Economy and Fair Work Committee
The Data Protection and Digital Information (No.2) Bill was introduced in the House of Commons on 8 March 2023 replacing the original Data Protection and Digital Information Bill. The Bill was carried over and reintroduced to the House of Commons on 08 November 2023 for Session 2023-24, and renamed as the Data Protection and Digital Information Bill.
The Scottish Government lodged a Legislative Consent Memorandum (LCM) on the Bill on 15 May 2023. The Presiding Officer has not received a letter from the Minister of Parliamentary Business explaining the delay in the LCM being lodged. Under rule 9B.3.5, the Parliamentary Bureau referred the LCM to the Economy and Fair Work Committee.
The Committee considered its approach to the scrutiny of this LCM on 31 May 2023. Subsequent to this consideration, amendments to the Bill were tabled in the House of Commons. In response to these amendments, the Scottish Government lodged a supplementary LCM on 14 September 2023.
The Committee took evidence from Richard Lochhead, Minister for Small Business, Innovation, Tourism and Trade on both the original LCM and the supplementary LCM on 22 November 2023.
It is best practice for Committees to report ahead of the last amending stage in the first house (in this case the House of Commons) where possible. However, the Bill's Report Stage and Third Reading in the House of Commons took place on 29 November 2023, with the result that it has not been possible to report before this deadline.
The Bill makes changes to the legal regime for processing personal data and touches on a number of different policy areas. According to the UK Government, the Bill will reduce the administrative burden of data protection compliance on business and clarify the rules to encourage innovation and improve trust and confidence in the use of data in the public interest.
In the original LCM, the Scottish Government recommended that consent should be granted for the majority of those provisions in the Bill which relate to Scotland and require legislative consent, as follows—
Clause 54(3) – Power of public authority to disclose information to registered persons;
Clauses 61-77 – Smart data; and
Clause 92 – Disclosure of information to improve public service delivery to undertakings
Clause 54(3) enables public authorities to share personal data with digital verification service providers as a result of a user request for their services. The Scottish Government states that it wants people to benefit from data held by Scottish public authorities when using digital verification services and so recommended that consent be given for this provision.
Clauses 61-77 focus on sharing data for the purposes of smart data initiatives. The clauses enable a customer to request that a business shares their personal data with a separate service provider. The provisions also cover the transfer of business data between businesses. The Scottish Government argues these provisions are technical and believes there is no benefit from legislating separately on them and so recommended that consent is given.
Clause 92 amends the UK Digital Economy Act 2017 (the Act), Part 5 Section 35, to extend the public service delivery data sharing powers to improve outcomes for “undertakings” which is defined to include any form of business and charitable bodies.
However, Clause 93 of the Bill (as originally drafted) granted the Secretary of State the power to make regulations implementing international agreements on information sharing for law enforcement purposes. The Scottish Government states that the implementation of international agreements in devolved areas is within devolved competence. In the original draft of the Bill there was no provision for Scottish Ministers to have concurrent powers in this area. It is for this reason that the Scottish Government recommended in the original LCM that consent for this provision be withheld.
The Scottish Government lodged a supplementary LCM after amendments to the Data Protection and Digital Information (No.2) Bill were published on 23 May, addressing the previous concerns the Scottish Government had in relation to Clause 93.
Clauses 99 (previously Clause 93),100 and 115 confer parallel powers on Scottish Ministers and on the Secretary of State to make regulations in secondary legislation to implement future international agreements as they relate to the sharing of information for law enforcement purposes. The Scottish Government now recommends consent be given for these provisions.
Clause 59 of the Bill (previously Clause 55) would create a new criminal offence of onward sharing of Revenue Scotland data provided for Digital Verification Services provisions without permission. The Scottish Government is content that this provides protection consistent with arrangements for HMRC and the Welsh Revenue Authority. The Scottish Government recommends consent for Clause 59.
The draft motion, which will be lodged by the Cabinet Secretary for Wellbeing, Economy, Fair Work and Energy in relation to the original LCM, is—
That the Parliament agrees that the relevant provisions of the Data Protection and Digital Information (No. 2) Billi, introduced in the House of Commons on 18 July 2022, relating to Clauses 54(3), 61-77 and 92, so far as these matters fall within the legislative competence of the Scottish Parliament, should be considered by the UK Parliament.
