The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000

Statutory Instruments

2000 No. 185

DATA PROTECTION

The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000

Made

31st January 2000

Laid before Parliament

7th February 2000

Coming into force

1st March 2000

The Secretary of State, in exercise of the powers conferred upon him by section 67(2) of, and paragraph 3(1) of Part II of Schedule 1 to, the Data Protection Act 1998(1), and after consultation with the Data Protection Commissioner in accordance with section 67(3) of that Act, hereby makes the following Order:

Citation and commencement

1.  This Order may be cited as the Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000 and shall come into force on 1st March 2000.

Interpretation

2.  In this Order, “Part II” means Part II of Schedule 1 to the Data Protection Act 1998.

General provisions

3.—(1) In cases where the primary condition referred to in paragraph 3(2)(a) of Part II is met, the provisions of articles 4 and 5 apply.

(2) In cases where the primary condition referred to in paragraph 3(2)(b) of that Part is met by virtue of the fact that the recording of the information to be contained in the data by, or the disclosure of the data by, the data controller is not a function conferred on him by or under any enactment or an obligation imposed on him by order of a court, but is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract, the provisions of article 4 apply.

Notices in writing

4.—(1) One of the further conditions prescribed in paragraph (2) must be met if paragraph 2(1)(b) of Part II is to be disapplied in respect of any particular data subject.

(2) The conditions referred to in paragraph (1) are that—

(a) no notice in writing has been received at any time by the data controller from an individual, requiring that data controller to provide the information set out in paragraph 2(3) of that Part before the relevant time (as defined in paragraph 2(2) of that Part) or as soon as practicable after that time; or

(b) where such notice in writing has been received but the data controller does not have sufficient information about the individual in order readily to determine whether he is processing personal data about that individual, the data controller shall send to the individual a written notice stating that he cannot provide the information set out in paragraph 2(3) of that Part because of his inability to make that determination, and explaining the reasons for that inability.

(3) The requirement in paragraph (2) that notice should be in writing is satisfied where the text of the notice—

(a) is transmitted by electronic means,

(b) is received in legible form, and

(c) is capable of being used for subsequent reference.

Further condition in cases of disproportionate effort

5.—(1) The further condition prescribed in paragraph (2) must be met for paragraph 2(1)(b) of Part II to be disapplied in respect of any data.

(2) The condition referred to in paragraph (1) is that the data controller shall record the reasons for his view that the primary condition referred to in article 3(1) is met in respect of the data.

Mike O'Brien

Parliamentary Under-Secretary of State

Home Office

31st January 2000

Explanatory Note

(This note is not part of the Order)

Paragraph 2 of Part II of Schedule 1 to the Data Protection Act 1998 (“Part II”) provides that personal data will not be treated as processed fairly unless certain requirements are met relating to the provision to the data subject of information about the processing (“the information requirements”). Different provisions apply depending on whether data have been obtained from the data subject or from some other source.

Paragraph 3 of Part II sets out conditions which, if met, allow the data controller to disregard the information requirements in cases where the data have been obtained from a source other than the data subject. Power is given to the Secretary of State to prescribe further conditions which must be met before the information requirements can be disregarded in this way.

Article 4 of this Order prescribes further conditions for cases where the disproportionate effort ground in paragraph 3(2)(a) of Part II is being relied upon, or where the disclosure or recording of the data is necessary for compliance with a legal obligation, other than one imposed by contract or by or under an enactment or by a court order. In both cases, the Order provides that any data controller claiming the benefit of the disapplication of the information requirements must still provide the relevant information to any individual who requests it. Further, if a data controller cannot readily determine whether he is processing information about the individual concerned because of a lack of identifying information, that data controller must write to the individual explaining the position. In the former case only (disproportionate effort), article 5 of this Order provides for a further condition to be met: the data controller must keep a record of the reasons why he believes the disapplication of the information requirements is necessary.

This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

A Regulatory Impact Assessment was prepared for the Data Protection Bill as it was then and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.homeoffice.gov.uk. Alternatively, copies can be obtained by post from the Home Office, LGDP Unit, 50 Queen Anne’s Gate, London SW1H 9AT.

(1)

1998 c. 29.