ICO blog: Key battle won in war against forced subject access request
In this section
- Key battle won in war against forced subject access request
- NHS patient information and the Data Protection Act
- NHS patient information: the Information Centre and the DPA
By Jonathan Bamford
14 February 2014
There is an old adage about winning battles but not necessarily winning the war. It was nearly eighteen years ago when I was sat in the Home Office, doing my best to make the case for including a provision in the Data Protection Bill to deal with the problem of enforced subject access. This is where individuals are forced by someone like a prospective employer to make a DPA subject access request and reveal the results to them, typically in relation to criminal conviction data.
It is not only a clear perversion of an individual’s own rights, with consequences like unwarranted loss of employment opportunities, it also undermined important public polices such as the rehabilitation of offenders. The information provided in a police subject access response, for instance, is potentially far greater than an individual would ever have to declare to a prospective employer, and would include convictions considered ‘spent’ under the Rehabilitation of Offenders Act.
Back when we were discussing the Data Protection Bill, another law - what was to become the Police Act 1997 – was also going through Parliament. That Act set up a new criminal record checking regime aimed at striking the right balance between the needs of employers and others, and the interests of individuals. Enforced subject access also undermines those important protections.
What we ultimately did see put on the statute book was section 56 of the Data Protection Act, which made it an offence to require a person to make a subject access request and reveal the result. But while that may sound like the result we were seeking, the battle was not won: the Government decided to delay implementation of this provision until the new criminal records checking regime was fully in place.
That has left the ICO to do what it can to discourage enforced subject access, while pressing Government to trigger the offence. We have enjoyed some limited success in dissuading organisations from using it, but the problem has not gone away – if anything, it has persisted and spread. It is now not only employers wanting access to criminal record information they are not entitled to: we have seen it being used by organisations as diverse as insurers when dealing with claims and TV production companies when selecting participants for their programmes.
Yesterday came the announcement that the final elements of the Police Act will take effect from 10 March 2014. With that comes the news that section 56 can also now be brought into effect in the near future, backed by the Government.
This is welcome news. Enforced subject access will be a criminal offence at long last and we will have the tools to help deal with the problem. We will be working to ensure that those who are involved in this unsavoury practice are aware they will be committing criminal offences and we will be preparing ourselves ready to prosecute those who are involved in the practice.
The Government’s commitment to trigger section 56 and the powers for the ICO to prosecute those involved is major step forward. The war is not yet won but a significant new weapon is entering the battlefield. We intend to use it to help stamp out this practice once and for all.
Head of Strategic Liaison
14 February 2014