Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, whether he has received representations on the provisions for data protection breaches in the Data Protection Bill; and if he will make a statement.

We have received a wide range of queries and correspondence from organisations and individuals during passage of the Bill about the Information Commissioner’s role in enforcing the new legislation, the increased administrative fines she will be able to impose for data breaches under the new legislation, and the criminal penalties that may be available for the very worst data breaches. Many of the Commissioner’s existing functions, such as powers to make codes of practice and guidance, her range of investigatory and enforcement powers are all preserved by the Bill to support organisations to achieve compliance. However, we have also modernised some of the tools at her disposal, including through the creation of a new offence of unlawfully re-identifying encrypted data, to keep pace with changes in technology and the way that the use of data has evolved.

Further guidance on the ICO’s enforcement powers can be viewed on the Bill website at: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/644818/2017-09-06_Factsheet05_Bill_ICO.pdf