---

Criminal Justice and Immigration Bill

My Lords, I beg to move that the House do agree with the Commons in their Amendment No. 89A to Lords Amendment No. 89. I have spoken to this Motion with Motion C. On Question, Motion agreed to. 115: Insert the following new Clause- "Data protection: additional offences (1) After section 55 of the Data Protection Act 1998 (c. 29) insert- "55AData protection: additional offences (1) A data controller must not- (a) intentionally or recklessly disclose information contained in personal data to another person, (b) repeatedly and negligently allow information to be contained in personal data to be disclosed, or (c) intentionally or recklessly fail to comply with duties under section 4(4). (2) Subsection (1)(a) does not apply if the data controller can show that the disclosure- (a) was necessary for the purpose of preventing or detecting crime, (b) was required or authorised by or under any enactment, by any rule of law, or by the order of a court, or (c) was justified in the particular circumstances as being in the public interest. (3) This section shall apply whether or not the data controller is- (a) a relevant authority under section 29, or (b) exercising a relevant function under section 31. (4) A data controller who contravenes subsection (1) is guilty of an offence." (2) Section 63(5) of that Act ceases to have effect in relation to government departments other than the Crown Estate Commissioners." The Commons disagree to Lords Amendment 115, but propose the following Amendment in lieu- 115A: Page 140, line 33, at end insert the following new Clause:- "Power to require data controllers to pay monetary penalty (1) After section 55 of the Data Protection Act 1998 insert- "Monetary penalties 55A Power of Commissioner to impose monetary penalty (1) The Commissioner may serve a data controller with a monetary penalty notice if the Commissioner is satisfied that- (a) there has been a serious contravention of section 4(4) by the data controller, (b) the contravention was of a kind likely to cause substantial damage or substantial distress, and (c) subsection (2) or (3) applies. (2) This subsection applies if the contravention was deliberate. (3) This subsection applies if the data controller- (a) knew or ought to have known - (i) that there was a risk that the contravention would occur, and (ii) that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but (b) failed to take reasonable steps to prevent the contravention. (4) A monetary penalty notice is a notice requiring the data controller to pay to the Commissioner a monetary penalty of an amount determined by the Commissioner and specified in the notice. (5) The amount determined by the Commissioner must not exceed the prescribed amount. (6) The monetary penalty must be paid to the Commissioner within the period specified in the notice. (7) The notice must contain such information as may be prescribed. (8) Any sum received by the Commissioner by virtue of this section must be paid into the Consolidated Fund. (9) In this section- "data controller" does not include the Crown Estate Commissioners or a person who is a data controller by virtue of section 63(3); "prescribed" means prescribed by regulations made by the Secretary of State. 55B Monetary penalty notices: procedural rights (1) Before serving a monetary penalty notice, the Commissioner must serve the data controller with a notice of intent. (2) A notice of intent is a notice that the Commissioner proposes to serve a monetary penalty notice. (3) A notice of intent must- (a) inform the data controller that he may make written representations in relation to the Commissioner's proposal within a period specified in the notice, and (b) contain such other information as may be prescribed. (4) The Commissioner may not serve a monetary penalty notice until the time within which the data controller may make representations has expired. (5) A person on whom a monetary penalty notice is served may appeal to the Tribunal against- (a) the issue of the monetary penalty notice; (b) the amount of the penalty specified in the notice. (6) In this section, "prescribed" means prescribed by regulations made by the Secretary of State. 55C Guidance about monetary penalty notices (1) The Commissioner must prepare and issue guidance on how he proposes to exercise his functions under sections 55A and 55B. (2) The guidance must, in particular, deal with- (a) the circumstances in which he would consider it appropriate to issue a monetary penalty notice, and (b) how he will determine the amount of the penalty. (3) The Commissioner may alter or replace the guidance. (4) If the guidance is altered or replaced, the Commissioner must issue the altered or replacement guidance. (5) The Commissioner may not issue guidance under this section without the approval of the Secretary of State. (6) The Commissioner must lay any guidance issued under this section before each House of Parliament. (7) The Commissioner must arrange for the publication of any guidance issued under this section in such form and manner as he considers appropriate. (8) In subsections (5) to (7), "guidance" includes altered or replacement guidance. 55D Monetary penalty notices: enforcement (1) This section applies in relation to any penalty payable to the Commissioner by virtue of section 55A. (2) In England and Wales, the penalty is recoverable- (a) if a county court so orders, as if it were payable under an order of that court; (b) if the High Court so orders, as if it were payable under an order of that court. (3) In Scotland, the penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland. (4) In Northern Ireland, the penalty is recoverable- (a) if a county court so orders, as if it were payable under an order of that court; (b) if the High Court so orders, as if it were payable under an order of that court. 55E Notices under sections 55A and 55B: supplemental (1) The Secretary of State may by order make further provision in connection with monetary penalty notices and notices of intent. (2) An order under this section may in particular- (a) provide that a monetary penalty notice may not be served on a data controller with respect to the processing of personal data for the special purposes except in circumstances specified in the order; (b) make provision for the cancellation or variation of monetary penalty notices; (c) confer rights of appeal to the Tribunal against decisions of the Commissioner in relation to the cancellation or variation of such notices; (d) make provision for the proceedings of the Tribunal in respect of appeals under section 55B(5) or appeals made by virtue of paragraph (c); (e) make provision for the determination of such appeals; (f) confer rights of appeal against any decision of the Tribunal in relation to monetary penalty notices or their cancellation or variation. (3) An order under this section may apply any provision of this Act with such modifications as may be specified in the order. (4) An order under this section may amend this Act." (2) In section 67 (orders, regulations, rules)- (a) in subsection (4) insert at the appropriate place- "section 55E(1),"; and (b) in subsection (5) after paragraph (c) insert- "(ca) regulations under section 55A(5) or (7) or 55B(3)(b),"."