New Clause 7 - Searches in response to data subjects’ requests

Data Protection and Digital Information Bill – in the House of Commons am 4:15 pm ar 29 Tachwedd 2023.

Danfonwch hysbysiad imi am ddadleuon fel hyn

“(1) In Article 15 of the UK GDPR (right of access by the data subject)—

(a) after paragraph 1 insert—

‘1A. Under paragraph 1, the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that paragraph.’, and

(b) in paragraph 3, after ‘processing’ insert ‘to which the data subject is entitled under paragraph 1’.

(2) The 2018 Act is amended in accordance with subsections (3) and (4).

(3) In section 45 (law enforcement processing: right of access by the data subject), after subsection (2) insert—

‘(2A) Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.’

(4) In section 94 (intelligence services processing: right of access by the data subject), after subsection (2) insert—

‘(2ZA) Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.’

(5) The amendments made by this section are to be treated as having come into force on 1 January 2024.”—(Sir John Whittingdale.)

This new clause confirms that, in responding to subject access requests, controllers are only required to undertake reasonable and proportionate searches for personal data and other information.

Brought up, read the First and Second time, and added to the Bill.