Enforced subject access requests a criminal offence as of 10 March 2015

Posted on
Since 10 March 2015 it has been a criminal offence, contrary to section 56 of the Data Protection Act 1998 (DPA), for an employer to require an individual to use their subject access rights under the DPA to provide certain records as a condition of employment. The new offence was due to be brought in December last year, but was delayed until March this year.

The offence is not limited to employers; it is also an offence contractually to require certain records as a condition for providing or receiving a service (such as insurance or housing).

Section 7 of the DPA entitles individuals to find out about what personal data is being processed about them. This is a core right that enables individuals to check that their information is accurate and is being used fairly and lawfully. Section 56 of the DPA seeks to protect individuals from the potential for abuse that can arise where third parties make it a condition of employment, or contract award, or a condition of access to goods and services, that an individual must make a subject access to the police for criminal record data and produce the resulting information.

Anecdotally, the Information Commissioner’s Office (ICO), which has responsibility for overseeing the DPA, reports that the practice of requiring potential employees and contractors to make subject access requests of this kind has been widespread in certain sectors for many years. The practice, which is considered to undermine public policy in relation to the rehabilitation of offenders and to side step limits imposed by law on the conduct of criminal records checks, has long been the subject of criticism by the Information Commissioner who has now welcomed the introduction of the new offence.

Since section 56 DPA came into effect on 10 March, any person requiring an applicant for employment or for goods or services to produce the results of a subject access request made to specified authorities, including the police, for information regarding past cautions or convictions will be committing a criminal offence. No offence is committed where the record is required by law or is justified in the public interest. Anyone convicted of the offence in England and Wales is liable to an unlimited fine. In Scotland the maximum fine that can be imposed in the Sheriff's Court is £10,000.

Current rules governing applications to the Disclosure and Barring Service are unaffected.