Draft 0rder laid before Parliament under section 67(4) of the Data Protection Act 1998, for approval by resolution of each House of Parliament.
2002 No.

DA TA PROTECTION

Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002
Made
2002
Coming into force
2002
Whereas a draft of this Order has been laid before and approved by a resolution of each House of Parliament:
Now, therefore, the Lord Chancellor, in exercise of the powers conferred upon him by section 67(2) of, and paragraph 10 of Schedule 3 to, the Data Protection Act 1998 , and after consultation with the Information Commissioner in accordance with section 67(3) of that Act, hereby makes the following Order:
1
This Order may be cited as the Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 and shall come into force on the twenty-eighth day after the day on which it is made.
2
For the purposes of paragraph 10 of Schedule 3 to the Data Protection Act 1998, the circumstances specified in any of paragraphs 3, 4, 5 or 6 in the Schedule to this Order are circumstances in which sensitive personal data may be processed .
Signed by the authority of the Lord Chancellor
Parliamentary Secretary,
Lord Chancellor’s Department
2002
SCHEDULE

CIRCUMSTANCES IN WHICH SENSITIVE PERSONAL DATA MAY BE PROCESSED
Article 2

Interpretation
1
In this Schedule, “elected representative” means—
a
a Member of the House of Commons, a Member of the National Assembly for Wales, a Member of the Scottish Parliament or a Member of the Northern Ireland Assembly;
b
a Member of the European Parliament elected in the United Kingdom;
c
an elected member of a local authority within the meaning of section 270(1) of the Local Government Act 1972 , namely—
i
in England, a county council, a district council, a London borough council or a parish council,
ii
in Wales, a county council, a county borough council or a community council;
d
an elected mayor of a local authority within the meaning of Part II of the Local Government Act 2000 ;
e
the Mayor of London or an elected member of the London Assembly;
f
an elected member of—
i
the Common Council of the City of London, or
ii
the Council of the Isles of Scilly;
g
an elected member of a council constituted under section 2 of the Local Government etc (Scotland) Act 1994 ; or
h
an elected member of a district council within the meaning of the Local Government Act (Northern Ireland) 1972 .
2
For the purposes of paragraph 1 above—
a
a person who is—
i
a Member of the House of Commons immediately before Parliament is dissolved,
ii
a Member of the Scottish Parliament immediately before that Parliament is dissolved, or
iii
a Member of the Northern Ireland Assembly immediately before that Assembly is dissolved,
shall be treated as if he were such a member until the end of the fourth day after the day on which the subsequent general election in relation to that Parliament or Assembly is held;
b
a person who is a Member of the National Assembly for Wales and whose term of office comes to an end, in accordance with section 2(5)(b) of the Government of Wales Act 1998 , at the end of the day preceding an ordinary election (within the meaning of section 2(4) of that Act), shall be treated as if he were such a member until the end of the fourth day after the day on which that ordinary election is held; and
c
a person who is an elected member of the Common Council of the City of London and whose term of office comes to an end at the end of the day preceding the annual Wardmotes shall be treated as if he were such a member until the end of the fourth day after the day on which those Wardmotes are held.

Processing by elected representatives
3
The processing—
a
is carried out by an elected representative or a person acting with his authority;
b
is in connection with the discharge of his functions as such a representative;
c
is carried out pursuant to a request made by the data subject to the elected representative to take action on behalf of the data subject or any other individual; and
d
is necessary for the purposes of, or in connection with, the action reasonably taken by the elected representative pursuant to that request.
4
The processing—
a
is carried out by an elected representative or a person acting with his authority;
b
is in connection with the discharge of his functions as such a representative;
c
is carried out pursuant to a request made by an individual other than the data subject to the elected representative to take action on behalf of the data subject or any other individual;
d
is necessary for the purposes of, or in connection with, the action reasonably taken by the elected representative pursuant to that request; and
e
is carried out without the explicit consent of the data subject because the processing—
i
is necessary in a case where explicit consent cannot be given by the data subject,
ii
is necessary in a case where the elected representative cannot reasonably be expected to obtain the explicit consent of the data subject,
iii
must necessarily be carried out without the explicit consent of the data subject being sought so as not to prejudice the action taken by the elected representative, or
iv
is necessary in the interests of another individual in a case where the explicit consent of the data subject has been unreasonably withheld.

