EU adequacy, and lay a report of that assessment before both Houses of Parliament.

(2) The report must assess the impact on—

(a) data risk, and

(b) small and medium-sized businesses.

(3) The report must quantify the impact of the Act in financial terms.”

New clause 47—Review of the impact of the Act on anonymisation and the identifiability of data subjects—

“(1) Within six months of the passage of this Act, the Secretary of State must lay before Parliament the report of an assessment of the impact of the measures in the Act on anonymisation and the identifiability of data subjects.

(2) The report must include a comparison between the rights afforded to data subjects under this Act with those afforded to data subjects by the EU General Data Protection Regulation.”

Amendment 278, in clause 5, page 6, line 15, leave out paragraphs (b) and (c).

This amendment and Amendment 279 would remove the power for the Secretary of State to create pre-defined and pre-authorised “recognised legitimate interests”, for data processing. Instead, the current test would continue to apply in which personal data can only be processed in pursuit of a legitimate interest, as balanced with individual rights and freedoms.

Amendment 279, page 6, line 23, leave out subsections (4), (5) and (6).

See explanatory statement to Amendment 278.

Amendment 230, page 7, leave out lines 1 and 2 and insert—

“8. The Secretary of State may not make regulations under paragraph 6 unless a draft of the regulations has been laid before both Houses of Parliament for the 60-day period.

8A. The Secretary of State must consider any representations made during the 60-day period in respect of anything in the draft regulations laid under paragraph 8.

8B. If, after the end of the 60-day period, the Secretary of State wishes to proceed to make the regulations, the Secretary of State must lay before Parliament a draft of the regulations (incorporating any changes the Secretary of State considers appropriate pursuant to paragraph 8A).

8C. Draft regulations laid under paragraph 8B must, before the end of the 40-day period, have been approved by a resolution of each House of Parliament.

8D. In this Article—

“the 40-day period” means the period of 40 days beginning on the day on which the draft regulations mentioned in paragraph 8 are laid before Parliament (or, if it is not laid before each House of Parliament on the same day, the later of the days on which it is laid);

“the 60-day period” means the period of 60 days beginning on the day on which the draft regulations mentioned in paragraph 8B are laid before Parliament (or, if it is not laid before each House of Parliament on the same day, the later of the days on which it is laid).

8E. When calculating the 40-day period or the 60-day period for the purposes of paragraph 8D, ignore any period during which Parliament is dissolved or prorogued or during which both Houses are adjourned for more than 4 days.”

This amendment would make regulations made in respect of recognised legitimate interest subject to a super-affirmative Parliamentary procedure.

Amendment 11, page 7, line 12, at end insert—

““internal administrative purposes” , in relation to special category data, means the conditions set out for lawful processing in paragraph 1 of Schedule 1 of the Data Protection Act 2018.”

This amendment clarifies that the processing of special category data in employment must follow established principles for reasonable processing, as defined by paragraph 1 of Schedule 1 of the Data Protection Act 2018.

Government amendment 252.

Amendment 222, page 10, line 8, leave out clause 8.

Amendment 3, in clause 8, page 10, leave out line 31.

This amendment would mean that the resources available to the controller could not be taken into account when determining whether a request is vexatious or excessive.

Amendment 2, page 11, line 34, at end insert—

“(6A) When informing the data subject of the reasons for not taking action on the request in accordance with subsection (6), the controller must provide evidence of why the request has been treated as vexatious or excessive.”

This amendment would require the data controller to provide evidence of why a request has been considered vexatious or excessive if the controller is refusing to take action on the request.

Government amendment 17.

Amendment 223, page 15, line 22, leave out clause 10.

Amendment 224, page 18, line 7, leave out clause 12.

Amendment 236, in clause 12, page 18, line 21, at end insert—

“(c) a data subject is an identified or identifiable individual who is affected by a significant decision, irrespective of the direct presence of their personal data in the decision-making process.”

This amendment would clarify that a “data subject” includes identifiable individuals who are subject to data-based and automated decision-making, whether or not their personal data is directly present in the decision-making process.

Amendment 232, page 19, line 12, leave out “solely” and insert “predominantly”.

This amendment would mean safeguards for data subjects’ rights, freedoms and legitimate interests would have to be in place in cases where a significant decision in relation to a data subject was taken based predominantly, rather than solely, on automated processing.

Amendment 5, page 19, line 12, after “solely” insert “or partly”.

This amendment would mean that the protections provided for by the new Article 22C would apply where a decision is based either solely or partly on automated processing, not only where it is based solely on such processing.

Amendment 233, page 19, line 18, at end insert

“including the reasons for the processing.”

This amendment would require data controllers to provide the data subject with the reasons for the processing of their data in cases where a significant decision in relation to a data subject was taken based on automated processing.

Amendment 225, page 19, line 18, at end insert—

“(aa) require the controller to inform the data subject when a decision described in paragraph 1 has been taken in relation to the data subject;”.

Amendment 221, page 20, line 3, at end insert—

“7. When exercising the power to make regulations under this Article, the Secretary

of State must have regard to the following statement of principles:

Digital information principles at work

1. People should have access to a fair, inclusive and trustworthy digital environment

at work.

2. Algorithmic systems should be designed and used to achieve better outcomes:

to make work better, not worse, and not for surveillance. Workers and their

representatives should be involved in this process.

3. People should be protected from unsafe, unaccountable and ineffective

algorithmic systems at work. Impacts on individuals and groups must be assessed

in advance and monitored, with reasonable and proportionate steps taken.

4. Algorithmic systems should not harm workers’ mental or physical health, or

integrity.

5. Workers and their representatives should always know when an algorithmic

system is being used, how and why it is being used, and what impacts it may

have on them or their work.

6. Workers and their representatives should be involved in meaningful consultation

before and during use of an algorithmic system that may significantly impact

work or people.

7. Workers should have control over their own data and digital information collected

about them at work.

8. Workers and their representatives should always have an opportunity for human

contact, review and redress when an algorithmic system is used at work where

it may significantly impact work or people. This includes a right to a written

explanation when a decision is made.

9. Workers and their representatives should be able to use their data and digital

technologies for contact and association to improve work quality and conditions.

10. Workers should be supported to build the information, literacy and skills needed

to fulfil their capabilities through work transitions.”

This amendment would insert into new Article 22D of the UK GDPR a requirement for the Secretary of State to have regard to the statement of digital information principles at work when making regulations about automated decision-making.

Amendment 4, in clause 15, page 25, line 4, at end insert

“(including in the cases specified in sub-paragraphs (a) to (c) of paragraph 3 of Article 35)”.

This amendment, together with Amendment 1, would provide a definition of what constitutes “high risk processing” for the purposes of applying Articles 27A, 27B and 27C, which require data controllers to designate, and specify the duties of, a “senior responsible individual” with responsibility for such processing.

Government amendments 18 to 44.

Amendment 12, in page 32, line 7, leave out clause 17.

This amendment keeps the current requirement on police in the Data Protection Act 2018 to justify why they have accessed an individual’s personal data.

Amendment 1, in clause 18, page 32, line 18, leave out paragraph (c) and insert—

“(c) omit paragraph 2,

(ca) in paragraph 3—

(i) for “data protection” substitute “high risk processing”,

(ii) in sub-paragraph (a), for “natural persons” substitute “individuals”,

(iii) in sub-paragraph (a) for “natural person” substitute “individual” in both places where it occurs,

(cb) omit paragraphs 4 and 5,”.

This amendment would leave paragraph 3 of Article 35 of the UK GDPR in place (with amendments reflecting amendments made by the Bill elsewhere in the Article), thereby ensuring that there is a definition of “high risk processing” on the face of the Regulation.

Amendment 226, page 39, line 38, leave out clause 26.

Amendment 227, page 43, line 2, leave out clause 27.

Amendment 228, page 46, line 32, leave out clause 28.

Government amendment 45.

Amendment 235, page 57, line 29, leave out clause 34.

This amendment would leave in place the existing regime, which refers to “manifestly unfounded” or excessive requests to the Information Commissioner, rather than the proposed change to “vexatious” or excessive requests.

Government amendments 46 and 47.

Amendment 237, in clause 48, page 77, line 4, leave out “individual” and insert “person”.

This amendment and Amendments 238 to 240 are intended to enable the digital verification services covered by the Bill to include verification of organisations as well as individuals.

Amendment 238, page 77, line 5, leave out “individual” and insert “person”.

See explanatory statement to Amendment 237.

Amendment 239, page 77, line 6, leave out “individual” and insert “person”.

See explanatory statement to Amendment 237.

Amendment 240, page 77, line 7, leave out “individual” and insert “person”.

See explanatory statement to Amendment 237.

Amendment 241, page 77, line 8, at end insert (on new line)—

“and the facts which may be so ascertained, verified or confirmed may include the fact that an individual has a claimed connection with a legal person.”

This amendment would ensure that the verification services covered by the Bill will include verification that an individual has a claimed connection with a legal person.

Government amendments 48 to 50.

Amendment 280, in clause 49, page 77, line 13, at end insert—

“(2A) The DVS trust framework must include a description of how the provision of digital verification services is expected to uphold the Identity Assurance Principles.

(2B) Schedule (Identity Assurance Principles) describes each Identity Assurance Principle and its effect.”

Amendment 281, page 77, line 13, at end insert—

“(2A) The DVS trust framework must allow valid attributes to be protected by zero-knowledge proof and other decentralised technologies, without restriction upon how and by whom those proofs may be held or processed.”

Government amendments 51 to 66.

Amendment 248, in clause 52, page 79, line 7, at end insert—

“(1A) A determination under subsection (1) may specify an amount which is tiered to the size of the person and its role as specified in the DVS trust framework.”

This amendment would enable fees for application for registration in the DVS register to be determined on the basis of the size and role of the organisation applying to be registered.

Amendment 243, page 79, line 8, after “may”, insert “not”.

This amendment would provide that the fee for application for registration in the DVS register could not exceed the administrative costs of determining the application.

Government amendment 67.

Amendment 244, page 79, line 13, after “may”, insert “not”.

This amendment would provide that the fee for continued registration in the DVS register could not exceed the administrative costs of that registration.

Government amendment 68.

Amendment 245, page 79, line 21, at end insert—

“(10) The fees payable under this section must be reviewed every two years by the National Audit Office.”

This amendment would provide that the fees payable for DVS registration must be reviewed every two years by the NAO.

Government amendments 69 to 77.

Amendment 247, in clause 54, page 80, line 38, after “person”, insert “or by other parties”.

This amendment would enable others, for example independent experts, to make representations about a decision to remove a person from the DVS register, as well as the person themselves.

Amendment 246, page 81, line 7, at end insert—

“(11) The Secretary of State may not exercise the power granted by subsection (1) until the Secretary of State has consulted on proposals for how a decision to remove a person from the DVS register will be reached, including—

(a) how information will be collected from persons impacted by a decision to remove the person from the register, and from others;

(b) how complaints will be managed;

(c) how evidence will be reviewed;

(d) what the burden of proof will be on which a decision will be based.”

This amendment would provide that the power to remove a person from the DVS register could not be exercised until the Secretary of State had consulted on the detail of how a decision to remove would be reached.

Government amendments 78 to 80.

Amendment 249, in clause 62, page 86, line 17, at end insert—

“(3A) A notice under this section must give the recipient of the notice an opportunity to consult the Secretary of State on the content of the notice before providing the information required by the notice.”

This amendment would provide an option for consultation between the Secretary of State and the recipient of an information notice before the information required by the notice has to be provided.

Government amendment 81.

Amendment 242, in clause 63, page 87, line 21, leave out “may” and insert “must”.

This amendment would require the Secretary of State to make arrangements for a person to exercise the Secretary of State’s functions under this Part of the Bill, so that an independent regulator would perform the relevant functions and not the Secretary of State.

Amendment 250, in clause 64, page 87, line 34, at end insert—

“(1A) A report under subsection (1) must include a report on any arrangements made under section 63 for a third party to exercise functions under this Part.”

This amendment would require information about arrangements for a third party to exercise functions under this Part of the Bill to be included in the annual reports on the operation of the Part.

Government amendments 82 to 196.

Amendment 6, in clause 83, page 107, leave out from line 26 to the end of line 34 on page 108.

This amendment would leave out the proposed new regulation 6B of the PEC Regulations, which would enable consent to be given, or an objection to be made, to cookies automatically.

Amendment 217, page 109, line 20, leave out clause 86.

This amendment would leave out the clause which would enable the sending of direct marketing electronic mail on a “soft opt-in” basis.

Amendment 218, page 110, line 1, leave out clause 87.

This amendment would remove the clause which would enable direct marketing for the purposes of democratic engagement. See also Amendment 220.

Government amendments 253 to 255.

Amendment 219, page 111, line 6, leave out clause 88.

This amendment is consequential on Amendment 218.

Government amendments 256 to 265.

Amendment 7, in clause 89, page 114, line 12, at end insert—

“(2A) A provider of a public electronic communications service or network is not required to intercept or examine the content of any communication in order to comply with their duty under this regulation.”

This amendment would clarify that a public electronic communications service or network is not required to intercept or examine the content of any communication in order to comply with their duty to notify the Commissioner of unlawful direct marketing.

Amendment 8, page 117, line 3, at end insert—

“(5) In regulation 1—

(a) at the start, insert “(1)”;

(b) after “shall”, insert “save for regulation 26A”;

(c) at end, insert—

“(2) Regulation 26A comes into force six months after the Commissioner has published guidance under regulation 26C (Guidance in relation to regulation 26A).””

This amendment would provide for the new regulation 26A, Duty to notify Commissioner of unlawful direct marketing, not to come into force until six months after the Commissioner has published guidance in relation to that duty.

Government amendment 197.

Amendment 251, in clause 101, page 127, line 3, leave out “and deaths” and insert “, deaths and deed polls”.

This amendment would require deed poll information to be kept to the same standard as records of births and deaths.

Amendment 9, page 127, line 24, at end insert—

“(2A) After section 25, insert—

“25A Review of form in which registers are to be kept

(1) The Secretary of State must commission a review of the provisions of this Act and of related legislation, with a view to the creation of a single digital register of births and deaths.

(2) The review must consider and make recommendations on the effect of the creation of a single digital register on—

(a) fraud,

(b) data collection, and

(c) ease of registration.

(3) The Secretary of State must lay a report of the review before each House of Parliament within six months of this section coming into force.””

This amendment would insert a new section into the Births and Deaths Registration Act 1953 requiring a review of relevant legislation, with consideration of creating a single digital register for registered births and registered deaths and recommendations on the effects of such a change on reducing fraud, improving data collection and streamlining digital registration.

