Data (Use and Access) Act 2025

47

Page 170, line 2, leave out Clause 135

48

Page 170, line 23, leave out Clause 136

49

Page 171, line 15, leave out Clause 137

50

Page 171, line 37, leave out Clause 138

51

Page 173, line 1, leave out Clause 139

52

Page 173, line 13, leave out Clause 140

53

Clause 141, page 173, line 27, leave out “or soliciting the creation of”

54

Clause 141, page 173, line 35, leave out from beginning to end of line 8 on page 174

55

Clause 141, page 174, line 26, at end insert- "(7A) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for creating the purported intimate image.”

56

Clause 141, page 174, line 29, at end insert- “66EA Requesting the creation of purported intimate image of adult (1) A person (A) commits an offence if — (a) A intentionally requests the creation of a purported intimate image of another person (B) (either in general or specific terms), (b) B does not consent to A requesting the creation of the purported intimate image, and (c) A does not reasonably believe that B consents. (2) A person (A) commits an offence if — (a) A intentionally requests that, if a purported intimate image of another person (B) is created, it includes or excludes something in particular (whether relating to B's appearance, the intimate state in which B is shown or anything else), (b) B does not consent to A requesting the inclusion or exclusion of that thing, and (c) A does not reasonably believe that B consents. (3) References in this section to making a request (however expressed) include doing an act which could reasonably be taken to be a request (such as, for example, indicating agreement in response to an offer or complying with conditions of an offer). (4) References in this section to making a request (however expressed) are references to (a) making a request directed to a particular person or persons, or (b) making a request so that it is available to one or more persons (or people generally), without directing it to a particular person or persons. (5) References in this section to consent to a person requesting something are- (a) in a case described in subsection (4)(a), references to consent to a request being made that is directed to the particular person or persons, and (b) in a case described in subsection (4)(b), references to consent to a request being made so that it is available to the person or persons (or people generally), as appropriate. (6) An offence under this section is committed— (a) regardless of whether the purported intimate image is created, (b) regardless of whether the purported intimate image, or the particular thing to be included in or excluded from such an image, is also requested by another person, and

57

Clause 141, page 174, line 30, leave out “soliciting” and insert “requesting”

58

Clause 141, page 174, line 32, leave out “section 66E” and insert “sections 66E and 66EA”

59

Clause 141, page 174, line 33, leave out “the creation of a purported intimate image" and insert "an act"

60

Clause 141, page 174, line 34, leave out “of creation”

61

Clause 141, page 174, line 35, at end insert “(and see also section 66EA(5))”

62

Clause 141, page 175, line 10, at end insert- "(8) The "maximum term for summary offences” means (a) if the offence is committed before the time when section 281(5) of the Criminal Justice Act 2003 comes into force, six months; (b) if the offence is committed after that time, 51 weeks.”

63

Clause 141, page 175, line 10, at end insert- “66G Creating, or requesting the creation of, purported intimate image of adult: time limit for prosecution (1) Notwithstanding section 127(1) of the Magistrates' Courts Act 1980, a magistrates' court may try an information or written charge relating to an offence under section 66E or 66EA if the information is laid or the charge is issued - (a) before the end of the period of 3 years beginning with the day on which the offence was committed, and (b) before the end of the period of 6 months beginning with the day on which evidence which the prosecutor thinks is sufficient to justify a prosecution comes to the prosecutor's knowledge. (2) A certificate signed by or on behalf of a prosecutor stating the date on which evidence described in subsection (1)(b) came to the prosecutor's knowledge is conclusive evidence of that fact."

64

Clause 141, page 175, line 12, after “66E” insert “, 66EA”

65

Clause 141, page 175, line 12, at end insert- "(3A) In the Armed Forces Act 2006, after section 177D insert – "177DA Purported intimate images to be treated as used for purpose of certain offences (1) This section applies where a person commits an offence under section 42 as respects which the corresponding offence under the law of England and Wales is an offence under section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult). (2) The purported intimate image to which the offence relates, and anything containing it, is to be regarded for the purposes of section 177C(3) (and section 94A(3)(b)(ii)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring)."'"

66

Clause 141, page 175, line 12, at end insert- “(3B) In Part 2 of Schedule 3 to the Serious Crime Act 2007 (offences to be disregarded in reckoning whether an act is capable of encouraging or assisting the commission of an offence: England and Wales), after paragraph 38 insert – “Sexual Offences Act 2003 38ZA An offence under section 66EA of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult).”””

67

Clause 141, page 175, line 16, leave out “This section” and insert “Subsection (2)"

68

Clause 141, page 175, line 17, leave out “or soliciting the creation of”

69

Clause 141, page 175, line 23, at end insert- "(3) Subsection (4) applies where a person commits an offence under section 66EA of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult). (4) A purported intimate image which is connected with the offence, and anything containing it, is to be regarded for the purposes of section 153 (and section 157(3)(b)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring). (5) A purported intimate image is connected with an offence under section 66EA of the Sexual Offences Act 2003 if - (a) it appears to be of a person who was the subject of the request to which the offence relates (whether or not it is what was requested), and (b) it was in the offender's possession, or under the offender's control, as a result of that request.”

70

Clause 144, page 177, line 25, leave out “141” and insert “141(1) to (3) and (4)”

71

Clause 144, page 177, line 26, leave out “extends” and insert “extend”

72

Clause 144, page 177, line 26, at end insert- "(d) section 141(3A) (amendment of the Armed Forces Act 2006) extends to - (i) England and Wales, Scotland and Northern Ireland, (ii) the Isle of Man, and (iii) the British overseas territories, except Gibraltar;"

73

Clause 144, page 177, line 26, at end insert- "(d) section 141(3B) (amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only."

74

Clause 144, page 177, line 26, at end insert- "(5A) The powers conferred by section 384(1) and (2) of the Armed Forces Act 2006 (powers to extend provisions to the Channel Islands and to make provisions apply with modifications as they extend to the Channel Islands, the Isle of Man and British overseas territories other than Gibraltar) may be exercised in relation to section 177DA of that Act (inserted by section 141(3A) of this Act)."

75

Clause 147, page 179, line 10, leave out subsection (2)

76

Schedule 11, page 227, line 13, at end insert - "21A In section 170(2)(a) (unlawful obtaining etc of personal data), after “preventing” insert “, investigating". 21B (1) Section 171 (re-identification of de-identified personal data) is amended as follows. (2) In subsection (3)(a), after “preventing” insert ", investigating". (3) In subsection (6)(a), after “preventing” insert ", investigating”."

77

Schedule 15, page 255, line 35, at end insert - “(5) This section does not authorise the processing of information if the processing would contravene the data protection legislation (but in determining whether it would do so, take into account the power conferred by this section). (6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

79

Title, line 18, leave out "and solicitation"

NC16

Economic impact assessment (1) The Secretary of State must, before the end of the period of 12 months beginning with the day on which this Act is passed- (a) prepare and publish an assessment of the economic impact in the United Kingdom of each of the four policy options described in section B.4 of the Copyright and Al Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and (b) lay a document containing the assessment before Parliament. (2) The document may include an assessment of the economic impact in the United Kingdom of policy options which are alternatives to the options described in subsection (1)(a). (3) An assessment included in the document must, among other things, include assessment of the economic impact of each option on- (a) copyright owners, and (b) persons who develop or use Al systems, including the impact on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses. (4) In this section- "Al system” means a machine-based system that, from the input it receives, can infer how to— (a) generate predictions, digital content, recommendations, decisions or other similar outputs, or (b) influence a physical or virtual environment, with a view to achieving an explicit or implicit objective; "the Copyright and Al Consultation Paper" means the command paper "Copyright and Al: Consultation”, numbered CP1205, published on 17 December 2024; "copyright owner" has the same meaning as in Part 1 of the Copyright, Designs and Patents Act 1988; "develop" an Al system means carry on an activity involved in producing the system, such as (for example) designing, programming, training or testing the system (and related terms are to be interpreted accordingly); "digital content" means data which is produced and supplied in digital form; "medium-sized business" means a business with at least 50 but fewer than 250 staff; "micro business” means a business with fewer than 10 staff; "small business" means a business with at least 10 but fewer than 50 staff; "use” an Al system means instruct an Al system to generate outputs or to influence an environment (and related terms are to be interpreted accordingly).”

NC17

Report on the use of copyright works in the development of Al systems (1) The Secretary of State must, before the end of the period of 12 months beginning with the day on which this Act is passed— (a) prepare and publish a report on the use of copyright works in the development of Al systems, and (b) lay the report before Parliament. (2) The report must consider- (a) the four policy options described in section B.4 of the Copyright and Al Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and (b) such alternative options as the Secretary of State considers appropriate. (3) The report must consider, and make proposals in relation to, each of the following- (a) technical measures and standards (for example, measures and standards concerned with metadata) that may be used to control- (i) the use of copyright works to develop Al systems, and (ii) the accessing of copyright works for that purpose (for example, by web crawlers); (b) the effect of copyright on access to, and use of, data by developers of Al systems (for example, on text and data mining), including the effect on developers who are individuals, micro businesses, small businesses or medium-sized businesses; (c) the disclosure of information by developers of Al systems about- (i) their use of copyright works to develop Al systems, and (ii) how they access copyright works for that purpose (for example, by means of web crawlers); (d) the granting of licences to developers of Al systems to do acts restricted by copyright, including the granting of licences by and to individuals, micro businesses, small businesses and medium-sized businesses. (4) In preparing the report, the Secretary of State must consider the likely effect of proposals, in the United Kingdom, on— (a) copyright owners, and (b) persons who develop or use Al systems, including the likely effect on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses. (5) In preparing the report, the Secretary of State must have regard to, among other things, the Consultation Paper responses. (6) The Secretary of State may comply with this section by preparing and publishing two or more reports which, taken together, satisfy the requirements in this section. (7) In this section- "Consultation Paper responses” means responses to the Copyright and Al Consultation Paper received by the Secretary of State on or before 25 February 2025; "copyright” means the property right which subsists in accordance with Part 1 of the Copyright, Designs and Patents Act 1988; "copyright work” has the same meaning as in Part 1 of the Copyright, Designs and Patents Act 1988; "web crawler" means a computer program that obtains data from websites in accordance with instructions and that can autonomously determine which websites to visit. (8) Terms used in this section and in section (Economic impact assessment) have the same meaning in this section as they have in that section."

NC1

Age of consent for social media data processing (1) The UK GDPR is as amended as follows. (2) In Article 8 of the UK GDPR (Conditions applicable to child's consent in relation to information society services) After paragraph 1 insert- "(1A) References to 13 years old in paragraph 1 shall be read as 16 years old in the case of social networking services processing personal data for the purpose of delivering personalised content, including targeted advertising and algorithmically curated recommendations. (1B) For the purposes of paragraph 1A "social networking services” means any online service that- (a) allows users to create profiles and interact publicly or privately with other users, and (b) facilitates the sharing of user-generated content, including text, images, or videos, with a wider audience. (1C) Paragraph 1B does not apply to- (a) educational platforms and learning management systems provided in recognised educational settings, where personal data processing is solely for educational purposes. (b) health and well-being services, including NHS digital services, mental health support applications, and crisis helplines, where personal data processing is necessary for the provision of care and support""

NC2

This new clause would raise the age for processing personal data in the case of social networking services from 13 to 16.

NC3

Compliance with UK copyright law by operators of web crawlers and general-purpose Al models (1) The Secretary of State must by regulations make provision (including any such provision as might be made by Act of Parliament), requiring the operators of web crawlers and general-purpose artificial intelligence (AI) models whose services have links with the United Kingdom within the meaning of section 4(5) of the Online Safety Act 2023 to comply with United Kingdom copyright law, including the Copyright, Designs and Patents Act 1988, regardless of the jurisdiction in which the copyright-relevant acts relating to the pre-training, development and operation of those web crawlers and general-purpose Al models take place. (2) Provision made under subsection (1) must apply to the entire lifecycle of a general-purpose Al model, including but not limited to— (a) pre-training and training, (b) fine tuning, (c) grounding and retrieval-augmented generation, and (d) the collection of data for the said purposes. (3) The Secretary of State must lay before Parliament a draft of the statutory instrument containing regulations under subsection (1) within six months of the day on which this Act is passed and the regulations are subject to the affirmative procedure."

NC3

Transparency of crawler identity, purpose and segmentation (1) The Secretary of State must by regulations make provision requiring operators of web crawlers and general-purpose artificial intelligence (AI) models whose services have links with the United Kingdom within the meaning of section 4(5) of the Online Safety Act 2023 to disclose information regarding the identity of crawlers used by them or by third parties on their behalf, including but not limited to- (a) the name of the crawler, (b) the legal entity responsible for the crawler, (c) the specific purposes for which each crawler is used, (d) the legal entities to which operators provide data scraped by the crawlers they operate, and (e) a single point of contact to enable copyright owners to communicate 35 with them and to lodge complaints about the use of their copyrighted works. (2) The information disclosed under subsection (1) must be available on an easily accessible platform and updated at the same time as any change. (3) The Secretary of State must by regulations make provision requiring operators of web crawlers and general-purpose Al models to deploy distinct crawlers for different purposes, including but not limited to— (a) web indexing for search engine results pages, (b) general-purpose Al model pre-training, and (c) retrieval-augmented generation. (4) The Secretary of State must by regulations make provision requiring operators of web crawlers and general-purpose Al models to ensure that the exclusion of a crawler by a copyright owner does not negatively impact the findability of the copyright owner's content in a search engine. (5) The Secretary of State must lay before Parliament a draft of the statutory instrument containing regulations under this section within six months of the day on which this Act is passed and the regulations are subject to the affirmative procedure."

NC4

Transparency of copyrighted works scraped (1) The Secretary of State must by regulations make provision requiring operators of web crawlers and general-purpose artificial intelligence (AI) models whose services have links with the United Kingdom within the meaning of section 4(5) of the Online Safety Act 2023 to disclose information regarding text and data used in the pre-training, training and fine-tuning of general purpose Al models, including but not limited to— (a) the URLs accessed by crawlers deployed by them or by third parties on their behalf or from whom they have obtained text or data, (b) the text and data used for the pre-training, training and fine-tuning, including the type and provenance of the text and data and the means by which it was obtained, and (c) information that can be used to identify individual works, and (d) the timeframe of data collection. (2) The disclosure of information under subsection (1) must be updated on a monthly basis in such form as the regulations may prescribe and be published in such manner as the regulations may prescribe so as to ensure that it is accessible to copyright owners upon request. (3) The Secretary of State must lay before Parliament a draft of the statutory instrument containing regulations under subsection (1) within six months of the day on which this Act is passed and the regulations are subject to the affirmative procedure."

