Key Facts

• Amendments 78-101 aim to apply rights given to data subjects to decision subjects.
• New clause 12 proposes defining 'decision subject' in Article 4 as an identifiable individual subject to automated decision-making.
• Amendment 106 would require the ICO to have regard to decision subjects along with data subjects.
• New clause 12 would insert a definition of 'decision subject'.
• Amendments seek to extend rights for decision subjects at various points in the Bill.
• The Government argues current reference to data subjects covers decision subjects.
• Amendment 120 aims to ensure data controllers notify data subjects of decisions made via automated processing.
• The amendment seeks to balance power between those conducting automated decisions and those affected by them.
• Hollobone supports transparency and awareness of rights for individuals subject to automated decision-making.
• The statement is about the Data Protection and Digital Information Bill.
• Amendment 120 seeks to require data controllers to inform subjects whenever a significant decision about them was based solely on automated processing.
• Carol Monaghan indicates she may bring amendment 120 back during the Report stage.
• Amendment 75 requires the ICO to prepare a code of practice under section 124A of the Data Protection Act 2018.
• The code must interpret references to 'meaningful human involvement' and 'similarly significant'.
• The code must include examples of processing that do, and do not, fall within these definitions.
• The rise of AI has happened at an unprecedented speed.
• PwC UK suggests that UK GDP could be up to 10.3% higher by 2030 due to artificial intelligence.
• In 2020, nearly 40% of students received grades lower than expected from an automated system.
• The GDPR article 21 gives data subjects the right to object to processing unless there are compelling legitimate grounds for overriding their rights.
• Amendment 76 aims to prevent the Secretary of State from arbitrarily changing definitions and safeguards.
• Statutory guidance would be provided by the Information Commissioner on how terms apply in practice.
• The amendments address clause 44 and article 22 provisions under UK GDPR.
• The MP suggests that statutory guidance is necessary for defining 'meaningful human involvement' and 'similarly significant'.
• Proposed digital information principles include worker protection, transparency, and control over personal data.
• Amendment 122 would insert digital information principles into new section 50D of the DPA2018.
• The amendment aims to ensure that automated decision-making regulations consider fairness, trustworthiness, protection from harmful systems, and meaningful consultation with workers.
• Workers should have control over their data and be able to seek human review and redress when algorithmic systems impact them significantly.
• Royal Mail uses a digital assistant service to monitor worker activity.
• Amazon collects data from handheld scanners to assess worker performance.
• WeClock is a free mobile app helping workers track their own data profiles.
• Just Eat fired 11 couriers robotically after allegations of fraudulent activity, with average undeserved payments amounting to £1.44.
• Chi Onwurah previously worked at Ofcom as head of technology.
• The amendment proposes 'digital information principles at work' to ensure a fair, inclusive and trustworthy digital environment.
• John Whittingdale acknowledges the need for wider regulatory frameworks beyond data protection law.
• Amendment 17 addresses consequential amendments under Article 12(2) of the UK GDPR.
• The amendment aims for consistency with other amendments involving new Articles 22A to 22D.
• Philip Hollobone is discussing government amendments 18 to 23.
• Schedule 3 sets out consequential changes related to automated decision-making.
• Amendments 17 to 23 are minor technical updates to ensure consistency across data protection regulations.
• Clause 12 improves terminology in the UK GDPR and Data Protection Act, replacing 'appropriate technical and organisational measures' with 'appropriate measures, including technical and organisational measures'.
• Clause 13 removes article 27 of the UK GDPR, ending the requirement for overseas controllers or processors to appoint a representative in the UK under certain conditions.
• Article 27 of the UK GDPR currently requires controllers and processors based outside the UK to appoint a UK-based representative unless they process only occasionally or are public authorities.
• The Government’s impact assessment acknowledges limited data on the benefits of having an Article 27 representative due to its newness and exclusive application to non-UK entities.
• Removing the requirement could save large organisations up to £50,000 per year but stakeholders argue this figure may be overestimated.
• Clause 12 to 18 aim to give organisations greater flexibility regarding policies and procedures.
• The existing prescriptive rules are seen as imposing unnecessary burdens on businesses.
• A senior responsible individual will be designated where appropriate, overseeing data protection risks and ensuring compliance with the legislation.
• Clauses 15 and 16 aim to simplify record-keeping requirements under GDPR.
• Small businesses find current exemptions difficult to understand and apply.
• Clause 16 removes the justification requirement for logging personal data consultations or disclosures by officers.
• The change is estimated to save approximately 1.5 million policing hours.
• Amendment 103 would insert a new requirement into Article 35(11) of UKGDPR.
• Public authorities and government departments using public data must publish assessments of high-risk processing conducted under Article 35.
• Assessments published must be redacted where necessary for removing sensitive details, protecting public interests, or ensuring the security of data processing operations.
• The Bill loosens restrictions on processing personal data.
• The amendment would require publication of high-risk assessments completed by Government Departments or public authorities.
• DPIAs (Data Protection Impact Assessments) are crucial legal tests that weigh up whether an infringement of human rights is justified.
• Clause 17 reduces prescriptive requirements for data protection impact assessments.
• Clause 18 makes prior consultation with the ICO optional but allows it as a factor in administrative fines.
• Amendment 1 replaces mandatory submission of draft codes to the Information Commissioner with encouragement.
• Amendments 42 and 43 are made consequential on Amendment 40.
• Government amendments 24 to 29 aim to address technical changes for data transfers.
• Amendment 104 seeks to reinsert a principle in Article on general principles for international data transfers.
• Clause 21 introduces reforms to the UK’s international personal data transfers regime under schedules 5 and 6.
• Schedule 5 consolidates provisions for transferring personal data internationally and introduces articles 44A, 45A, 45B, 45C, and 47A.
• Schedule 6 amends parts of the Data Protection Act 2018 governing international transfers under the law enforcement processing regime.
• The Bill amends the adequacy-based framework and replaces it with a new outcomes-based approach through the data protection test.
• Stakeholders like Reset.tech and TUC are concerned that the new test could mean UK data is transferred to countries with lower standards of protection than previously allowed under the regime.
• Losing the EU’s data adequacy status would have real-world consequences for UK consumers and businesses, potentially costing hundreds of millions of pounds.
• Amendments 34 to 39 are minor, technical changes.
• The amendments clarify that controllers must use anonymous data unless personal data is necessary for research purposes.
• Processing to anonymise personal data is permitted under these amendments.
• Clause 24 introduces an exemption for processing personal data under the law enforcement regime for the purpose of safeguarding national security.
• It aligns existing exemptions with the UK GDPR and intelligence services regime.
• Subsection (2) removes organisational self-exemption powers regarding individual complaint rights under article 77 of the UK GDPR.
• Clauses 24, 25, and 26 increase opportunities for competent authorities to operate with reduced transparency regarding personal data.
• Rights and Security International warns that these clauses could violate UK’s obligations under the Human Rights Act 1998 and European convention on human rights.
• Clause 25(2) allows the Secretary of State alone to specify which competent authorities can apply for designation notices.
• The debate was adjourned.
• The next sitting date is set for Thursday 18 May at half-past Eleven o'clock.