Delegated Powers and Law Reform Committee
At its meeting on 30 April 2024, the Committee considered the delegated powers that are exercisable within devolved competence in the Data Protection and Digital Information Bill ("the Bill”).
This is the second iteration of the UK Government Bill introduced initially in Westminster on 18 July 2022. The Bill was paused and then subsequently introduced again in the House of Commons on 8 March 2023. The provisions in the Bill relate principally to reserved matters, however, a few aspects of the Bill relate to matters that are devolved in Scotland.
The Scottish Government lodged a Legislative Consent Memorandum ("LCM") on 15 May 2023. At its meetings on 6 and 27 June 2023, the Committee considered the delegated powers that are exercisable within devolved competence in the Bill. The Committee published its report on 29 June 2023.
The Bill was subsequently amended, and a Supplementary LCM was lodged on 14 September 2023 which the Committee considered at its meeting on 3 October 2023. The Committee published its report on 5 October 2023.
The Scottish Government lodged a further Supplementary LCM for the Bill on 17 April 2024. The Scottish Government is supportive of the intent of the Bill and has published a draft motion recommending that the Scottish Parliament gives its legislative consent.
The Supplementary LCM is being considered in terms of the Committee’s wider remit contained in Rule 6.11.1(b) of the Standing Orders which provides that the remit of the Committee includes considering and reporting on proposed powers to make subordinate legislation in particular bills “or other proposed legislation”. The Committee and its predecessor Committee have considered powers conferred on UK Ministers in devolved areas in various Bills over the course of sessions 5 and 6.
The lead committee for the Supplementary LCM is the Social Justice and Social Security Committee.
This is a substantial Bill which has been subject to amendment as it has progressed through the UK parliamentary process. It is currently at the Committee stage in the House of Lords.
The stated purpose of the Bill is to update and simplify the UK’s data protection framework with a view to reducing burdens on organisations while maintaining high data protection standards. The UK Government states that the privacy frameworks within the Bill are necessary, pro-growth reforms to enable data driven innovation, reduce data protection-associated burdens on businesses, and empower people to take control of their data, within a trusted data regime.
The provisions in the Bill relate principally to reserved matters, however, a few aspects of the Bill relate to matters that are devolved in Scotland which this Committee has previously considered and reported.
Following amendment, the Bill confers further powers on the Secretary of State in devolved areas which the Supplementary LCM relates to. Additional powers are introduced by clause 128 which makes provision in schedule 11 for delegated powers that are exercisable in devolved areas which are addressed in the next section of the report.
Background
Clause 128 has been introduced by amendment as the Bill has progressed. It amends the Social Security Administration Act 1992 to allow the Secretary of State to be able to obtain information for social security purposes to address the issue of welfare fraud and error.
The Secretary of State is able to issue account information notices to prescribed persons requiring them to provide certain information relating to accounts which they administer or have access to. Schedule 3B, which is introduced by schedule 11 of the Bill, contains four delegated powers on the Secretary of State in relation to issuing of information notices. These four powers are discussed together below.
Schedule 11, Part 1 paragraph 6 - Paragraph 1(1) of Schedule 3B of the 1992 Act: Power to specify persons to whom an account information notice may be given by the Secretary of State
Power conferred on: the Secretary of State
Power exercisable by: regulations
Parliamentary procedure: affirmative
Provision
Paragraph 1(1) of the schedule confers power on the Secretary of State to prescribe persons to whom an account information notice may be given requiring the person to provide account information. Any regulations made under this provision would be subject to the affirmative procedure.
Schedule 11, Part 1 Paragraph 6 - Paragraph 6 (1) of Schedule 3B of the 1992 Act: Provision to issue a code of practice in connection with account information notices
Power conferred on: the Secretary of State
Power exercisable by: statutory code of practice
Parliamentary procedure: laying only
Provision
Paragraph 6(1) confers power on the Secretary of State to issue a code of practice in connection with account information notices. The code can include provisions about what considerations may be relevant to the issue of an information notice and the imposition of penalties. The delegated powers memorandum states the code is designed to assist persons given account information notices in how to comply with them, is laid only and not subject to any parliamentary procedure.