NC5

This new clause mandates transparency about the sources and types of data used in Al training, requiring monthly updates accessible to copyright owners.

NC5

Enforcement (1) The Secretary of State must by regulations make provision requiring the Information Commission (under section 114 of the Data Protection Act 2018) ("the Commissioner") to monitor and secure compliance with the duties by an operator of a web crawler or general-purpose artificial intelligence (AI) model whose service has links with the United Kingdom within the meaning of section 4(5) of the Online Safety Act 2023 (“a relevant operator"), including but not limited to the following- (a) the regulations must provide for the Commissioner to have the power by written notice (an "information notice") to require a relevant operator to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of investigating a suspected failure to comply with the duties; (b) the regulations must provide for the Commissioner to have the power by written notice (an "assessment notice") to require and to permit the Commissioner to carry out an assessment of whether a relevant operator has complied or is complying with the duties and to require a relevant operator to do any of the acts set out in section 146(2) of the Data Protection Act 2018; (c) the regulations must provide that where the Commissioner is satisfied 15 that a relevant operator has failed, or is failing to comply with the duties, the Commissioner may give the relevant operator a written notice (an “enforcement notice") which requires it- (i) to take steps specified in the notice, or (ii) to refrain from taking steps specified in the notice; (d) the regulations must provide that where the Commissioner is satisfied that a relevant operator has failed or is failing to comply with the duties or has failed to comply with an information notice, an assessment notice or an enforcement notice, the Commissioner may, by written notice (a “penalty notice"), require the person to pay to the Commissioner an amount in sterling specified in the notice, the maximum amount of the penalty that may be imposed by a penalty notice being the "higher maximum amount” as defined in section 157 of the Data Protection Act 2018; and (e) the regulations may provide for the procedure and rights of appeal 30 in relation to the giving of an information notice, an assessment notice, an enforcement notice or a penalty notice. (2) The regulations must provide that any failure to comply with the duties by a relevant operator shall be directly actionable by any copyright owner who is adversely affected by such failure, and that such copyright owner will be entitled to recover damages for any loss suffered and to injunctive relief. (3) The regulations must provide that the powers of the Commissioner and the rights of a copyright owner will apply in relation to a relevant operator providing a service from outside the United Kingdom (as well as such one provided from within the United Kingdom). (4) The Secretary of State must lay before Parliament a draft of the statutory instrument containing regulations under this section within six months of the day on which this Act is passed and the regulations are subject to the affirmative procedure."

NC6

Technical solutions (1) The Secretary of State must conduct a review of the technical solutions that may be adopted by copyright owners and by the operators of web crawlers and general-purpose artificial intelligence (AI) models whose services have links with the United Kingdom within the meaning of section 4(5) of the Online Safety Act 2023 to prevent and to identify the unauthorised scraping or other unauthorised use of copyright owners' text and data. (2) Within 18 months of the day on which this Act is passed, the Secretary of State must report on such technical solutions and must issue guidance as to the technical solutions to be adopted and other recommendations for the protection of the interests of copyright owners."

NC7

Right to use non-digital verification services (1) This section applies when an organisation— (a) requires an individual to use a verification service; and (b) uses a digital verification service for that purpose. (2) Where it is reasonably practicable for an organisation to offer a non-digital method of verification, the organisation must- (a) make a non-digital alternative method of verification available to any individual required to use a verification service; and (b) provide information about digital and non-digital methods of verification to those individuals before verification is required."

NC8

Data Vision and Strategy Within six months of Royal Assent of this Act, the Secretary of State must publish a “Data Vision and Strategy" which outlines— (a) the Government's data transformation priorities for the next five years; and (b) steps the Government will take to ensure the digitisation of Government services.”

NC9

No clause text provided.

NC10

Departmental Board Appointments (1) Within six months of the day on which this Act is passed- (a) Government departments; (b) NHS England; and (c) NHS trusts shall appoint to their departmental board or equivalent body at least one of the following- (i) Chief Information Officer; (ii) Chief Technology Officer; (iii) Chief Digital Information Officer; (iv) Service Transformation Leader; or (v) equivalent postholder. (2) The person or persons appointed as under subsection (1) shall provide an annual report on the progress of the department or body towards the Government's Data Vision and Strategy."

Data use in Public Service Delivery Review (1) The Secretary of State must, every 12 months, lay before Parliament a "Data use in Public Service Delivery Review". (2) The Data use in Public Service Delivery Review shall include, but is not limited to assessment of the steps being taken to- (a) improve the Government's use of data in public service delivery over the previous 12 months; (b) expand the use of data to support increased and improved digital services in public service delivery; (c) improve expertise and digital talent within Government departments to help expand the use of data for public service delivery; and (d) facilitate and regulate for better use of data in the delivery of public services."

NC11

Access to a deceased child's social media data (1) Where a person under 18 years of age has deceased, a parent or legal guardian (the "requestor”) may request from any internet service provider (ISP) the child's user data from up to 12 months prior to the date of death. (2) The ISP must provide a copy of the requested data, or direct account access, upon verification of the requestor's identity and relationship to the deceased person, and no court order shall be required for such disclosure. (3) "User data" includes all content, communications, or metadata generated by or associated with the deceased person's online activity, including stored messages and posts, except where the deceased person had explicitly directed otherwise prior to death. (4) The ISP may refuse or redact specific data only where- (a) disclosure would unduly infringe the privacy rights of another individual, (b) the deceased person had explicitly opted out before death, (c) there is a conflicting court order, or (d) a serious risk to public safety or national security would result. (5) In providing data under this section, the ISP must comply with data protection legislation. (6) This section constitutes a lawful basis for disclosure under Article 6 of the UK GDPR. (7) The Secretary of State may, by regulations subject to the affirmative resolution procedure- (a) provide guidance on verifying parent or guardian status, (b) clarify any additional grounds for refusal, and (c) prescribe safeguards to protect third-party confidentiality. (8) For the purposes of this section— "internet service provider (ISP)" includes any provider of social media, messaging, or other online platforms; and "data protection legislation” has the meaning given in section 51 of this Act."

NC12

Raising the minimum age at which users can consent to processing of personal data (1) The UK GDPR is amended in accordance with subsection (2) of this section. (2) (2) After paragraph 1 of Article 8 of the UK GDPR (Conditions applicable to child's consent in relation to information society services) insert- "(1A) References to "13 years old" and "age of 13 years" in paragraph 1 shall be read as "16 years old" and "age of 16 years" in the case of processing of personal data. (1B) Paragraph (1A) does not apply to- (a) platform systems and services operated where the primary purpose of processing of personal data is for the advancement of a charitable purpose as defined in the Charities Act 2011; (b) publicly owned platform systems and services operated for the primary purpose of law enforcement, child protection, education, or healthcare; (c) cases in which the Secretary of State determines it is in the best interests of the child for an operator to accept the child's own consent.""

NC13

This new clause would raise the age for processing personal data from 13 to 16 years old with certain exceptions for charitable purposes and child safety.

NC14

Transparency of business and customer data used in training Artificial Intelligence models (1) The Secretary of State must by regulations make provision requiring operators of general-purpose Al models to disclose upon request information about business data and customer data processed for the purposes of pre-training, training, fine-tuning, and retrieval-augmented generation in an Al model, or any other data input to an Al model. (2) Business data and customer data must include, but is not limited to, the whole or any substantial part of a literary, dramatic, musical or artistic work, sound recording, film or broadcast included in any text, images and data used for the purposes set out in subsection (1). (3) Information disclosable under subsection (1) must include but is not limited to: (i) Digital Object Identifiers and file names; (ii) Details of how the work was identified, including metadata; (iii) The source from which it was scraped or otherwise obtained; and (iv) The URLs accessed by crawlers deployed by operators, or by third parties, to obtain the data. (4) The owner of rights in any individual work identifiable in information disclosed under subsection (1) must be provided upon request to the relevant operator with information as to whether and how they have complied with the laws of the United Kingdom in respect to that work. (5) The Secretary of State must lay before Parliament a draft of the statutory instrument containing regulations under subsection (1) within six months of the day on which this Act is passed and the regulations are subject to the affirmative procedure."

NC15

Complaints procedure for vulnerable individuals The Data Protection Act 2018 is amended in accordance with subsections (2) to (4). (2) After section 165(3) insert- "(3A) For complaints under subsection (2), the Information Commissioner must provide appropriate complaints-handling procedures for- (a) victims of modern slavery, (b) victims of domestic abuse, (c) victims of gender-based violence, or (d) data subjects otherwise in a position of vulnerability. (3B) Procedures under subsection (3A) must include- (a) appropriate support for vulnerable individuals; (b) provision of specialised officers for sensitive cases; (c) signposting to support services; (d) provision of a helpline; (e) de-escalation protocols.” (3) After section 166(1)(c) insert- "(d) fails to investigate a complaint appropriately or take adequate action to remedy findings of inadequacy." (4) After section 166(2)(b), insert- "(c) to use formal powers as appropriate to investigate a complaint and to remedy any findings of inadequacy, unless the request from the data subject is manifestly unfounded or excessive.""

NC18

Report on the introduction of a public interest test for allowing access to NHS data by third-parties and companies (1) The Secretary of State must within six months of the passing of this Act- (a) prepare and publish a report examining the need for a specific statutory public interest test to determine and safeguard access to NHS data by third-parties and companies. (b) within 28 days of a report being laid under subsection (1) the Government must schedule a debate and votable motion on the findings of the report in each House. (2) The report must consider- (a) whether and in what situations it would be necessary, proportionate and lawful to share NHS data with third-parties and companies when the interests and risks to both the individual and/or public is considered. (b) when it would be in the public interest and in the best interests of patients and the NHS to allow access by third-parties and companies to NHS data in relation to the provision of health care services and for promotion of health."

NC19

This new clause would require the Secretary of State to produce a report on the introduction of a public interest test for allowing access to NHS data by third-parties and companies and then to schedule a debate on it in each House.

NC20

Duties of the Secretary of State in relation to the use by web-crawlers and artificial intelligence models of creative content The Secretary of State must- (a) by 16 September 2025, issue a statement, by way of a copyright notice issued by the Intellectual Property Office or otherwise, in relation to the application of the Copyright, Designs and Patents Act 1988 to activities conducted by web-crawlers or artificial intelligence models which may infringe the copyright attaching to creative works; (b) by 16 September 2025, lay before Parliament a report which includes a plan to help ensure proportionate and effective measures for transparency in the use of copyright materials in training, refining, tuning and generative activities in Al; (c) by 16 September 2025, lay before Parliament a report which includes a plan to reduce barriers to market entry for start-ups and smaller Al enterprises on use of and access to data; (d) by 1 July 2026, publish a technological standard for a machine-readable digital watermark for the purposes of identifying licensed content and relevant information associated with the licence."

NC21

Directions to public authorities on recording of sex data (1) The Secretary of State must, within three months of the passage of this Act, issue regulations relating to the code of practice set out in section 49 of this Act which require public authorities to- (a) collect, process and retain sex data only where it is lawful to do so in accordance with data protection legislation; (b) request and record sex data accurately, in every circumstance where sex data is collected, in accordance with following category terms and definitions— (i) "Sex" meaning male or female only based on "sex at birth”, “natal sex” or "biological sex" (these terms carrying the same meaning and capable of being used interchangeably); and, (ii) in addition, where it is lawful to do so in accordance with data protection legislation and the Gender Recognition Act 2004, “Acquired Gender" meaning male or female only, as recorded on a gender recognition certificate issued in accordance with the Gender Recognition Act 2004; (c) have updated relevant organisation guidance to stipulate that, where sex data is collected, this must be done in accordance with the definitions set out by subsection (1)(b) within three months of these regulations coming into force; (d) have conducted a review of the accuracy of data held in relation to the sex of data subjects to ensure that the data is accurate in recording sex at birth and, where relevant and collected lawfully, acquired gender as recorded on a gender recognition certificate within 12 months of these regulations coming into force; (e) have taken every reasonable step to ensure that any data held in relation to the sex and, where relevant, acquired gender as recorded on a gender recognition certificate of a data subject that is found to be inaccurate is rectified or erased within 18 months of these regulations coming into force; and (f) have produced and submitted to the Secretary of State a report setting out the findings of its review in relation to the matters set out by subsection (1)(d) and, where relevant, a description of the steps taken to ensure that the data held by the relevant public authority is accurate within the definitions set out subsection (1)(b) with 18 months of these regulations coming into force. (2) The Secretary of State may, on receipt of a report in accordance with subsection (1)(f) instruct a public authority to take any further remedial steps within a specified timeframe reasonably necessary to ensure the accuracy of the sex and acquired gender data held by the relevant public authority. (3) The Secretary of State must, within one month of the passage of this Act, establish and maintain a register of public authorities approved to act as sources of data relating to the attribute of sex for persons providing digital verification services. (4) The register in subsection (3) must be published on the website of the Office for Digital Identities & Attributes or any successor body. (5) Until such time as a public authority is added to the register under subsection (3), persons providing digital verification services may only obtain data on the sex of an individual requesting the provision of digital verification services from the record of births held by the General Register Office in accordance with subsection (6). (6) Information supplied by the General Register Office pursuant to subsection (5) must specify sex as recorded at birth, as well as any subsequent corrections to the register in the field marked "Sex". (7) The Secretary of State may, from time to time, add public authorities to the register as under subsection (3) only upon being satisfied on the basis of a report issued under subsection (1)(f), or satisfaction of such further steps required by the Secretary of State under subsection (2) that the data held by the relevant public authority in relation to sex and, where relevant, acquired gender as recorded on a gender recognition certificate, as defined in subsection (1)(b), is accurate."

NC22

Recording of ethnicity data for the purposes of public service delivery (1) The Secretary of State must make regulations which make provision for the collection of individual ethnicity data in the process of public service delivery and associated data collection. (2) The regulations set out by subsection (1) must make provision for ethnic classifications to include Jewish and Sikh categories. (3) The Secretary of State must lay before both Houses of Parliament a draft of the statutory instrument containing regulations under this section within six months of the day on which this Act is passed which will be subject to the affirmative procedure."

