1. At its meetings on 6 June and 27 June 2023ⁱJeremy Balfour, MSP, submitted apologies for the meeting on 27 June., the Committee considered the delegated powers in the Data Protection and Digital Information (No.2) Bill (“the Bill”) which are exercisable within devolved competence.

2. The Committee considered the Legislative Consent Memorandum (“LCM”) for the Data Protection and Digital Information (No.2) Bill by virtue of Rule 9B.3 of the Parliament’s Standing Orders. Paragraph 6 of Rule 9B.3 provides that where the Bill that is the subject of an LCM contains provisions conferring on the Scottish Ministers powers to make subordinate legislation, the Delegated Powers and Law Reform Committee shall consider and may report to the lead committee on those provisions.

3. The LCM was also considered in terms of the Committee’s wider remit contained in Rule 6.11.1(b) of Standing Orders which provides that the remit of the Committee includes considering and reporting on proposed powers to make subordinate legislation in particular bills “or other proposed legislation”. The Committee and its predecessor Committee have considered powers conferred on UK Ministers in devolved areas in various Bills over the course of sessions 5 and 6.

4. At its meeting on 6 June 2023, the Committee was content with the following powers (clauses in brackets indicate clause numbering at time of consideration on 6 June):

   Smart Data Provisions

   • Clause 66 (1)-(3) (previously clause 62(1)-(3)): Power to make provision in connection with customer data

   • Clause 68(1) & (2) (previously clause 64(1) & (2))- Power to make provision in connection with business data

   • Clause 71 (previously clause 67) - Enforcement of data regulations

   • Clause 74 (previously clause 70) – Fees

   • Clause 75 (previously clause 71) - Levy

   Other Provisions

   • Clause 98 (previously clause 92) - Disclosure of information to improve public service delivery to undertakings

   • Clause 114 (previously clause 107) - Power to make consequential amendments

5. However, the Committee agreed to write to the Scottish Government and UK Government in relation to the following delegated power:

   • Clause 99 (previously clause 93) - Implementation of law enforcement information-sharing agreements

6. The Scottish Government and the UK Government have responded to the questions posed by the Committee. The Committee’s questions and the responses received are also set out at the Annex. The responses are considered below.

7. The Data Protection and Digital Information (No.2) Bill (“the Bill”) is the second iteration of a UK Government Bill introduced initially in Westminster on 18 July 2022. The Bill was paused and then subsequently introduced again in the House of Commons on 8 March 2023. The Bill is currently at Report stage. As the Bill is still progressing through the UK Parliament it is still subject to amendment. The Committee may therefore need to consider a supplementary LCM in due course.

8. This is a substantial Bill containing 114 clauses and 13 schedules. The stated purpose of the Bill is to update and simplify the UK’s data protection framework with a view to reducing burdens on organisations while maintaining high data protection standards. The UK Government states that the privacy frameworks within the Bill are necessary, pro-growth reforms to enable data driven innovation, reduce data protection-associated burdens on businesses, and empower people to take control of their data, within a trusted data regime. The Scottish Government states that the proposed changes to data protection law represent a dilution rather than a radical change.

9. The Scottish Government lodged the LCM on 15 May 2023. The provisions in the Bill relate principally to reserved matters, however, a few aspects of the Bill relate to matters that are devolved in Scotland.

10. The lead Committee in respect of this LCM is the Economy and Fair Work Committee. The Scottish Government states in its LCM that it is recommending consent be given to the Bill.

11. The UK Government has published a Delegated Powers Memorandum to accompany the Bill (the “UK DPM”). As is normal for UK bills, the Scottish Government has not published a delegated powers memorandum. The Scottish Government’s view on the relevant clauses is set out in the LCM.

Review of relevant powers

Smart Data Provisions

Provisions

12. Part 3 of the Bill (clauses 65-81) contain several delegated powers to provide for “smart data” schemes to be established. These schemes will provide for the secure sharing of customer data at the customer’s request with authorised third-party providers. These provisions, whilst they extend to Scotland, are made mainly in a reserved area (consumer protection), however, aspects are devolved where it is a business-to-business transfer and so partial consent is sought by the UK Government in relation to these provisions. Further detail on the delegated powers relating to smart data schemes and comment on them is outlined below.

