Part VII: Amendments of Data Protection Act 1998
Sections 68 to 73
212.Part VII of the Act has the effect that the Data Protection Act 1998 rights of subject access and data accuracy are extended to all personal information held by public authorities, with some modifications and exemptions.
213.This is achieved by the device of providing that all personal information held by public authorities counts as personal data for the purposes of the 1998 Act, then cancelling all of the effects of that redefinition except those relating to subject access and accuracy (other than as regards personal information and non-designated functions of public authorities). Some modifications are made to the right of subject access as it relates to certain unstructured records.
214.The Data Protection Act 1998 creates two important rights for individuals in respect of information which is personal to them. Individuals are entitled to be told whether personal information relating to them is being held (or otherwise processed) and, if so, to have both it and certain other details about it communicated to them. This is known as subject access. The 1998 Act also makes provision placing a duty of accuracy on all data controllers. In both cases, the 1998 Act makes the rights enforceable both in the courts and, as a regulatory matter, by the Commissioner. These rights are, however, limited by the terms of application of the Data Protection Act 1998 itself. In particular, the scope of that Act is limited by the key definitions set out in section 1(1), most importantly the definition of “data”, which is restricted to information which is automated, or intended for automated processing, or part of a structured “relevant filing system” (as defined), or part of an “accessible record” (defined by section 68 of the 1998 Act to mean certain health, education, housing and social work records).
215.Section 68 has the effect that, for public authorities within the terms of the Act, the limitations on the definition of “data” in s.1(1) of the 1998 Act disappear (except to the extent that the information relates to functions in respect of which, under section 7, the Act does not apply). Subject to that limitation, the 1998 Act therefore applies to any personal information held by a public authority. That means, specifically, that the Data Protection Act applies to public authorities’ non-automated records even though they are not part of a “relevant filing system” and not part of an “accessible record” as defined in the Act. An example of that might be incidental personal information on a policy file, or in loose papers. The chief effect of this section for present purposes is that it achieves the extension of all the Data Protection Act provisions about subject access and accuracy to this new range of information. Section 1 of the 1998 Act, as amended by the Act, is set out as an Annex to these Notes.
216.But subject access will work in a slightly modified way in this new area, and Section 69 introduces two important qualifications to the subject access right which are not found in the 1998 Act as it stands. Section 69 itself applies to only some of the personal information added to the scope of subject access by section 68. It does not apply to information recorded on paper which, although it is not part of a “relevant filing system” or part of an “accessible record”, is nevertheless structured to a certain extent by reference to individuals. An example of such relatively structured information might be a case file about an individual which contains correspondence about a number of matters relating to that individual and is indexed by reference only to the dates of the correspondence. This relatively structured information will be treated for subject access purposes in exactly the same way as other personal information within the scope of the Data Protection Act. But two special rules will apply in respect of subject access to the residue, that is, the relatively unstructured information.
Firstly, subject access will not be given to this information unless the information is expressly described in the request. A request from a data subject for access to his own personal data has to be met in general by giving access to all of that subject’s data, without his having to specify any of it. No part of the residue of relatively unstructured personal information, however, will be included in response to a subject access request unless the data subject has expressly described it.
Secondly, even where residual relatively unstructured personal information has been described, the authority will be able to rely on provisions equivalent to those set out in section 12 of the Act to refuse a request in so far as it relates to that information where to do so would cost more than is provided for by a prescribed cost ceiling.
217.Section 68 also provides that the extension of subject access is to have no effect on the criminal offence created by section 56 of the 1998 Act, which prohibits in some circumstances the act of requiring the production of information obtained in the exercise of the right of subject access.
218.However, as well as achieving the expansion (and partial modification) of data subject rights, the amendment to the definition of “data” produced by section 68 would of course bring all the rest of the 1998 Act to bear on the totality of public authorities’ personal information. Given that the new rights exist and are operated wholly within the context of the 1998 Act, the extension of the definition of “data” is a streamlined way of extending the key subject access and accuracy provisions. But the general application of the 1998 Act to all personal information held by public authorities is not an intended by-product, and the Act therefore needed to ensure that the excess application of the 1998 Act was cancelled out. That is what section 70 achieves. It strips out of the extension of the new definition of “data” all the substantive effects of the Data Protection Act 1998 except those relating to subject access and accuracy.
219.Section 70 has one further effect. It provides that the extension of the rights of subject access and accuracy achieved in Part VII of the Act does not apply to personnel information held by public authorities.
220.Section 71 amends section 16(1) of the Data Protection Act 1998 so as to require data controllers who are public authorities for the purposes of the Act to state that fact when making any notification under Part III of the 1998 Act. This information will then appear on the public register maintained under Part III of the 1998 Act.
221.Section 72 amends section 34 of the Data Protection Act 1998. Section 34 provides that personal data are exempt from the Act’s provisions relating to subject access and accuracy, and from certain other restrictions on disclosure, if they consist of information which is subject to a statutory duty to make it available to the public. That is because such statutory access provisions – such as those governing the Register of births, marriages and deaths or the Land Registry – make their own detailed arrangements for access, accuracy, and disclosure, which are accordingly made to prevail over the more general provisions of the 1998 Act. But the reference in section 34 to statutory obligations would be capable of including those in this Act, thus making this Act’s regime predominate over that of the 1998 Act. This would not be consistent with this Act’s express provision that, in the case of personal data, its own provisions are subject to the limits of the 1998 Act. Section 72 removes the inconsistency by providing that the reference to statutory obligations in section 34 of the 1998 Act is not to include those in this Act.
222.Section 73 introduces Schedule 6 which contains further amendments to the 1998 Act.