NC23

Recording of ethnicity data on the Register of Births and Deaths (1) The Secretary of State must make regulations which make provision for the collection of individual ethnicity data during birth and death registration. (2) The regulations set out by subsection (1) must make provision for ethnic classifications to include Jewish and Sikh categories. (3) The Secretary of State must lay before both Houses of Parliament a draft of the statutory instrument containing regulations under this section within six months of the day on which this Act is passed which will be subject to the affirmative procedure."

11

Clause 4, page 6, line 25, after "recipient" insert "in relation to business data"

12

Clause 4, page 6, line 26, after "authority" insert "to do something with the business data"

13

Clause 4, page 6, line 30, at end insert- "(aa) make provision requiring a person who is a third party recipient in relation to business data (whether by virtue of those regulations or other data regulations), and who is appointed by a public authority to do something with the business data, to publish or provide business data as described in paragraph (a)(i) or (ii),”

14

Clause 4, page 6, line 31, leave out from “or” to “, make" in line 32 and insert "the appointed person referred to in paragraph (a) or (aa)"

15

Clause 4, page 6, line 37, after "authority" insert "or appointed person"

16

Clause 4, page 6, line 39, leave out "(a)(ii)" and insert "(a) or (aa), other than a customer described in paragraph (a)(i)"

17

Clause 8, page 12, line 5, leave out "and sections 9 and 10"

18

Clause 8, page 12, line 6, at end insert "(and see sections 9 and 10)"

19

Clause 11, page 16, line 14, leave out "for the purpose of meeting expenses" and insert “in connection with activities"

20

Clause 11, page 16, line 25, leave out from beginning to “performing” in line 26 and insert "Those activities are"

21

Clause 11, page 16, line 35, leave out “in respect of which the fee is charged” and insert “in connection with which the fee is charged (and for the total amount of fees payable in connection with things to exceed the total cost)"

22

Clause 11, page 17, line 14, at end insert- “(9) The Secretary of State or the Treasury may by regulations make provision about whether a person listed in subsection (2), or a person acting on their behalf, who could require payment in connection with an activity described in subsection (3) otherwise than in reliance on regulations under subsection (1) may do so. (10) Where duties or powers are imposed or conferred- (a) on a person in their capacity as a third party recipient by or under regulations made under this Part, other than regulations made in reliance on section 4(4)(a) (aa) or (b), or (b) on a person in their capacity as a person described in section 4(4)(c) by or under regulations made under this Part, nothing in this section, or in regulations under subsection (1) or (9), prevents the person, or a person acting on their behalf, from requiring payment in connection with the performance or exercise of those duties or powers, or restricts their ability to do so, where the person could do so otherwise than in reliance on regulations under subsection (1). (11) Examples of requiring payment otherwise than in reliance on regulations under subsection (1) include doing so in reliance on other legislation or a contract or other arrangement (whenever entered into).”

23

Clause 15, page 21, line 26, leave out third “to”

24

Clause 15, page 21, line 27, after “subsection,” insert "or to a person acting on behalf of such a body or person,”

25

Clause 15, page 21, line 27, leave out "for the purpose of meeting expenses" and insert “in connection with activities"

26

Clause 15, page 21, line 32, leave out subsection (8) and insert- "(8) Those activities are performing or exercising- (a) duties or powers imposed or conferred on the interface body or person listed in subsection (7) by FCA interface rules, and (b) other duties or powers imposed or conferred on that body or person by or under regulations made under this Part.”

27

Clause 15, page 21, line 40, leave out "in respect of which the fee is charged" and insert “in connection with which the fee is charged (and for the total amount of fees payable in connection with things to exceed the total cost)"

28

Clause 15, page 22, line 10, at end insert- "(da) may require or enable rules to make provision about what must or may be done with amounts paid as fees;"

29

Clause 15, page 22, line 13, at end insert- "(9A) Regulations under section 14 may enable FCA interface rules to make provision about whether an interface body or a person listed in subsection (7), or a person acting on behalf of such a body or person, who could require payment in connection with an activity described in subsection (8) otherwise than in reliance on FCA interface rules may do so. (9B) Examples of requiring payment otherwise than in reliance on FCA interface rules include doing so in reliance on other legislation or a contract or other arrangement (whenever entered into).”

30

Clause 21, page 26, line 17, after “sections" insert “11(9),”

31

Clause 23, page 27, line 26, at end insert- "(3A) For the purposes of determining whether subordinate legislation contains provision described in clauses 2(1) to (4) or 4(1) to (4), references in those sections to something specified are to be read as including something specified by or under any subordinate legislation."

32

Clause 25, page 29, line 2, at end insert- "(4) In this Part, references to regulations made under subsection (3) of section 4 or any of sections 5 to 21 (and references which include such regulations) include regulations made under section 4(4)(b) or (c) which make provision that could be made under the other subsection or section."

39

Clause 45, page 42, line 30, at the beginning insert- "Save in respect of data relating to sex,”

40

Clause 45, page 43, line 15, at end insert- ""gender recognition certificate” means a gender recognition certificate issued in accordance with the Gender Recognition Act 2004."

1

Clause 56, page 57, leave out lines 35 and 36 and insert "obtain the consent of the Welsh Ministers in relation to any provision which would be within the legislative competence of Senedd Cymru if contained in an Act of the Senedd (ignoring any requirement for the consent of a Minister of the Crown imposed under Schedule 7B to the Government of Wales Act 2006).”

2

Clause 57, page 60, line 2, leave out "consult the Welsh Ministers" and insert "obtain the consent of the Welsh Ministers in relation to any provision that relates to apparatus in streets in Wales"

3

Clause 57, page 60, line 25, at end insert- “(4A) Before making regulations under this section the Secretary of State must obtain the consent of the Welsh Ministers in relation to any provision that relates to apparatus in streets in Wales."

4

Clause 57, page 60, leave out line 28

5

Clause 57, page 61, line 17, leave out subsections (8) and (9)

6

Clause 58, page 67, leave out lines 25 to 27 and insert- "(A1) Before making regulations under this Order the Secretary of State must obtain the consent of the Department for Infrastructure.”

7

Clause 59, page 69, leave out lines 35 and 36

8

Clause 59, page 70, leave out line 25

37

Clause 67, page 75, line 24, at end insert- "(2A) For the purposes of paragraph 2, "scientific research" means creative and systematic work undertaken in order to increase the stock of knowledge, including knowledge of humankind, culture and society, and to devise new applications of available knowledge. (2B) To meet the reasonableness test in paragraph 2, the activity being described as scientific research must be conducted according to appropriate ethical, legal and professional frameworks, obligations and standards."

41

Clause 80, page 95, line 19, at end insert- "3. For the purposes of paragraph 1(a), a human's involvement is only meaningful if they are a natural person with the necessary competence, authority and capacity to understand, challenge and alter the decision.”

45

Clause 80, page 96, line 2, at end insert- "5. Consent in accordance with paragraph 2 cannot be given by persons under the age of 18 where— (a) the automated decision-making is likely to produce legal or similarly significant effects on the child, or (b) the processing involves the profiling of a child to determine access to essential services, education, or other significant opportunities. 6. The controller shall not be obliged to maintain, acquire or process additional information in order to identify the age of a data subject for the sole purpose of complying with this Regulation. 7. A significant decision may not be taken based solely on automated processing, if the data subject is a child or may be a child unless the provider is satisfied that the decision is in, and compatible with, the best interests of a child, taking into account their rights and development stage, authorised by law to which the controller is subject, and after suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are made publicly available. 8. Profiling or solely automated processing of children's data may not occur for the purposes of targeted advertising or behavioural analysis."

46

Clause 80, page 96, leave out lines 13 to 19 and insert- "(a) communicate to the data subject before and after the decision is taken the fact that automated decision-making is involved in the decision, the extent of any human involvement, and the availability of safeguards under this Article; (b) provide the data subject with information about decisions described in paragraph 1 taken in relation to the data subject including meaningful information about the logic involved, the significance and the envisaged consequences of such processing for the data subject, and a personalised explanation for the decision; (c) enable the data subject to make representations about such decisions; (d) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions; (e) enable the data subject to contest such decisions. 3. For the purposes of paragraph 2(b), a personalised explanation must- (a) be clear, concise and in plain language of the data subject's choice in a readily available format; (b) be understandable, and assume limited technical knowledge of algorithmic systems; (c) address the reasons for the decision and how the decision affects the individual personally, which must include- (i) the inputs, including any personal data; (ii) parameters that were likely to have influenced or were decisive to decision or a counterfactual of what change would have resulted in a more favourable outcome; (iii) the sources of parameters and inputs; (d) be available free of charge and conveniently accessible to the data subject, free of deceptive design patterns. 4. Where the safeguards apply after a decision is made, the controller must give effect to data subject requests as soon as reasonably practicable and within one month of the request. 5. The controller must ensure the safeguards are fully in place and complete a data protection impact assessment under Article 35 before a decision under Article 22A is taken, documenting their implementation of the safeguards in addition to the requirements of that Article."

42

Clause 80, page 96, line 23, after "Article 22A(1)(a)," insert "and subject to Article 22A(3)"

43

Clause 80, page 97, line 19, at end insert- "(3) To qualify as meaningful human involvement, the review must be performed by a person with the necessary competence, training, authority to alter the decision and analytical understanding of the data.”

44

Clause 80, page 98, line 31, after "and 50C(3)(c),” insert "and subject to 50A(3)”

9

Clause 81, page 100, line 7, at end insert- "Age assurance 1C. Information society services which are likely to be accessed by children must use highly effective age verification or age estimation measures for the purpose of delivering on children's higher protection matters."

38

Clause 86, page 103, line 22, at end insert- "(2A) Where personal data is processed for the purposes of scientific research under section 87(4) of the 2018 Act ('reuse'), the processor or controller must publish details of the data sources used. (2B) These details must as a minimum include a description of the scientific research, the provenance and method of acquisition of the personal data being reused, the original lawful basis for processing, the number of data subjects affected, and whether the data subjects have been notified of the reuse. (2C) The processor or controller must notify the Information Commission when processing data for the purposes of scientific research under section 87(4) of the 2018 Act with the same details."

33

Clause 135, page 173, line 22, leave out "This section" and insert "Subsection (2)"

34

Clause 135, page 173, line 29, at end insert- "(3) Subsection (4) applies where a person commits an offence under section 66F of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult). (4) A purported intimate image which is connected with the offence, and anything containing it, is to be regarded for the purposes of section 153 (and section 157(3)(b)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring). (5) A purported intimate image is connected with an offence under section 66F of the Sexual Offences Act 2003 if - (a) it appears to be of a person who was the subject of the request to which the offence relates (whether or not it is what was requested), and (b) it was in the offender's possession, or under the offender's control, as a result of that request.”

10

This amendment provides that deprivation orders can be made under the Sentencing Code in connection with an offence under new section 66F of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult).

Schedule 7, page 201, line 5, at end insert- "(1B) A third country cannot be considered adequate or capable of providing appropriate safeguards by any authority where there exists no credible means to enforce data subject rights or obtain legal remedy. (1C) For the purposes of paragraph 1A, the Secretary of State must make a determination as to whether credible means are present in a third country. (1D) In making a determination regarding credible means, the Secretary of State must have due regard to the view of the Information Commissioner. (1E) Credible means do not exist where the Secretary of State considers that any of the following are true: (a) judicial protection of persons whose personal data is transferred to that third country is insufficient; (b) effective administrative and judicial redress are not present; (c) effective judicial review mechanisms do not exist; and (d) there is no statutory right to effective legal remedy for data subjects."

35

Schedule 11, page 225, line 13, at end insert- "21A In section 170(2)(a) (unlawful obtaining etc of personal data), after "preventing” insert “, investigating". 21B (1) Section 171 (re-identification of de-identified personal data) is amended as follows. (2) In subsection (3)(a), after "preventing" insert ", investigating". (3) In subsection (6)(a), after "preventing" insert ", investigating”.'"

36

Title, line 18, after “services;” insert "to make provision about works protected by copyright and the development of artificial intelligence systems;"

NC23

To move the following Clause—"Recording of ethnicity data on the Register of Births and Deaths (1) The Secretary of State must make regulations which make provision for the collection of individual ethnicity data during birth and death registration. (2) The regulations set out by subsection (1) must make provision for ethnic classifications to include Jewish and Sikh categories. (3) The Secretary of State must lay before both Houses of Parliament a draft of the statutory instrument containing regulations under this section within six months of the day on which this Act is passed which will be subject to the affirmative procedure."

NC24

To move the following Clause—"Establishment of property rights in personality (1) The Secretary of State must by regulations make provision (including any such provision as might be made by an Act of Parliament) to protect the data of natural or legal persons by establishing property rights in personality, in accordance with the following conditions. (2) The provisions created pursuant to subsection (1) must provide that- (a) a form of property subsists in a personality (hereinafter “personality rights"); (b) a personality is defined as the name, voice, likeness, appearance, feature, face, expressions, gestures, mannerisms and any other distinctive characteristic or personal attribute (together “personal attributes") of a natural or legal person; (c) a natural or legal person has exclusive rights in the reproduction, use and exploitation of that personality, thereby making them a proprietor of "personality rights"; (d) such personality rights intend to provide meaningful statutory protection to the proprietor's proprietary, economic, and moral interests in the personal attributes and preserve their fundamental freedoms of expression, privacy and human dignity; (e) a natural or legal person may register their personal attributes in accordance with section [Establishment of a regime for the registration of personality with the Intellectual Property Office]; (f) there are limitations in scope and duration on the transfer of these rights, which cannot be assigned or waived in perpetuity by contracts; (g) personality rights apply at least up to seventy years after the death of their proprietor; (h) the proprietor of a personality right has a right of action against any party who infringes this right by exploiting their personal attributes without the proprietor's consent, and that such action grants access to meaningful remedies including but not limited to damages and injunctions; (i) online platforms and information society services are required to: act expeditiously to remove or disable access to content infringing the proprietor's personality rights upon obtaining knowledge or awareness of such unlawful activity or information; or be held liable for infringement of personality rights; (j) an exception applies to personality rights where personal attributes have been reproduced in the public interest."