Clause 66 (1)-(3) (previously clause 62(1)-(3)): Power to make provision in connection with customer data

Power conferred on: Secretary of State and the Treasury

Power exercisable by: Regulations

Parliamentary procedure: Affirmative (apart from some amendment regulations)

13. Clause 66 of the Bill contains several delegated powers. Clause 66(1) confers power on the Secretary of State or the Treasury by regulations to require suppliers of goods, services and digital content specified in the regulations and other persons holding the relevant data (“data holder”) to provide customers or their authorised representatives with access to customer data. This applies to consumers and business customers.

14. There are also powers under clause 66(2)(a) to require suppliers to collect and retain data, under 66(2)(b) to provide for rectification of inaccurate data and under subsection 66(3) to allow the authorised representative to exercise the customer’s rights. Clause 67 of the Bill provides further specifics on how the regulation making powers in clause 66 can be exercised.

15. Regulations made under clause 66 are subject to the affirmative procedure where they are the first set of regulations under the power and where they make the requirements of existing regulations more onerous for data holders, contain enforcement or investigatory provisions, contain revenue-raising provisions or amend or repeal primary legislation. Otherwise, they are subject to the negative procedure.

Clause 68(1) & (2) (previously clause 64(1) & (2))- Power to make provision in connection with business data

Power conferred on: Secretary of State and the Treasury

Power exercisable by: Regulations

Parliamentary procedure: Affirmative (apart from some amendment regulations)

16. Clause 68 of the Bill also contains several delegated powers. Clause 68(1) confers power on the Secretary of State or the Treasury by regulations to make provision requiring a data holder to publish business data or to provide business data on request to a customer of the trader, or to a “third party recipient”.

17. There is a further power under clause 68(2) to require suppliers to collect and retain data. Clause 65 of the Bill provides further specifics on how the regulation making powers in clause 68 can be exercised.

18. Regulations made under clause 68 are subject to the affirmative procedure where they are the first set of regulations under the power and where they make the requirements of existing regulations more onerous for data holders, contain enforcement or investigatory provisions, contain revenue-raising provisions or amend or repeal primary legislation. Otherwise, they are subject to the negative procedure.

Clause 71 (previously clause 67) - Enforcement of data regulations

Power conferred on: Secretary of State and the Treasury

Power exercisable by: Regulations

Parliamentary procedure: Affirmative

19. Clause 71 of the Bill confers power on the Secretary of State or the Treasury by regulations to make provision for the enforcement of the smart data regulations. Enforcement will be by a public body identified in the regulations.

20. Clause 72 outlines the restrictions on the investigatory powers that can be made and clause 73 outlines, in relation to the power on an enforcer to impose a financial penalty, what that may or must contain.

21. Regulations made under clause 71 are subject to the affirmative procedure and are also subject to mandatory periodic review under clause 79.

Clause 74 (previously clause 70) – Fees

Power conferred on: Secretary of State and the Treasury

Power exercisable by: Regulations

Parliamentary procedure: Affirmative

22. Clause 74 of the Bill confers power on the Secretary of State and the Treasury by regulations to make provision requiring the payment of fees for expenses incurred, or to be incurred, in performing duties, or exercising powers, imposed or conferred by regulations under smart data schemes. Regulations made under this clause may also make provision about how fees paid must or may be used.

23. Regulations made under clause 74 are subject to the affirmative procedure and are also subject to public consultation under clause 78 as well as mandatory periodic review under clause 79.

Clause 75 (previously clause 71) - Levy

Power conferred on: Secretary of State and the Treasury

Power exercisable by: Regulations

Parliamentary procedure: Affirmative

24. Clause 75 of the Bill confers power on the Secretary of State or the Treasury by regulations to make provision to impose, or provide for a specified public body to impose, a levy on data holders to meeting all or part of the expenses incurred, or to be incurred, during a period by decision-makers or enforcers or by persons acting on their behalf in relation to smart data schemes. Regulations made under this clause may also make provision about how fees paid must or may be used.

