Member

464: Clause 192, page 223, line 33, at end insert— “(4A) Before the appropriate national authority makes regulations under subsection (1) for the purpose of implementing a new international agreement, or significantly altering an existing agreement, the authority must conduct and publish a comprehensive Privacy Impact Assessment.(4B) The Privacy Impact Assessment required under subsection (4A) must analyse and report on—(a) the necessity and proportionality of the information sharing arrangements,(b) the mechanism by which individual rights, including those under Article 8 of the Human Rights Act 1998, will be safeguarded,(c) the risks of non-compliance with the data protection legislation or of unintended consequences arising from the sharing of personal data, and(d) the nature and volume of personal data intended to be shared or accessed under the agreement.(4C) The appropriate national authority must lay before Parliament, no later than 12 months after the first regulations are made under this section, and annually thereafter, a report on the operation of regulations made under this section.(4D) The annual report required under subsection (4C) must include, in particular—(a) an assessment of the overall volume and categories of information shared under the regulations,(b) a detailed analysis of the impact of the regulations on the privacy and data protection rights of individuals, and(c) a summary of any internal reviews, audits, or legal challenges relating to information sharing under the agreements implemented by the regulations.”Member's explanatory statement This amendment requires a privacy impact assessment to be carried out before regulations are made under this section.