Citation, commencement and interpretation

1.—(1) These Regulations may be cited as the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 and shall come into force on 1st March 2000.

(2) In these Regulations “the Act” means the Data Protection Act 1998.

Extent of subject access requests

2.—(1) A request for information under any provision of section 7(1)(a), (b) or (c) of the Act is to be treated as extending also to information under all other provisions of section 7(1)(a), (b) and (c).

(2) A request for information under any provision of section 7(1) of the Act is to be treated as extending to information under the provisions of section 7(1)(d) only where the request shows an express intention to that effect.

(3) A request for information under the provisions of section 7(1)(d) of the Act is to be treated as extending also to information under any other provision of section 7(1) only where the request shows an express intention to that effect.

Maximum subject access fee

3.  Except as otherwise provided by regulations 4, 5 and 6 below, the maximum fee which may be required by a data controller under section 7(2)(b) of the Act is £10.

Limited requests for subject access where data controller is credit reference agency

4.—(1) In any case in which a request under section 7 of the Act has been made to a data controller who is a credit reference agency, and has been limited, or by virtue of section 9(2) of the Act is taken to have been limited, to personal data relevant to an individual’s financial standing—

(a)the maximum fee which may be required by a data controller under section 7(2)(b) of the Act is £2, and

(b)the prescribed period for the purposes of section 7(8) of the Act is seven working days.

(2) In this regulation “working day” means any day other than—

(a)Saturday or Sunday,

(b)Christmas Day or Good Friday,

(c)a bank holiday, within the meaning of section 1 of the Banking and Financial Dealings Act 1971(2), in the part of the United Kingdom in which the data controller’s address is situated.

(3) For the purposes of paragraph (2)(c) above—

(a)the address of a registered company is that of its registered office, and

(b)the address of a person (other than a registered company) carrying on a business is that of his principal place of business in the United Kingdom.

Subject access requests in respect of educational records

5.—(1) This regulation applies to any case in which a request made under section 7 of the Act relates wholly or partly to personal data forming part of an accessible record which is an educational record within the meaning of Schedule 11 to the Act.

(2) Except as provided by paragraph (3) below, a data controller may not require a fee under section 7(2)(b) of the Act in any case to which this regulation applies.

(3) Where, in a case to which this regulation applies, the obligation imposed by section 7(1)(c)(i) of the Act is to be complied with by supplying the data subject with a copy of information in permanent form, the maximum fee which may be required by a data controller under section 7(2)(b) of the Act is that applicable to the case under the Schedule to these Regulations.

(4) In any case to which this regulation applies, and in which the address of the data controller to whom the request is made is situated in England and Wales, the prescribed period for the purposes of section 7(8) of the Act is fifteen school days within the meaning of section 579(1) of the Education Act 1996(3).

Certain subject access requests in respect of health records—transitional provisions

6.—(1) This regulation applies only to cases in which a request made under section 7 of the Act—

(a)relates wholly or partly to personal data forming part of an accessible record which is a health record within the meaning of section 68(2) of the Act,

(b)does not relate exclusively to data within paragraphs (a) and (b) of the definition of “data” in section 1(1) of the Act, and

(c)is made before 24th October 2001.

(2) Where in a case to which this regulation applies, the obligation imposed by section 7(1)(c)(i) of the Act is to be complied with by supplying the data subject with a copy of information in permanent form, the maximum fee which may be required by a data controller under section 7(2)(b) of the Act is £50.

(3) Except in a case to which paragraph (2) above applies, a data controller may not require a fee under section 7(2)(b) of the Act where, in a case to which this regulation applies, the request relates solely to personal data which—

(a)form part of an accessible record—

(i)which is a health record within the meaning of section 68(2) of the Act, and

(ii)at least some of which was made after the beginning of the period of 40 days immediately preceding the date of the request; and

(b)do not fall within paragraph (a) or (b) of the definition of “data” in section 1(1) of the Act.

(4) For the purposes of paragraph (3) above, an individual making a request in any case to which this regulation applies may specify that his request is limited to personal data of the description set out in that paragraph.

Regulation 5(3)

SCHEDULEMAXIMUM SUBJECT ACCESS FEES WHERE A COPY OF INFORMATION CONTAINED IN AN EDUCATIONAL RECORD IS SUPPLIED IN PERMANENT FORM

1.  In any case in which the copy referred to in regulation 5(3) includes material in any form other than a record in writing on paper, the maximum fee applicable for the purposes of regulation 5(3) is £50.

2.  In any case in which the copy referred to in regulation 5(3) consists solely of a record in writing on paper, the maximum fee applicable for the purposes of regulation 5(3) is set out in the table below.

Explanatory Note

(This note is not part of the Regulations)

These Regulations make miscellaneous provision in respect of the exercise of the right of access to personal data conferred in section 7 of the Data Protection Act 1998.

Regulation 2 provides that a request for access to information under any provision of section 7(1)(a) to (c) of the Act is to be treated as extending to all such information. But a request is not to be taken to extend to information about the logic of automated decision-taking under section 7(1)(d) unless an express intention appears, and where there is such an express intention, the request is to be treated as limited to that information unless an express contrary intention appears.

Regulation 3 provides that, except in the special cases set out in regulations 4, 5 and 6, the maximum fee which a data controller may charge for access to data under section 7(2) of the Act is £10.

The Regulations make special provision as to fees and time limits in relation to three particular types of subject access request:—

In respect of limited requests as provided in section 9 of the Act, where the data controller is a credit reference agency and a subject access request is limited to personal data relevant to the applicant’s financial standing, the maximum fee which may be charged by the data controller for access is prescribed as £2, and the period within which a data controller must comply with the request is prescribed as seven working days rather than the forty day period which, by virtue of section 7(10) of the Act, otherwise applies (regulation 4).

In respect of subject access requests relating to accessible records which are educational records (as defined in section 68(1) of and Schedule 11 to the Act), no access fee may be charged unless a permanent copy of the information is to be provided, in which case the maximum fee which may be charged for access is as set out in the Schedule, and varies according to the type and volume of copies in question. The prescribed period for compliance with these requests is set at fifteen school days in England and Wales (regulation 5); otherwise, again, the forty day period in section 7(10) of the Act applies.

In respect of subject access requests relating to accessible records which are health records (as defined in section 68 of the Act), and which are not exclusively automated or intended for automation within the meaning of the first two paragraphs of the definition of “data” in section 1(1) of the Act, the Regulations make transitional provision in respect of certain requests made before 24th October 2001. Firstly, where a permanent copy of the information is to be provided, the maximum fee which may be charged by the data controller for access in the case of such requests is prescribed as £50. Secondly, where the request is restricted solely to data which form part of a health record, and that record has been at least partially created within the forty days preceding the request, and no permanent copy of the information is to be provided, no fee may be charged; provision is made for requests to be specifically limited to conform to these circumstances (regulation 6).

This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

A Regulatory Impact Assessment was prepared for the Data Protection Bill as it was then and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.homeoffice.gov.uk. Alternatively, copies can be obtained by post from the Home Office, LGDP Unit, 50 Queen Anne’s Gate, London SW1H 9AT.