Government amendment 198.

Amendment 229, in clause 112, page 135, line 8, leave out subsections (2) and (3).

Amendment 10, in clause 113, page 136, line 35, leave out

“which allows or confirms the unique identification of that individual”.

This amendment would amend the definition of “biometric data” for the purpose of the oversight of law enforcement biometrics databases so as to extend the protections currently in place for biometric data for identification to include biometric data for the purpose of classification.

Government amendments 199 to 207.

Government new schedule 1—Power to require information for social security purposes.

Government new schedule 2—National Underground Asset Register: monetary penalties.

New schedule 3—Identity Assurance Principles—

“Part 1

Definitions

1 These Principles are limited to the processing of Identity Assurance Data (IdA Data) in an Identity Assurance Service (e.g. establishing and verifying identity of a Service User; conducting a transaction that uses a user identity; maintaining audit requirements in relation a transaction associated with the use of a service that needs identity verification etc.). They do not cover, for example, any data used to deliver a service, or to measure its quality.

2 In the context of the application of the Identity Assurance Principles to an Identity Assurance Service, “Identity Assurance Data” (“IdA Data”) means any recorded information that is connected with a “Service User” including—

“Audit Data.” This includes any recorded information that is connected with any log or audit associated with an Identity Assurance Service.

“General Data.” This means any other recorded information which is not personal data, audit data or relationship data, but is still connected with a “Service User”.

“Personal Data.” This takes its meaning from the Data Protection Act 2018 or subsequent legislation (e.g. any recorded information that relates to a “Service User” who is also an identified or identifiable living individual).

“Relationship Data.” This means any recorded information that describes (or infers) a relationship between a “Service User”, “Identity Provider” or “Service Provider” with another “Service User”, “Identity Provider” or “Service Provider” and includes any cookie or program whose purpose is to supply a means through which relationship data are collected.

3 Other terms used in relation to the Principles are defined as follows—

“save-line2Identity Assurance Service.” This includes relevant applications of the technology (e.g. hardware, software, database, documentation) in the possession or control of any “Service User”, “Identity Provider” or “Service Provider” that is used to facilitate identity assurance activities; it also includes any IdA Data processed by that technology or by an Identity Provider or by a Service Provider in the context of the Service; and any IdA Data processed by the underlying infrastructure for the purpose of delivering the IdA service or associated billing, management, audit and fraud prevention.

“Identity Provider.” This means the certified individual or certified organisation that provides an Identity Assurance Service (e.g. establishing an identity, verification of identity); it includes any agent of a certified Identity Provider that processes IdA data in connection with that Identity Assurance Service.

“Participant.” This means any “Identity Provider”, “Service Provider” or “Service User” in an Identity Assurance Service. A “Participant” includes any agent by definition.

“Processing.” In the context of IdA data means “collecting, using, disclosing, retaining, transmitting, copying, comparing, corroborating, correlating, aggregating, accessing” the data and includes any other operation performed on IdA data.

“Provider.” Includes both “Identity Provider” and/or “Service Provider”.

“Service Provider.” This means the certified individual or certified organisation that provides a service that uses an Identity Provider in order to verify identity of the Service User; it includes any agent of the Service Provider that processes IdA data from an Identity Assurance Service.

“Service User.” This means the person (i.e. an organisation (incorporated or not)) or an individual (dead or alive) who has established (or is establishing) an identity with an Identity Provider; it includes an agent (e.g. a solicitor, family member) who acts on behalf of a Service User with proper authority (e.g. a public guardian, or a Director of a company, or someone who possesses power of attorney). The person may be living or deceased (the identity may still need to be used once its owner is dead, for example by an executor).

“Third Party.” This means any person (i.e. any organisation or individual) who is not a “Participant” (e.g. the police or a Regulator).

Part 2

The Nine Identity Assurance Principles

Any exemptions from these Principles must be specified via the “Exceptional Circumstances Principle”. (See Principle 9).

1 User Control Principle

Statement of Principle: “I can exercise control over identity assurance activities affecting me and these can only take place if I consent or approve them.”

1.1 An Identity Provider or Service Provider must ensure any collection, use or disclosure of IdA data in, or from, an Identity Assurance Service is approved by each particular Service User who is connected with the IdA data.

1.2 There should be no compulsion to use the Identity Assurance Service and Service Providers should offer alternative mechanisms to access their services. Failing to do so would undermine the consensual nature of the service.

2 Transparency Principle

Statement of Principle: “Identity assurance can only take place in ways I understand and when I am fully informed.”

2.1 Each Identity Provider or Service Provider must be able to justify to Service Users why their IdA data are processed. Ensuring transparency of activity and effective oversight through auditing and other activities inspires public trust and confidence in how their details are used.

2.2 Each Service User must be offered a clear description about the processing of IdA data in advance of any processing. Identity Providers must be transparent with users about their particular models for service provision.

2.3 The information provided includes a clear explanation of why any specific information has to be provided by the Service User (e.g. in order that a particular level of identity assurance can be obtained) and identifies any obligation on the part of the Service User (e.g. in relation to the User’s role in securing his/her own identity information).

2.4 The Service User will be able to identify which Service Provider they are using at any given time.

2.5 Any subsequent and significant change to the processing arrangements that have been previously described to a Service User requires the prior consent or approval of that Service User before it comes into effect.

2.6 All procedures, including those involved with security, should be made publicly available at the appropriate time, unless such transparency presents a security or privacy risk. For example, the standards of encryption can be identified without jeopardy to the encryption keys being used.

3 Multiplicity Principle

Statement of Principle: “I can use and choose as many different identifiers or identity providers as I want to.”

3.1 A Service User is free to use any number of identifiers that each uniquely identifies the individual or business concerned.

3.2 A Service User can use any of his identities established with an Identity Provider with any Service Provider.

3.3 A Service User shall not be obliged to use any Identity Provider or Service Provider not chosen by that Service User; however, a Service Provider can require the Service User to provide a specific level of Identity Assurance, appropriate to the Service User’s request to a Service Provider.

3.4 A Service User can choose any number of Identity Providers and where possible can choose between Service Providers in order to meet his or her diverse needs. Where a Service User chooses to register with more than one Identity Provider, Identity Providers and Service Providers must not link the Service User’s different accounts or gain information about their use of other Providers.

3.5 A Service User can terminate, suspend or change Identity Provider and where possible can choose between Service Providers at any time.

3.6 A Service Provider does not know the identity of the Identity Provider used by a Service User to verify an identity in relation to a specific service. The Service Provider knows that the Identity Provider can be trusted because the Identity Provider has been certified, as set out in GPG43 – Requirements for Secure Delivery of Online Public Services (RSDOPS).

4 Data Minimisation Principle

Statement of Principle: “My interactions only use the minimum data necessary to meet my needs.”

4.1 Identity Assurance should only be used where a need has been established and only to the appropriate minimum level of assurance.

4.2 Identity Assurance data processed by an Identity Provider or a Service Provider to facilitate a request of a Service User must be the minimum necessary in order to fulfil that request in a secure and auditable manner.

4.3 When a Service User stops using a particular Identity Provider, their data should be deleted. Data should be retained only where required for specific targeted fraud, security or other criminal investigation purposes.

5 Data Quality Principle

Statement of Principle: “My interactions only use the minimum data necessary to meet my needs.”

5.1 Service Providers should enable Service Users (or authorised persons, such as the holder of a Power of Attorney) to be able to update their own personal data, at a time at their choosing, free of charge and in a simple and easy manner.

5.2 Identity Providers and Service Providers must take account of the appropriate level of identity assurance required before allowing any updating of personal data.

6 Service User Access and Portability Principle

Statement of Principle: “I have to be provided with copies of all of my data on request; I can move/remove my data whenever I want.”

6.1 Each Identity Provider or Service Provider must allow, promptly, on request and free of charge, each Service User access to any IdA data that relates to that Service User.

6.2 It shall be unlawful to make it a condition of doing anything in relation to a Service User to request or require that Service User to request IdA data.

6.3 The Service User must be able to require an Identity Provider to transfer his personal data, to a second Identity Provider in a standard electronic format, free of charge and without impediment or delay.

7 Certification Principle

Statement of Principle: “I can have confidence in the Identity Assurance Service because all the participants have to be certified against common governance requirements.”

7.1 As a baseline control, all Identity Providers and Service Providers will be certified against a shared standard. This is one important way of building trust and confidence in the service.

7.2 As part of the certification process, Identity Providers and Service Providers are obliged to co-operate with the independent Third Party and accept their impartial determination and to ensure that contractual arrangements—

• reinforce the application of the Identity Assurance Principles

• contain a reference to the independent Third Party as a mechanism for dispute resolution.

7.3 In the context of personal data, certification procedures include the use of Privacy Impact Assessments, Security Risk Assessments, Privacy by Design concepts and, in the context of information security, a commitment to using appropriate technical measures (e.g. encryption) and ever improving security management. Wherever possible, such certification processes and security procedures reliant on technical devices should be made publicly available at the appropriate time.

7.4 All Identity Providers and Service Providers will take all reasonable steps to ensure that a Third Party cannot capture IdA data that confirms (or infers) the existence of relationship between any Participant. No relationships between parties or records should be established without the consent of the Service User.

7.5 Certification can be revoked if there is significant non-compliance with any Identity Assurance Principle.

8 Dispute Resolution Principle

Statement of Principle: “If I have a dispute, I can go to an independent Third Party for a resolution.”

8.1 A Service User who, after a reasonable time, cannot, or is unable, to resolve a complaint or problem directly with an Identity Provider or Service Provider can call upon an independent Third Party to seek resolution of the issue. This could happen for example where there is a disagreement between the Service User and the Identity Provider about the accuracy of data.

8.2 The independent Third Party can resolve the same or similar complaints affecting a group of Service Users.

8.3 The independent Third Party can co-operate with other regulators in order to resolve problems and can raise relevant issues of importance concerning the Identity Assurance Service.

8.4 An adjudication/recommendation of the independent Third Party should be published. The independent Third Party must operate transparently, but detailed case histories should only be published subject to appropriate review and consent.

8.5 There can be more than one independent Third Party.

8.6 The independent Third Party can recommend changes to standards or certification procedures or that an Identity Provider or Service Provider should lose their certification.

9 Exceptional Circumstances Principle

Statement of Principle: “Any exception has to be approved by Parliament and is subject to independent scrutiny.”

9.1 Any exemption from the application of any of the above Principles to IdA data shall only be lawful if it is linked to a statutory framework that legitimises all Identity Assurance Services, or an Identity Assurance Service in the context of a specific service. In the absence of such a legal framework then alternative measures must be taken to ensure, transparency, scrutiny and accountability for any exceptions.

9.2 Any exemption from the application of any of the above Principles that relates to the processing of personal data must also be necessary and justifiable in terms of one of the criteria in Article 8(2) of the European Convention of Human Rights: namely in the interests of national security; public safety or the economic well-being of the country; for the prevention of disorder or crime; for the protection of health or morals, or for the protection of the rights and freedoms of others.

9.3 Any subsequent processing of personal data by any Third Party who has obtained such data in exceptional circumstances (as identified by Article 8(2) above) must be the minimum necessary to achieve that (or another) exceptional circumstance.

9.4 Any exceptional circumstance involving the processing of personal data must be subject to a Privacy Impact Assessment by all relevant “data controllers” (where “data controller” takes its meaning from the Data Protection Act).

9.5 Any exemption from the application of any of the above Principles in relation to IdA data shall remain subject to the Dispute Resolution Principle.”

Amendment 220, in schedule 1, page 141, leave out from line 21 to the end of line 36 on page 144.

This amendment would remove from the new Annex 1 of the UK GDPR provisions which would enable direct marketing for the purposes of democratic engagement. See also Amendment 218.

Government amendments 266 to 277.

Government amendments 208 to 211.

Amendment 15, in schedule 5, page 154, line 2, at end insert—

“(g) the views of the Information Commission on suitability of international transfer of data to the country or organisation.”

This amendment requires the Secretary of State to seek the views of the Information Commission on whether a country or organisation has met the data protection test for international data transfer.

Amendment 14, page 154, line 25, at end insert—

“5. In relation to special category data, the Information Commissioner must assess whether the data protection test is met for data transfer to a third country or international organisation.”

This amendment requires the Information Commission to assess suitability for international transfer of special category data to a third country or international organisation.

Amendment 13, page 154, line 30, leave out “ongoing” and insert “annual”.

This amendment mandates that a country’s suitability for international transfer of data is monitored on an annual basis.

Amendment 16, in schedule 6, page 162, line 36, at end insert—

“(g) the views of the Information Commission on suitability of international transfer of data to the country or organisation.”

This amendment requires the Secretary of State to seek the views of the Information Commission on whether a country or organisation has met the data protection test for international data transfer in relation to law enforcement processing.

Government amendment 212.

Amendment 231, in schedule 13, page 202, line 33, at end insert—

“(2A) A person may not be appointed under sub-paragraph (2) unless the Science, Innovation and Technology Committee of the House of Commons has endorsed the proposed appointment.”

This amendment would ensure that non-executive members of the Information Commission may not be appointed unless the Science, Innovation and Technology Committee has endorsed the Secretary of State’s proposed appointee.

Government amendments 213 to 216.

Layla Moran (Oxford West and Abingdon) (LD)

- Hansard -

Copy Link

- - Excerpts

I am grateful to the Minister for giving way so early. Oxford West and Abingdon has a huge number of spin-offs and scientific businesses that have expressed concern that any material deviation on standards, particularly European Union data adequacy, would entangle them in more red tape, rather than remove it. He says he has spoken to industry leaders. Have he and his Department assessed the risk of any deviation? Is there any associated cost to businesses from any potential deviation? Who is going to bear that cost?

Layla Moran

- Hansard -

Copy Link

- - Excerpts

The Minister says, “We do not wish”. Is that a guarantee from the Dispatch Box that there will be absolutely no deviation that causes a material difference for businesses on EU data adequacy? Can he give that guarantee?

Dawn Butler (Brent Central) (Lab)

- Hansard -

Copy Link

- - Excerpts

Will the Minister confirm that no services will rely on digital identity checks?

Sir Jeremy Wright (Kenilworth and Southam) (Con)

- Hansard -

Copy Link

- - Excerpts

Before my right hon. Friend moves on to the specifics of the Government amendments, may I ask him about something they do not yet cover? The Bill does not address the availability of data to researchers so that they can assist in the process of, for example, identifying patterns in online safety. He will know that there was considerable discussion of this during the passage of the Online Safety Act 2023, when a succession of Ministers said that we might return to the subject in this Bill. Will he update the House on how that is going? When might we expect to see amendments to deal with this important area?