NC25

To move the following Clause—"Establishment of a regime for the registration of personality with the Intellectual Property Office (1) The Secretary of State must by regulations make provision (including any such provision as might be made by an Act of Parliament) to establish a statutory regime for the registration of personality rights, in accordance with section [Establishment of property rights in personality], to be administered by the Intellectual Property Office. This regime shall include (a) criteria for registration of a personality right in accordance with section [Establishment of property rights in personality]. (b) granting of powers to the Intellectual Property Office to determine applications for the registration of a personality right; (c) grounds upon which an application may be refused; (d) a scheme for the raising of and determination of disputes about a personality right; (e) granting of powers to the Intellectual Property Office to take enforcement action against infringements of personality rights. (2) The Secretary of State must lay before Parliament a draft of the provisions to be made pursuant to this section within 10 months of the day on which this Act is passed."

37

Clause 67, page 75, line 24, at end insert—"(2A) For the purposes of paragraph 2, “scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, including knowledge of humankind, culture and society, and to devise new applications of available knowledge. (2B) To meet the reasonableness test in paragraph 2, the activity being described as scientific research must be conducted according to appropriate ethical, legal and professional frameworks, obligations and standards."

41

Clause 80, page 95, line 19, at end insert—"3. For the purposes of paragraph 1(a), a human's involvement is only meaningful if they are a natural person with the necessary competence, training, authority and capacity to understand, challenge and alter the decision.”"

45

Clause 80, page 96, line 2, at end insert—"5. Consent in accordance with paragraph 2 cannot be given by persons under the age of 18 where- (a) the automated decision-making is likely to produce legal or similarly significant effects on the child, or (b) the processing involves the profiling of a child to determine access to essential services, education, or other significant opportunities. 6. The controller shall not be obliged to maintain, acquire or process additional information in order to identify the age of a data subject for the sole purpose of complying with this Regulation. 7. A significant decision may not be taken based solely on automated processing, if the data subject is a child or may be a child unless the provider is satisfied that the decision is in, and compatible with, the best interests of a child, taking into account their rights and development stage, authorised by law to which the controller is subject, and after suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are made publicly available. 8. Profiling or solely automated processing of children's data may not occur for the purposes of targeted advertising or behavioural analysis."

42

Clause 80, page 96, leave out lines 13 to 19 and insert—"(a) communicate to the data subject before and after the decision is taken the fact that automated decision-making is involved in the decision, the extent of any human involvement, and the availability of safeguards under this Article;"

43

Clause 80, page 97, line 19, at end insert—"(3) To qualify as meaningful human involvement, the review must be performed by a person with the necessary competence, training, authority to alter the decision and analytical understanding of the data.”"

44

Clause 80, page 98, line 31, after "and 50C(3)(c),” insert “and subject to 50A(3)”"

38

Clause 86, page 103, line 22, at end insert—"(2A) Where personal data is processed for the purposes of scientific research under section 87(4) of the 2018 Act ('reuse'), the processor or controller must publish details of the data sources used. (2B) These details must as a minimum include a description of the scientific research, the provenance and method of acquisition of the personal data being reused, the original lawful basis for processing, the number of data subjects affected, and whether the data subjects have been notified of the reuse."

39

Clause 45, page 42, line 30, at the beginning insert—"Save in respect of data relating to sex,"

40

Clause 45, page 43, line 15, at end insert—""gender recognition certificate” means a gender recognition certificate issued in accordance with the Gender Recognition Act 2004."

NC16

To move the following Clause- "Economic impact assessment (1) The Secretary of State must, before the end of the period of 12 months beginning with the day on which this Act is passed— (a) prepare and publish an assessment of the economic impact in the United Kingdom of each of the four policy options described in section B.4 of the Copyright and Al Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and (b) lay a document containing the assessment before Parliament. (2) The document may include an assessment of the economic impact in the United Kingdom of policy options which are alternatives to the options described in subsection (1)(a). (3) An assessment included in the document must, among other things, include assessment of the economic impact of each option on— (a) copyright owners, and (b) persons who develop or use Al systems, including the impact on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses. (4) In this section—

NC17

To move the following Clause- "Report on the use of copyright works in the development of Al systems (1) The Secretary of State must, before the end of the period of 12 months beginning with the day on which this Act is passed- (a) prepare and publish a report on the use of copyright works in the development of Al systems, and (b) lay the report before Parliament. (2) The report must consider- (a) the four policy options described in section B.4 of the Copyright and Al Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and (b) such alternative options as the Secretary of State considers appropriate.

NC18

★ To move the following Clause— "Report on the introduction of a public interest test for allowing access to NHS data by third-parties and companies (1) The Secretary of State must within six months of the passing of this Act— (a) prepare and publish a report examining the need for a specific statutory public interest test to determine and safeguard access to NHS data by third-parties and companies. (b) within 28 days of a report being laid under subsection (1) the Government must schedule a debate and votable motion on the findings of the report in each House. (2) The report must consider- (a) whether and in what situations it would be necessary, proportionate and lawful to share NHS data with third-parties and companies when the interests and risks to both the individual and/or public is considered. (b) when it would be in the public interest and in the best interests of patients and the NHS to allow access by third-parties and companies to NHS data in relation to the provision of health care services and for promotion of health."

NC19

★ To move the following Clause— "Secretary of State's duty to review the age of consent for data processing under the UK GDPR (1) The Secretary of State must, within 12 months of Royal Assent of this Act, have conducted a review and published a report into the operation of Article 8 (Conditions applicable to child's consent in relation to information society services) of the UK GDPR in relation to the data processed by social media platforms of children under the age of 16. (2) As part of this review, the Secretary of State must consider- (a) the desirability of increasing the digital age of consent under the UK GDPR from 13 to 16, taking into account the available evidence in relation to the impact of social media platforms on the educational, social and emotional development of children; and (b) the viability of increasing the digital age of consent under Article 8 of the UK GDPR in relation to specific social media platforms which are shown by the evidence to be unsuitable for use by children under the age of 16. (3) Within six months of the publication of the report under subsection (1), the Secretary of State must lay a plan before Parliament for raising the digital age of consent to 16 through amendments to Article 8 GDPR, unless the review concludes that such changes are unnecessary."

NC20

★ To move the following Clause— "Duties of the Secretary of State in relation to the use by web-crawlers and artificial intelligence models of creative content The Secretary of State must- (a) by 16 September 2025, issue a statement, by way of a copyright notice issued by the Intellectual Property Office or otherwise, in relation to the application of the Copyright, Designs and Patents Act 1988 to activities conducted by web-crawlers or artificial intelligence models which may infringe the copyright attaching to creative works;

NC21

★ To move the following Clause— "Directions to public authorities on recording of sex data (1) The Secretary of State must, within three months of the passage of this Act, issue regulations relating to the code of practice set out in section 49 of this Act which require public authorities to- (a) collect, process and retain sex data only where it is lawful to do so in accordance with data protection legislation; (b) request and record sex data accurately, in every circumstance where sex data is collected, in accordance with following category terms and definitions- (i) "Sex" meaning male or female only based on "sex at birth”, "natal sex” or “biological sex” (these terms carrying the same meaning and capable of being used interchangeably); and, (ii) in addition, where it is lawful to do so in accordance with data protection legislation and the Gender Recognition Act 2004, "Acquired Gender” meaning male or female only, as recorded on a gender recognition certificate issued in accordance with the Gender Recognition Act 2004; (c) have updated relevant organisation guidance to stipulate that, where sex data is collected, this must be done in accordance with the definitions set out by subsection (1)(b) within three months of these regulations coming into force; (d) have conducted a review of the accuracy of data held in relation to the sex of data subjects to ensure that the data is accurate in recording sex at birth and, where relevant and collected lawfully, acquired gender as recorded on a gender recognition certificate within 12 months of these regulations coming into force; (e) have taken every reasonable step to ensure that any data held in relation to the sex and, where relevant and collected lawfully, acquired gender as recorded on a gender recognition certificate of a data subject that

NC22

★ To move the following Clause— "Recording of ethnicity data for the purposes of public service delivery (1) The Secretary of State must make regulations which make provision for the collection of individual ethnicity data in the process of public service delivery and associated data collection. (2) The regulations set out by subsection (1) must make provision for ethnic classifications to include Jewish and Sikh categories. (3) The Secretary of State must lay before both Houses of Parliament a draft of the statutory instrument containing regulations under this section within six months of the day on which this Act is passed which will be subject to the affirmative procedure.\

NC16

To move the following Clause- "Economic impact assessment (1) The Secretary of State must, before the end of the period of 12 months beginning with the day on which this Act is passed— (a) prepare and publish an assessment of the economic impact in the United Kingdom of each of the four policy options described in section B.4 of the Copyright and AI Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and (b) lay a document containing the assessment before Parliament. (2) The document may include an assessment of the economic impact in the United Kingdom of policy options which are alternatives to the options described in subsection (1)(a). (3) An assessment included in the document must, among other things, include assessment of the economic impact of each option on— (a) copyright owners, and (b) persons who develop or use AI systems, including the impact on copyright owners, developers and users who are individuals, micro businesses, small businesses or medium-sized businesses. (4) In this section—

NC17

To move the following Clause- "Report on the use of copyright works in the development of AI systems (1) The Secretary of State must, before the end of the period of 12 months beginning with the day on which this Act is passed- (a) prepare and publish a report on the use of copyright works in the development of AI systems, and (b) lay the report before Parliament. (2) The report must consider- (a) the four policy options described in section B.4 of the Copyright and AI Consultation Paper, read with relevant parts of section C of that Paper (policy options about copyright law and the training of artificial intelligence models using copyright works), and (b) such alternative options as the Secretary of State considers appropriate.

11

Clause 4, page 6, line 25, after “recipient” insert “in relation to business data"

12

Clause 4, page 6, line 26, after “authority” insert “to do something with the business data"

13

Clause 4, page 6, line 30, at end insert- "(aa) make provision requiring a person who is a third party recipient in relation to business data (whether by virtue of those regulations or other data regulations), and who is appointed by a public authority to do something with the business data, to publish or provide business data as described in paragraph (a)(i) or (ii),”

14

Clause 4, page 6, line 31, leave out from "or" to ", make" in line 32 and insert "the appointed person referred to in paragraph (a) or (aa)"

15

Clause 4, page 6, line 37, after "authority” insert "or appointed person”

33

★ Clause 135, page 173, line 22, leave out "This section” and insert "Subsection (2)"

34

★ Clause 135, page 173, line 29, at end insert- "(3) Subsection (4) applies where a person commits an offence under section 66F of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult).

35

★ Schedule 11, page 225, line 13, at end insert- "21A In section 170(2)(a) (unlawful obtaining etc of personal data), after "preventing” insert “, investigating".

36

★ Title, line 18, after "services;" insert "to make provision about works protected by copyright and the development of artificial intelligence systems;"

16

Clause 4, page 6, line 39, leave out ""(a)(ii)"" and insert "(a) or (aa), other than a customer described in paragraph (a)(i)"

17

✩ Clause 8, page 12, line 5, leave out "and sections 9 and 10"

18

✩ Clause 8, page 12, line 6, at end insert “(and see sections 9 and 10)”

19

✩ Clause 11, page 16, line 14, leave out “for the purpose of meeting expenses” and insert "in connection with activities"

20

✩ Clause 11, page 16, line 25, leave out from beginning to "performing” in line 26 and insert "Those activities are"

21

✩ Clause 11, page 16, line 35, leave out "in respect of which the fee is charged" and insert "in connection with which the fee is charged (and for the total amount of fees payable in connection with things to exceed the total cost)"

22

☆Clause 11, page 17, line 14, at end insert—“(9) The Secretary of State or the Treasury may by regulations make provision about whether a person listed in subsection (2), or a person acting on their behalf,

23

✩ Clause 15, page 21, line 26, leave out third "to"

24

✩ Clause 15, page 21, line 27, after “subsection,” insert "or to a person acting on behalf of such a body or person,”

25

☆Clause 15, page 21, line 27, leave out “for the purpose of meeting expenses” and insert "in connection with activities"

26

✩ Clause 15, page 21, line 32, leave out subsection (8) and insert—“(8) Those activities are performing or exercising-(a) duties or powers imposed or conferred on the interface body or person listed in subsection (7) by FCA interface rules, and(b) other duties or powers imposed or conferred on that body or person by or under regulations made under this Part."

27

✩ Clause 15, page 21, line 40, leave out “in respect of which the fee is charged” and insert "in connection with which the fee is charged (and for the total amount of fees payable in connection with things to exceed the total cost)"

28

✩ Clause 15, page 22, line 10, at end insert—“(da) may require or enable rules to make provision about what must or may be done with amounts paid as fees;”

29

✩ Clause 15, page 22, line 13, at end insert—“(9A) Regulations under section 14 may enable FCA interface rules to make provision about whether an interface body or a person listed in subsection (7), or a person acting on behalf of such a body or person, who could require payment

30

✩ Clause 21, page 26, line 17, after “sections” insert "11(9),”

31

✩ Clause 23, page 27, line 26, at end insert—“(3A) For the purposes of determining whether subordinate legislation contains provision described in clauses 2(1) to (4) or 4(1) to (4), references in those sections to something specified are to be read as including something specified by or under any subordinate legislation.”

32

✩ Clause 25, page 29, line 2, at end insert—“(4) In this Part, references to regulations made under subsection (3) of section 4 or any of sections 5 to 21 (and references which include such regulations) include regulations made under section 4(4)(b) or (c) which make provision that could be made under the other subsection or section.”

NC15

To move the following Clause- "Complaints procedure for vulnerable individuals (1) The Data Protection Act 2018 is amended in accordance with subsections (2) to (4). (2) After section 165(3) insert- "(3A) For complaints under subsection (2), the Information Commissioner must provide appropriate complaints-handling procedures for- (a) victims of modern slavery, (b) victims of domestic abuse, (c) victims of gender-based violence, or (d) data subjects otherwise in a position of vulnerability. (3B) Procedures under subsection (3A) must include— (a) appropriate support for vulnerable individuals; (b) provision of specialised officers for sensitive cases; (c) signposting to support services; (d) provision of a helpline; (e) de-escalation protocols." (3) After section 166(1)(c) insert- "(d) fails to investigate a complaint appropriately or take adequate action to remedy findings of inadequacy." (4) After section 166(2)(b), insert— "(c) to use formal powers as appropriate to investigate a complaint and to remedy any findings of inadequacy, unless the request from the data subject is manifestly unfounded or excessive.””

