Moved by
Lord Moylan
106: After Clause 42, insert the following new Clause—
“Retention by the police of personal data relating to non-criminal conduct perceived to be motivated by hostility
(1) The processing of relevant data by a police authority in accordance with Article 6(1) of the GDPR and section 35 of the Data Protection Act 2018 is not lawful unless it is undertaken in accordance with regulations made by statutory instrument under this section.
(2) In this section, “relevant data” means personal data relating to a data subject which is based in whole or in part on the perception by another person that the conduct of the data subject was motivated wholly or partially by hostility or prejudice towards any group of people sharing a characteristic and where the conduct in question is unlikely to constitute a criminal offence.
(3) In this section, “a police authority” means—
(a) a person specified or described in paragraphs 5 to 20 of Schedule 7 to the Data Protection Act 2018;
(b) a person acting under the authority of such a person.
(4) Subsection (1) does not apply in respect of the processing of information—
(a) pursuant to an ongoing criminal investigation;
(b) for the purposes of the internal administrative functions of the police authority.
(5) Regulations under this section must—
(a) identify different categories of personal data and processing of the personal data in question;
(b) include provisions by reference to each of the various categories of processing and personal data as to—
(i) the person or persons whose authority is required for the processing of the personal data;
(ii) the notifying of the data subject of the processing of the personal data;
(iii) the period for which the personal data can be retained (including provision for the granting of authority for extending that period);
(iv) the disclosure of the personal data to third parties;
(c) have particular regard to the importance of the right to freedom of expression and the extent to which that right is adversely affected by the processing of relevant data by any police authority.
(6) A statutory instrument containing regulations under this section may not be made unless a draft of the instrument has been laid before, and approved by resolution of, each House of Parliament.
(7) In section 113B of the Police Act 1997, after subsection (3) insert—
“(3A) An enhanced criminal record certificate must not give the details of a relevant matter to the extent that doing so would result in the disclosure of relevant data as defined at subsection (2) of section (Retention by the police of personal data relating to non-criminal conduct perceived to be motivated by hostility) of the Police, Crime, Sentencing and Courts Act 2021.”
(8) In this section—
(a) the terms “personal data”, “data subject”, “processing” and “the GDPR” have the same meanings as under section 3 of the Data Protection Act 2018;
(b) the term “characteristic” includes but is not limited to any protected characteristics under section 4 of the Equality Act 2010.”