Sir Chris Bryant

- View Speech - Hansard -

Copy Link

- - Excerpts

Broadly speaking, we support this measure. What negotiations and discussions has the Minister had about red notices under Interpol and the abuse of them, for instance by the Russian state? We have concerns about decent people being maltreated by the Russian state through the use of red notices. Are those concerns conflicted by the measure that the Government are introducing?

Carol Monaghan (Glasgow North West) (SNP)

- Hansard -

Copy Link

- - Excerpts

Is any consideration given to the fact that that information could be used by bad actors? If people are able to find out where particular cables or pipes are, they also have the ability to find weakness in the system, which could have implications for us all.

Patrick Grady (Glasgow North) (SNP)

- Hansard -

Copy Link

- - Excerpts

Is the Minister prepared to look at how the proposals in the Bill and the amendments align with relevant legislation passed in the Scottish Government? A number of framework Bills to govern the operation of potential future referendums on a variety of subjects have been passed, particularly the Referendums (Scotland) Act 2020. It is important that there is alignment with the definitions used in the Bill, such as that for “a permitted participant”. Will he commit to looking at that and, if necessary, make changes to the Bill at a later stage in its progress, in discussion with the Scottish Government?

Layla Moran

- Hansard -

Copy Link

- - Excerpts

We welcome such measures, but is the Minister aware of the case of Breck Bednar, who was groomed and then murdered? His family is campaigning not just for new clause 35 but for measures that go further. In that case, the coroner would have wanted access to Breck’s online life but, as it currently stands, new clause 35 does not provide what the family needs without a change to widen the scope of the amendment to the Online Safety Act. Will the Minister look at that? I think it will just require a tweak in some of the wording.

Sir Stephen Timms (East Ham) (Lab)

- Hansard -

Copy Link

- - Excerpts

My reading of the proposed new schedule is that it gives the Department the power to look into the bank accounts of people claiming the state pension. Am I right about that?

Sir Chris Bryant

- Hansard -

Copy Link

- - Excerpts

But it does include the state pension, doesn’t it?

Sir Chris Bryant

- Hansard -

Copy Link

- - Excerpts

Pensions?

Sir Chris Bryant

- Hansard -

Copy Link

- - Excerpts

The House of Commons Library makes it absolutely clear that the Bill, if taken forward in the way that the Government are proposing at the moment, does allow the Government to look at people in receipt of state pensions. That is the case, is it not?

Mr David Davis (Haltemprice and Howden) (Con)

- View Speech - Hansard -

Copy Link

- - Excerpts

I think everybody in the House understands the importance of getting this right. We all want to stop fraud in the state system. That being said, this is the only time that I am aware of where the state seeks the right to put people under surveillance without prior suspicion, and therefore such a power has to be restricted very carefully indeed. As we are not going to have time to debate this properly today, is my right hon. Friend open to having further discussion on this issue when the Bill goes to the Lords, so that we can seek further restrictions? I do not mean to undermine the effectiveness of the action; I just want to make it more targeted.

Sir Stephen Timms

- Hansard -

Copy Link

- - Excerpts

Can the Minister give us an example of the circumstances in which the Department would need to look into the bank accounts of people claiming state pensions in order to tackle the fraud problem? Why is the state pension within the scope of this amendment?

John Penrose (Weston-super-Mare) (Con)

- Hansard -

Copy Link

- - Excerpts

rose—

John Penrose

- Hansard -

Copy Link

- - Excerpts

The Minister is very kind. I just wanted to pick up on his last point about smart data. He is right to say that the provisions are incredibly important and potentially extremely valuable to the economy. Can he just clarify a couple of points? I want to be clear on Government new clause 27 about interface bodies. Does that apply to the kinds of new data standards that will be required under smart data? If it does, can he please clarify how he will make sure that we do not end up with multiple different standards for each sector of our economy? It is absolutely in everybody’s interests that the standards are interoperable and, to the greatest possible extent, common between sectors so that they can talk to each other?

Madam Deputy Speaker (Dame Rosie Winterton)

- Hansard -

Copy Link

- - Excerpts

I call the shadow Minister.

Mr Deputy Speaker (Sir Roger Gale)

- Hansard -

Copy Link

- - Excerpts

With the leave of the House, I call the Minister to wind up the debate.

Sir Chris Bryant

- Hansard -

Copy Link

- - Excerpts

But the Minister has already indicated that, basically, he will come forward with exactly the same list as is in the legislation that the Government are amending. All that is happening is that, in the Bill, the Information Commissioner will be doing what the Government or the House could be doing, and this is the one area where the Government disagree with the Information Commissioner.

Sir Stephen Timms

- Hansard -

Copy Link

- - Excerpts

My understanding was that the level of fraud among state pension claims was indeed extremely small. The Minister said earlier that the Government should take powers only where they are absolutely necessary; I think he is now saying that they are not necessary in the case of people claiming a state pension. Is he confident that that bit of this power—to look into the bank account of anybody claiming a state pension—is absolutely necessary?

Sir Chris Bryant

- Hansard -

Copy Link

- - Excerpts

The trouble is that this is not about amending. The Government describe the relevant benefits in part 5 of proposed new schedule 3B, within new schedule 1, which is clear that pensions are included. The Minister has effectively said at the Dispatch Box that the Government do not need to tackle fraud in relation to pensions; perhaps it would be a good idea for us to all sit down and have a meeting to work out a more sensible set of measures to tackle fraud where it is necessary, rather than giving unending powers to the Government.

Mr Deputy Speaker (Sir Roger Gale)

- View Speech - Hansard -

Copy Link

- - Excerpts

For the benefit of all Members, we are before the knife, so we will have to go through a sequence of procedures. It would help me, the Clerk and the Minister if we had a degree of silence. This will take a little time, and we need to be able to concentrate.

New Clause 48

Processing of personal data revealing political opinions

“(1) Schedule 1 to the Data Protection Act 2018 (special categories of personal data) is amended in accordance with subsections (2) to (5).

(2) After paragraph 21 insert—

‘Democratic engagement

21A (1) This condition is met where—

(a) the personal data processed is personal data revealing political opinions,

(b) the data subject is aged 14 or over, and

(c) the processing falls within sub-paragraph (2),

subject to the exceptions in sub-paragraphs (3) and (4).

(2) Processing falls within this sub-paragraph if—

(a) the processing—

(i) is carried out by an elected representative or a person acting with the authority of such a representative, and

(ii) is necessary for the purposes of discharging the elected representative’s functions or for the purposes of the elected representative’s democratic engagement activities,

(b) the processing—

(i) is carried out by a registered political party, and

(ii) is necessary for the purposes of the party’s election activities or democratic engagement activities,

(c) the processing—

(i) is carried out by a candidate for election as an elected representative or a person acting with the authority of such a candidate, and

(ii) is necessary for the purposes of the candidate’s campaign for election,

(d) the processing—

(i) is carried out by a permitted participant in relation to a referendum or a person acting with the authority of such a person, and

(ii) is necessary for the purposes of the permitted participant’s campaigning in connection with the referendum, or

(e) the processing—

(i) is carried out by an accredited campaigner in relation to a recall petition or a person acting with the authority of such a person, and

(ii) is necessary for the purposes of the accredited campaigner’s campaigning in connection with the recall petition.

(3) Processing does not meet the condition in sub-paragraph (1) if it is likely to cause substantial damage or substantial distress to an individual.

(4) Processing does not meet the condition in sub-paragraph (1) if—

(a) an individual who is the data subject (or one of the data subjects) has given notice in writing to the controller requiring the controller not to process personal data in respect of which the individual is the data subject (and has not given notice in writing withdrawing that requirement),

(b) the notice gave the controller a reasonable period in which to stop processing such data, and

(c) that period has ended.

(5) For the purposes of sub-paragraph (2)(a) and (b)—

(a) “democratic engagement activities” means activities whose purpose is to support or promote democratic engagement;

(b) “democratic engagement” means engagement by the public, a section of the public or a particular person with, or with an aspect of, an electoral system or other democratic process in the United Kingdom, either generally or in connection with a particular matter, whether by participating in the system or process or engaging with it in another way;

(c) examples of democratic engagement activities include activities whose purpose is—

(i) to promote the registration of individuals as electors;

(ii) to increase the number of electors participating in elections for elected representatives, referendums or processes for recall petitions in which they are entitled to participate;

(iii) to support an elected representative or registered political party in discharging functions, or carrying on other activities, described in sub-paragraph (2)(a) or (b);

(iv) to support a person to become a candidate for election as an elected representative;

(v) to support a campaign or campaigning referred to in sub-paragraph (2)(c), (d) or (e);

(vi) to raise funds to support activities whose purpose is described in sub-paragraphs (i) to (v);

(d) examples of activities that may be democratic engagement activities include—

(i) gathering opinions, whether by carrying out a survey or by other means;

(ii) communicating with electors.

(6) In this paragraph—

“accredited campaigner” has the meaning given in Part 5 of Schedule 3 to the Recall of MPs Act 2015;

“candidate” , in relation to election as an elected representative, has the meaning given by the provision listed in the relevant entry in the second column of the table in sub-paragraph (7);

“elected representative” means a person listed in the first column of the table in sub-paragraph (7) and see also sub-paragraphs (8) to (10);

“election activities” , in relation to a registered political party, means—

(a) campaigning in connection with an election for an elected representative, and

(b) activities whose purpose is to enhance the standing of the party, or of a candidate standing for election in its name, with electors;

“elector” means a person who is entitled to vote in an election for an elected representative or in a referendum;

“permitted participant” has the same meaning as in Part 7 of the Political Parties, Elections and Referendums Act 2000 (referendums) (see section 105 of that Act);

“recall petition” has the same meaning as in the Recall of MPs Act 2015 (see section 1(2) of that Act);

“referendum” means a referendum or other poll held on one or more questions specified in, or in accordance with, an enactment;

“registered political party” means a person or organisation included in a register maintained under section 23 of the Political Parties, Elections and Referendums Act 2000;

“successful” , in relation to a recall petition, has the same meaning as in the Recall of MPs Act 2015 (see section 14 of that Act).

(7) This is the table referred to in the definitions of “candidate” and “elected representative” in sub-paragraph (6)—

Elected representative	Candidate for election as an elected representative
member of the House of Commons	section 118A of the Representation of the People Act 1983
a member of the Senedd	article 84(2) of the National Assembly for Wales (Representation of the People) Order 2007 (S.I. 2007/236)
a member of the Scottish Parliament	article 80(1) of the Scottish Parliament (Elections etc) Order 2015 (S.S.I. 2015/425)
a member of the Northern Ireland Assembly	section 118A of the Representation of the People Act 1983, as applied by the Northern Ireland Assembly (Elections) Order 2001 (S.I. 2001/2599)
an elected member of a local authority within the meaning of section 270(1) of the Local Government Act 1972, namely— (i) in England, a county council, a district council, a London borough council or a parish council; (ii) in Wales, a county council, a county borough council or a community council;	section 118A of the Representation of the People Act 1983
an elected mayor of a local authority within the meaning of Part 1A or 2 of the Local Government Act 2000	section 118A of the Representation of the People Act 1983, as applied by the Local Authorities (Mayoral Elections) (England and Wales) Regulations 2007 (S.I. 2007/1024)
a mayor for the area of a combined authority established under section 103 of the Local Democracy, Economic Development and Construction Act 2009	section 118A of the Representation of the People Act 1983, as applied by the Combined Authorities (Mayoral Elections) Order 2017 (S.I. 2017/67)
a mayor for the area of a combined county authority established under section 9 of the Levelling-up and Regeneration Act 2023	section 118A of the Representation of the People Act 1983, as applied by the Combined Authorities (Mayoral Elections) Order 2017 (S.I. 2017/67)
the Mayor of London or an elected member of the London Assembly	section 118A of the Representation of the People Act 1983
an elected member of the Common Council of the City of London	section 118A of the Representation of the People Act 1983
an elected member of the Council of the Isles of Scilly	section 118A of the Representation of the People Act 1983
an elected member of a council constituted under section 2 of the Local Government etc (Scotland) Act 1994	section 118A of the Representation of the People Act 1983
an elected member of a district council within the meaning of the Local Government Act (Northern Ireland) 1972 (c. 9 (N.I.))	section 130(3A) of the Electoral Law Act (Northern Ireland) 1962 (c. 14 (N.I.))
(n)a police and crime commissioner	article 3 of the Police and Crime Commissioner Elections Order 2012 (S.I. 2012/1917)

(8) For the purposes of the definition of “elected representative” in sub-paragraph (6), a person who is—

(a) a member of the House of Commons immediately before Parliament is dissolved,

(b) a member of the Senedd immediately before Senedd Cymru is dissolved,

(c) a member of the Scottish Parliament immediately before that Parliament is dissolved, or

(d) a member of the Northern Ireland Assembly immediately before that Assembly is dissolved,

is to be treated as if the person were such a member until the end of the period of 30 days beginning with the day after the day on which the subsequent general election in relation to that Parliament or Assembly is held.

(9) For the purposes of the definition of “elected representative” in sub-paragraph (6), where a member of the House of Commons’s seat becomes vacant as a result of a successful recall petition, that person is to be treated as if they were a member of the House of Commons until the end of the period of 30 days beginning with the day after—

(a) the day on which the resulting by-election is held, or

(b) if earlier, the day on which the next general election in relation to Parliament is held.

(10) For the purposes of the definition of “elected representative” in sub-paragraph (6), a person who is an elected member of the Common Council of the City of London and whose term of office comes to an end at the end of the day preceding the annual Wardmotes is to be treated as if the person were such a member until the end of the fourth day after the day on which those Wardmotes are held.’

(3) Omit paragraph 22 and the italic heading before it.

(4) In paragraph 23 (elected representatives responding to requests)—

(a) leave out sub-paragraphs (3) to (5), and

(b) at the end insert—

‘(6) In this paragraph, “elected representative” has the same meaning as in paragraph 21A.’

(5) In paragraph 24(3) (definition of ‘elected representative’), for ‘23’ substitute ‘21A’.

(6) In section 205(2) of the 2018 Act (general interpretation: periods of time), in paragraph (i), for ‘paragraph 23(4) and (5)’ substitute ‘paragraph 21A(8) to (10)’.”—(Sir John Whittingdale.)

This new Clause inserts into Schedule 1 to the Data Protection Act 2018 (conditions for processing of special categories of personal data) a condition relating to processing by elected representatives, registered political parties and others of information about an individual’s political opinions for the purposes of democratic engagement activities and campaigning.

Brought up, read the First and Second time, and added to the Bill.

