Section 175 and Schedule 20: Further amendments of the Data Protection Act 1998
765.This section introduces Schedule 20, which makes amendments to the 1998 Act.
Data Controllers’ Registration
766.Paragraph 1 of Schedule 20 amends section 16(1) of the 1998 Act. The Information Commissioner is obliged under section 19 of the 1998 Act to maintain a register of data controller notifications. Section 17(1) of the 1998 Act prohibits the processing of personal data unless the data controller has an entry recording his or her details in the register of data controllers. Section 18(5) of the 1998 Act provides that where a data controller notifies the Information Commissioner, the notification must be accompanied by such fee as may be prescribed by fees regulations. Under section 19(2) of the 1998 Act each register entry shall consist of the registrable particulars of the data controller and such other information as is required by the notification regulations. The term “registrable particulars” is defined in section 16(1). The amendment in paragraph 1 adds a new registrable particular to section 16(1) of the 1998 Act (new subparagraph (h)).
767.The new registrable particular is such information about the data controller as is prescribed under new section 18(5A) of the 1998 Act. Section 18(5A) is inserted by paragraph 2 of Schedule 20 and provides that notification regulations may prescribe the information about the data controller that is required for the purpose of verifying the fee payable under section 18(5). If false information is provided in a notification then this may be an offence under section 5 of the Perjury Act 1911, Article 10 of the Perjury (Northern Ireland) Order 1979 (SI 1979/1714 (NI 19)) or section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995.
768.Paragraph 3 of Schedule 20 amends section 19 of the 1998 Act to add a new subsection (8). It provides that the Information Commissioner will not be required to comply with section 19(6) and (7) in relation to the information that has to be supplied under new section 16(1)(h). Section 19(6) provides for the Information Commissioner to make the register of notifications available to the public for inspection and available to the public in such other ways as he or she considers appropriate. Section 19(7) requires the Information Commissioner to provide certified copies of registrable particulars in the register of notifications to members of the public.
769.Paragraph 4 amends section 20 of the Act to enable regulations to be made requiring data controllers to notify the Information Commissioner of any changes to their registrable particulars for the purpose of ensuring that the correct annual notification fee is paid. Data controllers will not need to provide the Information Commissioner with this information year after year whenever they pay their notification fee. Instead, they will need to provide this information only upon a change of circumstance. Any failure to comply with a duty imposed by such regulations may be an offence under section 21(2) of the 1998 Act.
770.The overall effect of these amendments is to provide a way for the Information Commissioner to check that a data controller has paid the correct notification fee.
Assessment notices
771.Paragraphs 5 and 6 of Schedule 20 make three amendments that are consequential on the creation of new sections 41A and 41B of the 1998 Act by section 173. Paragraph 5 amends section 48 of the 1998 Act to provide a right of appeal to the tribunal against an assessment notice. Paragraph 6 amends section 67 of the 1998 Act to specify the parliamentary procedure that is to be followed by the Secretary of State in making orders under the power in new section 41A(2)(b) (power to designate specific public authorities as being within the scope of Assessment Notices) and 41A(2)(c) (power to designate a person of a description as being within the scope of Assessment Notices). Such orders will be subject to the negative resolution procedure and the affirmative resolution procedure respectively. Paragraph 7 inserts a new definition of government department into section 70(1) of the 1998 Act.
Power to require information
772.Paragraph 8 of Schedule 20 amends section 43 of the 1998 Act to strengthen the Information Commissioner’s powers for inspecting a data controller’s compliance with the data protection principles, using an information notice.
773.Paragraph 8(3) inserts two new subsections into section 43 of the 1998 Act, which contains the power of the Information Commissioner to issue an information notice. New section 43(1A) allows an information notice to require that the data controller must provide (a) particular information as specified; (b) information of a particular description; or (c) information in a category as specified or described. New section 43(1B) allows an information notice to require that the information is provided (a) within a specified period; (b) at a specified time and place; (c) in a specified form.
774.Paragraph 9 provides an equivalent amendment (to that made in paragraph 8 detailed above) to section 44 of the 1998 Act for special information notices (which makes special provisions in relation to the processing of personal data for journalistic, artistic and literary purposes).
Restriction on the use of information
775.Paragraph 10 of Schedule 20 amends section 43 of the 1998 Act to place restrictions on the use of certain information obtained under the newly extended information notice power.
