The Data Protection and Digital Information Bill: progress of the Bill

The Data Protection and Digital Information Bill [Bill 001 2023-24] (PDF) was introduced in the House of Commons on 8 November 2023. It was first introduced during the 2022-23 session as the Data Protection and Digital Information (No. 2 Bill). The Bill has been carried over to the 2023-24 session. It had its remaining stages in the Commons on 29 November 2023. A House of Lords Library briefing summarises the amendments that were made (PDF).

The Bill [HL Bill 30 2023-24] (PDF) was introduced in the House of Lords on 6 December 2023. It is scheduled to have its second reading in the Lords on 19 December 2023. 

This Library briefing was published in the last session and refers to the Bill under its 2022-23 title.  

What would the Data Protection and Digital Information (No. 2) Bill do?

The Data Protection and Digital Information (No. 2) Bill [Bill 265 2022-23] was introduced in the House of Commons on 8 March 2023.

Much of the Bill is the same as the Data Protection and Digital Information Bill [Bill 143 2022-23] which was introduced in the Commons on 18 July 2022. The Bill was scheduled to have its second reading on 5 September 2022. A Library Briefing on the Bill (PDF) (31 August 2022) was published for the debate. However, in a Business Statement on 5 September 2022, the Government said that, following the election of Elizabeth Truss as Conservative Party leader, second reading would not take place. This was to allow Ministers to consider the Bill further. The Bill was withdrawn on 8 March 2023.

In a Written Ministerial Statement of 8 March 2023, Michelle Donelan, Secretary of State for Science, Innovation and Technology, said the new Bill followed a detailed codesign process with industry, business, privacy and consumer groups. The Bill would seize the post-Brexit opportunity to “create a new UK data rights regime tailor-made for our needs”. It would reduce burdens on businesses and researchers and would boost the economy by £4.7 billion over the next decade. The Secretary of State explained that changes had been made to the original Bill that would:

• reduce compliance costs in the sector and reduce the amount of paperwork that organisations need to complete to demonstrate compliance.
• reduce burdens by enabling businesses to continue to use their existing cross-border transfer mechanisms if they are already compliant.
• give organisations greater confidence about the circumstances in which they can progress personal data without consent.
• increase public and business confidence in AI technologies.

The Bill would:

• establish a framework for the provision of digital verification services to enable digital identities to be used with the same confidence as paper documents.
• increase fines for nuisance calls and texts under the Privacy and Electronic Communications Regulations (PECR).
• update the PECR to cut down on ‘user consent’ pop-ups and banners.
• allow for the sharing of customer data, through smart data schemes, to provide services such as personalised market comparisons and account management.
• reform the way births and deaths are registered in England and Wales, enabling the move from a paper-based system to registration in an electronic register.
• facilitate the flow and use of personal data for law enforcement and national security purposes.
• create a clearer legal basis for political parties and elected representatives to process personal data for the purposes of democratic engagement.

The governance structure and powers of the Information Commissioner’s Office (ICO, the data protection regulator) would also be reformed and transferred to a new body, the Information Commission. 

Policy background to the Bill, as it was originally introduced, is set out in the Library briefing, Data Protection and Digital Information (No. 2) Bill (28 March 2023).

Progress of the Bill in the House of Commons

The Bill had its second reading in the House of Commons on 17 April 2023. A carry-over motion, allowing it to be carried into the next parliamentary session, was approved on the same date.

The Bill was considered by a Public Bill Committee over eight sittings between 10 and 23 May 2023. Oral evidence was taken from expert witnesses during the first two sittings.

Line by line examination took place over six sittings between 16 and 23 May 2023. Nearly all divisions took place in relation to Labour amendments on the data protection provisions in Part 1 of the Bill. None of the amendments were agreed. Two Labour amendments on the privacy and electronic communications provisions in Part 4 were not agreed. There were also divisions on three new clauses moved by Labour; these were again unsuccessful.

Government amendments, mainly minor or technical were agreed. Government new clauses 1 to 7 were added to the Bill.

The Bill (Bill 314 2022-23)(PDF), as amended in Committee, was published.