New Clause 7

Searches in response to data subjects’ requests

“(1) In Article 15 of the UK GDPR (right of access by the data subject)—

(a) after paragraph 1 insert—

‘1A. Under paragraph 1, the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that paragraph.’, and

(b) in paragraph 3, after ‘processing’ insert ‘to which the data subject is entitled under paragraph 1’.

(2) The 2018 Act is amended in accordance with subsections (3) and (4).

(3) In section 45 (law enforcement processing: right of access by the data subject), after subsection (2) insert—

‘(2A) Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.’

(4) In section 94 (intelligence services processing: right of access by the data subject), after subsection (2) insert—

‘(2ZA) Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.’

(5) The amendments made by this section are to be treated as having come into force on 1 January 2024.”—(Sir John Whittingdale.)

This new clause confirms that, in responding to subject access requests, controllers are only required to undertake reasonable and proportionate searches for personal data and other information.

Brought up, read the First and Second time, and added to the Bill.

New Clause 8

Notices from the Information Commissioner

“(1) The 2018 Act is amended in accordance with subsections (2) and (3).

(2) Omit section 141 (notices from the Commissioner).

(3) After that section insert—

‘141A Notices from the Commissioner

(1) This section applies in relation to a notice authorised or required by this Act to be given to a person by the Commissioner.

(2) The notice may be given to the person by—

(a) delivering it by hand to a relevant individual,

(b) leaving it at the person’s proper address,

(c) sending it by post to the person at that address, or

(d) sending it by email to the person’s email address.

(3) A “relevant individual” means—

(a) in the case of a notice to an individual, that individual;

(b) in the case of a notice to a body corporate (other than a partnership), an officer of that body;

(c) in the case of a notice to a partnership, a partner in the partnership or a person who has the control or management of the partnership business;

(d) in the case of a notice to an unincorporated body (other than a partnership), a member of its governing body.

(4) For the purposes of subsection (2)(b) and (c), and section 7 of the Interpretation Act 1978 (services of documents by post) in its application to those provisions, a person’s proper address is—

(a) in a case where the person has specified an address as one at which the person, or someone acting on the person’s behalf, will accept service of notices or other documents, that address;

(b) in any other case, the address determined in accordance with subsection (5).

(5) The address is—

(a) in a case where the person is a body corporate with a registered office in the United Kingdom, that office;

(b) in a case where paragraph (a) does not apply and the person is a body corporate, partnership or unincorporated body with a principal office in the United Kingdom, that office;

(c) in any other case, an address in the United Kingdom at which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of the person.

(6) A person’s email address is—

(a) an email address published for the time being by that person as an address for contacting that person, or

(b) if there is no such published address, an email address by means of which the Commissioner believes, on reasonable grounds, that the notice will come to the attention of that person.

(7) A notice sent by email is treated as given 48 hours after it was sent, unless the contrary is proved.

(8) In this section “officer”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body.

(9) This section does not limit other lawful means of giving a notice.’

(4) In Schedule 2 to the Electronic Identification and Trust Services for Electronic Transactions Regulations 2016 (S.I. 2016/696) (Commissioner’s enforcement powers), in paragraph 1(b), for ‘141’ substitute ‘141A’.”—(Sir John Whittingdale.)

This amendment adjusts the procedure by which notices can be given by the Information Commissioner under the Data Protection Act 2018. In particular, it enables the Information Commissioner to give notices by email without obtaining the consent of the recipient to use that mode of delivery.

Brought up, read the First and Second time, and added to the Bill.

New Clause 9

Court procedure in connection with subject access requests

“(1) The Data Protection Act 2018 is amended as follows.

(2) For the italic heading before section 180 substitute—

‘Jurisdiction and court procedure’.

(3) After section 180 insert—

‘180A Procedure in connection with subject access requests

(1) This section applies where a court is required to determine whether a data subject is entitled to information by virtue of a right under—

(a) Article 15 of the UK GDPR (right of access by the data subject);

(b) Article 20 of the UK GDPR (right to data portability);

(c) section 45 of this Act (law enforcement processing: right of access by the data subject);

(d) section 94 of this Act (intelligence services processing: right of access by the data subject).

(2) The court may require the controller to make available for inspection by the court so much of the information as is available to the controller.

(3) But, unless and until the question in subsection (1) has been determined in the data subject’s favour, the court may not require the information to be disclosed to the data subject or the data subject’s representatives, whether by discovery (or, in Scotland, recovery) or otherwise.

(4) Where the question in subsection (1) relates to a right under a provision listed in subsection (1)(a), (c) or (d), this section does not confer power on the court to require the controller to carry out a search for information that is more extensive than the reasonable and proportionate search required by that provision.’”—(Sir John Whittingdale.)

This new clause makes provision about courts’ powers to require information to be provided to them, and to a data subject, when determining whether a data subject is entitled to information under certain provisions of the data protection legislation.

Brought up, read the First and Second time, and added to the Bill.

New Clause 10

Approval of a supplementary code

“(1) This section applies to a supplementary code whose content is for the time being determined by a person other than the Secretary of State.

(2) The Secretary of State must approve the supplementary code if—

(a) the code meets the conditions set out in the DVS trust framework (so far as relevant),

(b) an application for approval of the code is made which complies with any requirements imposed by a determination under section (Applications for approval and re-approval), and

(c) the applicant pays any fee required to be paid by a determination under section (Fees for approval, re-approval and continued approval)(1).

(3) The Secretary of State must notify an applicant in writing of the outcome of an application for approval.

(4) The Secretary of State may not otherwise approve a supplementary code.

(5) In this Part, an “approved supplementary code” means a supplementary code for the time being approved under this section.

(6) For when a code ceases (or may cease) to be approved under this section, see sections (Change to conditions for approval or designation), (Revision of a recognised supplementary code) and (Request for withdrawal of approval).”—(Sir John Whittingdale.)

This amendment sets out when a supplementary code of someone other than the Secretary of State must be approved by the Secretary of State.

Brought up, read the First and Second time, and added to the Bill.

New Clause 11

Designation of a supplementary code

“(1) This section applies to a supplementary code whose content is for the time being determined by the Secretary of State.

(2) If the Secretary of State determines that the supplementary code meets the conditions set out in the DVS trust framework (so far as relevant), the Secretary of State may designate the code as one which complies with the conditions.

(3) In this Part, a ‘designated supplementary code’ means a supplementary code for the time being designated under this section.

(4) For when a code ceases (or may cease) to be designated under this section, see sections (Change to conditions for approval or designation), (Revision of a recognised supplementary code) and (Removal of designation).”—(Sir John Whittingdale.)

This enables the Secretary of State to designate a supplementary code of the Secretary of State as one which complies with the conditions set out in the DVS trust framework.

Brought up, read the First and Second time, and added to the Bill.

New Clause 12

List of recognised supplementary codes

“(1) The Secretary of State must—

(a) maintain a list of recognised supplementary codes, and

(b) make the list publicly available.

(2) For the purposes of this Part, each of the following is a ‘recognised supplementary code’—

(a) an approved supplementary code, and

(b) a designated supplementary code.”—(Sir John Whittingdale.)

This amendment places the Secretary of State under a duty to publish, and keep up to date, a list of supplementary codes that are designated or approved.

Brought up, read the First and Second time, and added to the Bill.

New Clause 13

Change to conditions for approval or designation

“(1) This section applies if the Secretary of State revises the DVS trust framework so as to change the conditions which must be met for the approval or designation of a supplementary code.

(2) An approved supplementary code which is affected by the change ceases to be an approved supplementary code at the end of the relevant period unless an application for re-approval of the code is made within that period.

(3) Pending determination of an application for re-approval the supplementary code remains an approved supplementary code.

(4) Before the end of the relevant period the Secretary of State must—

(a) review each designated supplementary code which is affected by the change (if any), and

(b) determine whether it meets the conditions as changed.

(5) If, on a review under subsection (4), the Secretary of State determines that a designated supplementary code does not meet the conditions as changed, the code ceases to be a designated supplementary code at the end of the relevant period.

(6) A supplementary code is affected by a change if the change alters, or adds, a condition which is or would be relevant to the supplementary code when deciding whether to approve it under section (Approval of a supplementary code) or designate it under section (Designation of a supplementary code).

(7) In this section “the relevant period” means the period of 21 days beginning with the day on which the DVS trust framework containing the change referred to in subsection (1) comes into force.

(8) Section (Approval of a supplementary code) applies to re-approval of a supplementary code as it applies to approval of such a code.”—(Sir John Whittingdale.)

This amendment provides that when conditions for approval or designation are changed this requires re-approval of an approved supplementary code and, in the case of a designated supplementary code, a re-assessment of whether the code meets the revised conditions.

Brought up, read the First and Second time, and added to the Bill.

New Clause 14

Revision of a recognised supplementary code

“(1) If an approved supplementary code is revised—

(a) the code before and after the revision are treated as the same code for the purposes of this Part, and

(b) the code ceases to be an approved supplementary code unless subsection (2) or (4) applies.

(2) This subsection applies if the supplementary code, in its revised form, has been approved under section (Approval of a supplementary code).

(3) If subsection (2) applies the approved supplementary code, in its revised form, remains an approved supplementary code.

(4) This subsection applies for so long as—

(a) a decision is pending under section (Approval of a supplementary code) on an application for approval of the supplementary code in its revised form, and

(b) the revisions to the code have not taken effect.

(5) If subsection (4) applies the supplementary code, in its unrevised form, remains an approved supplementary code.

(6) The Secretary of State may revise a designated supplementary code only if the Secretary of State is satisfied that the code, in its revised form, meets the conditions set out in the DVS trust framework (so far as relevant).

(7) If a designated supplementary code is revised, the code before and after the revision are treated as the same code for the purposes of this Part.”—(Sir John Whittingdale.)

This amendment sets out the consequences where there are changes to a recognised supplementary code and, in particular, what needs to be done for the code to remain a recognised supplementary code.

Brought up, read the First and Second time, and added to the Bill.

New Clause 15

Applications for approval and re-approval

“(1) The Secretary of State may determine—

(a) the form of an application for approval or re-approval under section (Approval of a supplementary code),

(b) the information to be contained in or provided with the application,

(c) the documents to be provided with the application,

(d) the manner in which the application is to be submitted, and

(e) who may make the application.

(2) A determination may make different provision for different purposes.

(3) The Secretary of State must publish a determination.

(4) The Secretary of State may revise a determination.

(5) If the Secretary of State revises a determination the Secretary of State must publish the determination as revised.”—(Sir John Whittingdale.)

This amendment enables the Secretary of State to determine the process for making a valid application for approval of a supplementary code.

Brought up, read the First and Second time, and added to the Bill.

New Clause 16

Fees for approval, re-approval and continued approval

“(1) The Secretary of State may determine that a person who applies for approval or re-approval of a supplementary code under section (Approval of a supplementary code) must pay a fee to the Secretary of State of an amount specified in the determination.

(2) A determination under subsection (1) may specify an amount which exceeds the administrative costs of determining the application for approval or re-approval.

(3) The Secretary of State may determine that a fee is payable to the Secretary of State, of an amount and at times specified in the determination, in connection with the continued approval of a supplementary code.

(4) A determination under subsection (3)—

(a) may specify an amount which exceeds the administrative costs associated with the continued approval of a supplementary code, and

(b) must specify, or describe, who must pay the fee.

(5) A fee payable under subsection (3) is recoverable summarily (or, in Scotland, recoverable) as a civil debt.

(6) A determination may make different provision for different purposes.

(7) The Secretary of State must publish a determination.

(8) The Secretary of State may revise a determination.

(9) If the Secretary of State revises a determination the Secretary of State must publish the determination as revised.”—(Sir John Whittingdale.)

This amendment enables the Secretary of State to determine that a fee is payable for approval/re-approval/continued approval of a supplementary code and the amount of such a fee.

Brought up, read the First and Second time, and added to the Bill.

New Clause 17

Request for withdrawal of approval

“(1) The Secretary of State must withdraw approval of a supplementary code if—

(a) the Secretary of State receives a notice requesting the withdrawal of approval of the supplementary code, and

(b) the notice complies with any requirements imposed by a determination under subsection (3).

(2) Before the day on which the approval is withdrawn, the Secretary of State must inform the person who gave the notice of when it will be withdrawn.

(3) The Secretary of State may determine—

(a) the form of a notice,

(b) the information to be contained in or provided with the notice,

(c) the documents to be provided with the notice,

(d) the manner in which the notice is to be submitted,

(e) who may give the notice.

(4) A determination may make different provision for different purposes.

(5) The Secretary of State must publish a determination.

(6) The Secretary of State may revise a determination.

(7) If the Secretary of State revises a determination the Secretary of State must publish the determination as revised.”—(Sir John Whittingdale.)

This amendment enables a supplementary code to be “de-approved”, on request.

Brought up, read the First and Second time, and added to the Bill.

New Clause 18

Removal of designation

“(1) The Secretary of State may determine to remove the designation of a supplementary code.

(2) A determination must—

(a) be published, and

(b) specify when the designation is to be removed, which must be a time after the end of the period of 21 days beginning with the day on which the determination is published.”—(Sir John Whittingdale.)

This amendment enables the Secretary of State to determine that a designated supplementary code should cease to be designated.

Brought up, read the First and Second time, and added to the Bill.

New Clause 19

Registration of additional services

“(1) Subsection (2) applies if—

(a) a person is registered in the DVS register,

(b) the person applies for their entry in the register to be amended to record additional digital verification services that the person provides in accordance with the main code,

(c) the person holds a certificate from an accredited conformity assessment body certifying that the person provides the additional services in accordance with the main code,

(d) the application complies with any requirements imposed by a determination under section 51, and

(e) the person pays any fee required to be paid by a determination under section 52(1).

(2) The Secretary of State must amend the DVS register to record that the person is also registered in respect of the additional services referred to in subsection (1).

(3) For the purposes of subsection (1)(c), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

(c) it is required to be ignored by reason of provision included in the DVS trust framework under 49(10).”—(Sir John Whittingdale.)

This amendment provides for a person to apply to add services to their entry in the DVS register and requires the Secretary of State to amend the register to record that a person is registered in respect of the additional services.

Brought up, read the First and Second time, and added to the Bill.

New Clause 20

Supplementary notes

“(1) Subsection (2) applies if—

(a) a person holds a certificate from an accredited conformity assessment body certifying that digital verification services provided by the person are provided in accordance with a recognised supplementary code,

(b) the person applies for a note about one or more of the services to which the certificate relates to be included in the entry relating to that person in the DVS register,

(c) the application complies with any requirements imposed by a determination under section 51, and

(d) the person pays any fee required to be paid by a determination under section 52(1).