NC30

To move the following Clause—
“Access to a deceased child’s social media data
(1) Where a person under 18 years of age has deceased, a parent or legal guardian (the ‘requestor’) may request from any internet service provider (ISP) the child’s user data from up to 12 months prior to the date of death.
(2) The ISP must provide a copy of the requested data, or direct account access, upon verification of the requestor’s identity and relationship to the deceased person, and no court order shall be required for such disclosure.
(3) “User data” includes all content, communications, or metadata generated by or associated with the deceased person’s online activity, including stored messages and posts, except where the deceased person had explicitly directed otherwise prior to death.
(4) The ISP may refuse or redact specific data only where—
(a) disclosure would unduly infringe the privacy rights of another individual,
(b) the deceased person had explicitly opted out before death,
(c) there is a conflicting court order, or
(d) a serious risk to public safety or national security would result.
(5) In providing data under this section, the ISP must comply with data protection legislation.
(6) This section constitutes a lawful basis for disclosure under Article 6 of the UK GDPR.
(7) The Secretary of State may, by regulations subject to the affirmative resolution procedure—
(a) provide guidance on verifying parent or guardian status,
(b) clarify any additional grounds for refusal, and
(c) prescribe safeguards to protect third-party confidentiality.
(8) For the purposes of this section—
“internet service provider (ISP)” includes any provider of social media, messaging, or other online platforms; and
“data protection legislation” has the meaning given in section 51 of this Act.”

This new clause would allow parents of a deceased minor to obtain that child’s social media data without a court order, subject to privacy safeguards for third parties.

NC14

★ Schedule 7, page 201, line 5, at end insert— "(1B) A third country cannot be considered adequate or capable of providing appropriate safeguards by any authority where there exists no credible means to enforce data subject rights or obtain legal remedy. (1C) For the purposes of paragraph 1A, the Secretary of State must make a determination as to whether credible means are present in a third country. (1D) In making a determination regarding credible means, the Secretary of State must have due regard to the view of the Information Commissioner. (1E) Credible means do not exist where the Secretary of State considers that any of the following are true: (a) judicial protection of persons whose personal data is transferred to that third country is insufficient; (b) effective administrative and judicial redress are not present; (c) effective judicial review mechanisms do not exist; and (d) there is no statutory right to effective legal remedy for data subjects."

10

★ Schedule 7, page 201, line 5, at end insert— "(1B) A third country cannot be considered adequate or capable of providing appropriate safeguards by any authority where there exists no credible means to enforce data subject rights or obtain legal remedy. (1C) For the purposes of paragraph 1A, the Secretary of State must make a determination as to whether credible means are present in a third country. (1D) In making a determination regarding credible means, the Secretary of State must have due regard to the view of the Information Commissioner. (1E) Credible means do not exist where the Secretary of State considers that any of the following are true: (a) judicial protection of persons whose personal data is transferred to that third country is insufficient; (b) effective administrative and judicial redress are not present; (c) effective judicial review mechanisms do not exist; and (d) there is no statutory right to effective legal remedy for data subjects."

NC12

To move the following Clause—
“Raising the minimum age at which users can consent to processing of personal data
(1) The UK GDPR is amended in accordance with subsection (2) of this section.
(2) (2) After paragraph 1 of Article 8 of the UK GDPR (Conditions applicable to child's consent in relation to information society services) insert—
“(1A) References to “13 years old” and “age of 13 years” in paragraph 1 shall be read as “16 years old” and “age of 16 years” in the case of processing of personal data.
(1B) Paragraph (1A) does not apply to—
(a) platform systems and services operated where the primary purpose of processing of personal data is for the advancement of a charitable purpose as defined in the Charities Act 2011;
(b) publicly owned platform systems and services operated for the primary purpose of law enforcement, child protection, education, or healthcare;
(c) cases in which the Secretary of State determines it is in the best interests of the child for an operator to accept the child’s own consent.””

This new clause would raise the age for processing personal data from 13 to 16 years old with certain exceptions for charitable purposes and child safety.

9

Clause 81, page 100, line 7, at end insert—
“Age assurance
1C. Information society services which are likely to be accessed by children must use highly effective age verification or age estimation measures for the purpose of delivering on children’s higher protection matters.”

This amendment requires services which are likely to be accessed by children to use highly effective age verification measures.

NC13

To move the following Clause—"Code of practice for the use of children's educational data (1) Within 6 months of the passage of this Act, the Information Commissioner must prepare a code of practice which contains such guidance as the Information Commissioner considers appropriate on the processing of children's data in connection with the provision of education. (2) Guidance under subsection (1) must consider- (a) all aspects of the provision of education including learning, school management, and safeguarding; (b) all types of schools and learning settings in the development of guidance; (c) the use of Al systems in the provision of education; (d) the impact of profiling and automated decision-making on children's access to education opportunities; (e) children's consent to the way their personal data is generated, collected, processed, stored and shared; (f) parental consent to the way their children's personal data is being generated, collected, processed, stored and shared; (g) the security of children's data; (h) the exchange of information for safeguarding purposes."

NC11

To move the following Clause—
“Access to a deceased child’s social media data
(1) Where a person under 18 years of age has deceased, a parent or legal guardian (the “requestor”) may request from any internet service provider (ISP) the child’s user data from up to 12 months prior to the date of death.
(2) The ISP must provide a copy of the requested data, or direct account access, upon verification of the requestor’s identity and relationship to the deceased person, and no court order shall be required for such disclosure.
(3) ”User data” includes all content, communications, or metadata generated by or associated with the deceased person’s online activity, including stored messages and posts, except where the deceased person had explicitly directed otherwise prior to death.
(4) The ISP may refuse or redact specific data only where—
(a) disclosure would unduly infringe the privacy rights of another individual,
(b) the deceased person had explicitly opted out before death,
(c) there is a conflicting court order, or
(d) a serious risk to public safety or national security would result.
(5) In providing data under this section, the ISP must comply with data protection legislation.
(6) This section constitutes a lawful basis for disclosure under Article 6 of the UK GDPR.
(7) The Secretary of State may, by regulations subject to the affirmative resolution procedure—
(a) provide guidance on verifying parent or guardian status,
(b) clarify any additional grounds for refusal, and
(c) prescribe safeguards to protect third-party confidentiality.
(8) For the purposes of this section—
”internet service provider (ISP)” includes any provider of social media, messaging, or other online platforms; and
”data protection legislation” has the meaning given in section 51 of this Act.”

This new clause would allow parents of a deceased minor to obtain that child’s social media data without a court order, subject to privacy safeguards for third parties.

1

Clause 56, page 57, leave out lines 35 and 36 and insert “obtain the consent of the Welsh Ministers in relation to any provision which would be within the legislative competence of Senedd Cymru if contained in an Act of the Senedd (ignoring any requirement for the consent of a Minister of the Crown imposed under Schedule 7B to the Government of Wales Act 2006).”

This amendment provides that the Secretary of State must obtain the consent of the Welsh Ministers before making regulations under Part 3A of the New Roads and Street Works Act 1991 (inserted by this clause) in relation to any provision that would be within the legislative competence of Senedd Cymru if contained in an Act of the Senedd.

2

Clause 57, page 60, line 2, leave out “consult the Welsh Ministers” and insert “obtain the consent of the Welsh Ministers in relation to any provision that relates to apparatus in streets in Wales”

This amendment provides that the Secretary of State must obtain the consent of the Welsh Ministers before making regulations under section 79 of the New Roads and Street Works Act 1991 in relation to any provision that relates to apparatus in streets in Wales.

3

Clause 57, page 60, line 25, at end insert—
“(4A) Before making regulations under this section the Secretary of State must obtain the consent of the Welsh Ministers in relation to any provision that relates to apparatus in streets in Wales.”

This amendment provides that the Secretary of State must obtain the consent of the Welsh Ministers before making regulations under section 80 of the New Roads and Street Works Act 1991 in relation to any provision that relates to apparatus in streets in Wales.

4

Clause 57, page 60, leave out line 28

This amendment is consequential on amendment 3.

5

Clause 57, page 61, line 17, leave out subsections (8) and (9)

This amendment removes provision applying the Street Works (Records) (England) Regulations 2002 to Wales and also removes provision revoking the Street Works (Records) (Wales) Regulations 2005.

6

Clause 58, page 67, leave out lines 25 to 27 and insert—
“(A1) Before making regulations under this Order the Secretary of State must obtain the consent of the Department for Infrastructure.”

This amendment provides that the Secretary of State must obtain the consent of the Department for Infrastructure in Northern Ireland before making regulations under the Street Works (Northern Ireland) Order 1995.

7

Clause 59, page 69, leave out lines 35 and 36

This amendment is consequential on amendment 6.

8

Clause 59, page 70, leave out line 25

This amendment is consequential on amendment 6.

NC6

To move the following Clause—
“Technical solutions
(1) The Secretary of State must conduct a review of the technical solutions that may be adopted by copyright owners and by the operators of web crawlers and general-purpose artificial intelligence (AI) models whose services have links with the United Kingdom within the meaning of section 4(5) of the Online Safety Act 2023 to prevent and to identify the unauthorised scraping or other unauthorised use of copyright owners’ text and data.
(2) Within 18 months of the day on which this Act is passed, the Secretary of State must report on such technical solutions and must issue guidance as to the technical solutions to be adopted and other recommendations for the protection of the interests of copyright owners.”

This new clause requires the Secretary of State to review and report on technical measures to prevent unauthorised data scraping by web crawlers and AI models.

NC1

To move the following Clause—
“Age of consent for social media data processing
(1) The UK GDPR is as amended as follows.
(2) In Article 8 of the UK GDPR (Conditions applicable to child's consent in relation to information society services)
After paragraph 1 insert—
“ (1A)References to 13 years old in paragraph 1 shall be read as 16 years old in the case of social networking services processing personal data for the purpose of delivering personalised content, including targeted advertising and algorithmically curated recommendations.
(1B) For the purposes of paragraph 1A “social networking services” means any online service that—
(a) allows users to create profiles and interact publicly or privately with other users, and
(b) facilitates the sharing of user-generated content, including text, images, or videos, with a wider audience.
(1C) Paragraph 1B does not apply to—
(a) educational platforms and learning management systems provided in recognised educational settings, where personal data processing is solely for educational purposes.
(b) health and well-being services, including NHS digital services, mental health support applications, and crisis helplines, where personal data processing is necessary for the provision of care and support””

This new clause would raise the age for processing personal data in the case of social networking services from 13 to 16.

NC2

To move the following Clause—
“Compliance with UK copyright law by operators of web crawlers and general-purpose AI models
(1) The Secretary of State must by regulations make provision (including any such provision as might be made by Act of Parliament), requiring the operators of web crawlers and general-purpose artificial intelligence (AI) models whose services have links with the United Kingdom within the meaning of section 4(5) of the Online Safety Act 2023 to comply with United Kingdom copyright law, including the Copyright, Designs and Patents Act 1988, regardless of the jurisdiction in which the copyright-relevant acts relating to the pre-training, development and operation of those web crawlers and general-purpose AI models take place.
(2) Provision made under subsection (1) must apply to the entire lifecycle of a general-purpose AI model, including but not limited to—
(a) pre-training and training,
(b) fine tuning,
(c) grounding and retrieval-augmented generation, and
(d) the collection of data for the said purposes.
(3) The Secretary of State must lay before Parliament a draft of the statutory instrument containing regulations under subsection (1) within six months of the day on which this Act is passed and the regulations are subject to the affirmative procedure.”

This new clause requires web crawlers and general-purpose AI models with UK links to comply with UK copyright law across all stages of AI development.

NC3

To move the following Clause—
“Transparency of crawler identity, purpose and segmentation
(1) The Secretary of State must by regulations make provision requiring operators of web crawlers and general-purpose artificial intelligence (AI) models whose services have links with the United Kingdom within the meaning of section 4(5) of the Online Safety Act 2023 to disclose information regarding the identity of crawlers used by them or by third parties on their behalf, including but not limited to—
(a) the name of the crawler,
(b) the legal entity responsible for the crawler,
(c) the specific purposes for which each crawler is used,
(d) the legal entities to which operators provide data scraped by the crawlers they operate, and
(e) a single point of contact to enable copyright owners to communicate 35 with them and to lodge complaints about the use of their copyrighted works.
(2) The information disclosed under subsection (1) must be available on an easily accessible platform and updated at the same time as any change.
(3) The Secretary of State must by regulations make provision requiring operators of web crawlers and general-purpose AI models to deploy distinct crawlers for different purposes, including but not limited to—
(a) web indexing for search engine results pages,
(b) general-purpose AI model pre-training, and
(c) retrieval-augmented generation.
(4) The Secretary of State must by regulations make provision requiring operators of web crawlers and general-purpose AI models to ensure that the exclusion of a crawler by a copyright owner does not negatively impact the findability of the copyright owner’s content in a search engine.
(5) The Secretary of State must lay before Parliament a draft of the statutory instrument containing regulations under this section within six months of the day on which this Act is passed and the regulations are subject to the affirmative procedure.”

This new clause requires operators of web crawlers and AI models to disclose their identity, purpose, data-sharing practices, and use separate crawlers for different functions.

NC4

To move the following Clause—
“Transparency of copyrighted works scraped
(1) The Secretary of State must by regulations make provision requiring operators of web crawlers and general-purpose artificial intelligence (AI) models whose services have links with the United Kingdom within the meaning of section 4(5) of the Online Safety Act 2023 to disclose information regarding text and data used in the pre-training, training and fine-tuning of general purpose AI models, including but not limited to—
(a) the URLs accessed by crawlers deployed by them or by third parties on their behalf or from whom they have obtained text or data,
(b) the text and data used for the pre-training, training and fine-tuning, including the type and provenance of the text and data and the means by which it was obtained, and
(c) information that can be used to identify individual works, and (d) the timeframe of data collection.
(2) The disclosure of information under subsection (1) must be updated on a monthly basis in such form as the regulations may prescribe and be published in such manner as the regulations may prescribe so as to ensure that it is accessible to copyright owners upon request.
(3) The Secretary of State must lay before Parliament a draft of the statutory 35 instrument containing regulations under subsection (1) within six months of the day on which this Act is passed and the regulations are subject to the affirmative procedure.”

