Data Protection Act 2018

After Clause 1 Insert the following new Clause—

“Protection of personal data

After Clause 1 Insert the following new Clause—

“Right to protection of personal data

Clause 6, page 4, line 34 leave out line 34

Clause 6, page 4, line 36 leave out “, subject to subsection (2)”

Clause 6, page 4, line 37 at end insert—

“subject to subsections (1A) and (2).

Clause 7, page 5, line 11 after “enactment” insert “or rule of law”

Clause 8, page 5, line 19 at end insert—

The Secretary of State must as soon as practicable after the passing of this Act by regulations require the Commissioner to set standards for the age-appropriate design of relevant information society services accessed by children and that such standards are to be set out in a code in accordance with section (Age-appropriate design code).”

Clause 9, page 5, line 37 at end insert—

The processing of biometric data meets the requirements of Article 9(4) of the GDPR for authorisation by the law of the United Kingdom or part of the United Kingdom only if it meets the condition in paragraph 11A of Part 2 of Schedule 1.”

Clause 9, page 6, line 5 leave out paragraphs (a) and (b) and insert—

amend Schedule 1 —

Clause 9, page 6, line 8 leave out “affirmative resolution procedure” and insert “super-affirmative resolution procedure under section 18 of the Legislative and Regulatory Reform Act 2006, with references in that section to section 14 to be read as references to this section of this Act”

Clause 13, page 7, line 20 at end insert “or a group sharing a protected characteristic, within the meaning of the Equality Act 2010, to which the data subject belongs”

Clause 13, page 7, line 20 at end insert—

A decision that engages an individual’s rights under the Human Rights Act 1998 does not fall within Article 22(2)(b) of the GDPR (exemption from prohibition on taking significant decisions based solely on automated processing for decisions that are authorised by law and subject to safeguards for the data subject's rights, freedoms and legitimate interests).”

Clause 13, page 7, line 26 at end insert—

A decision is “based solely on automated processing” for the purposes of this Act if, in relation to a data subject, there is no meaningful input by a natural person in the decision-making process.”

Clause 13, page 7, line 31 at end insert—

the controller must provide meaningful information to the data subject which will be sufficient to enable the data subject to assess whether the profiling will be beneficial or harmful to their interests,”

Clause 13, page 7, line 36 at end insert—

provide an explanation of the decision reached.”

Clause 13, page 7, line 36 at end insert—

If a request is made to a controller for an explanation of a qualifying significant decision under subsection (4), the information the controller must provide must include, at least—

Clause 13, page 7, line 44 at end insert—

Where a controller takes or expects to take a qualifying significant decision in relation to a data subject based solely or partially on automated processing, the controller must ensure that the following information is made available to the public via electronic means—

After Clause 13 Insert the following new Clause—

“Automated decision-making concerning a child

After Clause 13 Insert the following new Clause—

“Use of private personal data accounts

Clause 15, page 9, line 14 leave out paragraph (d)