(2) The Secretary of State must include a note in the entry relating to the person in the DVS register recording that the person provides, in accordance with the recognised supplementary code referred to in subsection (1), the services in respect of which the person made the application referred to in that subsection.

(3) The Secretary of State may not otherwise include a note described in subsection (2) in the DVS register.

(4) For the purposes of subsection (1)(a), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

(c) subsection (5) applies.

(5) This subsection applies if—

(a) the recognised supplementary code to which the certificate relates has been revised since the certificate was issued,

(b) the certificate was issued before the revision to the supplementary code took effect, and

(c) the supplementary code (as revised) provides—

(i) that certificates issued before the time the revision takes effect are required to be ignored, or

(ii) that such certificates are to be ignored from a date, or from the end of a period, specified in the code and that date has passed or that period has elapsed.

(6) In this Part, a note included in the DVS register in accordance with subsection (2) is referred to as a supplementary note.”—(Sir John Whittingdale.)

This amendment provides for a person to apply for a note to be included in the DVS register that they provide digital verification services in accordance with a recognised supplementary code.

Brought up, read the First and Second time, and added to the Bill.

New Clause 21

Addition of services to supplementary notes

“(1) Subsection (2) applies if—

(a) a person has a supplementary note included in the DVS register,

(b) the person applies for the note to be amended to record additional digital verification services that the person provides in accordance with a recognised supplementary code,

(c) the person holds a certificate from an accredited conformity assessment body certifying that the person provides the additional services in accordance with the recognised supplementary code referred to in paragraph (b),

(d) the application complies with any requirements imposed by a determination under section 51, and

(e) the person pays any fee required to be paid by a determination under section 52(1).

(2) The Secretary of State must amend the note to record that the person also provides the additional services referred to in subsection (1) in accordance with the recognised supplementary code referred to in that subsection.

(3) For the purposes of subsection (1)(c), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

(c) subsection (4) applies.

(4) This subsection applies if—

(a) the recognised supplementary code to which the certificate relates has been revised since the certificate was issued,

(b) the certificate was issued before the revision to the supplementary code took effect, and

(c) the supplementary code (as revised) provides—

(i) that certificates issued before the time the revision takes effect are required to be ignored, or

(ii) that such certificates are to be ignored from a date, or from the end of a period, specified in the code and that date has passed or that period has elapsed.”—(Sir John Whittingdale.)

This amendment provides for a person to add services to their supplementary note in the DVS register and requires the Secretary of State to amend the note to record that a person is registered in respect of the additional services.

Brought up, read the First and Second time, and added to the Bill.

New Clause 22

Duty to remove services from the DVS register

“(1) Where a person is registered in the DVS register in respect of digital verification services, subsection (2) applies if the person—

(a) asks for the register to be amended so that the person is no longer registered in respect of one or more of those services,

(b) ceases to provide one or more of those services, or

(c) no longer holds a certificate from an accredited conformity assessment body certifying that all of those services are provided in accordance with the main code.

(2) The Secretary of State must amend the register to record that the person is no longer registered in respect of (as the case may be)—

(a) the service or services mentioned in a request described in subsection (1)(a),

(b) the service or services which the person has ceased to provide, or

(c) the service or services for which there is no longer a certificate as described in subsection (1)(c).

(3) For the purposes of subsection (1)(c), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

(c) it is required to be ignored by reason of provision included in the DVS trust framework under section 49(10).”—(Sir John Whittingdale.)

This amendment places the Secretary of State under a duty to amend the DVS register, in certain circumstances, to record that a person is no longer registered in respect of certain services.

Brought up, read the First and Second time, and added to the Bill.

New Clause 23

Duty to remove supplementary notes from the DVS register

“(1) The Secretary of State must remove a supplementary note included in the entry in the DVS register relating to a person if—

(a) the person asks for the note to be removed,

(b) the person ceases to provide all of the digital verification services to which the note relates,

(c) the person no longer holds a certificate from an accredited conformity assessment body certifying that at least one of those digital verification services is provided in accordance with the supplementary code, or

(d) the person continues to hold a certificate described in paragraph (c) but the supplementary code is not a recognised supplementary code.

(2) For the purposes of subsection (1)(c) and (d), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

(c) subsection (3) applies.

(3) This subsection applies if—

(a) the supplementary code to which the certificate relates has been revised since the certificate was issued,

(b) the certificate was issued before the revision to the supplementary code took effect, and

(c) the supplementary code (as revised) provides—

(i) that certificates issued before the time the revision takes effect are required to be ignored, or

(ii) that such certificates are to be ignored from a date, or from the end of a period, specified in the code and that date has passed or that period has elapsed.”—(Sir John Whittingdale.)

This amendment sets out the circumstances in which the Secretary of State must remove a supplementary note from the DVS register.

Brought up, read the First and Second time, and added to the Bill.

New Clause 24

Duty to remove services from supplementary notes

“(1) Where a person has a supplementary note included in their entry in the DVS register in respect of digital verification services, subsection (2) applies if the person—

(a) asks for the register to be amended so that the note no longer records one or more of those services,

(b) ceases to provide one or more of the services recorded in the note, or

(c) no longer holds a certificate from an accredited conformity assessment body certifying that all of the services included in the note are provided in accordance with a supplementary code.

(2) The Secretary of State must amend the supplementary note so it no longer records (as the case maA24y be)—

(a) the service or services mentioned in a request described in subsection (1)(a),

(b) the service or services which the person has ceased to provide, or

(c) the service or services for which there is no longer a certificate as described in subsection (1)(c).

(3) For the purposes of subsection (1)(c), a certificate is to be ignored if—

(a) it has expired in accordance with its terms,

(b) it has been withdrawn by the body that issued it, or

(c) subsection (4) applies.

(4) This subsection applies if—

(a) the supplementary code to which the certificate relates has been revised since the certificate was issued,

(b) the certificate was issued before the revision to the supplementary code took effect, and

(c) the supplementary code (as revised) provides—

(i) that certificates issued before the time the revision takes effect are required to be ignored, or

(ii) that such certificates are to be ignored from a date, or from the end of a period, specified in the code and that date has passed or that period has elapsed.”—(Sir John Whittingdale.)

This amendment places the Secretary of State under a duty to amend a supplementary note on the DVS register relating to a person, in certain circumstances, to remove reference to certain services from the note.

Brought up, read the First and Second time, and added to the Bill.

New Clause 25

Index of defined terms for Part 2

“The Table below lists provisions that define or otherwise explain terms defined for the purposes of this Part of this Act.

Term	Provision
accredited conformity assessment body	section 50(7)
approved supplementary code	section (Approval of a supplementary code)(6)
designated supplementary code	section (Designation of a supplementary code)(3)
digital verification services	section 48(2)
the DVS register	section 50(2)
the DVS trust framework	section 49(2)(a)
the main code	section 49(2)(b)
recognised supplementary code	section (List of recognised supplementary codes)(2)
supplementary code	section 49(2)(c)
supplementary note	section (Supplementary notes)(6)”

—(Sir John Whittingdale.)

This amendment provides an index of terms which are defined in Part 2.

Brought up, read the First and Second time, and added to the Bill.

New Clause 26

Powers relating to verification of identity or status

“(1) In section 15 of the Immigration, Asylum and Nationality Act 2006 (penalty for employing a person subject to immigration control), after subsection (7) insert—

“(8) An order under subsection (3) containing provision described in subsection (7)(a), (b) or (c) may, in particular—

(a) specify a document generated by a DVS-registered person or a DVS-registered person of a specified description;

(b) specify a document which was provided to such a person in order to generate such a document;

(c) specify steps involving the use of services provided by such a person.

(9) In subsection (8), “DVS-registered person” means a person who is registered in the DVS register maintained under Part 2 of the Data Protection and Digital Information Act 2024 (“the DVS register”).

(10) An order under subsection (3) which specifies a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to specified services (see section (Supplementary notes) of the Data Protection and Digital Information Act 2024).”

(2) In section 34 of the Immigration Act 2014 (requirements which may be prescribed for the purposes of provisions about occupying premises under a residential tenancy agreement)—

(a) in subsection (1)—

(i) in paragraph (a), after “occupiers” insert “, a DVS-registered person or a DVS-registered person of a prescribed description”,

(ii) in paragraph (b), after “occupiers” insert “, a DVS-registered person or a DVS-registered person of a prescribed description”, and

(iii) in paragraph (c), at the end insert “, including steps involving the use of services provided by a DVS-registered person or a DVS-registered person of a prescribed description”, and

(b) after that subsection insert—

“(1A) An order prescribing requirements for the purposes of this Chapter which contains provision described in subsection (1)(a) or (b) may, in particular—

(a) prescribe a document generated by a DVS-registered person or a DVS-registered person of a prescribed description;

(b) prescribe a document which was provided to such a person in order to generate such a document.

(1B) In subsections (1) and (1A), “DVS-registered person” means a person who is registered in the DVS register maintained under Part 2 of the Data Protection and Digital Information Act 2024 (“the DVS register”).

(1C) An order prescribing requirements for the purposes of this Chapter which prescribes a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section (Supplementary notes) of the Data Protection and Digital Information Act 2024).”

(3) In Schedule 6 to the Immigration Act 2016 (illegal working compliance orders etc), after paragraph 5 insert—

“Prescribed checks and documents

5A (1) Regulations under paragraph 5(6)(b) or (c) may, in particular—

(a) prescribe checks carried out using services provided by a DVS-registered person or a DVS-registered person of a prescribed description;

(b) prescribe documents generated by such a person;

(c) prescribe documents which were provided to such a person in order to generate such documents.

(2) In sub-paragraph (1), “DVS-registered person” means a person who is registered in the DVS register maintained under Part 2 of the Data Protection and Digital Information Act 2024 (“the DVS register”).

(3) Regulations under paragraph 5(6)(b) or (c) which prescribe a description of DVS-registered person may do so by, for example, describing a DVS-registered person whose entry in the DVS register includes a note relating to prescribed services (see section (Supplementary notes) of the Data Protection and Digital Information Act 2024).””—(Sir John Whittingdale.)

This amendment contains amendments of powers to make subordinate legislation so they can be exercised so as to make provision by reference to persons registered in the DVS register established under Part 2 of the Bill.

Brought up, read the First and Second time, and added to the Bill.

New Clause 27

Interface bodies

“(1) This section is about the provision that regulations under section 66 or 68 may (among other things) contain about bodies with one or more of the following tasks—

(a) establishing a facility or service used, or capable of being used, for providing, publishing or otherwise processing customer data or business data or for taking action described in section 66(3) (an “interface”);

(b) setting standards (“interface standards”), or making other arrangements (“interface arrangements”), for use by other persons when establishing, maintaining or managing an interface;

(c) maintaining or managing an interface, interface standards or interface arrangements.

(2) Such bodies are referred to in this Part as “interface bodies”.

(3) The regulations may—

(a) require a data holder, an authorised person or a third party recipient to set up an interface body;

(b) make provision about the type of body to be set up.

(4) In relation to an interface body (whether or not it is required to be set up by regulations under section 66 or 68), the regulations may—

(a) make provision about the body’s composition and governance;

(b) make provision requiring a data holder, an authorised person or a third party recipient to provide, or arrange for, assistance for the body;

(c) impose other requirements relating to the body on a person required to set it up or to provide, or arrange for, assistance for the body;

(d) make provision requiring the body to carry on all or part of a task described in subsection (1);

(e) make provision requiring the body to do other things in connection with its interface, interface standards or interface arrangements;

(f) make provision about how the body carries out its functions (such as, for example, provision about the body’s objectives or matters to be taken into account by the body);

(g) confer powers on the body for the purpose of monitoring use of its interface, interface standards or interface arrangements (“monitoring powers”) (and see section 71 for provision about enforcement of requirements imposed in exercise of those powers);

(h) make provision for the body to arrange for its monitoring powers to be exercised by another person;

(i) make provision about the rights of persons affected by the exercise of the body’s functions under the regulations, including (among other things)—

(i) provision about the review of decisions made in exercise of those functions;

(ii) provision about appeals to a court or tribunal;

(j) make provision about complaints, including provision requiring the body to implement procedures for the handling of complaints;

(k) make provision enabling or requiring the body to publish, or provide to a specified person, specified documents or information relating to its interface, interface standards or interface arrangements;

(l) make provision enabling or requiring the body to produce guidance about how it proposes to exercise its functions under the regulations, to publish the guidance and to provide copies to specified persons.

(5) The monitoring powers that may be conferred on an interface body include power to require the provision of documents or information (but such powers are subject to the restrictions in section 72 as well as any restrictions included in the regulations).

(6) Examples of facilities or services referred to in subsection (1) include dashboard services, other electronic communications services and application programming interfaces.

(7) In subsection (4)(b) and (c), the references to assistance include actual or contingent financial assistance (such as, for example, a grant, loan, guarantee or indemnity or buying a company’s share capital).”—(Sir John Whittingdale.)

This new clause enables regulations under Part 3 to make provision about bodies providing facilities or services used for providing, publishing or processing customer data or business data, or setting standards or making other arrangements in connection with such facilities or services.

Brought up, read the First and Second time, and added to the Bill.

New Clause 28

The FCA and financial services interfaces

“(1) The Treasury may by regulations make provision enabling or requiring the Financial Conduct Authority (“the FCA”) to make rules—

(a) requiring financial services providers described in the regulations to use a prescribed interface, or prescribed interface standards or interface arrangements, when providing or receiving customer data or business data which is required to be provided by or to the financial services provider by data regulations;

(b) requiring persons described in the regulations to use a prescribed interface, or prescribed interface standards or interface arrangements, when the person, in the course of a business, receives, from a financial services provider, customer data or business data which is required to be provided to the person by data regulations;

(c) imposing interface-related requirements on a description of person falling within subsection (2),

and such rules are referred to in this Part as “FCA interface rules”.

(2) The following persons fall within this subsection—

(a) an interface body linked to the financial services sector on which requirements are imposed by regulations made in reliance on section (Interface bodies);

(b) a person required by regulations made in reliance on section (Interface bodies) to set up an interface body linked to the financial services sector;

(c) a person who uses an interface, interface standards or interface arrangements linked to the financial services sector or who is required to do so by data regulations or rules made by virtue of regulations under subsection (1)(a) or (b).

(3) For the purposes of this section, requirements are interface-related if they relate to—

(a) the composition, governance or activities of an interface body linked to the financial services sector,

(b) an interface, interface standards or interface arrangements linked to the financial services sector, or

(c) the use of such an interface, such interface standards or such interface arrangements.