This new clause mandates transparency about the sources and types of data used in AI training, requiring monthly updates accessible to copyright owners.

NC5

To move the following Clause—
“Enforcement
(1) The Secretary of State must by regulations make provision requiring the Information Commission (under section 114 of the Data Protection Act 2018) (“the Commissioner”) to monitor and secure compliance with the duties under sections 136 and 137 (“the duties”) by an operator of a web crawler or general-purpose artificial intelligence (AI) model whose service has links with the United Kingdom within the meaning of section 4(5) of the Online Safety Act 2023 (“a relevant operator”), including but not limited to the following—
(a) the regulations must provide for the Commissioner to have the power by written notice (an “information notice”) to require a relevant operator to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of investigating a suspected failure to comply with the duties;
(b) the regulations must provide for the Commissioner to have the power by written notice (an “assessment notice”) to require and to permit the Commissioner to carry out an assessment of whether a relevant operator has complied or is complying with the duties and to require a relevant operator to do any of the acts set out in section 146(2) of the Data Protection Act 2018;
(c) the regulations must provide that where the Commissioner is satisfied 15 that a relevant operator has failed, or is failing to comply with the duties, the Commissioner may give the relevant operator a written notice (an “enforcement notice”) which requires it—
(i) to take steps specified in the notice, or
(ii) to refrain from taking steps specified in the notice;
(d) the regulations must provide that where the Commissioner is satisfied that a relevant operator has failed or is failing to comply with the duties or has failed to comply with an information notice, an assessment notice or an enforcement notice, the Commissioner may, by written notice (a “penalty notice”), require the person to pay to the Commissioner an amount in sterling specified in the notice, the maximum amount of the penalty that may be imposed by a penalty notice being the “higher maximum amount” as defined in section 157 of the Data Protection Act 2018; and
(e) the regulations may provide for the procedure and rights of appeal 30 in relation to the giving of an information notice, an assessment notice, an enforcement notice or a penalty notice.
(2) The regulations must provide that any failure to comply with the duties by a relevant operator shall be directly actionable by any copyright owner who is adversely affected by such failure, and that such copyright owner will be entitled to recover damages for any loss suffered and to injunctive relief.
(3) The regulations must provide that the powers of the Commissioner and the rights of a copyright owner will apply in relation to a relevant operator providing a service from outside the United Kingdom (as well as such one provided from within the United Kingdom).
(4) The Secretary of State must lay before Parliament a draft of the statutory instrument containing the regulations under this section within six months of the day on which this Act is passed and the regulations are subject to the affirmative procedure.”

This new clause grants the Information Commissioner enforcement powers to ensure compliance with AI and web crawler transparency rules, including penalties for breaches.

NC7

To move the following Clause—
“Right to use non-digital verification services
(1) This section applies when an organisation—
(a) requires an individual to use a verification service; and
(b) uses a digital verification service for that purpose.
(2) Where it is reasonably practicable for an organisation to offer a non-digital method of verification, the organisation must—
(a) make a non-digital alternative method of verification available to any individual required to use a verification service; and
(b) provide information about digital and non-digital methods of verification to those individuals before verification is required.”

This new clause would create a duty upon organisations to support digital inclusion by offering non-digital verification services where practicable.

NC8

To move the following Clause—
“Data Vision and Strategy
Within six months of Royal Assent of this Act, the Secretary of State must publish a “Data Vision and Strategy” which outlines—
(a) the Government’s data transformation priorities for the next five years; and
(b) steps the Government will take to ensure the digitisation of Government services.”

NC9

To move the following Clause—
“Departmental Board Appointments
(1) Within six months of the day on which this Act is passed—
(a) Government departments;
(b) NHS England; and
(c) NHS trusts
shall appoint to their departmental board or equivalent body at least one of the following—
(i) Chief Information Officer;
(ii) Chief Technology Officer;
(iii) Chief Digital Information Officer;
(iv) Service Transformation Leader; or
(v) equivalent postholder.
(2) The person or persons appointed as under subsection (1) shall provide an annual report on the progress of the department or body towards the Government’s Data Vision and Strategy.”

This new clause would require digital leaders to be represented at executive level within Government departments and other bodies.

NC10

To move the following Clause—
“Data use in Public Service Delivery Review
(1) The Secretary of State must, every 12 months, lay before Parliament a “Data use in Public Service Delivery Review”.
(2) The Data use in Public Service Delivery Review shall include, but is not limited to assessment of the steps being taken to—
(a) improve the Government’s use of data in public service delivery over the previous 12 months;
(b) expand the use of data to support increased and improved digital services in public service delivery;
(c) improve expertise and digital talent within Government departments to help expand the use of data for public service delivery; and
(d) facilitate and regulate for better use of data in the delivery of public services.”

This new clause would require an annual assessment by the Secretary of State to examine the steps being taken to facilitate and regulate the use of data in the delivery of public services using digital and online technologies.

NC30

To move the following Clause- "Access to a deceased child's social media data (1) Where a person under 18 years of age has deceased, a parent or legal guardian (the 'requestor') may request from any internet service provider (ISP) the child's user data from up to 12 months prior to the date of death. (2) The ISP must provide a copy of the requested data, or direct account access, upon verification of the requestor's identity and relationship to the deceased person, and no court order shall be required for such disclosure. (3) "User data” includes all content, communications, or metadata generated by or associated with the deceased person's online activity, including stored messages and posts, except where the deceased person had explicitly directed otherwise prior to death. (4) The ISP may refuse or redact specific data only where— (a) disclosure would unduly infringe the privacy rights of another individual, (b) the deceased person had explicitly opted out before death, (c) there is a conflicting court order, or (d) a serious risk to public safety or national security would result. (5) In providing data under this section, the ISP must comply with data protection legislation. (6) This section constitutes a lawful basis for disclosure under Article 6 of the UK GDPR. (7) The Secretary of State may, by regulations subject to the affirmative resolution procedure- (a) provide guidance on verifying parent or guardian status, (b) clarify any additional grounds for refusal, and (c) prescribe safeguards to protect third-party confidentiality. (8) For the purposes of this section— "internet service provider (ISP)” includes any provider of social media, messaging, or other online platforms; and "data protection legislation” has the meaning given in section 51 of this Act.”

49

Clause 70, page 78, leave out lines 15 to 19

This amendment would remove subsections (2)(b) and (c) from the Bill which would create a new lawful ground for processing personal data by way of inserting a new Article into the UK GDPR.

53

Clause 70, page 78, line 17, after “interest” insert “, excluding personal health data”

This amendment would exclude personal health data from being a recognised legitimate interest.

50

Clause 70, leave out from line 24 on page 78 to line 32 on page 79

This amendment omits subsection (4), (5) and (6) which make amendments to UK GDPR to define certain data processing activities as “recognised legitimate interests”.

51

Clause 80, page 95, line 19, at end insert—
“(3) To qualify as meaningful human involvement, a review must be performed by a person with the necessary competence, training, authority to alter the decision and analytical understanding of the data.”

This amendment would make clear that in the context of new Article 22A of the UK GDPR, for human involvement to be considered as meaningful a review must be carried out by a competent person.

52

Schedule 14, page 242, line 33, at end insert—
“(1A) The appointment of the Chair of the Information Commission must be subject to approval by a resolution of each House of Parliament.”

This amendment seeks to strengthen the regulator’s independence by subjecting key appointments to Parliamentary approval.

54

Clause 127, page 161, line 36, at end insert—
“(6A) An authority which retains biometric data under this Part must—
(a) review the necessity and proportionality of retention every 12 months, and
(b) erase the biometric data unless continued retention is strictly necessary for a lawful purposes, the reasons for which must be recorded and reviewable by the Information Commission.
(6B) The Secretary of State must publish an annual report on the retention and use of biometric data under this Part, including statistical data on the number of records retained, the time period of retainment, and the purposes of retainment.”

This amendment would introduce mandatory periodic reviews of retained biometric data, requiring erasure unless the authority can demonstrate ongoing necessity. It also would mandate annual transparency reporting to Parliament on biometric use and retention.

NC22

To move the following Clause—
“Statement on changes to recognise legitimate interest
(1) The Secretary of State must publish a statement outlining the purpose of any additions or variations to what constitutes a recognised legitimate interest if they exercise powers contained under section 70.
(2) This statement must reference—
(a) the purpose of the addition or variation,
(b) whether it is appropriate to specific data controllers, and
(c) the timeline for its relevance.”

This new clause would require the Secretary of State to publish a statement if they add or vary what constitutes a recognised legitimate interest under powers contained in section 70.

NC23

To move the following Clause—
“Definition of meaningful human involvement in automated decision-making
The Secretary of State must, in conjunction with the Information Commission and within six months of the day on which this Act is passed, produce a definition of what constitutes meaningful human involvement in automated decision-making or clearly set out their reasoning as to why a definition is not required.”

This new clause would require the Secretary of State to produce a definition of meaningful human involvement in automated decision-making, in collaboration with the Information Commission, or clearly set out reasoning why this is not required.

NC24

To move the following Clause—
“Register of algorithmic tools used in public sector decision-making
(1) The Secretary of State must establish and maintain, or arrange for the establishment and maintenance of, a public register of all automated or semi-automated systems used by public authorities to make, or materially influence, decisions affecting the rights, entitlements or legitimate expectations of individuals.
(2) A public authority that uses or intends to use an automated or semi-automated decisionmaking tool must notify the Secretary of State of—
(a) the name or brief description of the tool;
(b) the decision or class of decisions in which it is used;
(c) the nature and source of the data used by the tool; and
(d) details of any meaningful human review required by law or policy.
(3) A public authority must not deploy an automated or semi-automated decisionmaking tool unless the information specified in subsection (2) has been submitted to the register.
(4) The Secretary of State must publish guidance on compliance with this section, following consultation with the Information Commission.”

This new clause would create a publicly accessible register for AI and algorithmic tools in the public sector.

NC25

To move the following Clause—
“Promotion of public-interest data trusts and communities
(1) The Secretary of State must, within 12 months of this Act being passed, lay before Parliament a strategy for promoting data trusts and community data governance models for the public interest (referred to in this section as ‘data trusts’).
(2) That strategy must include—
(a) a definition of data trusts or data communities which prioritise ethical and responsible use of personal data;
(b) mechanisms for ensuring meaningful participant control and governance over shared datasets;
(c) potential incentives for organisations to participate in or develop such data trusts;
(d) safeguards to protect individuals’ rights and freedoms when data is shared;
(e) requirements for transparency in data trusts’ decision-making, including governance arrangements and any commercial partnerships;
(f) arrangements for ongoing independent oversight and review; and
(g) an assessment of how these models might advance innovation, economic growth, and data-driven research in socially beneficial areas such as health, climate resilience, and energy
(3) The Secretary of State must consult—
(a) the Information Commission,
(b) UK Research and Innovation,
(c) relevant civil society groups, and such other persons as the Secretary of State considers appropriate prior to laying the strategy under subsection (1).
(4) The Secretary of State must, at least once every three years, publish a progress report on how data trusts and data communities are being used and how they have contributed to the public interest, including any recommendations for further legislative or policy changes.”

This new clause would require the Secretary of State to develop a formal strategy for data trusts and to report periodically on progress. Encourages innovative but responsible data use.

NC26

To move the following Clause—
“Provision of explanations for high-risk AI decisions
(1) Where a decision based wholly or partly on automated processing, including AI or machine learning, has a legal or similarly significant effect on a data subject, that data subject has the right to obtain from a data controller, on request—
(a) a concise, explanation of the reasons and criteria used by the automated processing to reach the decision;
(b) a description of the principal factors or features that most significantly influenced the outcome; and
(c) meaningful information about how to appeal, or request human review of, that decision.
(2) In this section, ‘legal or similarly significant effect’ includes (but is not limited to) decisions affecting an individual’s access to credit, employment, insurance, healthcare, social security, or other key public or private sector services.
(3) The Secretary of State must by regulations define the criteria and thresholds for ‘high-risk AI decisions’ to which this section applies, following consultation with the Information Commission, technical experts, civil society bodies, and such other persons as the Secretary of State considers appropriate.
(4) Regulations under subsection (3) are subject to the affirmative resolution procedure.”

This new clause would give individuals a right to obtain from data controllers an explanation of the key factors determining an AI outcome and provide a mechanism to appeal or request a human review of high-impact automated decisions.

NC27

To move the following Clause—
“Secretary of State’s powers in relation to the Information Commission
(1) Prior to issuing any guidance or statement of strategic priorities to the Information Commission, the Secretary of State must consult—
(a) the Science, Innovation and Technology Committee of the House of Commons, and
(b) the Senedd, Scottish Parliament, or Northern Ireland Assembly where guidance relates to devolved powers.
(2) The Secretary of State may not reject or change a Code of Practice prepared by the Information Commission without a resolution to do so from each House of Parliament.”

This new clause seeks to strengthen the regulator’s independence by limiting ministerial powers to direct or override the Information Commission without oversight.

NC28

To move the following Clause—
“Public-interest data altruism
(1) The Secretary of State must, within 12 months of this Act being passed, establish a framework to recognise and register ‘data altruism organisations’ that manage personal data voluntarily contributed for public-interest objectives.
(2) A data altruism organisation registered under this section must—
(a) demonstrate enhanced governance, transparency, and accountability measures;
(b) publish clear terms on how personal data is used or shared; and
(c) uphold safeguards protecting data subjects’ rights.
(3) The Secretary of State may by regulations—
(a) provide for eligibility criteria and the application process for data altruism organisations;
(b) pecify ongoing compliance and auditing requirements;
(c) establish processes for revocation of registration where an organisation fails to meet the criteria.
(4) In developing the framework under this section, the Secretary of State must consult the Information Commission, data subjects, civil society organisations, and such other persons as the Secretary of State considers appropriate.
(5) Regulations under this section are subject to the affirmative resolution procedure.”

This new clause would require creation of a statutory framework for data altruism allowing organisations to register as data altruism organisations where they collect and process personal data for public-interest purposes under enhanced transparency, governance, and accountability standards.

NC29

To move the following Clause—
“Compliance with Section 124 of this Act and Part 3, Chapter 2 of the Online Safety Act 2023
(1) The Secretary of State must, within 12 months of the passing of this Act, publish a report on provisions of Section 124 of this Act.
(2) A report published under subsection (1) must include an analysis of the level compliance to notices requiring social media companies, including Category 1 services under the Online Safety Act 2023, to preserve data relating to the use of specified regulated services by children where that information may be needed to respond to an information notice issued under s.101 or to produce a report under s.163 of the Online Safety Act.”

