Explanatory Note
(This note is not part of the Regulations)
These Regulations make miscellaneous provision in respect of the exercise of the right of access to personal data conferred in section 7 of the Data Protection Act 1998.
Regulation 2 provides that a request for access to information under any provision of section 7(1)(a) to (c) of the Act is to be treated as extending to all such information. But a request is not to be taken to extend to information about the logic of automated decision-taking under section 7(1)(d) unless an express intention appears, and where there is such an express intention, the request is to be treated as limited to that information unless an express contrary intention appears.
Regulation 3 provides that, except in the special cases set out in regulations 4, 5 and 6, the maximum fee which a data controller may charge for access to data under section 7(2) of the Act is £10.
The Regulations make special provision as to fees and time limits in relation to three particular types of subject access request:—
In respect of limited requests as provided in section 9 of the Act, where the data controller is a credit reference agency and a subject access request is limited to personal data relevant to the applicant’s financial standing, the maximum fee which may be charged by the data controller for access is prescribed as £2, and the period within which a data controller must comply with the request is prescribed as seven working days rather than the forty day period which, by virtue of section 7(10) of the Act, otherwise applies (regulation 4).
In respect of subject access requests relating to accessible records which are educational records (as defined in section 68(1) of and Schedule 11 to the Act), no access fee may be charged unless a permanent copy of the information is to be provided, in which case the maximum fee which may be charged for access is as set out in the Schedule, and varies according to the type and volume of copies in question. The prescribed period for compliance with these requests is set at fifteen school days in England and Wales (regulation 5); otherwise, again, the forty day period in section 7(10) of the Act applies.
In respect of subject access requests relating to accessible records which are health records (as defined in section 68 of the Act), and which are not exclusively automated or intended for automation within the meaning of the first two paragraphs of the definition of “data” in section 1(1) of the Act, the Regulations make transitional provision in respect of certain requests made before 24th October 2001. Firstly, where a permanent copy of the information is to be provided, the maximum fee which may be charged by the data controller for access in the case of such requests is prescribed as £50. Secondly, where the request is restricted solely to data which form part of a health record, and that record has been at least partially created within the forty days preceding the request, and no permanent copy of the information is to be provided, no fee may be charged; provision is made for requests to be specifically limited to conform to these circumstances (regulation 6).
This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
A Regulatory Impact Assessment was prepared for the Data Protection Bill as it was then and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.homeoffice.gov.uk. Alternatively, copies can be obtained by post from the Home Office, LGDP Unit, 50 Queen Anne’s Gate, London SW1H 9AT.