My Lords, the government amendments in this group seek to give the Secretary of State the power to make regulations introducing new charges to fund the regulatory functions of the Information Commissioner for data protection. The charges will replace the existing notification fees set out in regulations made under Sections 18 and 26 of the Data Protection Act 1998.
The amendments will also repeal Part 3 of the Data Protection Act, which imposes an obligation on data controllers to notify the Information Commissioner of certain types of data processing. The commissioner maintains a register of all data controllers. The General Data Protection Regulation removes the obligation on data controllers to notify the Commissioner, so it is necessary to repeal Part 3. The GDPR will become part of UK law on 25 May 2018.
The amendments seek to replicate the substance of the fee-raising powers in the Data Protection Act 1998. I can confirm that charges will continue to be based on the principle of full cost recovery and, in line with the current model, fee levels will be determined on size and turnover of organisation, but will also take account of the volume of personal data being processed by organisations to recognise the additional risk of a breach occurring when an organisation processes large volumes of sensitive personal data.
Although organisations will no longer be required to notify the Information Commissioner that they are processing personal data, they will continue to receive a range of services from the Information Commissioner’s Office in return for the charge. This includes good practice guidance on organisations’ obligations under the data protection framework and how to comply; online training videos; free voluntary audits of organisations’ data protection practices to support improved compliance; and advisory visits.
The Government have considered the DPRRC’s recommendations on these clauses and have responded. We agree with the committee that regulations made under the new charging powers should be subject to appropriate external consultation and parliamentary oversight. We will therefore bring forward an amendment at Third Reading to require the Secretary of State to consult,
“such representatives of persons likely to be affected by the regulations as the Secretary of State thinks appropriate and such other persons as the Secretary of State thinks appropriate”,
in addition to the Information Commissioner. We will also bring forward an amendment to require the Secretary of State to use the affirmative procedure when making regulations under the new power, except in the case of purely inflationary increases, where the negative procedure will apply.
We have considered carefully the committee’s recommendation to require the Secretary of State to ensure that the income from the charges does not exceed the reasonably anticipated costs of discharging the specified functions of the Information Commissioner and Secretary of State related to data protection. It is the Government’s view that the limited flexibility given in the government amendments is necessary, given rapid developments in the digital economy and to manage the inevitable period of transition as the ICO takes on additional responsibilities under the forthcoming general data protection regulation. The language used in the Government’s amendment mirrors that in the existing Data Protection Act. Parliament has not expressed any concerns about how the existing powers have been exercised and we believe that by subjecting each exercise of the power to the affirmative procedure, we are putting in place sufficient parliamentary safeguards to ensure the powers will be exercised in a rational and responsible way in the future. We therefore do not intend to table an amendment to address this recommendation. I beg to move.
Amendment 33ZN (to Amendment 33ZM)