Change 1 Article Choose an article Title and introductory text 1 Overview 2 Protection of personal data 3 Terms relating to the processing of personal data 4 Processing to which this Part applies 5 Definitions 6 Meaning of “controller” 7 Meaning of “public authority” and “public body” 8 Lawfulness of processing: public interest etc 9 Child's consent in relation to information society services 9A Processing in reliance on relevant international law 10 Special categories of personal data and criminal convictions etc data 11 Special categories of personal data etc: supplementary 12 Limits on fees that may be charged by controllers 13 Obligations of credit reference agencies 13A Meaning of “relevant offence” for purpose of right to erasure 14 Automated decision-making authorised by law: safeguards 15 Exemptions etc 16 Power to make further exemptions etc by regulations 17 Accreditation of certification providers 17A Transfers based on adequacy regulations 17B Transfers based on adequacy regulations: review etc 17C Standard data protection clauses 18 Transfers of personal data to third countries etc : public interest 19 Processing for archiving, research and statistical purposes: safeguards 20 Meaning of “court” 21 Definitions 22 Application of the GDPR to processing to which this Chapter applies 23 Power to make provision in consequence of regulations related to the GDPR 24 Manual unstructured data held by FOI public authorities 25 Manual unstructured data used in longstanding historical research 26 National security and defence exemption 27 National security: certificate 28 National security and defence: modifications to Articles 9 and 32 of the UK GDPR 29 Processing to which this Part applies 30 Meaning of “competent authority” 31 “The law enforcement purposes” 32 Meaning of “controller” and “processor” 33 Other definitions 34 Overview and general duty of controller 35 The first data protection principle 36 The second data protection principle 37 The third data protection principle 38 The fourth data protection principle 39 The fifth data protection principle 40 The sixth data protection principle 40A Conditions for consent 41 Safeguards: archiving 42 Safeguards: sensitive processing 42A Further provision about sensitive processing 43 Overview and scope 44 ... Controller's general duties 45 Right of access by the data subject 45A Exemption from sections 44 and 45: legal professional privilege 46 Right to rectification 47 Right to erasure or restriction of processing 48 Rights under section 46 or 47: supplementary 49 Right not to be subject to automated decision-making 50 Automated decision-making authorised by law: safeguards 50A Automated processing and significant decisions 50B Restrictions on automated decision-making based on sensitive processing 50C Safeguards for automated decision-making 50D Further provision about automated decision-making 51 Exercise of rights through the Commission 52 Form of provision of information etc 53 Manifestly unfounded or excessive requests by the data subject 54 Meaning of “applicable time period” 55 Overview and scope 56 General obligations of the controller 57 Data protection by design and default 58 Joint controllers 59 Processors 60 Processing under the authority of the controller or processor 61 Records of processing activities 62 Logging 63 Co-operation with the Commission 64 Data protection impact assessment 65 Prior consultation with the Commission 66 Security of processing 67 Notification of a personal data breach to the Commission 68 Communication of a personal data breach to the data subject 69 Designation of a data protection officer 70 Position of data protection officer 71 Tasks of data protection officer 71A Codes of conduct 72 Overview and interpretation 73 General principles for transfers of personal data 74 Transfers on the basis of an adequacy decision 74A Transfers based on adequacy regulations 74AA Transfers approved by regulations 74AB The data protection test 74B Transfers approved by regulations: monitoring 75 Transfers subject to appropriate safeguards 76 Transfers based on special circumstances 77 Additional conditions for transfers in reliance on section 73(4)(b) 78 Subsequent transfers 78A National security exemption 79 National security: certificate 80 Special processing restrictions 81 Reporting of infringements 82 Processing to which this Part applies 82A Designation of processing by a qualifying competent authority 82B Duration of designation notice 82C Review and withdrawal of designation notice 82D Records of designation notices 82E Appeal against designation notice 83 Meaning of “controller” and “processor” 84 Other definitions 85 Overview 86 The first data protection principle 87 The second data protection principle 88 The third data protection principle 89 The fourth data protection principle 90 The fifth