(4) For the purposes of this section—

(a) an interface body is linked to the financial services sector to the extent that its interface, interface standards or interface arrangements are linked to the financial service sector;

(b) interfaces, interface standards and interface arrangements are linked to the financial services sector to the extent that they are used, or intended to be used, by financial services providers (whether or not they are used, or intended to be used, by other persons).

(5) The Treasury may by regulations make provision enabling or requiring the FCA to impose requirements on a person to whom FCA interface rules apply (referred to in this Part as “FCA additional requirements”) where the FCA considers it appropriate to impose the requirement—

(a) in response to a failure, or likely failure, by the person to comply with an FCA interface rule or FCA additional requirement, or

(b) in order to advance a purpose which the FCA is required to advance when exercising functions conferred by regulations under this section (see section (The FCA and financial services interfaces: supplementary)(3)(a)).

(6) Regulations under subsection (5) may, for example, provide for the FCA to impose requirements by giving a notice or direction.

(7) The restrictions in section 72 apply in connection with FCA interface rules and FCA additional requirements as they apply in connection with regulations under this Part.

(8) In section 72 as so applied—

(a) the references in subsections (1)(b) and (8) to an enforcer include the FCA, and

(b) the references in subsections (3) and (4) to data regulations include FCA interface rules and FCA additional requirements.

(9) In this section—

“financial services provider” means a person providing financial services;

“prescribed” means prescribed in FCA interface rules.”—(Sir John Whittingdale.)

This new clause and new clause NC29 enable the Treasury, by regulations, to confer powers on the Financial Conduct Authority to impose requirements (by means of rules or otherwise) on interface bodies used by the financial services sector and on persons participating in, or using facilities and services provided by, such bodies.

Brought up, read the First and Second time, and added to the Bill.

New Clause 29

The FCA and financial services interfaces: supplementary

“(1) This section is about provision that regulations under section (The FCA and financial services interfaces) may or must (among other things) contain.

(2) The regulations—

(a) may enable or require the FCA to impose interface-related requirements that could be imposed by regulations made in reliance on section (Interface bodies)(4) or (5), but

(b) may not enable or require the FCA to require a person to set up an interface body.

(3) The regulations must—

(a) require the FCA, so far as is reasonably possible, to exercise functions conferred by the regulations in a manner which is compatible with, or which advances, one or more specified purposes;

(b) specify one or more matters to which the FCA must have regard when exercising functions conferred by the regulations;

(c) if they enable or require the FCA to make rules, make provision about the procedure for making rules, including provision requiring such consultation with persons likely to be affected by the rules or representatives of such persons as the FCA considers appropriate.

(4) The regulations may—

(a) require the FCA to carry out an analysis of the costs and benefits that will arise if proposed rules are made or proposed changes are made to rules and make provision about what the analysis must include;

(b) require the FCA to publish rules or changes to rules and to provide copies to specified persons;

(c) make provision about the effect of rules, including provision about circumstances in which rules are void and circumstances in which a person is not to be taken to have contravened a rule;

(d) make provision enabling or requiring the FCA to modify or waive rules as they apply to a particular case;

(e) make provision about the procedure for imposing FCA additional requirements;

(f) make provision enabling or requiring the FCA to produce guidance about how it proposes to exercise its functions under the regulations, to publish the guidance and to provide copies to specified persons.

(5) The regulations may enable or require the FCA to impose the following types of requirement on a person as FCA additional requirements—

(a) a requirement to review the person’s conduct;

(b) a requirement to take remedial action;

(c) a requirement to make redress for loss or damage suffered by others as a result of the person’s conduct.

(6) The regulations may enable or require the FCA to make rules requiring a person falling within section (The FCA and financial services interfaces)(2)(b) or (c) to pay fees to an interface body for the purpose of meeting expenses incurred, or to be incurred, by such a body in performing duties, or exercising powers, imposed or conferred by regulations under this Part or by rules made by virtue of regulations under section (The FCA and financial services interfaces).

(7) Regulations made in reliance on subsection (6)—

(a) may enable rules to provide for the amount of a fee to be an amount which is intended to exceed the cost of the things in respect of which the fee is charged;

(b) must require rules to provide for the amount of a fee to be—

(i) a prescribed amount or an amount determined in accordance with the rules, or

(ii) an amount not exceeding such an amount;

(c) may enable or require rules to provide for the amount, or maximum amount, of a fee to increase at specified times and by—

(i) a prescribed amount or an amount determined in accordance with the rules, or

(ii) an amount not exceeding such an amount;

(d) if they enable rules to enable a person to determine an amount, must require rules to require the person to publish information about the amount and how it is determined;

(e) may enable or require rules to make provision about—

(i) interest on any unpaid amounts;

(ii) the recovery of unpaid amounts.

(8) In this section—

“interface-related” has the meaning given in section (The FCA and financial services interfaces);

“prescribed” means prescribed in FCA interface rules.

(9) The reference in subsection (5)(c) to making redress includes—

(a) paying interest, and

(b) providing redress in the form of a remedy or relief which could not be awarded in legal proceedings.”—(Sir John Whittingdale.)

See the explanatory statement for new clause NC28.

Brought up, read the First and Second time, and added to the Bill.

New Clause 30

The FCA and financial services interfaces: penalties and levies

“(1) Subsections (2) and (3) are about the provision that regulations made by the Treasury under this Part providing for the FCA to enforce requirements under FCA interface rules may (among other things) contain in relation to financial penalties.

(2) The regulations may require or enable the FCA—

(a) to set the amount or maximum amount of, or of an increase in, a penalty imposed in respect of failure to comply with a requirement imposed by the FCA in exercise of a power conferred by regulations under section (The FCA and financial services interfaces) (whether imposed by means of FCA interface rules or an FCA additional requirement), or

(b) to set the method for determining such an amount.

(3) Regulations made in reliance on subsection (2)—

(a) must require the FCA to produce and publish a statement of its policy with respect to the amount of the penalties;

(b) may require the policy to include specified matters;

(c) may make provision about the procedure for producing the statement;

(d) may require copies of the statement to be provided to specified persons;

(e) may require the FCA to have regard to a statement published in accordance with the regulations.

(4) The Treasury may by regulations—

(a) impose, or provide for the FCA to impose, a levy on data holders, authorised persons or third party recipients for the purpose of meeting all or part of the expenses incurred, or to be incurred, during a period by the FCA, or by a person acting on the FCA’s behalf, in performing duties, or exercising powers, imposed or conferred on the FCA by regulations under section (The FCA and financial services interfaces), and

(b) make provision about how funds raised by means of the levy must or may be used.

(5) Regulations under subsection (4) may only provide for a levy in respect of expenses of the FCA to be imposed on persons that appear to the Treasury to be capable of being directly affected by the exercise of some or all of the functions conferred on the FCA by regulations under section (The FCA and financial services interfaces).

(6) Section 75(3) and (4) apply in relation to regulations under subsection (4) of this section as they apply in relation to regulations under section 75(1).”—(Sir John Whittingdale.)

This new clause enables the Treasury, by regulations, to confer power on the Financial Conduct Authority to set the amount of certain penalties. It also enables the Treasury to impose a levy in respect of expenses incurred by that Authority.

Brought up, read the First and Second time, and added to the Bill.

New Clause 31

Liability in damages

“(1) The Secretary of State or the Treasury may by regulations provide that a person listed in subsection (2) is not liable in damages for anything done or omitted to be done in the exercise of functions conferred by regulations under this Part.

(2) Those persons are—

(a) a public authority;

(b) a member, officer or member of staff of a public authority;

(c) a person who could be held vicariously liable for things done or omitted by a public authority.

(3) Regulations under this section may not—

(a) make provision removing liability for an act or omission which is shown to have been in bad faith, or

(b) make provision so as to prevent an award of damages made in respect of an act or omission on the ground that the act or omission was unlawful as a result of section 6(1) of the Human Rights Act 1998.”— (Sir John Whittingdale.)

This new clause enables regulations under Part 3 to provide that certain persons are not liable in damages when exercising functions under such regulations.

Brought up, read the First and Second time, and added to the Bill.

New Clause 32

Other data provision

“(1) This section is about cases in which subordinate legislation other than regulations under this Part contains provision described in section 66(1) to (3) or 68(1) to (2A) (“other data provision”).

(2) The regulation-making powers under this Part may be exercised so as to make, in connection with the other data provision, any provision that they could be exercised to make as part of, or in connection with, provision made under section 66(1) to (3) or 68(1) to (2A) that is equivalent to the other data provision.

(3) In this Part, references to “data regulations” include regulations made in reliance on subsection (2) to the extent that they make provision described in sections 66 to 70 or (Interface bodies).

(4) In this section, “subordinate legislation” has the same meaning as in the Interpretation Act 1978 (see section 21 of that Act).”—(Sir John Whittingdale.)

This new clause enables the regulation-making powers under Part 3 to be used to supplement existing subordinate legislation which requires customer data or business data to be provided to customers and others.

Brought up, read the First and Second time, and added to the Bill.

New Clause 33

Duty to notify the Commissioner of personal data breach: time periods

“(1) In regulation 5A of the PEC Regulations (personal data breach)—

(a) in paragraph (2), after “delay” insert “and, where feasible, not later than 72 hours after having become aware of it”, and

(b) after paragraph (3) insert—

“(3A) Where notification under paragraph (2) is not made within 72 hours, it must be accompanied by reasons for the delay.”

(2) In Article 2 of Commission Regulation (EU) No 611/2013 of 24 June 2013 on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC of the European Parliament and of the Council on privacy and electronic communications (notification to the Information Commissioner)—

(a) in paragraph 2—

(i) in the first subparagraph, for the words from “no” to “feasible” substitute “without undue delay and, where feasible, not later than 72 hours after having becoming aware of it”, and

(ii) in the second subparagraph, after “shall” insert “, subject to paragraph 3,”, and

(b) for paragraph 3 substitute—

“3. To the extent that the information set out in Annex 1 is not available to be included in the notification, it may be provided in phases without undue further delay.””—(Sir John Whittingdale.)

This adjusts the period within which the Information Commissioner must be notified of a personal data breach. It also inserts a duty (into the PEC Regulations) to give reasons for not notifying within 72 hours and adjusts the duty (in Commission Regulation (EU) No 611/2013) to provide accompanying information.

Brought up, read the First and Second time, and added to the Bill.

New Clause 34

Power to require information for social security purposes

“In Schedule (Power to require information for social security purposes)—

(a) Part 1 amends the Social Security Administration Act 1992 to make provision about a power for the Secretary of State to obtain information for social security purposes;

(b) Part 2 amends the Social Security Administration (Northern Ireland) Act 1992 to make provision about a power for the Department for Communities to obtain information for such purposes;

(c) Part 3 makes related amendments of the Proceeds of Crime Act 2002.”—(Sir John Whittingdale.)

This new clause introduces a new Schedule NS1 which amends social security legislation to make provision about a new power for the Secretary of State or, in Northern Ireland, the Department for Communities, to obtain information for social security purposes.

Brought up, read the First and Second time, and added to the Bill.

New Clause 35

Retention of information by providers of internet services in connection with death of child

“(1) The Online Safety Act 2023 is amended as follows.

(2) In section 100 (power to require information)—

(a) omit subsection (7);

(b) after subsection (8) insert—

“(8A) The power to give a notice conferred by subsection (1) does not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).”

(3) In section 101 (information in connection with investigation into death of child)—

(a) before subsection (1) insert—

“(A1) Subsection (D1) applies if a senior coroner (in England and Wales), a procurator fiscal (in Scotland) or a coroner (in Northern Ireland) (“the investigating authority”)—

(a) notifies OFCOM that—

(i) they are conducting an investigation, or are due to conduct an investigation, in connection with the death of a child, and

(ii) they suspect that the child may have taken their own life, and

(b) provides OFCOM with the details in subsection (B1).

(B1) The details are—

(a) the name of the child who has died,

(b) the child’s date of birth,

(c) any email addresses used by the child (so far as the investigating authority knows), and

(d) if any regulated service has been brought to the attention of the investigating authority as being of interest in connection with the child’s death, the name of the service.

(C1) Where this subsection applies, OFCOM—

(a) must give a notice to the provider of a service within subsection (E1) requiring the provider to ensure the retention of information relating to the use of the service by the child who has died, and

(b) may give a notice to any other relevant person requiring the person to ensure the retention of information relating to the use of a service within subsection (E1) by that child.

(D1) The references in subsection (C1) to ensuring the retention of information relating to the child’s use of a service include taking all reasonable steps, without delay, to prevent the deletion of such information by the routine operation of systems or processes.

(E1) A service is within this subsection if it is—

(a) a regulated service of a kind described in regulations made by the Secretary of State, or

(b) a regulated service notified to OFCOM by the investigating authority as described in subsection (B1)(d).

(F1) A notice under subsection (C1) may require information described in that subsection to be retained only if it is information—

(a) of a kind which OFCOM have power to require under a notice under subsection (1) (see, in particular, subsection (2)(a) to (d)), or

(b) which a person might need to retain to enable the person to provide information in response to a notice under subsection (1) (if such a notice were given).

(G1) OFCOM must share with the investigating authority any information they receive in response to requirements mentioned in section 102(5A)(d) that are included in a notice under subsection (C1).”

(b) in subsection (3), for “power conferred by subsection (1) includes” substitute “powers conferred by this section include”;

(c) after subsection (5) insert—

“(5A) The powers to give a notice conferred by this section do not include power to require processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, the duty imposed by the notice is to be taken into account).”

(4) In section 102 (information notices)—

(a) in subsection (1), for “101(1)” substitute “101(C1) or (1)”;

(b) in subsection (3)—

(i) after “information notice” insert “under section 100(1) or 101(1)”,

(ii) omit “and” at the end of paragraph (c), and

(iii) after paragraph (c) insert—

“(ca) specify when the information must be provided (which may be on or by a specified date, within a specified period, or at specified intervals), and”;

(c) omit subsection (4);

(d) after subsection (5) insert—

“(5A) An information notice under section 101(C1) must—

(a) specify or describe the information to be retained,

(b) specify why OFCOM require the information to be retained,

(c) require the information to be retained for the period of one year beginning with the date of the notice,

(d) require the person to whom the notice is given—

(i) if the child to whom the notice relates used the service in question, to notify OFCOM by a specified date of steps taken to ensure the retention of information;

(ii) if the child did not use the service, or the person does not hold any information of the kind required, to notify OFCOM of that fact by a specified date, and

(e) contain information about the consequences of not complying with the notice.

(5B) If OFCOM give an information notice to a person under section 101(C1), they may, in response to information received from the investigating authority, extend the period for which the person is required to retain information by a maximum period of six months.

