Commons Library analysis of the Data Protection Bill [HL] 2017-19

The European Union’s data protection framework is changing from May 2018:

• the General Data Protection Regulation (GDPR) will apply from 25 May 2018
• the Police and Criminal Justice Directive (the “Law Enforcement Directive” or LED) has to be transposed into law by 6 May 2018

The Data Protection Bill [HL] 2017-19 [Bill 153] was introduced in the House of Commons on 18 January 2018. This paper has been prepared for the Bill’s second reading on 5 March 2018.

The Bill, Explanatory Notes, and an Impact Assessment are available from the parliamentary website.

The Bill has a number of purposes:

• it sets out how the UK would apply the derogations available under the GDPR
• it would bring the LED into UK law
• it would update the laws governing the processing of personal data by the intelligence services
• it aims to ensure that the UK would be able to freely exchange data with the European Union post-Brexit
• it would repeal the Data Protection Act 1998.

The Bill was originally introduced in the House of Lords on 13 September 2017 where it was broadly welcomed by the opposition parties. However concerns were raised in a number of areas, mainly in relation to the GDPR and its exemptions. These included:

• the age of consent for children to access information society services
• immigration control
• freedom of expression and journalism

At Report stage, the Government was defeated on amendments relating to press regulation – i.e. on commencing part 2 of the Leveson inquiry and on bringing section 40 of the Crime and Courts Act 2013 into force.

In a statement on 1 March 2018, Matt Hancock, the Secretary of State announced that the Government was formally closing the Leveson inquiry. He also said that section 40 would not be commenced and would be repealed at the “earliest opportunity”.

The Bill would extend to the whole of the UK.