Update on the Data Protection and Digital Information Bill

The Data Protection and Digital Information Bill (the Bill) completed all five stages in the House of Commons on 29 November 2023 and is currently waiting for a date to be announced for a ‘line-by-line’ examination at the Committee stage in the House of Lords.

In light of its progress, Rhiannon Hastings, data protection paralegal in our commercial team, discusses the expected changes to the data protection legislation.  

Who is responsible for the Bill?

The Department for Digital, Culture, Media and Sport (DCMS) has been the government department responsible for delivering key legislative and regulatory reforms to drive competition and promote innovation.

However, in February 2023, the government announced the creation of a new department, the Department for Science, Innovation and Technology (DSIT), who will take over the DCMS’ responsibility for data policy – which will include the management of the Bill.

What are the Bill’s latest amendments?

Various amendments have been made during the House of Commons' report stage which include, amongst others:

1. Changes to retention of biometric data for national security purposes;
2. A data preservation process to require social media companies to retain data that may be required for investigations; and
3. New powers to require data from third parties such as banks and financial organisations.

Amendment 1: retention of biometric data

The first amendment will enable the Police to retain biometric data, such as fingerprints, for as long as an INTERPOL notice is in force to strengthen national security.

The amendment will also enable the Police to retain biometrics pertaining to individuals with a foreign conviction indefinitely, whereas currently this is restricted to UK convictions only.

Amendment 2: requiring social media platforms to retain data

The second amendment enables social media companies (platforms) to retain any relevant personal data which could then be used in subsequent investigations or inquests.

The motive for this amendment is to provide support to families who have lost a family member due to suicide by enabling platforms to rely on the ‘data preservation process’ in order to retain data it feels will assist with any subsequent investigations.

Currently, data protection legislation doesn’t require platforms to retain data for longer than is needed, meaning that data which could prove vital to the investigations could be deleted as part of a platform’s own retention and deletion procedure.

Amendment 3: requiring data disclosure from third-party providers

The third amendment will enable the government to reduce benefit fraud by requiring third-party providers, such as banks and financial organisations, to disclose data to facilitate the government’s checks on claimant bank accounts.

To ensure the government don’t receive more than is necessary, it will only receive the necessary data to establish when a claimant sits above the benefit eligibility threshold.

Currently, the Department for Work and Pensions (DWP) can only undertake fraud checks on a claimant on an individual basis and where a suspicion of fraud exists which restricts its objective to reduce benefit fraud.

To see the full list of amendments considered by the House of Commons, please take a look at the UK Parliament’s website.

For more information on this and other data protection matters, please contact Rhiannon using: [email protected]