(5C) The power conferred by subsection (5B) is exercisable—

(a) by giving the person a notice varying the notice under section 101(C1) and stating the further period for which information must be retained and the reason for the extension;

(b) any number of times.”;

(e) after subsection (9) insert—

“(9A) OFCOM must cancel an information notice under section 101(C1) by notice to the person to whom it was given if advised by the investigating authority that the information in question no longer needs to be retained.”

(f) in subsection (10), after the definition of “information” insert—

““the investigating authority” has the same meaning as in section 101;”.

(5) In section 109 (offences in connection with information notices)—

(a) in subsection (2)(b), for “all reasonable steps” substitute “all of the steps that it was reasonable, and reasonably practicable, to take”;

(b) after subsection (6) insert—

“(6A) A person who is given an information notice under section 101(C1) commits an offence if—

(a) the person deletes or alters, or causes or permits the deletion or alteration of, any information required by the notice to be retained, and

(b) the person’s intention was to prevent the information being available, or (as the case may be) to prevent it being available in unaltered form, for the purposes of any official investigation into the death of the child to whom the notice relates.

(6B) For the purposes of subsection (6A) information has been deleted if it is irrecoverable (however that occurred).”

(6) In section 110 (senior managers’ liability: information offences)—

(a) after subsection (6) insert—

“(6A) An individual named as a senior manager of an entity commits an offence if—

(a) the entity commits an offence under section 109(6A) (deletion etc of information), and

(b) the individual has failed to take all reasonable steps to prevent that offence being committed.”;

(b) in subsection (7), for “or (6)” substitute “, (6) or (6A)”.

(7) In section 113 (penalties for information offences), in subsection (2)—

(a) for “(4) or (5)” substitute “(4), (5) or (6A)”;

(b) for “(5) or (6)” substitute “(5), (6) or (6A)”.

(8) In section 114 (co-operation and disclosure of information: overseas regulators), in subsection (7), omit the definition of “the data protection legislation”.

(9) In section 225 (Parliamentary procedure for regulations), in subsection (10), after paragraph (c) insert—

“(ca) regulations under section 101(E1)(a),”

(10) In section 236(1) (interpretation)—

(a) after the definition of “country” insert—

““the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);”;

(b) in the definition of “information notice”, for “101(1)” substitute “101(C1) or (1)”.

(11) In section 237 (index of defined terms), after the entry for “CSEA content” insert—

“the data protection legislation

section 236”.”

—(Sir John Whittingdale.)

This new clause amends the Online Safety Act 2023 to enable OFCOM to give internet service providers a notice requiring them to retain information in connection with an investigation by a coroner (or, in Scotland, procurator fiscal) into the death of a child suspected to have taken their own life. The new clause also creates related offences.

Brought up, read the First and Second time, and added to the Bill.

New Clause 36

Retention of biometric data and recordable offences

“(1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (10).

(2) In section 18A(3) (retention of material: general), after “recordable offence” insert “or recordable-equivalent offence”.

(3) Section 18E (supplementary provision) is amended in accordance with subsections (4) to (10).

(4) In subsection (1), after the definition of “recordable offence” insert—

““recordable-equivalent offence” means an offence under the law of a country or territory outside England and Wales and Northern Ireland where the act constituting the offence would constitute a recordable offence if done in England and Wales or Northern Ireland (whether or not the act constituted such an offence when the person was convicted);”.

(5) In subsection (3), in the words before paragraph (a), after “offence” insert “in England and Wales or Northern Ireland”.

(6) After subsection (5) insert—

“(5A) For the purposes of section 18A, a person is to be treated as having been convicted of an offence in a country or territory outside England and Wales and Northern Ireland if, in respect of such an offence, a court exercising jurisdiction under the law of that country or territory has made a finding equivalent to—

(a) a finding that the person is not guilty by reason of insanity, or

(b) a finding that the person is under a disability and did the act charged against the person in respect of the offence.”

(7) In subsection (6)(a)—

(a) after “convicted” insert “—

(i) ‘”, and

(b) after “offence,” insert “or

(ii) in a country or territory outside England and Wales and Northern Ireland, of a recordable-equivalent offence,”.

(8) In subsection (6)(b)—

(a) omit “of a recordable offence”, and

(b) for “a recordable offence, other than a qualifying offence” substitute “an offence, other than a qualifying offence or qualifying-equivalent offence”.

(9) In subsection (7), for “subsection (6)” substitute “this section”.

(10) After subsection (7) insert—

“(7A) In subsection (6), “qualifying-equivalent offence” means an offence under the law of a country or territory outside England and Wales and Northern Ireland where the act constituting the offence would constitute a qualifying offence if done in England and Wales or Northern Ireland (whether or not the act constituted such an offence when the person was convicted).”

(11) The amendments made by this section apply only in connection with the retention of section 18 material that is or was obtained or acquired by a law enforcement authority—

(a) on or after the commencement day, or

(b) in the period of 3 years ending immediately before the commencement day.

(12) Subsection (13) of this section applies where—

(a) at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day,

(b) at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material, and

(c) at the pre-commencement time, the law enforcement authority could have retained the material under section 18A of the Counter-Terrorism Act 2008, as it has effect taking account of the amendments made by subsections (2) to (10) of this section, if those amendments had been in force.

(13) Where this subsection applies—

(a) the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but

(b) the material may not be used in evidence against the person to whom the material relates—

(i) in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or

(ii) in criminal proceedings in any other country or territory.

(14) In this section—

“the commencement day” means the day on which this Act is passed;

“law enforcement authority” has the meaning given by section 18E(1) of the Counter-Terrorism Act 2008;

“section 18 material” has the meaning given by section 18(2) of that Act.

(15) For the purposes of this section, proceedings in relation to an offence are instituted—

(a) in England and Wales, when they are instituted for the purposes of Part 1 of the Prosecution of Offences Act 1985 (see section 15(2) of that Act);

(b) in Northern Ireland, when they are instituted for the purposes of Part 2 of the Justice (Northern Ireland) Act 2002 (see section 44(1) and (2) of that Act);

(c) in Scotland, when they are instituted for the purposes of Part 3 of the Proceeds of Crime Act 2002 (see section 151(1) and (2) of that Act).”—(Sir John Whittingdale.)

This new clause enables a law enforcement authority to retain fingerprints and DNA profiles where a person has been convicted of an offence equivalent to a recordable offence in a jurisdiction outside England and Wales and Northern Ireland.

Brought up, read the First and Second time, and added to the Bill.

New Clause 37

Retention of pseudonymised biometric data

“(1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (6).

(2) Section 18A (retention of material: general) is amended in accordance with subsections (3) to (5).

(3) In subsection (1), for “subsection (5)” substitute “subsections (4) to (9)”.

(4) In subsection (4)(a), after “relates” insert “(a “pseudonymised form”)”.

(5) After subsection (6) insert—

“(7) Section 18 material which is not a DNA sample may be retained indefinitely by a law enforcement authority if—

(a) the authority obtains or acquires the material directly or indirectly from an overseas law enforcement authority,

(b) the authority obtains or acquires the material in a form which includes information which identifies the person to whom the material relates,

(c) as soon as reasonably practicable after obtaining or acquiring the material, the authority takes the steps necessary for it to hold the material in a pseudonymised form, and

(d) having taken those steps, the law enforcement authority continues to hold the material in a pseudonymised form.

(8) In a case where section 18 material is being retained by a law enforcement authority under subsection (7), if—

(a) the law enforcement authority ceases to hold the material in a pseudonymised form, and

(b) the material relates to a person who has no previous convictions or only one exempt conviction,

the material may be retained by the law enforcement authority until the end of the retention period specified in subsection (9).

(9) The retention period is the period of 3 years beginning with the date on which the law enforcement authority first ceases to hold the material in a pseudonymised form.”

(6) In section 18E(1) (supplementary provision)—

(a) in the definition of “law enforcement authority”, for paragraph (d) substitute—

“(d) an overseas law enforcement authority;”, and

(b) after that definition insert—

““overseas law enforcement authority” means a person formed or existing under the law of a country or territory outside the United Kingdom so far as exercising functions which—

(a) correspond to those of a police force, or

(b) otherwise involve the investigation or prosecution of offences;”.

(7) The amendments made by this section apply only in connection with the retention of section 18 material that is or was obtained or acquired by a law enforcement authority—

(a) on or after the commencement day, or

(b) in the period of 3 years ending immediately before the commencement day.

(8) Subsections (9) to (12) of this section apply where, at the beginning of the commencement day, a law enforcement authority has section 18 material which it obtained or acquired in the period of 3 years ending immediately before the commencement day.

(9) Where the law enforcement authority holds the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) and (d) of the Counter-Terrorism Act 2008 as having—

(a) taken the steps necessary for it to hold the material in a pseudonymised form as soon as reasonably practicable after obtaining or acquiring the material, and

(b) continued to hold the material in a pseudonymised form until the commencement day.

(10) Where the law enforcement authority does not hold the material in a pseudonymised form at the beginning of the commencement day, the authority is to be treated for the purposes of section 18A(7)(c) of the Counter-Terrorism Act 2008 as taking the steps necessary for it to hold the material in a pseudonymised form as soon as reasonably practicable after obtaining or acquiring the material if it takes those steps on, or as soon as reasonably practicable after, the commencement day.

(11) Subsection (12) of this section applies where, at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material but—

(a) at the pre-commencement time, the law enforcement authority could have retained the material under section 18A(7) to (9) of the Counter-Terrorism Act 2008 (as inserted by this section) if those provisions had been in force, or

(b) on or after the commencement day, the law enforcement authority may retain the material under those provisions by virtue of subsection (9) or (10) of this section.

(12) Where this subsection applies—

(a) the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but

(b) the material may not be used in evidence against the person to whom the material relates—

(i) in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or

(ii) in criminal proceedings in any other country or territory.

(13) In this section—

“the commencement day” , “law enforcement authority” and “section 18 material” have the meaning given in section (Retention of biometric data and recordable offences)(14);

“instituted” , in relation to proceedings, has the meaning given in section (Retention of biometric data and recordable offences)(15);

“in a pseudonymised form” has the meaning given by section 18A(4) and (10) of the Counter-Terrorism Act 2008 (as amended or inserted by this section).”—(Sir John Whittingdale.)

This new clause enables a law enforcement authority to retain fingerprints and DNA profiles where, as soon as reasonably practicable after acquiring or obtaining them, the authority takes the steps necessary for it to hold the material in a form which does not include information which identifies the person to whom the material relates.

Brought up, read the First and Second time, and added to the Bill.

New Clause 38

Retention of biometric data from INTERPOL

“(1) Part 1 of the Counter-Terrorism Act 2008 (powers to gather and share information) is amended in accordance with subsections (2) to (4).

(2) In section 18(4) (destruction of national security material not subject to existing statutory restrictions), after “18A” insert “, 18AA”.

(3) After section 18A insert—

“18AA Retention of material from INTERPOL

(1) This section applies to section 18 material which is not a DNA sample where the law enforcement authority obtained or acquired the material as part of a request for assistance, or a notification of a threat, sent to the United Kingdom via INTERPOL’s systems.

(2) The law enforcement authority may retain the material until the National Central Bureau informs the authority that the request or notification has been cancelled or withdrawn.

(3) If the law enforcement authority is the National Central Bureau, it may retain the material until it becomes aware that the request or notification has been cancelled or withdrawn.

(4) In this section—

“INTERPOL” means the organisation called the International Criminal Police Organization - INTERPOL;

“the National Central Bureau” means the body appointed for the time being in accordance with INTERPOL’s constitution to serve as the United Kingdom’s National Central Bureau.

(5) The reference in subsection (1) to material obtained or acquired as part of a request or notification includes material obtained or acquired as part of a communication, sent to the United Kingdom via INTERPOL’s systems, correcting, updating or otherwise supplementing the request or notification.

18AB Retention of material from INTERPOL: supplementary

(1) The Secretary of State may by regulations amend section 18AA to make such changes as the Secretary of State considers appropriate in consequence of—

(a) changes to the name of the organisation which, when section 18AA was enacted, was called the International Criminal Police Organization - INTERPOL (“the organisation”),

(b) changes to arrangements made by the organisation which involve fingerprints or DNA profiles being provided to members of the organisation (whether changes to existing arrangements or changes putting in place new arrangements), or

(c) changes to the organisation’s arrangements for liaison between the organisation and its members or between its members.

(2) Regulations under this section are subject to affirmative resolution procedure.”

(4) In section 18BA(5)(a) (retention of further fingerprints), after “18A” insert “, 18AA”.

(5) Section 18AA of the Counter-Terrorism Act 2008 applies in relation to section 18 material obtained or acquired by a law enforcement authority before the commencement day (as well as material obtained or acquired on or after that day), except where the law enforcement authority was informed, or became aware, as described in subsection (2) or (3) of that section before the commencement day.

(6) Subsection (7) of this section applies where—

(a) at the beginning of the commencement day, a law enforcement authority has section 18 material,

(b) at a time before the commencement day (a “pre-commencement time”), the law enforcement authority was required by section 18(4) of the Counter-Terrorism Act 2008 to destroy the material, but

(c) at the pre-commencement time, the law enforcement authority could have retained the material under section 18AA of that Act (as inserted by this section) if it had been in force.

(7) Where this subsection applies—

(a) the law enforcement authority is to be treated as not having been required to destroy the material at the pre-commencement time, but

(b) the material may not be used in evidence against the person to whom the material relates—

(i) in criminal proceedings in England and Wales, Northern Ireland or Scotland in relation to an offence where those proceedings, or other criminal proceedings in relation to the person and the offence, were instituted before the commencement day, or

(ii) in criminal proceedings in any other country or territory.

(8) In this section—

“the commencement day” , “law enforcement authority” and “section 18 material” have the meaning given in section (Retention of biometric data and recordable offences)(14);

“instituted” , in relation to proceedings, has the meaning given in section (Retention of biometric data and recordable offences)(15).”—(Sir John Whittingdale.)

This new clause enables fingerprints and DNA profiles obtained as part of a request for assistance, or notification of a threat, from INTERPOL and held for national security purposes by a law enforcement authority to be retained until the authority is informed that the request or notification has been withdrawn or cancelled.

Brought up, read the First and Second time, and added to the Bill.

New Clause 39

National Underground Asset Register

“(1) After section 106 of the New Roads and Street Works Act 1991 insert—

“Part 3A

National Underground Asset Register: England and Wales

The register

106A National Underground Asset Register

(1) The Secretary of State must keep a register of information relating to apparatus in streets in England and Wales.

(2) The register is to be known as the National Underground Asset Register (and is referred to in this Act as “NUAR”).

(3) NUAR must be kept in such form and manner as may be prescribed.