This new clause would require the Secretary of State to publish a report assessing compliance with Section 124 of this Act and Part 3, Chapter 2 of the Online Safety Act 2023.

NC21

To move the following Clause—
“Age of consent for social media data processing
(1) The UK GDPR is as amended as follows.
(2) In Article 8 of the UK GDPR (Conditions applicable to child's consent in relation to information society services)
After paragraph 1 insert —
“(1A) References to 13 years old in paragraph 1 shall be read as 16 years old in the case of social networking services processing personal data for the purpose of delivering personalised content, including targeted advertising and algorithmically curated recommendations.
(1B) For the purposes of paragraph 1A “social networking services” means any online service that—
(a) allows users to create profiles and interact publicly or privately with other users, and
(b) facilitates the sharing of user-generated content, including text, images, or videos, with a wider audience.
(1C) Paragraph 1B does not apply to—
(a) Educational platforms and learning management systems provided in recognised educational settings, where personal data processing is solely for educational purposes.
(b) Health and well-being services, including NHS digital services, mental health support applications, and crisis helplines, where personal data processing is necessary for the provision of care and support””

This new clause would raise the age for processing personal data in the case of social networking services from 13 to 16.

22

Clause 95, page 120, line 31, leave out subsection (1)

This amendment removes a subsection which was inserted at Report stage in the Lords.

23

Page 170, line 2, leave out Clause 135

This amendment removes clause 135, which was inserted at Report stage in the Lords.

24

Page 170, line 23, leave out Clause 136

This amendment removes clause 136, which was inserted at Report stage in the Lords.

25

Page 171, line 15, leave out Clause 137

This amendment removes clause 137, which was inserted at Report stage in the Lords.

26

Page 171, line 37, leave out Clause 138

This amendment removes clause 138, which was inserted at Report stage in the Lords.

27

Page 173, line 1, leave out Clause 139

This amendment removes clause 139, which was inserted at Report stage in the Lords.

28

Clause 141, page 173, line 27, leave out “or soliciting the creation of”

This amendment is consequential on Amendment 29.

29

Clause 141, page 173, line 35, leave out from beginning to end of line 8 on page 174

This amendment removes a new offence of soliciting the creation of a purported intimate image of an adult. For a replacement offence, see Amendment 31.

30

Clause 141, page 174, line 26, at end insert—
“(7A) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for creating the purported intimate image.”

This amendment adds a defence of reasonable excuse to the new offence of creating a purported intimate image of an adult.

31

Clause 141, page 174, line 29, at end insert—
“66EA Requesting the creation of purported intimate image of adult
(1) A person (A) commits an offence if—
(a) A intentionally requests the creation of a purported intimate image of another person (B) (either in general or specific terms),
(b) B does not consent to A requesting the creation of the purported intimate image, and
(c) A does not reasonably believe that B consents.
(2) A person (A) commits an offence if—
(a) A intentionally requests that, if a purported intimate image of another person (B) is created, it includes or excludes something in particular (whether relating to B’s appearance, the intimate state in which B is shown or anything else),
(b) B does not consent to A requesting the inclusion or exclusion of that thing, and
(c) A does not reasonably believe that B consents.
(3) References in this section to making a request (however expressed) include doing an act which could reasonably be taken to be a request (such as, for example, indicating agreement in response to an offer or complying with conditions of an offer).
(4) References in this section to making a request (however expressed) are references to—
(a) making a request directed to a particular person or persons, or
(b) making a request so that it is available to one or more persons (or people generally), without directing it to a particular person or persons.
(5) References in this section to consent to a person requesting something are—
(a) in a case described in subsection
(4)(a)
, references to consent to a request being made that is directed to the particular person or persons, and
(b) in a case described in subsection
(4)(b)
, references to consent to a request being made so that it is available to the person or persons (or people generally), as appropriate.
(6) An offence under this section is committed—
(a) regardless of whether the purported intimate image is created,
(b) regardless of whether the purported intimate image, or the particular thing to be included in or excluded from such an image, is also requested by another person, and
(c) regardless of where in the world the person or persons mentioned in subsection and (b) is or are located.
(4)(a)
(7) It is a defence for a person charged with an offence under this section to prove that the person had a reasonable excuse for making the request.
(8) A person who commits an offence under this section is liable on summary conviction to imprisonment for a term not exceeding the maximum term for summary offences or a fine (or both).
(9) In this section, references to a purported intimate image, to creating such an image and to a person shown in an intimate state have the same meaning as in section 66E.”

This amendment makes it an offence to request the creation of a purported intimate image of an adult without consent.

32

Clause 141, page 174, line 30, leave out “soliciting” and insert “requesting”

This amendment is consequential on Amendments 29 and 31.

33

Clause 141, page 174, line 32, leave out “section 66E” and insert “sections 66E and 66EA”

This amendment provides that the definitions in new section 66F of the Sexual Offences Act 2003 apply for the purposes of new section 66EA of that Act (see Amendment 31) (as well as for the purposes of new section 66E).

34

Clause 141, page 174, line 33, leave out “the creation of a purported intimate image” and insert “an act”

This amendment, and Amendments 35 and 36, adjust the definition of “consent” in new section 66F of the Sexual Offences Act 2003 so that it works for the purposes of new section 66EA of that Act (see Amendment 31) (as well as for the purposes of new section 66E).

35

Clause 141, page 174, line 34, leave out “of creation”

See the explanatory statement for Amendment 34.

36

Clause 141, page 174, line 35, at end insert “(and see also section
66EA(5)
)”

See the explanatory statement for Amendment 34.

37

Clause 141, page 175, line 10, at end insert—
“(8) The “maximum term for summary offences” means—
(a) if the offence is committed before the time when section 281(5) of the Criminal Justice Act 2003 comes into force, six months;
(b) if the offence is committed after that time, 51 weeks.”

This amendment explains what is meant by the “maximum term for summary offences” in new sections 66E and 66EA of the Sexual Offences Act 2003. (New section 66EA is inserted by Amendment 31).

38

Clause 141, page 175, line 10, at end insert—
“66G Creating, or requesting the creation of, purported intimate image of adult: time limit for prosecution
(1) Notwithstanding section 127(1) of the Magistrates’ Courts Act 1980, a magistrates’ court may try an information or written charge relating to an offence under section 66E or 66EA if the information is laid or the charge is issued—
(a) before the end of the period of 3 years beginning with the day on which the offence was committed, and
(b) before the end of the period of 6 months beginning with the day on which evidence which the prosecutor thinks is sufficient to justify a prosecution comes to the prosecutor’s knowledge.
(2) A certificate signed by or on behalf of a prosecutor stating the date on which evidence described in subsection
(1)(b)
came to the prosecutor’s knowledge is conclusive evidence of that fact.”

This amendment extends the period during which a person may be prosecuted for an offence under new section 66E or 66EA of the Sexual Offences Act 2003 (creating, or requesting the creation of, purported intimate image of adult).

39

Clause 141, page 175, line 12, after “66E” insert “, 66EA”

This amendment provides that references to an image of a person in new section 66EA of the Sexual Offences Act 2003 (see Amendment 31), like references to such an image in new section 66E of that Act, do not include an image of an imaginary person.

40

Clause 141, page 175, line 12, at end insert—
“(3A) In the Armed Forces Act 2006, after section 177D insert—
“177DA Purported intimate images to be treated as used for purpose of certain offences
(1) This section applies where a person commits an offence under section 42 as respects which the corresponding offence under the law of England and Wales is an offence under section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult).
(2) The purported intimate image to which the offence relates, and anything containing it, is to be regarded for the purposes of section 177C(3) (and section 94A(3)(b)(ii)) as used for the purposes of committing the offence (including where it is committed by aiding, abetting, counselling or procuring).””

This amendment provides that deprivation orders can be made under the Armed Forces Act 2006 in connection with an offence under new section 66E of the Sexual Offences Act 2003 (creating purported intimate image of adult).

41

Clause 141, page 175, line 12, at end insert—
“(3B) In Part 2 of Schedule 3 to the Serious Crime Act 2007 (offences to be disregarded in reckoning whether an act is capable of encouraging or assisting the commission of an offence: England and Wales), after paragraph 38 insert—
“Sexual Offences Act 2003
38ZA An offence under section 66EA of the Sexual Offences Act 2003 (requesting the creation of purported intimate image of adult).””

This amendment provides that a person cannot be guilty, under Part 2 of the Serious Crime Act 2007, of encouraging or assisting the offence under new section 66EA of the Sexual Offences Act 2003 (requesting the creation of a purported intimate image) (see Amendment 31).

42

Clause 141, page 175, line 17, leave out “or soliciting the creation of”

This amendment is consequential on Amendment 29.

43

Clause 144, page 177, line 25, leave out “141” and insert “141(1) to (3) and (4)”

This amendment, and Amendment 44, are consequential on Amendments 40 and 41.

44

Clause 144, page 177, line 26, leave out “extends” and insert “extend”

See the explanatory statement for Amendment 43.

45

Clause 144, page 177, line 26, at end insert—
“(d) section 141(3A) (amendment of the Armed Forces Act 2006) extends to—
(i) England and Wales, Scotland and Northern Ireland,
(ii) the Isle of Man, and
(iii) the British overseas territories, except Gibraltar;”

This amendment provides for the amendment of the Armed Forces Act 2006 made by Amendment 40 to have the same extent as that Act.

46

Clause 144, page 177, line 26, at end insert—
“(d) section 141(3B) (amendment of the Serious Crime Act 2007) extends to England and Wales and Northern Ireland only.”

This amendment provides for the amendment of the Serious Crime Act 2007 made by Amendment 41 to have the same extent as that Act.

47

Clause 144, page 177, line 26, at end insert—
“(5A) The powers conferred by section 384(1) and (2) of the Armed Forces Act 2006 (powers to extend provisions to the Channel Islands and to make provisions apply with modifications as they extend to the Channel Islands, the Isle of Man and British overseas territories other than Gibraltar) may be exercised in relation to section 177DA of that Act (inserted by section 141(3A) of this Act).”

This amendment provides that the new section inserted in the Armed Forces Act 2006 by Amendment 40 may, like the other provisions of that Act, be extended to the Channel Islands and modified as it extends to those Islands, the Isle of Man and British overseas territories other than Gibraltar.

NC16

To move the following Clause—
“Data use in Public Service Delivery Review
(1) The Secretary of State must, every 12 months, lay before Parliament a “Data use in Public Service Delivery Review”.
(2) The Data use in Public Service Delivery Review shall include, but is not limited to assessment of the steps being taken to—
(a) improve the Government’s use of data in public service delivery over the previous 12 months;
(b) expand the use of data to support increased and improved digital services in public service delivery;
(c) improve expertise and digital talent within Government departments to help expand the use of data for public service delivery; and
(d) facilitate and regulate for better use of data in the delivery of public services.”

This new clause would require an annual assessment by the Secretary of State to examine the steps being taken to facilitate and regulate the use of data in the delivery of public services using digital and online technologies.

NC17

To move the following Clause—
“Statement on application of the Copyright, Designs and Patents Act 1988 to activities by web-crawlers or artificial intelligence models
The Secretary of State must, within three months of Royal Assent, issue a statement, by way of a copyright notice issued by the Intellectual Property Office or otherwise, in relation to the application of the Copyright, Designs and Patents Act 1988 to activities conducted by webcrawlers or artificial intelligence models which may infringe the copyright attaching to creative works.”

NC18

To move the following Clause—
“Report on regulation of web-crawlers and artificial intelligence models on use of creative content
The Secretary of State must, within three months of Royal Assent, lay before Parliament a report which includes a plan to help ensure proportionate and effective measures for transparency in the use of copyright materials in training, refining, tuning and generative activities in AI.”

NC19

To move the following Clause—
“Report on reducing barriers to market entry for start-ups and smaller AI enterprises on use of and access to data
The Secretary of State must, within three months of Royal Assent, lay before Parliament a report which includes a plan to reduce barriers to market entry for start-ups and smaller AI enterprises on use of and access to data.”

NC20

To move the following Clause—
“Publication of a technological standard
The Secretary of State must, within 12 months of Royal Assent, publish a technological standard for a machine-readable digital watermark for the purposes of identifying licensed content and relevant information associated with the licence.”

48

Title, line 18, leave out “and solicitation”

This amendment is consequential on Amendment 29.

21

Clause 117, page 149, line 11, at end insert—
“(5A) In Schedule 13, paragraph 1(1), at end insert—
“(j) advise the Government on measures relating to data ownership, and individuals’ rights and freedoms, in the delivery of its Data Vision and Strategy.””

This amendment amends the functions of the Information Commission to allow it to advise the Government in the delivery of a Data Vision and Strategy.

NC1

To move the following Clause—
“Requirements of public sector organisations on use of algorithmic or automated decision-making systems
(1) No later than the commencement of use of a relevant algorithmic or automated decision-making system, a public authority must—
(a) give notice on a public register that the decision rendered will be undertaken in whole, or in part, by an algorithmic or automated decision-making system,
(b) make arrangements for the provision of a meaningful and personalised explanation to affected individuals of how and why a decision affecting them was made, including meaningful information about the decision-making processes, and an assessment of the potential consequences of such processing for the data subject, as prescribed in regulations to be made by the Secretary of State,
(c) develop processes to—
(i) monitor the outcomes of the algorithmic or automated decision-making system to safeguard against unintentional outcomes and to verify compliance with this Act and other relevant legislation, and
(ii) validate that the data collected for, and used by, the system is relevant, accurate, up-to-date, and in accordance with the Data Protection Act 2018, and
(d) make arrangements to conduct regular audits and evaluations of algorithmic and automated decision-making systems, including the potential risks of those systems and steps to mitigate such risks, as prescribed in regulations to be made by the Secretary of State.
(2) “Algorithmic decision system” or “automated decision system” mean any technology that either assists or replaces the judgement of human decision-makers.
(3) Regulations under this section are subject to the affirmative resolution procedure.”

This new clause would require the public sector to provide increased transparency to service users in informing when automated decision making had been used. It would also require them to develop processes to monitor the outcomes from utilising automated decision-making.