The draft motion to be lodged by the Cabinet Secretary for Wellbeing Economy, Fair Work and Energy in relation to the supplementary LCM, is—
That the Parliament agrees that the relevant provisions of the Data Protection and Digital Information (No.2) Bill, introduced in the House of Commons on 8 March 2023, relating to Clauses 59ii, 99, 100 and 115 so far as these matters fall within the legislative competence of the Scottish Parliament, should be considered by the UK Parliament.1
At its meeting on 22 November 2023, the Committee took evidence on both the original and the supplementary LCM from Richard Lochhead, Minister for Small Business, Innovation, Tourism and Trade.
The Committee noted the Scottish Government's revised position on consent in relation to those provisions in the Bill which relate to Scotland and require legislative consent.
The Committee asked the Minister for Small Business, Innovation, Tourism and Trade to explain the arrangements in place between the Scottish and UK Governments if the Secretary of State were to legislate without consulting the Scottish Government or Scottish Parliament.
The Minister gave a commitment that he would do his best to keep Parliament up to date and explained why, in this case, the Scottish Government was content with the Secretary of State legislating in devolved matters. The Minister explained—
We have got a concession whereby Scottish Ministers have a role and were added in to ... Clause 99. We have to weigh up the benefits and disbenefits; we took the view that overall, in supporting this, there are more benefits than would otherwise be the case.1
The Delegated Powers and Law Reform Committee (DPLRC) considered the LCM on Tuesday 6 June and again on Tuesday 27 June 2023.
The report published by the DPLRC states that the Committee finds the powers in relation to Clauses 54(3), 61-77 and 92 acceptable in principle. The Committee noted that amendments have been made to the Bill giving Scottish Ministers a concurrent power under Clause 99 (previously Clause 93) and accepted the delegated power in principle.
The DPLRC restates its general concern that—
“… it remains the case that the Secretary of State may make regulations within devolved competence, acting alone. There is no requirement for the Secretary of State to obtain consent or to consult with the Scottish Ministers before exercising the power. The Committee's position, as agreed by the Committee in November 2022, in relation to delegated powers in UK Bills exercised in devolved areas is, in general terms, that:
a) The Scottish Parliament should have the opportunity to effectively scrutinise the exercise of all legislative powers within devolved competence.
b) Where such powers are exercised by UK Ministers in devolved areas, there is no formal means by which the Scottish Parliament can scrutinise such regulations or be notified that they had been laid before the UK Parliament.
c) If such powers contain a requirement for the Scottish Ministers’ consent when exercised within devolved competence, the Scottish Parliament can scrutinise the Scottish Ministers’ consent decision. The Committee will scrutinise powers conferred on UK Ministers not subject to a requirement for Scottish Ministers’ consent and may suggest matters for the lead committee to consider.
d) As a minimum, powers when exercised by UK Ministers in devolved areas should be subject to the process set out in the SI Protocol 2 where the power is within the scope of that protocol.”
The DPLRC considered the supplementary LCM on 3 October and reported to this Committee on 5 October. The Committee reiterated the position it agreed at its meeting on 27 June 2023, as outlined above.
The Committee notes the conclusions of the Delegated Powers and Law Reform Committee and shares its general concerns about the lack of opportunity to effectively scrutinise the exercise of all legislative powers within devolved competence.
The Committee acknowledges the Minister for Small Business, Innovation, Tourism and Trade's commitment to keep the Parliament updated on any developments in relation to such matters, particularly where the Secretary of State can act unilaterally within devolved competence. The Committee is concerned at the frequency with which the Secretary of State takes powers to make regulations in devolved matters with no requirement to obtain the consent of Scottish Ministers.
After considering both the LCM and the supplementary LCM, the Committee agreed that it was content to recommend that the Parliament should agree the associated motions.
The Committee therefore recommends that the Parliament agrees the legislative consent motions on the Data Protection and Digital Information Bill to be lodged by the Cabinet Secretary for Wellbeing Economy, Fair Work and Energy.