Skip to main content

Enforced subject access – now a criminal offence

<p>After having its introduction postponed at the end of last year, section 56 of the Data Protection Act 1998 (DPA) has today come into force.</p>…

After having its introduction postponed at the end of last year, section 56 of the Data Protection Act 1998 (DPA) has today come into force.

Essentially, section 56 DPA makes it a criminal offence to force someone to supply the results of a subject access request (the right of an individual under the DPA to request access to their personal data) made to the police, the Disclosure and Barring Service or Secretary of State for Justice.  This means that it will not be permissible to oblige an individual to produce the results of any such subject access request in connection with their recruitment, continued employment or contract for the provision of services.  This includes where the response to a request says that no information is being processed about an individual.  Guidance from the ICO makes it clear that there is a distinction between an individual making a request for such information of their free will as opposed to being required to do so by a potential employer, for example.  Where there is legitimate reason to require information regarding criminal records, the appropriate way to access information regarding an individual's criminal record is through the criminal records disclosure scheme.

As well as the offence outlined above, there is a further offence committed if a person providing good, facilities or services to the public or a section of the public requires an individual to make a subject access request as a condition of providing them with goods, facilities or services. This includes where an individual is seeking voluntary work.

There are, however, certain circumstances under which a criminal offence will not be committed.  This includes where such a request would be authorised under other legislation or rule of law or where such a request is ordered by a court.  In addition, an enforced subject access request is also permissible if the requirement can be justified as being in the public interest.  In this instance, the public interest cannot relate to the prevention or detection of crime.

The offences created under section 56 DPA are "either way" offences, meaning that they can be heard by either a magistrates' court or a crown court.  Upon being found guilty of an offence under section 56 DPA, an individual can be sentenced to an unlimited fine.