(4) The Secretary of State must make arrangements so as to enable any person who is required, by a provision of Part 3, to enter information into NUAR to have access to NUAR for that purpose.

(5) Regulations under subsection (3) are subject to the negative procedure.

106B Access to information kept in NUAR

(1) The Secretary of State may by regulations make provision in connection with making information kept in NUAR available—

(a) under a licence, or

(b) without a licence.

(2) The regulations may (among other things)—

(a) make provision about which information, or descriptions of information, may be made available;

(b) make provision about the descriptions of person to whom information may be made available;

(c) make provision for information to be made available subject to exceptions;

(d) make provision requiring or authorising the Secretary of State to adapt, modify or obscure information before making it available;

(e) make provision authorising all information kept in NUAR to be made available to prescribed descriptions of person under prescribed conditions;

(f) make provision about the purposes for which information may be made available;

(g) make provision about the form and manner in which information may be made available.

(3) The regulations may make provision about licences under which information kept in NUAR is made available, including—

(a) provision about the form of a licence;

(b) provision about the terms and conditions of a licence;

(c) provision for information to be made available under a licence for free or for a fee;

(d) provision about the amount of the fees, including provision for the amount of a fee to be an amount which is intended to exceed the cost of the things in respect of which the fee is charged;

(e) provision about how funds raised by means of fees must or may be used, including provision for funds to be paid to persons who are required, by a provision of Part 3, to enter information into NUAR.

(4) Except as otherwise prescribed and subject to section 106G, processing of information by the Secretary of State in exercise of functions conferred by or under section 106A or this section does not breach—

(a) any obligation of confidence owed by the Secretary of State, or

(b) any other restriction on the processing of information (however imposed).

(5) Regulations under this section are subject to the affirmative procedure.

Requirements for undertakers to pay fees and provide information

106C Fees payable by undertakers in relation to NUAR

(1) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to pay fees to the Secretary of State for or in connection with the exercise by the Secretary of State of any function conferred by or under this Part.

(2) The regulations may—

(a) specify the amounts of the fees, or the maximum amounts of the fees, or

(b) provide for the amounts of the fees, or the maximum amounts of the fees, to be determined in accordance with the regulations.

(3) In making the regulations the Secretary of State must seek to secure that, so far as possible and taking one year with another, the income from fees matches the expenses incurred by the Secretary of State in, or in connection with, exercising functions conferred by or under this Part (including expenses not directly connected with the keeping of NUAR).

(4) Except where the regulations specify the amounts of the fees—

(a) the amounts of the fees must be specified by the Secretary of State in a statement, and

(b) the Secretary of State must—

(i) publish the statement, and

(ii) lay it before Parliament.

(5) Regulations under subsection (1) may make provision about—

(a) when a fee is to be paid;

(b) the manner in which a fee is to be paid;

(c) the payment of discounted fees;

(d) exceptions to requirements to pay fees;

(e) the refund of all or part of a fee which has been paid.

(6) Before making regulations under subsection (1) the Secretary of State must consult—

(a) such representatives of persons likely to be affected by the regulations as the Secretary of State considers appropriate, and

(b) such other persons as the Secretary of State considers appropriate.

(7) Subject to the following provisions of this section regulations under subsection (1) are subject to the affirmative procedure.

(8) Regulations under subsection (1) that only make provision of a kind mentioned in subsection (2) are subject to the negative procedure.

(9) But the first regulations under subsection (1) that make provision of a kind mentioned in subsection (2) are subject to the affirmative procedure.

106D Providing information for purposes of regulations under section 106C

(1) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes—

(a) assisting the Secretary of State in determining the provision that it is appropriate for regulations under section 106C(1) or a statement under section 106C(4) to make;

(b) assisting the Secretary of State in determining whether it is appropriate to make changes to such provision.

(2) The Secretary of State may by regulations make provision requiring undertakers having apparatus in a street to provide information to the Secretary of State for either or both of the following purposes—

(a) ascertaining whether a fee is payable by a person under regulations under section 106C(1);

(b) working out the amount of a fee payable by a person.

(3) Regulations under subsection (1) or (2) may require an undertaker to notify the Secretary of State of any changes to information previously provided under the regulations.

(4) Regulations under subsection (1) or (2) may make provision about—

(a) when information is to be provided (which may be at prescribed intervals);

(b) the form and manner in which information is to be provided;

(c) exceptions to requirements to provide information.

(5) Regulations under subsection (1) or (2) are subject to the negative procedure.

Monetary penalties

106E Monetary penalties

Schedule 5A makes provision about the imposition of penalties in connection with requirements imposed by regulations under sections 106C(1) and 106D(1) and (2).

Exercise of functions by third party

106F Arrangements for third party to exercise functions

(1) The Secretary of State may make arrangements for a prescribed person to exercise a relevant function of the Secretary of State.

(2) More than one person may be prescribed.

(3) Arrangements under this section may—

(a) provide for the Secretary of State to make payments to the person, and

(b) make provision as to the circumstances in which any such payments are to be repaid to the Secretary of State.

(4) In the case of the exercise of a function by a person authorised by arrangements under this section to exercise that function, any reference in this Part or in regulations under this Part to the Secretary of State in connection with that function is to be read as a reference to that person.

(5) Arrangements under this section do not prevent the Secretary of State from exercising a function to which the arrangements relate.

(6) Except as otherwise prescribed and subject to section 106G, the disclosure of information between the Secretary of State and a person in connection with the person’s entering into arrangements under this section or exercise of functions to which such arrangements relate does not breach—

(a) any obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (however imposed).

(7) Regulations under this section are subject to the affirmative procedure.

(8) In this section “relevant function” means any function of the Secretary of State conferred by or under this Part (including the function of charging or recovering fees under section 106C) other than—

(a) a power to make regulations, or

(b) a function under section 106C(4) (specifying of fees etc).

Data protection

106G Data protection

(1) A duty or power to process information that is imposed or conferred by or under this Part does not operate to require or authorise the processing of personal data that would contravene the data protection legislation (but in determining whether processing of personal data would do so, that duty or power is to be taken into account).

(2) In this section—

“the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3(9) of that Act);

“personal data” has the same meaning as in that Act (see section 3(2) of that Act).

Supplementary provisions

106H Regulations under this Part

(1) In this Part “prescribed” means prescribed by regulations made by the Secretary of State.

(2) Regulations under this Part may make—

(a) different provision for different purposes;

(b) supplementary and incidental provision.

(3) Regulations under this Part are to be made by statutory instrument.

(4) Before making regulations under this Part the Secretary of State must consult the Welsh Ministers.

(5) Where regulations under this Part are subject to “the affirmative procedure” the regulations may not be made unless a draft of the statutory instrument containing them has been laid before and approved by a resolution of each House of Parliament.

(6) Where regulations under this Part are subject to “the negative procedure” the statutory instrument containing the regulations is subject to annulment in pursuance of a resolution of either House of Parliament.

(7) Any provision that may be made in regulations under this Part subject to the negative procedure may be made in regulations subject to the affirmative procedure.

106I Interpretation

(1) In this Part the following terms have the same meaning as in Part 3—

“apparatus” (see sections 89(3) and 105(1));

“in” (in a context referring to apparatus in a street) (see section 105(1));

“street” (see section 48(1) and (2));

“undertaker” (in relation to apparatus or in a context referring to having apparatus in a street) (see sections 48(5) and 89(4)).

(2) In this Part “processing” has the same meaning as in the Data Protection Act 2018 (see section 3(4) of that Act) and “process” is to be read accordingly.”

(2) In section 167 of the New Roads and Street Works Act 1991 (Crown application)—

(a) after subsection (4) insert—

“(4A) The provisions of Part 3A of this Act (National Underground Asset Register: England and Wales) bind the Crown.”;

(b) in subsection (5), for “(4)” substitute “(4) or (4A)”.

(3) Schedule (National Underground Asset Register: monetary penalties) to this Act inserts Schedule 5A into the New Roads and Street Works Act 1991 (monetary penalties).”—(Sir John Whittingdale.)

This amendment inserts Part 3A into the New Roads and Street Works Act 1991 which requires, and makes provision in connection with, the keeping of a register of information relating to apparatus in streets (to be called the National Underground Asset Register).

Brought up, read the First and Second time, and added to the Bill.

New Clause 40

Information in relation to apparatus

“(1) The New Roads and Street Works Act 1991 is amended in accordance with subsections (2) to (6).

(2) For the italic heading before section 79 (records of location of apparatus) substitute “Duties in relation to recording and sharing of information about apparatus”.

(3) In section 79—

(a) for the heading substitute “Information in relation to apparatus”;

(b) in subsection (1), for paragraph (c) substitute—

“(c) being informed of its location under section 80(2),”;

(c) after subsection (1A) (as inserted by section 46(2) of the Traffic Management Act 2004) insert—

“(1B) An undertaker must, except in such cases as may be prescribed, record in relation to every item of apparatus belonging to the undertaker such other information as may be prescribed as soon as reasonably practicable after—

(a) placing the item in the street or altering its position,

(b) inspecting, maintaining, adjusting, repairing, altering or renewing the item,

(c) locating the item in the street in the course of executing any other works, or

(d) receiving any such information in relation to the item under section 80(2).”

(d) omit subsection (3);

(e) in subsection (3A) (as inserted by section 46(4) of the Traffic Management Act 2004)—

(i) for “to (3)” substitute “and (2A)”;

(ii) for “subsection (1)” substitute “this section”;

(f) after subsection (3A) insert—

“(3B) Before the end of the initial upload period an undertaker must enter into NUAR—

(a) all information that is included in the undertaker’s records under subsection (1) on the archive upload date, and

(b) any other information of a prescribed description that is held by the undertaker on that date.

(3C) Where an undertaker records information as required by subsection (1) or (1B), or updates such information, the undertaker must, within a prescribed period, enter the recorded or updated information into NUAR.

(3D) The duty under subsection (3C) does not apply in relation to information recorded or updated before the archive upload date.

(3E) A duty under subsection (3B) or (3C) does not apply in such cases as may be prescribed.

(3F) Information must be entered into NUAR under subsection (3B) or (3C) in such form and manner as may be prescribed.”

(g) in subsection (4)(a), omit “not exceeding level 5 on the standard scale”;

(h) after subsection (6) insert—

“(7) For the purposes of subsection (3B) the Secretary of State must by regulations—

(a) specify a date as “the archive upload date”, and

(b) specify a period beginning with that date as the “initial upload period”.

(8) For the meaning of “NUAR”, see section 106A.”

(4) For section 80 (duty to inform undertakers of location of apparatus) substitute—

“80 Duties to report missing or incorrect information in relation to apparatus

(1) Subsection (2) applies where a person executing works of any description in a street finds an item of apparatus belonging to an undertaker in relation to which prescribed information—

(a) is not entered in NUAR, or

(b) is entered in NUAR but is incorrect.

(2) The person must take such steps as are reasonably practicable to inform the undertaker to whom the item belongs of the missing or incorrect information.

(3) Where a person executing works of any description in a street finds an item of apparatus which does not belong to the person and is unable, after taking such steps as are reasonably practicable, to ascertain to whom the item belongs, the person must—

(a) if the person is an undertaker, enter into NUAR, in such form and manner as may be prescribed, prescribed information in relation to the item;

(b) in any other case, inform the street authority of that information.

(4) Subsections (2) and (3) have effect subject to such exceptions as may be prescribed.

(5) A person who fails to comply with subsection (2) or (3) commits an offence.

(6) A person who commits an offence under subsection (5) is liable on summary conviction to a fine not exceeding level 4 on the standard scale.

(7) Before making regulations under this section the Secretary of State must consult—

(a) such representatives of persons likely to be affected by the regulations as the Secretary of State considers appropriate, and

(b) such other persons as the Secretary of State considers appropriate.

(8) For the meaning of “NUAR”, see section 106A.”

(5) Before section 81 (duty to maintain apparatus) insert—

“Other duties and liabilities of undertakers in relation to apparatus”.

(6) In section 104 (regulations), after subsection (1) insert—

“(1A) Before making regulations under section 79 or 80 the Secretary of State must consult the Welsh Ministers.

(1B) Regulations under this Part may make supplementary or incidental provision.”

(7) In consequence of the provision made by subsection (4), omit section 47 of the Traffic Management Act 2004.”—(Sir John Whittingdale.)

This amendment amends the New Roads and Street Works Act 1991 so as to impose new duties on undertakers to keep records of, and share information relating to, apparatus in streets; and makes amendments consequential on those changes.

Brought up, read the First and Second time, and added to the Bill.

New Clause 41

Pre-commencement consultation

“A requirement to consult under a provision inserted into the New Roads and Street Works Act 1991 by section (National Underground Asset Register) or (Information in relation to apparatus) may be satisfied by consultation before, as well as consultation after, the provision inserting that provision comes into force.”—(Sir John Whittingdale.)

This amendment provides that a requirement that the Secretary of State consult under a provision inserted into the New Roads and Street Works Act 1991 by the new clauses inserted by Amendments NC39 and NC40 may be satisfied by consultation undertaken before or after the provision inserting that provision comes into force.

Brought up, read the First and Second time, and added to the Bill.

New Clause 42

Transfer of certain functions to Secretary of State

“(1) The powers to make regulations under section 79(1) and (2) of the New Roads and Street Works Act 1991, so far as exercisable in relation to Wales, are transferred to the Secretary of State.

(2) The power to make regulations under section 79(1A) of that Act (as inserted by section 46(2) A42of the Traffic Management Act 2004), so far as exercisable in relation to Wales, is transferred to the Secretary of State.

(3) The Street Works (Records) (England) Regulations 2002 (S.I. 2002/3217) have effect as if the reference to England in regulation 1(2) were a reference to England and Wales.

(4) The Street Works (Records) (Wales) Regulations 2005 (S.I. 2005/1812) are revoked.”—(Sir John Whittingdale.)

This amendment provides that certain powers to make regulations under section 79 of the New Roads and Street Works Act 1991, so far as exercisable in relation to Wales, are transferred from the Welsh Ministers to the Secretary of State; and makes provision in relation to regulations already made under those powers.

Brought up, read the First and Second time, and added to the Bill.

Clause 5

Lawfulness of processing

Amendment proposed: 11, page 7, line 12, at end insert—

““internal administrative purposes”, in relation to special category data, means the conditions set out for lawful processing in paragraph 1 of Schedule 1 of the Data Protection Act 2018.”—(Kate Osborne.)

This amendment clarifies that the processing of special category data in employment must follow established principles for reasonable processing, as defined by paragraph 1 of Schedule 1 of the Data Protection Act 2018.

Question put, That the amendment be made.