Schedule 11, Part 1 Paragraph 6- Paragraph 9(3) (a) of Schedule 3B of the 1992 Act: Power to specify an amount payable by a person who has been given an account information notice for failing to comply with it
Power conferred on: the Secretary of State
Power exercisable by: regulations
Parliamentary procedure: affirmative
Provision
Where someone who has been served an information notice has failed to comply with a request, the Secretary of State must give them an opportunity to make representations for their failure. If they have failed to comply with the request without any reasonable excuse, then the Secretary of State may issue a fixed penalty, a daily rate penalty, or both. Paragraph 9(3)(a) confers power on the Secretary of State to prescribe the amount of the fixed penalty. Such regulations would be subject to the affirmative procedure.
Schedule 11, Part 1 Paragraph 6 - Paragraph 12 of Schedule 3B of the 1992 Act: Power to change maximum amount of penalties
Power conferred on: the Secretary of State
Power exercisable by: regulations
Parliamentary procedure: affirmative
Provision
The maximum amount prescribed in the Bill for a penalty notice issued by the Secretary of State for failure to comply with an information notice as a fixed penalty is provided in paragraph 9(9) which is £1,000 and the daily rate penalty is provided in paragraph 9(10) which is £40. Paragraph 10(5) provides that where the issue of a fixed penalty has been appealed to a Tribunal, the Tribunal may not determine a daily rate that exceeds £1,000.
Paragraph 12 confers power on the Secretary of State to amend the maximum penalty amounts to reflect a change in the value of money. Such regulations would be subject to the affirmative procedure.
Committee consideration of the aforementioned four powers
Clause 128 amends the Social Security Administration Act 1992 to make provision about a power for the Secretary of State to obtain information for social security purposes to address welfare fraud and error which is stated to account for a significant amount of public spending.
The provisions extend to Scotland and there is nothing in the Bill to exclude devolved benefits from the definition of relevant benefits that the account information notices by the Secretary of State apply to. Section 128 and schedule 11 applies to certain devolved social security benefits which is something that the Scottish Parliament can legislate for.
The UK Government’s position, as outlined in the Supplementary LCM, is that these provisions have the effect of amending confidentiality requirements of financial institutions and so are reserved. The Scottish Government disagrees and considers legislative consent is required as the provisions allow the Secretary of State to be able to require information for devolved social security purposes.
The Scottish Government position in the Supplementary LCM is that the proposed powers will be applicable to Scottish residents in receipt of devolved benefits administered by the DWP under agency agreement on behalf of Scottish Ministers. They further note that whilst that is the case, there will be no direct impact given the timescales for delivery and the Secretary of State has no intention to exercise them in relation to devolved benefits.
The powers themselves are limited in scope. It is clear how they will be exercised with the Bill itself containing much of the detail of how the information notices will be implemented. Additionally, the code of practice is for guidance only and is of no legal effect. The powers to make regulations are all subject to appropriate levels of scrutiny. Whilst these powers can be unilaterally exercised in relation to devolved benefits the Scottish Government considers the practical impact of such powers to be theoretical only and not likely to have any impact on Scottish devolved benefits as they will apply only to those which are currently managed by DWP.
The Committee highlights that it remains the case that the Secretary of State may make regulations within devolved competence, acting alone. There is no requirement for the Secretary of State to obtain consent or to consult with the Scottish Ministers before exercising the power. It reiterates the Committee’s agreed general position, in relation to delegated powers in UK Bills exercised in devolved areas, which is, that:
a) The Scottish Parliament should have the opportunity to effectively scrutinise the exercise of all legislative powers within devolved competence.
b) Where such powers are exercised by UK Ministers in devolved areas, there is no formal means by which the Scottish Parliament can scrutinise such regulations or be notified that they had been laid before the UK Parliament.
c) If such powers contain a requirement for the Scottish Ministers’ consent when exercised within devolved competence, the Scottish Parliament can scrutinise the Scottish Ministers’ consent decision.
The Committee will scrutinise powers conferred on UK Ministers not subject to a requirement for Scottish Ministers’ consent, and may suggest matters for the lead committee to consider.
d) As a minimum, powers when exercised by UK Ministers in devolved areas should be subject to the process set out in the SI Protocol 2 where the power is within the scope of that protocol.
The Committee notes that there are no requirements to obtain Scottish Ministers consent when exercising these powers and so the SI Protocol 2 will not apply.
The Committee also notes that the Scottish Government considers it is unlikely that the powers will in practice be exercised in relation to devolved benefits.
As such, the Committee concludes that it does not wish to draw these powers to the attention of the lead committee.