25. Regulations made under clause 75 are subject to the affirmative procedure and are also subject to public consultation under clause 78 as well as mandatory periodic review under clause 79.

Committee consideration

26. The DPM states that the essential purpose of Part 3 (smart data schemes) is to update the government’s regulation-making powers to establish effective smart data schemes where they are needed, to allow each scheme to be tailored to the circumstances of the sector to which it applies with such schemes presently being contemplated in the areas of financial service markets and in retail telecoms.

27. Many aspects of the provisions of the Bill in part 3 are reserved through consumer protection, however, some areas are devolved where the customer is a business and not an individual.

28. The Scottish Government’s LCM outlines that as elements of the clauses in this part concern business-to-business information transfer they are not caught by the consumer protection reservation. Paragraph 14 of the LCM states that the Scottish Government is recommending consent to this part of the Bill on the basis that the provisions are highly technical, there is no administrative efficiency or benefit in seeking a legislative vehicle to make these provisions in Scotland, and there would also be a requirement to regulate these matters via a devolved body if it were not done by a UK Bill.

29. The powers in this part of the Bill in relation to smart data schemes are narrowly drawn in that they can only be used for the implementation of smart data schemes, where they are considered necessary. Much of the provisions relate to areas that are reserved, and only the aspect of business-to-business data in the scheme is within devolved competence. It would be difficult to separate out the reserved and devolved matters to work alongside each other. Additionally, a UK body will be set up through regulations in order to manage such schemes.

30. It is also clear what provision these powers will be used to make as the powers themselves give significant detail on what the regulations may and must contain. They cannot be used to make substantive provision in areas of devolved competence of the sort it might be appropriate for the Parliament to have some further scrutiny of.

Other Provisions

Clause 98 (previously clause 92) - Disclosure of information to improve public service delivery to undertakings

Power conferred on: the appropriate national authority (for regulations relating to a Scottish body, the Scottish Ministers)

Power exercised by: Regulations

Parliamentary Procedure: Affirmative procedure

32. Clause 98 of the Bill makes modifications to section 35 of the Digital Economy Act 2017 relating to disclosure of information to improve public service delivery. Section 35 confers delegated powers on the “appropriate national authority”, which for Scotland and Scottish bodies is the Scottish Ministers, to specify data sharing objectives, and specify public authorities that can share data for a specified objective, by amending Schedule 4 of that Act.

33. The amendments made by the Bill widen the conditions with which an objective must comply in order to meet the definition of an information-sharing “specified objective” to improve public service delivery.

34. Regulations made under section 35 of the Digital Economy Act 2017 are subject to the affirmative procedure and are subject to a duty to consult various bodies including the Information Commissioner, the Commissioners for His Majesty’s Revenue and Customs, appropriate national authorities and other persons considered appropriate.

Committee consideration

35. As the Scottish Ministers are the “appropriate national authority” for Scotland in relation to Scottish bodies, the amendments made to the Digital Economy Act 2017 by clause 98 will alter the executive competence of the Devolved Administrations by extending the scope of their regulation-making powers.

36. The Scottish Government’s LCM provides at paragraph 17 that the Scottish Government is recommending consent to this part of the Bill on the basis that it considers that proposed amendments could potentially provide benefits to business and that it would support the Scottish Government’s agenda for the post-pandemic recovery.

37. Regulations made under section 35 of the 2017 Act are subject to the affirmative procedure, along with various consultation requirements. The modifications made by clause 98 of the Bill do not alter the procedure. The power permits the amendment of primary legislation (schedule 4 of the 2017 Act), and it would therefore be appropriate for the highest level of scrutiny to be applied to such regulations.

Clause 99 (previously clause 93) - Implementation of law enforcement information-sharing agreements

Power conferred on: Appropriate national authority (Secretary of State or the Scottish Ministers within legislative competence)

Power exercised by: Regulations

Parliamentary Procedure: Negative procedure

Provision

39. Clause 99 of the Bill confers power on the "appropriate national authority” by regulations to make provision for the purpose of, or in connection with, implementing an international agreement so far as relating to the sharing of information for law enforcement purposes. Regulations made under clause 99 are subject to the negative procedure.