NC2

To move the following Clause—
“Impact of this Act and other developments at national and international level on EU data adequacy decision
Within three months of this Act receiving Royal Assent, the Secretary of State must carry out an assessment of the likely impact on the European Union data adequacy decisions relating to the United Kingdom of the following—
(a) this Act;
(b) other changes to the United Kingdom’s domestic frameworks which are relevant to the matters listed in Article 45(2) of the UK GDPR (transfers on the basis of an adequacy decision);
(c) relevant changes to the United Kingdom’s international commitments or other obligations arising from legally binding conventions or instruments, as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.”

This new clause requires the Secretary of State to carry out an assessment of the impact of this Act and other changes to the UK’s domestic and international frameworks relating to data adequacy.

NC3

To move the following Clause—
“Health and social care data records
(1) A person processing health and/or social care data for research purposes must maintain a record of the basis on which that data was shared or accessed.
(2) Such a person must make available a description of—
(a) the categories of data used,
(b) the intended research purpose,
(c) where possible, the scope of organisations or persons who will have access to the data,
(d) how individuals can exercise their data subject rights under Article 13 to Article 22 of the UK GDPR.
(3) The Secretary of State must by regulations set out requirements for how the record set out by subsection (2) must be published.”

This new clause would require researchers using health/social care data to keep and publish records explaining what data is used and for what reason.

NC4

To move the following Clause—
“Register of algorithmic tools used in public sector decision-making
(1) The Secretary of State must establish and maintain, or arrange for the establishment and maintenance of, a public register of all automated or semi-automated systems used by public authorities to make, or materially influence, decisions affecting the rights, entitlements or legitimate expectations of individuals.
(2) A public authority that uses or intends to use an automated or semi-automated decision-making tool must notify the Secretary of State of—
(a) the name or brief description of the tool,
(b) the decision or class of decisions in which it is used,
(c) the nature and source of the data used by the tool, and
(d) details of any meaningful human review required by law or policy.
(3) The information set out in subsection (2) must be submitted to the register prior to the deployment of any automated or semi-automatic decision-making tool by a public authority.
(4) The Secretary of State must, within six months of the passage of this Act, publish guidance on compliance with this section, following consultation with the Information Commission.”

This new clause would create a publicly accessible register for AI and algorithmic tools in the public sector.

NC5

To move the following Clause—
“Parliamentary approval for changes to data safeguards
(1) Where the Secretary of State proposes to exercise any power under this Act to amend, vary or remove a safeguard relating to—
(a) recognised legitimate interests,
(b) automated decision-making,
(c) the definition of “special category” data, or
(d) any data subject right provided under the UK GDPR,
the Secretary of State must lay before both Houses of Parliament draft regulations containing the proposed changes and an explanatory statement.
(2) The explanatory statement must include evidence from consultations with the Information Commission, data subjects, and relevant stakeholders, and an assessment of any impact on data adequacy with the European Union where they have occurred.
(3) The draft regulations referred to in subsection (1) are subject to affirmative procedure.”

This new clause would prevent ministerial changes being made to data safeguards without parliamentary debate and approval.

NC6

To move the following Clause—
“Public-interest data trusts and communities
(1) The Secretary of State must, within 12 months of this Act being passed, lay before Parliament a strategy for promoting data trusts and community data governance models for the public interest (referred to in this section as “data trusts”).
(2) That strategy must include—
(a) a definition of data trusts or data communities which prioritise ethical and responsible use of personal data,
(b) mechanisms for ensuring meaningful participant control and governance over shared datasets,
(c) potential incentives for organisations to participate in or develop such data trusts,
(d) safeguards to protect individuals’ rights and freedoms when data is shared,
(e) requirements for transparency in data trusts’ decision-making, including governance arrangements and any commercial partnerships,
(f) arrangements for ongoing independent oversight and review, and
(g) an assessment of how these models might advance innovation, economic growth, and data-driven research in socially beneficial areas such as health, climate resilience, and energy.
(3) The Secretary of State must consult the Information Commission, UK Research and Innovation, relevant civil society groups, and such other persons as the Secretary of State considers appropriate prior to laying the strategy under subsection (1).
(4) The Secretary of State must, at least once every three years, publish a progress report on how data trusts and data communities are being used and how they have contributed to the public interest, including any recommendations for further legislative or policy changes.”

This new clause would require the Secretary of State to develop a formal strategy for data trusts and to report periodically on progress. Encourages innovative but responsible data use.

NC7

To move the following Clause—
“Information regarding high-risk AI decisions
(1) Where a decision based wholly or partly on automated processing, including AI or machine learning, has a legal or similarly significant effect on a data subject, that data subject has the right to request the following information from a data controller—
(a) an explanation of the reasons and criteria used by the automated processing to reach the decision,
(b) a description of the principal factors or features that most significantly influenced the outcome, and
(c) information about process for appeal, or request human review of, that decision.
(2) In this section, ‘legal or similarly significant effect’ includes decisions affecting an individual’s access to credit, employment, insurance, healthcare, social security, or other key public or private sector services.
(3) The Secretary of State must by regulations define the criteria and thresholds for ‘high-risk AI decisions’ to which this section applies, following consultation with the Information Commission, technical experts, civil society bodies, and such other persons as the Secretary of State considers appropriate.
(4) Regulations under subsection (3) are subject to the affirmative resolution procedure.”

This new clause would give individuals a right to obtain from data controllers an explanation of the key factors determining an AI outcome and provide a mechanism to appeal or request a human review of “high-impact” automated decisions.

NC8

To move the following Clause—
“Intelligence services and law enforcement data-sharing: enhanced oversight
(1) Where intelligence services or law enforcement bodies share personal data under this Act, the Commissioner must review the nature, purposes, and scope of the data-sharing annually and produce a report assessing—
(a) the necessity and proportionality of the data-sharing,
(b) any impact on individuals’ rights, and
(c) any recommendations for improved safeguards or remedial measures.
(2) The Commissioner must lay the report under subsection (1) before both Houses of Parliament, subject to any redactions strictly necessary on national security grounds.
(3) This section does not authorise or require the Commissioner to disclose information that could jeopardise national security, but the Commissioner must endeavour to provide the maximum transparency compatible with security requirements.
(4) The Secretary of State must respond to each report within 90 days of their laying before Parliament, addressing any recommendations made by the Commissioner.”

This new clause would require the Information Commission to review, annually, data-sharing by intelligence and law enforcement services, and to publish a report of its findings.

NC9

To move the following Clause—
“Right to use non-digital verification services
(1) This section applies when an organisation—
(a) requires an individual to use a verification service; and
(b) uses a digital verification service for that purpose.
(2) Where it is reasonably practicable for an organisation to offer a non-digital method of verification, the organisation must—
(a) make a non-digital alternative method of verification available to any individual required to use a verification service; and
(b) provide information about digital and non-digital methods of verification to those individuals before verification is required.”

This new clause would create a duty upon organisations to support digital inclusion by offering non-digital verification services where practicable.

NC10

To move the following Clause—
“Data Vision and Strategy
Within six months of Royal Assent of this Act, the Secretary of State must publish a “Data Vision and Strategy” which outlines—
(a) the Government’s data transformation priorities for the next five years; and
(b) steps the Government will take to ensure the digitisation of Government services.”

NC11

To move the following Clause—
“Departmental Board Appointments
(1) Within six months of the day on which this Act is passed—
(a) Government departments;
(b) NHS England; and
(c) NHS trusts
shall appoint to their departmental board or equivalent body at least one of the following—
(i) Chief Information Officer;
(ii) Chief Technology Officer;
(iii) Chief Digital Information Officer;
(iv) Service Transformation Leader; or
(v) equivalent postholder.
(2) The person or persons appointed as under subsection (1) shall provide an annual report on the progress of the department or body towards the Government’s Data Vision and Strategy.”

This new clause would require digital leaders to be represented at executive level within Government departments and other bodies.

NC12

To move the following Clause—
“Digital talent review
(1) Within three months of the day on which this Act is passed, all Government Departments shall launch a digital talent review, to report within 12 months of the day on which this Act is passed.
(2) The digital talent review shall include, but is not limited to assessment of—
(a) digital career paths within the Department;
(b) digital leadership within the Department;
(c) actions taken to develop the digital culture within the Department; and
(d) how those assessments will assist the Department to improve public service delivery.”

NC13

To move the following Clause—
“State of Digital Government Review
The Secretary of State shall, every 12 months, lay before Parliament a “State of Digital Government Review”.”

This new clause would require the Secretary of State to publish a Digital Government Review each year.

NC14

To move the following Clause—
“Digitisation of Public Services
The Secretary of State shall report to Parliament within six months of the day on which this Act is passed the proportion of public services available online, 24 hours a day, every day, and make a further such report every six months until that proportion reaches 100 per cent.”

This new clause would make it a statutory requirement to report on Digitisation of Public Services.

NC15

To move the following Clause—
“Consumer Data Right: multi-sector extension
(1) The Secretary of State must, within 12 months of this Act being passed, publish a roadmap for implementing a cross-sector ‘Consumer Data Right’ to enable individuals and small businesses to control and share their data securely and effectively in the following sectors—
(a) energy,
(b) telecommunications,
(c) financial services, and
(d) such other sectors as regulations may specify.
(2) The roadmap under subsection (1) must set out—
(a) technical standards and data portability protocols,
(b) timelines for phased implementation in each sector,
(c) consumer protection measures, and
(d) oversight responsibilities for any designated cross-sector data regulator.
(3) In preparing the roadmap, the Secretary of State must consult relevant regulators, consumer groups, industry representatives, and any other persons the Secretary of State considers appropriate.
(4) The Secretary of State may by regulations make provision to implement the Consumer Data Right in additional sectors or extend obligations in existing ones.
(5) Regulations under this section are subject to the affirmative resolution procedure.”

This new clause would require the Secretary of State to develop and publish a roadmap for extending “smart data” portability rights beyond finance to other sectors, such as energy and telecommunications.

17

Clause 58, page 63, leave out lines 35 and 36

This amendment is linked to Amendments 18 to 20. See explanatory statement to Amendment 20.

18

Clause 58, page 64, leave out lines 1 to 3

This amendment is linked to Amendments 17, 19 and 20. See explanatory statement to Amendment 20.

19

Clause 58, page 64, line 14, leave out “or for a fee;”

This amendment is linked to Amendments 17, 18 and 20. See explanatory statement to Amendment 20.

20

Clause 58, page 64, leave out lines 15 to 22

This amendment is linked to Amendments 17 to 19. These amendments remove the ability of the Secretary of State to make provisions about which persons may access the National Underground Asset Register and removes their ability to set a fee for access to the register.

13

Clause 67, page 75, line 26, leave out “and that is conducted in the public interest”

This amendment removes words from new paragraph 2 of Article 4 of the UK GDPR (meaning of processing for the purposes of scientific research). The words were inserted at Report stage in the Lords.

14

Schedule 15, page 255, line 35, at end insert—
“(5) This section does not authorise the processing of information if the processing would contravene the data protection legislation (but in determining whether it would do so, take into account the power conferred by this section).
(6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).”

This amendment provides that information may not be processed for the purposes of new section 251ZC of the Health and Social Care Act 2012 (public censure of relevant IT providers) if that would contravene the data protection legislation.

15

Page 173, line 13, leave out Clause 140

This amendment removes clause 140, which was inserted at Report stage in the Lords.

16

Clause 147, page 179, line 10, leave out subsection (2)

This amendment removes the privilege amendment inserted by the Lords.

1

Clause 8, page 12, line 18, leave out “imposed by a decision-maker” and insert “(referred to in sections
3(2)
and
5(3)
)”

This amendment amends a reference to conditions for authorisation or approval to receive customer data or business data so as to reflect the fact that conditions will not necessarily be imposed by decision-makers.

2

Clause 8, page 13, line 16, after second “specified” insert “documents or”

This amendment provides that regulations may require enforcers to publish or provide documents as well as information, making the regulation-making powers in relation to enforcers consistent with the powers in relation to decision-makers and interface bodies (under clauses 6(9) and 7(4)(k)). See also Amendments 3 and 5.

3

Clause 8, page 13, line 18, leave out “information about” and insert “documents or information relating to”

See the explanatory statement for Amendment 2.

4

Clause 8, page 13, line 18, leave out “, either generally or in relation to a particular case”

This amendment leaves out unnecessary words. Power for regulations to make provision generally or in relation to particular cases is conferred by clause 21(1)(a).

5

Clause 8, page 13, line 20, leave out “information about” and insert “documents or information relating to”

See the explanatory statement for Amendment 2.

6

Clause 10, page 16, line 8, at end insert—
“(f) about what must or may be done with amounts paid as penalties.”

This amendment confers express power to make provision about the treatment of amounts paid to enforcers as penalties, for consistency with similar powers in clauses 11(1)(b) (fees) and 12(1)(b) (levies).

7

Clause 14, page 19, line 3, at end insert—
“(ba) requiring section
2(4)
actors described in the regulations to use a prescribed interface, comply with prescribed interface standards or participate in prescribed interface arrangements when taking, facilitating or doing other things in connection with relevant financial services action;”

This amendment provides that the Treasury’s powers to confer rule-making powers on the Financial Conduct Authority in connection with the use of interfaces include powers relating to the use of interfaces when taking action described in clause 2(4) of the Bill (persons authorised to receive customer data taking action on behalf of customers). See also Amendment 9.

8

Clause 14, page 19, line 14, leave out “or (b)” and insert “, (b) or (ba)”

This amendment is consequential on Amendment 7.

9

Clause 14, page 20, line 11, at end insert—
““relevant financial services action” means action described in section
2(4)
taken in relation to services or digital content provided or supplied by a financial services provider;
“section 2(4) actor” means—
(a) a person who, in reliance on regulations under subsection (4) of section 2, takes action described in that subsection;
(b) a data holder or other person who facilitates or does other things in connection with such action.”

This amendment defines terms used in the paragraph inserted by Amendment 7.

10

Clause 28, page 30, line 32, leave out subsections (3) and (4)

This amendment removes subsections which were inserted at Report stage in the Lords.

11

Clause 45, page 43, line 12, leave out subsection (6)

This amendment removes a subsection which was inserted at Report stage in the Lords.

12

Clause 56, page 54, line 1, leave out lines 1 to 3

This amendment removes a subsection which was inserted at Report stage in the Lords.