data protection principle 91 The sixth data protection principle 91A Further provision about sensitive processing 92 Overview 93 Right to information 94 Right of access 95 Right of access: supplementary 96 Right not to be subject to automated decision-making 97 Right to intervene in automated decision-making 98 Right to information about decision-making 99 Right to object to processing 100 Rights to rectification and erasure 101 Overview 102 General obligations of the controller 103 Data protection by design 104 Joint controllers 105 Processors 106 Processing under the authority of the controller or processor 107 Security of processing 108 Communication of a personal data breach 109 Transfers of personal data outside the United Kingdom 110 National security 111 National security: certificate 112 Other exemptions 113 Power to make further exemptions 114 The Information Commissioner 114A The Information Commission 115 General functions under the UK GDPR and safeguards 116 Other general functions 117 Competence in relation to courts etc 118 Co-operation between parties to the Data Protection Convention 119 Inspection of personal data in accordance with international obligations 119A Standard clauses for transfers to third countries etc 120 Further international role 120A Principal objective 120B Duties in relation to functions under the data protection legislation 120C Strategy 120D Duty to consult other regulators 121 Data-sharing code 122 Direct marketing code 123 Age-appropriate design code 124 Data protection and journalism code 124A Other codes of practice 124B Panels to consider codes of practice 124C Impact assessments for codes of practice 125 Approval of codes prepared under sections 121 to 124A 126 Publication and review of codes issued under section 125(4) 127 Effect of codes issued under section 125(4) 128 Other codes of practice 129 Consensual audits 130 Records of national security certificates 131 Disclosure of information to the Commission 132 Confidentiality of information 133 Guidance about privileged communications 134 Fees for services 135 Manifestly unfounded or excessive requests by data subjects etc 136 Guidance about fees 137 Charges payable to the Commission by controllers 138 Regulations under section 137: supplementary 139 Reporting to Parliament 139A Analysis of performance 140 Publication by the Commission 141 Notices from the Commissioner 141A Notices from the Commission 142 Information notices 143 Information notices: restrictions 144 False statements made in response to information notices 145 Information orders 146 Assessment notices 146A Assessment notices: approval of person to prepare report etc 147 Assessment notices: restrictions 148 Destroying or falsifying information and documents etc 148A Interview notices 148B Interview notices: restrictions 148C False statements made in response to interview notices 149 Enforcement notices 150 Enforcement notices: supplementary 151 Enforcement notices: rectification and erasure of personal data etc 152 Enforcement notices: restrictions 153 Enforcement notices: cancellation and variation 154 Powers of entry and inspection 155 Penalty notices 156 Penalty notices: restrictions 157 Maximum amount of penalty 158 Fixed penalties for non-compliance with charges regulations 159 Amount of penalties: supplementary 160 Guidance about regulatory action 161 Approval of first guidance about regulatory action 161A Annual report on regulatory action 162 Rights of appeal 163 Determination of appeals 164 Applications in respect of urgent notices 164A Complaints by data subjects to controllers 164B Controllers to notify the Commission of the number of complaints 165 Complaints by data subjects to the Commission 166 Orders to progress complaints to the Commission 167 Compliance orders 168 Compensation for contravention of the UK GDPR 169 Compensation for contravention of other data protection legislation 170 Unlawful obtaining etc of personal data 171 Re-identification of de-identified personal data 172 Re-identification: effectiveness testing conditions 173 Alteration etc of personal data to prevent disclosure to data subject 174 The special purposes 175 Provision of assistance in special purposes proceedings 176 Staying special purposes proceedings 177 Guidance about how to seek redress against media organisations 178 Review of processing of personal data for the purposes of journalism 179 Effectiveness of the media's dispute resolution procedures 180 Jurisdiction 180A Procedure in connection with subject access requests 181 Interpretation of Part 6 182 Regulations and consultation 183 Power to reflect changes to the Data Protection Convention 183A Protection of prohibitions and restrictions etc on processing: relevant enactments 183B Protection of prohibitions and restrictions etc on processing: other enactments 