Member

Amendment 109 from the noble Lord, Lord Clement-Jones, would amend requirements for data protection impact assessments. The noble Lord will know that I and the Government share his concerns about the measures in the previous Government’s Data Protection and Digital Information Bill. I am therefore glad that this Bill does not include them. The existing provisions in the UK GDPR already require data controllers to carry out a data protection impact assessment when the processing is likely to result in high risks to the rights and freedoms of individuals. This would include, for example, a risk that a processing activity may give rise to discrimination. The assessment must contain, among other things, a description of safeguards to ensure protection of personal data. However, the Government would prefer to avoid requiring organisations to comply with even more rigorous requirements, such as the need to consider environmental impacts.