Processing limited to disclosures to elected representatives
5
The disclosure—
a
is made to an elected representative or a person acting with his authority;
b
is made in response to a communication to the data controller from the elected representative, or a person acting with his authority, acting pursuant to a request made by the data subject;
c
is of sensitive personal data which are relevant to the subject matter of that communication; and
d
is necessary for the purpose of responding to that communication.
6
The disclosure—
a
is made to an elected representative or a person acting with his authority;
b
is made in response to a communication to the data controller from the elected representative, or a person acting with his authority, acting pursuant to a request made by an individual other than the data subject;
c
is of sensitive personal data which are relevant to the subject matter of that communication;
d
is necessary for the purpose of responding to that communication; and
e
is carried out without the explicit consent of the data subject because the disclosure—
i
is necessary in a case where explicit consent cannot be given by the data subject,
ii
is necessary in a case where the data controller cannot reasonably be expected to obtain the explicit consent of the data subject,
iii
must necessarily be carried out without the explicit consent of the data subject being sought so as not to prejudice the action taken by the elected representative, or
iv
is necessary in the interests of another individual in a case where the explicit consent of the data subject has been unreasonably withheld.
(This note is not part of the Order)
The first data protection principle, set out in paragraph 1of Schedule 1 to the Data Protection Act 1998, prohibits the processing of sensitive personal data unless one of the conditions in Schedule 3 to the Act is met. The condition set out in paragraph 10 of that Schedule is that the personal data are processed in circumstances specified in an order made by the Lord Chancellor.
The Schedule to this Order specifies a number of such circumstances, which relate to the processing of sensitive personal data by, and disclosures of sensitive personal data to, elected representatives.
An “elected representative” is defined for these purposes in paragraph 1 of the Schedule, and includes Members of the House of Commons, Members of the devolved administrations in Wales, Scotland and Northern Ireland, Members of the European Parliament, elected members of local authorities and elected mayors. Paragraph 2 provides that for the purposes of paragraph 1, a person who is a Member of the House of Commons immediately before Parliament is dissolved is to be treated as if he were such a member until the end of the fourth day after the general election, and makes comparable provision in relation to Members of the devolved administrations and elected members of the Common Council of the City of London.
Paragraphs 3 and 4 of the Schedule cover certain processing carried out by an elected representative (or a person acting with his authority) in connection with the discharge of his functions as such.
Paragraph 3 covers processing carried out pursuant to a request made by the data subject to the elected representative to take action on behalf of the data subject or any other individual. The processing must be necessary in connection with the action reasonably taken by the elected representative pursuant to the request.
Paragraph 4 covers processing carried out pursuant to a request made by an individual other than the data subject to the elected representative to take action on behalf of the data subject or any other individual. The processing must be necessary in connection with the action reasonably taken by the elected representative pursuant to the request. Further, one of the specified reasons for carrying out the processing without the explicit consent of the data subject must apply.
Paragraphs 5 and 6 of the Schedule cover certain disclosures made to an elected representative (or a person acting with his authority) by another data controller.
Paragraph 5 covers disclosures made in response to a communication to the data controller from an elected representative (or person acting with his authority) who is acting pursuant to a request made by the data subject. The sensitive personal data disclosed must be relevant to the subject matter of the communication and the disclosure must be necessary for the purpose of responding to the communication.
Paragraph 6 covers disclosures made in response to a communication to the data controller from an elected representative (or person acting with his authority) who is acting pursuant to a request made by an individual other than the data subject. The sensitive personal data disclosed must be relevant to the subject matter of the communication and the disclosure must be necessary for the purpose of responding to the communication. Further, one of the specified reasons for carrying out the processing without the explicit consent of the data subject must apply.
This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
A Regulatory Impact Assessment was prepared for the Data Protection Bill as it then was and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.lcd.gov.uk. Alternatively, copies can be obtained by post from the Lord Chancellor’s Department, FIDP Division, Selborne House, 54-60 Victoria Street, London SW1E 6QW.
This Order will have a negligible effect on business, charities and the voluntary sector, therefore a Regulatory Impact Assessment has not been prepared for this Order specifically.
1998 c. 29. The functions of the Secretary of State under section 67 of, and paragraph 10 of Schedule 3 to, the Data Protection Act 1998 were transferred to the Lord Chancellor by Article 3 of, and paragraph 11 of Schedule 1 to, the Transfer of Functions (Miscellaneous) Order 2001 (S.I. 2001/3500). Article 8 of, and paragraphs 6(v) and (z) of Schedule 2 to, that Order amended section 67 of, and Schedule 3 to, the Data Protection Act 1998 so as to refer to the Lord Chancellor.
The Data Protection Commissioner became the Information Commissioner on 30th January 2001 by virtue of sections 18(1) and 87(2)(a) of the Freedom of Information Act 2000 (c. 36). The consultation requirement in section 67(3) of the Data Protection Act 1998 now refers to the Information Commissioner as the definitions of “the Commissioner” in sections 6(1) and 70(1) of that Act have been amended by paragraphs 13(2) and 14(a) of Schedule 2 to the Freedom of Information Act 2000.
Additional circumstances in which sensitive personal data may be processed are specified in the Data Protection (Processing of Sensitive Personal Data) Order 2000 (S.I. 2000/417).
1972 c. 70.
2000 c. 22.
1994 c. 39.
1972 c. 9 (N. I.).
1998 c. 38. Section 2(5) provides that “The term of office of an Assembly member—(a) begins when he is declared to be returned as an Assembly member, and (b) continues until the end of the day before the day of the poll at the next ordinary election.” By section 2(4), “An ordinary election involves the holding of elections for the return of the entire Assembly.”
By section 2 of the Act of Common Council made on 14th June 1984, the annual Wardmotes for the election of Common Councilmen to the Common Council of the City of London are held on the first Friday in December each year, and persons elected as Common Councilmen cease to hold office at midnight on the Thursday immediately preceding the day of the next annual Wardmotes. (Copies of the Act of Common Council made on 14th June 1984 can be obtained from the Town Clerk’s Department, Corporation of London, PO Box 270, Guildhall, London EC2P 2EJ.)