Schedule 4 - Obligations of controllers and processors: consequential amendments

Data Protection and Digital Information Bill – in the House of Commons am 6:00 pm ar 29 Tachwedd 2023.

Danfonwch hysbysiad imi am ddadleuon fel hyn

Amendments made: 210, page 149, line 23, leave out paragraph 8 and insert—

“8 In Article 49 (derogations for specific authorities), for paragraph 6 substitute—

“6. The controller or processor must—

(a) maintain appropriate records of the assessment and safeguards referred to in the second subparagraph of paragraph 1, and

(b) make the records available to the Commissioner on request.””

This amendment maintains the duty to keep records of assessments made, and safeguards provided, in accordance with Article 49 of the UK GDPR, but removes the requirement to keep them as part of the general records of processing (see Article 30, which is to be replaced by new Article 30A inserted by clause 16).

Amendment 211, page 151, line 11, leave out paragraph 21 and insert—

“21 For paragraph 41 of Schedule 1 (additional safeguard for processing of special categories of personal data etc: record of processing) substitute—

“41 “(1) A controller must maintain appropriate records of processing of personal data carried out in reliance on a condition described in paragraph 38.

(2) The records must include the following information—

(a) which condition is relied on,

(b) how the processing satisfies Article 6 of the UK GDPR (lawfulness of processing), and

(c) whether the personal data is retained and erased in accordance with the policies described in paragraph 39(b) and, if it is not, the reasons for not following those policies.

(3) The controller must make the records available to the Commissioner on request.””—(Sir John Whittingdale.)

This amendment maintains the duty to keep records of processing in reliance on certain conditions in Schedule 1 to the Data Protection Act 2018, but removes the requirement to keep them as part of the general records of processing (see Article 30, which is to be replaced by new Article 30A inserted by clause 16).