40. Clause 100 defines the “appropriate national authority” as the Secretary of State, and the Scottish Ministers are also an appropriate national authority in relation to regulations which contain only provision within the legislative competence of the Scottish Parliament.

Committee consideration

41. At its meeting on 6 June, the Committee observed that this power was one which was exercisable by the Secretary of State alone. Whilst entering into international agreements is a reserved matter, their implementation in devolved areas is not, with current Scottish legislation making provision in relation to policing and law enforcement in Scotland.

42. The Committee therefore asked whether the Scottish Government considers that the power should be subject to a requirement for consent or consultation and why; whether the power falls within areas formerly within EU competence; and how the Scottish Government will facilitate scrutiny by the Scottish Parliament if the power is made subject to a consent or consultation requirement.

43. In its response, the Scottish Government explains that amendments have now been made to the Bill so that the power is exercisable by the “appropriate national authority”. The Secretary of State is designated as an “appropriate national authority” in all cases. The Scottish Ministers are also designated as an “appropriate national authority” where regulations made under the power contain only devolved provisions.

44. The response also states that having parallel powers for Scottish Ministers facilitates the scrutiny of the Scottish Parliament, that this is not within an area formerly within EU competence before the UK fully withdrew from the EU, and that the Scottish Government now recommend consent be given to this clause.

45. The Committee also asked the UK Government why it was considered appropriate that the power was solely conferred on the Secretary of State and why there is no consent or consultation requirement when exercising the power.

46. In its response, the UK Government explains that following amendments being made to the Bill, there is now a concurrent power for the Scottish Ministers to make regulations under clause 99 where that is within the legislative competence of the Scottish Parliament. The correspondence further states that Home Office officials will continue to engage with Scottish Government colleagues as the clause moves through the legislative process.

47. The Bill has been subject to amendments and has now progressed to the Report stage in the House of Commons. Clause 99 has been amended so the “appropriate national authority” can make regulations under this power. Where the subject matter is within the legislative competence of the Scottish Parliament the Scottish Ministers can make such regulations, as can the Secretary of State. This is now a concurrent power.

48. The power is one which is now concurrently exercisable by either the Secretary of State or the Scottish Ministers to implement data sharing agreements for law enforcement purposes, so either could implement obligations for Scotland implementing such agreements.

49. The power itself is limited in how it may be exercised in that it does not permit the amendment of primary legislation. According to the Delegated Powers Memorandum, the power is intended to be used to specify technical requirements relating to the sharing of data for law enforcement purposes.

50. Although the amendments now mean the power is one which is concurrently exercisable, regulations made under this clause could still be laid in the UK Parliament only, if made by the Secretary of State, making provision within devolved competence. Should that happen there will be no opportunity for Parliamentary scrutiny within the Scottish Parliament as there is no requirement for consent and no requirement to consult with Scottish Ministers before exercising this power. In order to have oversight as to how this delegated power is exercised by the UK Government within the Parliament’s legislative competence, or of the Scottish Ministers’ position if consulted, the Scottish Parliament will be reliant on information provided by the governments.

Clause 114 - (previously clause 107) - Power to make consequential amendments

Power conferred on: Secretary of State

Power exercised by: Regulations

Parliamentary Procedure: Affirmative procedure where regulations amend primary legislation; otherwise negative procedure

55. Clause 114(1) of the Bill confers power on the Secretary of State by regulations to make provision that is consequential on the Bill. Regulations made under clause 114(1) may make different provision for different purposes, may include transitional, transitory or saving provision and may amend, repeal or revoke any provision made by primary legislation, which includes an Act of the Scottish Parliament.

56. Regulations making provision consequential on certain clauses which deal with the abolition of the Information Commissioner can amend primary legislation whenever passed or made, however, regulations making provision consequential on other provisions of the Bill can only amend primary legislation passed or made before the end of the Session in which the Bill is passed.

