Citation and commencement

1.  This Order may be cited as the Data Protection (Subject Access Modification) (Health) Order 2000 and shall come into force on 1st March 2000.

Interpretation

2.  In this Order—

“the Act” means the Data Protection Act 1998;

“the appropriate health professional” means—

“care” includes examination, investigation, diagnosis and treatment;

“request” means a request made under section 7;

“section 7” means section 7 of the Act; and

“war pension” has the same meaning as in section 25 of the Social Security Act 1989(4) (establishment and functions of war pensions committees).

Personal data to which Order applies

3.—(1) Subject to paragraph (2), this Order applies to personal data consisting of information as to the physical or mental health or condition of the data subject.

(2) This Order does not apply to any data which are exempted from section 7 by an order made under section 38(1) of the Act.

Exemption from the subject information provisions

4.—(1) Personal data falling within paragraph (2) and to which this Order applies are exempt from the subject information provisions.

(2) This paragraph applies to personal data processed by a court and consisting of information supplied in a report or other evidence given to the court by a local authority, Health and Social Services Board, Health and Social Services Trust, probation officer or other person in the course of any proceedings to which the Family Proceedings Courts (Children Act 1989) Rules 1991(5), the Magistrates' Courts (Children and Young Persons) Rules 1992(6), the Magistrates' Courts (Criminal Justice (Children)) Rules (Northern Ireland) 1999(7), the Act of Sederunt (Child Care and Maintenance Rules) 1997(8) or the Children’s Hearings (Scotland) Rules 1996(9) apply where, in accordance with a provision of any of those Rules, the information may be withheld by the court in whole or in part from the data subject.

Exemptions from section 7

5.—(1) Personal data to which this Order applies are exempt from section 7 in any case to the extent to which the application of that section would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person.

(2) Subject to article 7(1), a data controller who is not a health professional shall not withhold information constituting data to which this Order applies on the ground that the exemption in paragraph (1) applies with respect to the information unless the data controller has first consulted the person who appears to the data controller to be the appropriate health professional on the question whether or not the exemption in paragraph (1) applies with respect to the information.

(3) Where any person falling within paragraph (4) is enabled by or under any enactment or rule of law to make a request on behalf of a data subject and has made such a request, personal data to which this Order applies are exempt from section 7 in any case to the extent to which the application of that section would disclose information—

(a)provided by the data subject in the expectation that it would not be disclosed to the person making the request;

(b)obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed; or

(c)which the data subject has expressly indicated should not be so disclosed,

provided that sub-paragraphs (a) and (b) shall not prevent disclosure where the data subject has expressly indicated that he no longer has the expectation referred to therein.

(4) A person falls within this paragraph if—

(a)except in relation to Scotland, the data subject is a child, and that person has parental responsibility for that data subject;

(b)in relation to Scotland, the data subject is a person under the age of sixteen, and that person has parental responsibilities for that data subject; or

(c)the data subject is incapable of managing his own affairs and that person has been appointed by a court to manage those affairs.

Modification of section 7 relating to data controllers who are not health professionals

6.—(1) Subject to paragraph (2) and article 7(3), section 7 of the Act is modified so that a data controller who is not a health professional shall not communicate information constituting data to which this Order applies in response to a request unless the data controller has first consulted the person who appears to the data controller to be the appropriate health professional on the question whether or not the exemption in article 5(1) applies with respect to the information.

(2) Paragraph (1) shall not apply to the extent that the request relates to information which the data controller is satisfied has previously been seen by the data subject or is already within the knowledge of the data subject.

Additional provision relating to data controllers who are not health professionals

7.—(1) Subject to paragraph (2), article 5(2) shall not apply in relation to any request where the data controller has consulted the appropriate health professional prior to receiving the request and obtained in writing from that appropriate health professional an opinion that the exemption in article 5(1) applies with respect to all of the information which is the subject of the request.

(2) Paragraph (1) does not apply where the opinion either—

(a)was obtained before the period beginning six months before the relevant day (as defined by section 7(10) of the Act) and ending on that relevant day, or

(b)was obtained within that period and it is reasonable in all the circumstances to re-consult the appropriate health professional.

(3) Article 6(1) shall not apply in relation to any request where the data controller has consulted the appropriate health professional prior to receiving the request and obtained in writing from that appropriate health professional an opinion that the exemption in article 5(1) does not apply with respect to all of the information which is the subject of the request.

Further modifications of section 7

8.  In relation to data to which this Order applies—

(a)section 7(4) of the Act shall have effect as if there were inserted after paragraph (b) of that subsection

“or,

(c)the information is contained in a health record and the other individual is a health professional who has compiled or contributed to the health record or has been involved in the care of the data subject in his capacity as a health professional”.

(b)section 7(9) shall have effect as if—

(i)there was substituted—

“(9) If a court is satisfied on the application of—

(a)any person who has made a request under the foregoing provisions of this section, or

(b)any other person to whom serious harm to his physical or mental health or condition would be likely to be caused by compliance with any such request in contravention of those provisions,

that the data controller in question is about to comply with or has failed to comply with the request in contravention of those provisions, the court may order him not to comply or, as the case may be, to comply with the request.”; and

(ii)the reference therein to a contravention of the foregoing provisions of that section included a reference to a contravention of the provisions contained in this Order.

Explanatory Note

(This note is not part of the Order)

This Order provides for the partial exemption from the provisions of the Data Protection Act 1998 which confer rights on data subjects to gain access to data held about them of data relating to the physical or mental health or condition of the data subject (article 3(1)). The Order does not apply to any data to which any order made under section 38 (1) of the Act applies (article 3 (2)).

An exemption from section 7 of the Act is conferred by article 5 (1) only to the extent to which the supply to the data subject of particulars of the information constituting the data would be likely to cause serious harm to his or any other person’s physical or mental health or condition. Before deciding whether this exemption applies (and, accordingly, whether to grant or withhold subject access) a data controller who is not a health professional is obliged by articles 5 (2) and 6 (1) to consult the health professional responsible for the clinical care of the data subject or, if there is more than one, the most suitable available health professional or, if there is none available or the data controller is the Secretary of State exercising his functions relating to social security, child support or war pensions, a health professional who has the necessary experience and qualifications to advise on the matters to which the information which is requested relates (definition in article 2). This obligation to consult does not apply where the data subject has already seen or knows about the information which is the subject of the request (article 6 (1)), nor in certain limited circumstances where consultation has been carried out prior to the request being made (article 7 (1) and (2)).

A further exemption from section 7 of the Act is conferred in certain circumstances where a third party is making the request for access on behalf of the data subject and the data subject does not wish that information to be disclosed to that third party (article 5 (3)).

In the case of court reports in certain proceedings where information in the report may be withheld by the court, article 4 provides an exemption from section 7 of the Act and also a complete exemption from the first data protection principle to the extent to which it requires compliance with paragraph 2 of Part II of Schedule 1 to the Act (which confers obligations on data controllers to give certain information to data subjects relating to data held about them).

Article 8 modifies section 7 of the Act so that a data controller cannot refuse access on the grounds that the identity of a third party would be disclosed in cases where the information is contained in a health record and the third party is a health professional who has compiled or contributed to that health record or has been involved in the care of the data subject in his capacity as a health professional, unless serious harm to that health professional’s physical or mental health or condition is likely to be caused by giving access such that the exemption in article 5(1) applies.

This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

A Regulatory Impact Assessment was prepared for the Data Protection Bill as it was then and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.homeoffice.gov.uk. Alternatively, copies can be obtained by post from the Home Office, LGDP Unit, 50 Queen Anne’s Gate, London SW1H 9AT.