776.Paragraph 10(3) inserts three new subsections into section 43 of the 1998 Act. These subsections make provision to ensure that the principle against self-incrimination is protected in relation to this section. First, the new section prohibits a data controller from being required to provide information which would incriminate him or her in relation to proceedings other than proceedings for offences under the 1998 Act, and certain perjury offences. Second, statements made under the new expanded power of section 43 cannot be used as evidence against the data controller for any data protection offence (other than the offence of failing to comply with the terms of an information notice), unless the accused acts in such a way as to forfeit this particular protection. In those circumstances evidence of the original statement would be admissible in order to rebut the false assertions made by the accused.
777.Paragraph 11 of Schedule 20 provides for an equivalent amendment to that made in paragraph 10 to be made to section 44 of the 1998 Act relating to special information notices (which makes special provisions in relation to the processing of personal data for journalistic, artistic and literary purposes).
778.Paragraph 12 of Schedule 20 amends paragraph 11 of Schedule 7 to the 1998 Act to make provision in relation to the principle against self-incrimination. This existing provision of the 1998 Act provides that data controllers are not obliged to satisfy subject access requests under section 7 of the 1998 Act, where to do so would reveal incriminating evidence of an offence other than an offence under the 1998 Act. The amendment adjusts the provisions so that neither the 1998 Act offences nor certain perjury offences are covered by this protection.
Monetary penalties: restriction on matters to be taken into account
779.Section 55A of the 1998 Act provides for the Information Commissioner to issue a monetary penalty for serious breaches of the data protection principles of a kind likely to cause substantial damage or distress that are carried out either deliberately or recklessly.
780.Under section 51(7) of the 1998 Act the Information Commissioner can, with the consent of the data controller, assess any processing of personal data for the following of good practice.
781.Paragraph 13 of Schedule 20 amends section 55A of the 1998 Act to prevent the imposition of a monetary penalty based on information that has been obtained from a good practice assessment (section 51 of the 1998 Act) or the use of an assessment notice under new section 41A of the 1998 Act as inserted by section 173.
Warrant for entry and inspection
782.Paragraph 14 of Schedule 20 amends Schedule 9 to the 1998 Act to give broader inspection powers to the Information Commissioner in relation to warrants obtained under Schedule 9 to the 1998 Act.
783.Paragraph 14(2) amends paragraph 1 of Schedule 9 to give a circuit judge or a District Judge (Magistrates’ Courts) the power to grant a warrant to the Information Commissioner on the grounds that a data controller has failed to comply with the requirements of an assessment notice.
784.Paragraph 14(3) broadens the range of activities the Information Commissioner can engage in when executing a warrant granted under Schedule 9. In particular, it gives the Information Commissioner the power to require any person on the premises to provide an explanation of any document or other material found on the premises (new paragraph 1(3)(e)) and to require such a person to provide information that is reasonably required to determine whether there has been any contravention of the data protection principles (new paragraph 1(3)(f)).
785.Paragraph 14(4) and 14(5) provide for amendments to Schedule 9 to the 1998 Act that are consequential on the introduction of warrants for failure to comply with an assessment notice. Under the amendments in paragraph 14(4) the requirement in paragraph 2(1)(a) of Schedule 9 to the Data Protection Act 1998, that before a warrant can be issued the Information Commissioner must give seven days’ notice in writing to the data controller demanding access to the premises, cannot be satisfied by serving a data controller with an assessment notice. The amendment in paragraph 14(5) reflects the fact that the new test for granting a warrant would not be dependent on the Information Commissioner finding evidence on the premises to be searched.
786.Paragraph 14(6) makes amendments to paragraph 12 of Schedule 9 to the 1998 Act, which provides a criminal offence for the obstruction of, or failure to assist, a person executing a warrant under that Schedule. The additional text extends the offence to cover deliberately or recklessly making false statements in response to the new powers to require information created in paragraph 14(3) detailed above.
787.Paragraph 14(7) provides protection against self-incrimination for any person required to provide information under the extended powers created under paragraph 14(3) above. In particular, any information provided by that person in response to these new powers under a warrant cannot be used as evidence in criminal proceedings against that person. However, this protection is not absolute, and the response given can be used in evidence if the offence concerned is either the offence of obstructing or failing to assist a person executing a Schedule 9 warrant or is one of a specific group of perjury offences. Furthermore the response can be used in evidence for the prosecution of any criminal offence if the accused acts in such a way as to forfeit this particular protection. In those circumstances evidence of the original statement becomes admissible in order to rebut the false assertions made by the accused.