Committee consideration

57. The DPM states this power is necessary to ensure that the provisions in the Bill operate correctly with respect to the new regulator and there are many amendments made to other pieces of legislation by this Bill which may require updates to relevant cross-references to provide legal certainty.

58. This provision is not addressed with the Scottish Government’s LCM.

59. Ancillary powers are standard in modern primary legislation. Although this power could be exercised within devolved competence, this is an ancillary power to enable implementation of provisions which principally relate to reserved matters and the power can only be exercised in consequence of provisions of the Bill. It would therefore not be appropriate for the Scottish Ministers to exercise this power separately.

Letter to Rt Hon Chloe Smith MP Secretary for State for Science, Innovation and Technology, 8 June 2023

At the meeting of the Scottish Parliament’s Delegated Powers and Law Reform Committee on 6 June, the Committee considered the delegated powers relevant to Scotland in the above Bill, as referred to in the Legislative Consent Memorandum (“the LCM”) lodged by the Scottish Government with the Scottish Parliament on 15 May 2023.

To assist the Committee in considering the LCM, it agreed to request further information in relation to Clause 93 - Implementation of law enforcement information sharing agreements.

The LCM states that the Scottish Government does not consider that consent should be given in respect of this clause. It notes that the implementation of international agreements within devolved competence is a devolved function. The Scottish Government states that consent may be given should amendments be made to the Bill for parallel powers to be granted to the Scottish Ministers or for implementation to be subject to consultation.

The Committee has agreed to ask:

• why the UK Government considers it appropriate, in the particular policy context of the Bill, that the power in clause 93 has been conferred so that it is exercisable independently by the Secretary of State within devolved competence, and not by the Scottish Ministers; and

• why the UK Government considers it appropriate, in the particular policy context of the Bill, that when the power is exercised by the Secretary of State within devolved competence, there is no requirement to obtain the consent of the Scottish Ministers.

I request a response to these questions by Wednesday, 21 June 2023, so that this can be reflected in the Committee’s final report.

Finally, I am also writing to the Scottish Ministers regarding this clause. In particular, I am asking how it is envisaged the Scottish Parliament will have a role in scrutinising the Scottish Ministers’ decision-making in relation to any consultation or consent decisions, in the event that an amendment is agreed providing for consultation with or consent of Scottish Ministers’ to the exercise of the delegated power insofar as it affects Scotland, as well as Ministers views on consultation or consent requirements.

Response from the Rt Hon Chris Philp MP Minister of State for Crime, Policing and Fire, 20 June 2023

Thank you for your letter of 8 June 2023 to the Secretary of State for Science, Innovation and Technology Justice on behalf of the Delegated Powers and Law Reform Committee. Your letter was transferred to the Home Office on 12 June and I am replying as the Minister for Crime and Policing.

Clause 93 of the Data Protection and Digital Information Bill No.2 is a Home Office measure that creates a delegated power to make regulations to implement international agreements relating to the sharing of information for law enforcement purposes. This legislation will provide powers to implement operational and technical aspects of such international agreements via secondary legislation once the agreements have been negotiated.

Home Office officials have had extensive engagement with Scottish Government colleagues on the application of Clause 93 and the inclusion of concurrent powers in respect of matters that fall within the competence of Scottish Parliament.

Following Government amendments tabled and agreed during Commons Committee stage in May 2023, Clause 93 has now become Clause 99 and has been supplemented by Clause 100. An updated version of the Bill can be found at: Data Protection and Digital Information (No. 2) Bill (parliament.uk) The latter now creates a delegated power for the Secretary of State and, separately, a concurrent power for Scottish Ministers to make regulations within the legislative competence of the Scottish Parliament. I hope this provides clarity that devolved competence is therefore now reflected in the Bill.

Please be assured that Home Office officials will continue to engage with Scottish Government colleagues as the Clause moves through the legislative process.

Letter to Cabinet Secretary for Wellbeing Economy, Fair Work and Energy, 8 June 2023

At the meeting of the Delegated Powers and Law Reform Committee on 6 June, the Committee considered the delegated powers relevant to Scotland in the above Bill, as referred to in the Legislative Consent Memorandum (“the LCM”) lodged by the Scottish Government with the Scottish Parliament on 15 May 2023.

