Key Facts

• Clause 100 establishes a body corporate, the Information Commission.
• Amendments 44 and 45 aim to ensure a smooth transition by enabling parallel appointments of non-executive members and an interim chief executive for up to 24 months.
• The chair will be appointed by His Majesty's letters patent on recommendation of the Secretary of State.
• Functions of the Surveillance Camera Commissioner are to be transferred.
• Proposed new clause transfers these functions to the Investigatory Powers Commissioner’s Office.
• Clause 105 seeks to abolish the office of the Surveillance Camera Commissioner.
• Amendment 123 proposes retaining the functions of the Surveillance Camera Commissioner but transferring them to the IPCO.
• The commissioners’ work includes ensuring that Government Departments cease deploying visual surveillance systems produced by companies subject to Chinese National Intelligence Law.
• Professor Pete Fussey and Professor William Webster are considered leading experts on surveillance in the UK.
• Amendment 119 aims to redefine biometric data in the Bill.
• New clause 8 seeks to amend Article 9 of UK GDPR.
• The proposed amendment covers biometric data for classification purposes.
• Biometric data includes facial geometry, fingerprints, walking style, tone of voice, and expressions.
• Under UK law, biometric data is special category personal data only if used for unique identification.
• New clause 8 seeks to extend GDPR protections to biometric data used for classification or categorisation purposes.
• Clause 107 provides the Secretary of State with a power to make consequential amendments to other legislation.
• Clause 108 outlines the form and procedure for making regulations under the Bill's powers.
• Clause 110 authorises expenditure arising from the Bill, requiring money resolution and Ways and Means resolutions.
• The clauses detail provisions for the territorial extent of the Bill, regulation-making powers, transitional measures, and the short title of the Bill.
• Clause 107 allows the Secretary of State to amend Acts of Parliament.
• Stakeholders such as the Public Law Project are concerned over the extent of powers granted by clause 107.
• The Minister believes these powers ensure legal clarity and public understanding of data protection legislation.
• The Information Commissioner must encourage representative bodies to submit codes of conduct.
• These codes may address rights and obligations under the Regulations, dispute resolution procedures, and monitoring mechanisms.
• A person who discloses information in contravention of the new clause commits an offence punishable by imprisonment or fine.
• The new clauses address issues such as digital verification services, appropriate national authority meaning, processing special categories of personal data, pre-commencement consultation, biometric data protections, and transparency in algorithmic tools.
• Clause 5 prevents further disclosure of information without consent if Revenue Scotland discloses it under clause 54 for digital verification services.
• Clause 6 extends the period during which former elected representatives can respond to requests involving special categories of personal data from four days to a period of 30 days.
• The UK Algorithmic Transparency Standard is published by the Central Digital and Data Office and Centre for Data Ethics and Innovation as part of the Government’s National Data Strategy.
• The amendment aims to require publication of information required by the Standard, with exemptions where necessary for legal inquiries or national security.
• Despite successful pilots across various public sector bodies, the government has chosen not to commit legislatively due to concerns about the standard's maturity.
• The Committee divided with Ayes 4, Noes 9.
• New Clause 10 would amend Section 190 of the Data Protection Act 2018.
• The Secretary of State must exercise powers within three months of the passage of the Data Protection and Digital Information Act 2023.
• Article 80(1) of the GDPR allows a data subject to mandate a not-for-profit body or organisation to lodge a complaint on their behalf.
• The UK has not yet adopted article 80(2), which would allow non-profits to lodge complaints independently of a data subject’s mandate.
• Organisations such as Which?, Reset, and 5Rights argue for collective redress mechanisms in data protection.
• The ICO recognises the potential benefits of opt-out proceedings under article 80(2).
• Business groups worry that article 80(2) could increase litigation costs during economic uncertainty.
• Privacy Enhancing Technologies are defined as software and hardware systems aimed at achieving specific privacy or data protection functionality.
• The new clause requires the Secretary of State to publish a report on the potential impact of these technologies within six months of the passage of this Act.
• Privacy enhancing technologies (PETs) can help organisations share data responsibly, securely, and lawfully.
• Federated learning is an example of a PET that allows for training machine-learning models without exchanging sensitive data.
• The Royal Society's report on PETs recommends the development of a national PET strategy to promote their responsible use in scientific research and collaboration.
• The Biometrics Office is to consist of three commissioners appointed by the Commission.
• Relevant entities must register prior to deploying biometric technology.
• Annual reports are required detailing proportionality assessments and future intentions.
• Non-compliance with registration or reporting requirements can result in unlimited fines.
• A transitional period of six months for existing entities to register.
• Biometric data includes facial expressions, fingerprints, and gait analysis.
• Public attitudes research shows opposition to facial recognition in shops, schools, public transport, and HR departments.
• An independent legal review found current governance structures for biometrics fragmented, unclear, and ineffective.
• New Clause 16 amends section 40 of the 2018 Act.
• It exempts the police from complying with certain data protection principles when preparing case-files for submission to the Crown Prosecution Service (CPS).
• The CPS is exempt from these principles while making charging decisions on submitted files.
• The new clause would adjust Section 40 of the Data Protection Act 2018.
• It aims to exempt the police service and Crown Prosecution Service from the first and third data protection principles.
• This exemption is intended for sharing unredacted data between the two services when making a charging decision.
• The Data Protection Act 2018 part 3 imposes redaction obligations that delay criminal justice processes.
• Police spend significant time on redactions, with one force investing £1 million in a disclosure specialist team.
• About 25% of cases submitted to the CPS are not charged.
• The statement concludes the Committee's discussion on the Data Protection and Digital Information (No. 2) Bill.
• Philip Hollobone thanks Members for their forbearance during the passage of the Bill.
• He acknowledges the diligence and attention to duty by officers of the House.