184 Prohibition of requirement to produce relevant records 185 Avoidance of certain contractual terms relating to health records 186 Protection of data subject’s rights 186A Protection of data subject’s rights: further provision 187 Representation of data subjects with their authority 188 Representation of data subjects with their authority: collective proceedings 189 Duty to review provision for representation of data subjects 190 Post-review powers to make provision about representation of data subjects 191 Framework for Data Processing by Government 192 Approval of the Framework 193 Publication and review of the Framework 194 Effect of the Framework 195 Reserve forces: data-sharing by HMRC 196 Penalties for offences 197 Prosecution 198 Liability of directors etc 199 Recordable offences 200 Guidance about PACE codes of practice 201 Disclosure of information to the Tribunal 202 Proceedings in the First-tier Tribunal: contempt 203 Tribunal Procedure Rules 204 Meaning of “health professional” and “social work professional” 205 General interpretation 206 Index of defined expressions 207 Territorial application of this Act 208 Children in Scotland 209 Application to the Crown 210 Application to Parliament 211 Minor and consequential provision 212 Commencement 213 Transitional provision 214 Extent 215 Short title Schedule A1 Processing in reliance on relevant international law SCHEDULE 1 Special categories of personal data and criminal convictions etc data SCHEDULE 2 Exemptions etc from the UK GDPR SCHEDULE 3 Exemptions etc from the UK GDPR: health, social work, education and child abuse data SCHEDULE 4 Exemptions etc from the UK GDPR: disclosure prohibited or restricted by an enactment SCHEDULE 5 Accreditation of certification providers: reviews and appeals SCHEDULE 7 Competent authorities SCHEDULE 8 Conditions for sensitive processing under Part 3 SCHEDULE 9 Conditions for processing under Part 4 SCHEDULE 10 Conditions for sensitive processing under Part 4 SCHEDULE 11 Other exemptions under Part 4 Schedule 12A The Information Commission SCHEDULE 13 Other general functions of the Commission SCHEDULE 14 Co-operation and mutual assistance SCHEDULE 15 Powers of entry and inspection SCHEDULE 16 Penalties SCHEDULE 17 Review of processing of personal data for the purposes of journalism SCHEDULE 18 Relevant records SCHEDULE 19 Minor and consequential amendments SCHEDULE 20 Transitional provision etc SCHEDULE 21 Further transitional provision etc
What to do with it
As published
57 Data protection by design and default
(1) Each controller must implement appropriate technical and organisational measures which are designed—
(a) to implement the data protection principles in an effective manner, and
(b) to integrate into the processing itself the safeguards necessary for that purpose.
(2) The duty under subsection (1) applies both at the time of the determination of the means of processing the data and at the time of the processing itself.
(3) Each controller must implement appropriate technical and organisational measures for ensuring that, by default, only personal data which is necessary for each specific purpose of the processing is processed.
(4) The duty under subsection (3) applies to—
(a) the amount of personal data collected,
(b) the extent of its processing,
(c) the period of its storage, and
(d) its accessibility.
(5) In particular, the measures implemented to comply with the duty under subsection (3) must ensure that, by default, personal data is not made accessible to an indefinite number of people without an individual's intervention.
Your wording
Your change, as a redline
57 Data protection by design and default
(1) Each controller must implement appropriate technical and organisational measures which are designed—
(a) to implement the data protection principles in an effective manner, and
(b) to integrate into the processing itself the safeguards necessary for that purpose.
(2) The duty under subsection (1) applies both at the time of the determination of the means of processing the data and at the time of the processing itself.
(3) Each controller must implement appropriate technical and organisational measures for ensuring that, by default, only personal data which is necessary for each specific purpose of the processing is processed.
(4) The duty under subsection (3) applies to—
(a) the amount of personal data collected,
(b) the extent of its processing,
(c) the period of its storage, and
(d) its accessibility.
(5) In particular, the measures implemented to comply with the duty under subsection (3) must ensure that, by default, personal data is not made accessible to an indefinite number of people without an individual's intervention.
A proposal here is not law. Support on Solon is evidence that people want the change; the official route says what it takes to make it law.