To assist the Committee in considering the LCM, it agreed to request further information in relation to Clause 93 - Implementation of law enforcement information sharing agreements.

The LCM states that the Scottish Government does not consider that consent should be given in respect of this clause. It notes that the implementation of international agreements within devolved competence is a devolved function. The Scottish Government states that consent may be given should amendments be made to the Bill for parallel powers to be granted to the Scottish Ministers or for implementation to be subject to consultation.

The Committee has agreed to ask:

(a) whether the Scottish Government considers that the power conferred on the Secretary of State by clause 93, insofar as within devolved competence, should be subject to a requirement for (i) the Scottish Minsters’ consent, or (ii) consultation with the Scottish Ministers, and why;

(b) whether the power conferred on the Secretary of State by clause 93, insofar as within devolved competence, falls within areas formerly within EU competence before the UK fully withdrew from the EU and as such is within the scope of Statutory Instrument Protocol 2; and

(c) how, if the bill is amended to require the consent of, or consultation with, the Scottish Ministers where the power is exercised by a UK Minister, the Scottish Government will facilitate scrutiny by the Scottish Parliament of the Scottish Minsters’ proposed consent or its proposed response to the consultation

I request a response to these questions by Wednesday, 21 June 2023, so that this can be reflected in the Committee’s final report.

Finally, I am also writing to the UK Government regarding this clause, in relation to why it considers it appropriate, in the particular policy context of the Bill, that the power in clause 93 has (a) been conferred so that it is exercisable independently by the Secretary of State within devolved competence, and not by the Scottish Ministers; and (b) when the power is exercised by the Secretary of State within devolved competence, there is no requirement to obtain the consent of the Scottish Ministers.

Response from the Cabinet Secretary for Wellbeing Economy, Fair Work,and Energy, 19 June 2023

Thank you for your letter dated 8 June 2023 relating to the Legislative Consent

Memorandum for the Data Protection and Digital Information (No. 2) Bill (“the Bill”). Before I respond to the committee’s questions, I would like to update you on agreed amendments to the Bill that alter Clause 93.

In total, ten amendments were agreed at the Bill’s Committee Stage. The Bill page has now been updated to reflect those amendments and I summarise them below:-

• Clause 93 (now Clause 99) is amended to grant the power to make regulations via the negative resolution procedure for the implementation of international agreements as they relate to law enforcement data sharing (“the power”) to ‘appropriate national authorities’.

• New Clause 100 designates the Scottish Ministers as an appropriate national

authority where regulations made with the power contain only devolved provisions.

• Clause 108 (now Clause 115) is consequentially amended to state the procedures to be followed for regulations made by the Scottish Ministers.

As a result of these amendments, the Scottish Government will recommend that parliament gives consent to Clause 93 (now clause 99).

I will respond to the committee’s questions as they are marked, (a) – (c):-

(a) We would not expect the UK Government to legislate in a devolved area without consulting the Scottish Government. However, following the aforementioned amendments to the Bill, the power will be granted to Scottish Ministers and its use by Scottish Ministers will be subject to scrutiny by the Scottish Parliament.

(b) The power itself does not fall within an area formerly within EU competence before the UK fully withdrew from the EU. It is possible that the future use of this power could create regulations that would fall within areas that were formerly within EU competence however it is difficult to say as the future use of this power is only hypothetical.

(c) Importantly and to avoid any doubt, due to the amendments to the DPDI that Scottish Ministers requested, the Scottish Parliament will scrutinise the Scottish Ministers’ use of the power via the negative procedure.

The Scottish Government’s position is that there ought to be parallel powers for Scottish Ministers to implement international agreements in this case, which thus facilitates the scrutiny of the Scottish Parliament.

To facilitate scrutiny where UK SIs in devolved areas are made in consultation with Scottish Ministers, both Scottish Ministers and UK Ministers may be invited to appear before committee.

I hope the committee finds this helpful.