Statutory Instruments
DATA PROTECTION
Made
17th February 2000
Coming into force
1st March 2000
Whereas a draft of this Order has been laid before and approved by a resolution of each House of Parliament:
Now, therefore, the Secretary of State, in exercise of powers conferred upon him by sections 30(2) and (4) and 67(2) of the Data Protection Act 1998(1), and after consultation with the Data Protection Commissioner in accordance with section 67(3) of the Act, hereby makes the following Order:
1. This Order may be cited as the Data Protection (Subject Access Modification) (Education) Order 2000 and shall come into force on 1st March 2000.
2. In this Order—
“the Act” means the Data Protection Act 1998;
“education authority” in article 6 has the same meaning as in paragraph 6 of Schedule 11 to the Act;
“Principal Reporter” means the Principal Reporter appointed under section 127 of the Local Government etc. (Scotland) Act 1994(2) or any officer of the Scottish Children’s Reporter Administration to whom there is delegated under section 131(1) of that Act any function of the Principal Reporter;
“request” means a request made under section 7; and
“section 7” means section 7 of the Act.
3.—(1) Subject to paragraph (2), this Order applies to personal data consisting of information constituting an educational record as defined in paragraph 1 of Schedule 11 to the Act.
(2) This Order does not apply—
(a)to any data consisting of information as to the physical or mental health or condition of the data subject to which the Data Protection (Subject Access Modification) (Health) Order 2000(3) applies; or
(b)to any data which are exempted from section 7 by an order made under section 38(1) of the Act.
4.—(1) Personal data falling within paragraph (2) and to which this Order applies are exempt from the subject information provisions.
(2) This paragraph applies to personal data processed by a court and consisting of information supplied in a report or other evidence given to the court in the course of proceedings to which the Magistrates' Courts (Children and Young Persons) Rules 1992(4), the Magistrates' Courts (Criminal Justice (Children)) Rules (Northern Ireland) 1999(5), the Act of Sederunt (Child Care and Maintenance Rules) 1997(6) or the Children’s Hearings (Scotland) Rules 1996(7) apply where, in accordance with a provision of any of those Rules, the information may be withheld by the court in whole or in part from the data subject.
5.—(1) Personal data to which this Order applies are exempt from section 7 in any case to the extent to which the application of that section would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person.
(2) In circumstances where the exemption in paragraph (1) does not apply, where any person falling within paragraph (3) is enabled by or under any enactment or rule of law to make a request on behalf of a data subject and has made such a request, personal data consisting of information as to whether the data subject is or has been the subject of or may be at risk of child abuse are exempt from section 7 in any case to the extent to which the application of that section would not be in the best interests of that data subject.
(3) A person falls within this paragraph if—
(a)the data subject is a child, and that person has parental responsibility for that data subject; or
(b)the data subject is incapable of managing his own affairs and that person has been appointed by a court to manage those affairs.
(4) For the purposes of paragraph (2), “child abuse” includes physical injury (other than accidental injury) to, and physical and emotional neglect, ill-treatment and sexual abuse of, a child.
(5) Paragraph (2) shall not apply in Scotland.
6. Where in Scotland a data controller who is an education authority receives a request relating to information constituting data to which this Order applies and which the education authority believes to have originated from or to have been supplied by or on behalf of the Principal Reporter acting in pursuance of his statutory duties, other than information which the data subject is entitled to receive from the Principal Reporter, section 7 shall be modified so that—
(a)the data controller shall, within fourteen days of the relevant day (as defined by section 7(10) of the Act), inform the Principal Reporter that a request has been made; and
(b)the data controller shall not communicate information to the data subject pursuant to that section unless the Principal Reporter has informed that data controller that, in his opinion, the exemption specified in article 5(1) does not apply with respect to the information.
7.—(1) In relation to data to which this Order applies—
(a)section 7(4) of the Act shall have effect as if there were inserted after paragraph (b) of that subsection
“or
(c)the other individual is a relevant person”;
(b)section 7(9) shall have effect as if—
(i)there was substituted—
“(9) If a court is satisfied on the application of—
(a)any person who has made a request under the foregoing provisions of this section, or
(b)any person to whom serious harm to his physical or mental health or condition would be likely to be caused by compliance with any such request in contravention of those provisions,
that the data controller in question is about to comply with or has failed to comply with the request in contravention of those provisions, the court may order him not to comply or, as the case may be, to comply with the request.”; and
(ii)the reference to a contravention of the foregoing provisions of that section included a reference to a contravention of the provisions contained in this Order.
(2) After section 7(ii) of the Act insert—
“(12) A person is a relevant person for the purposes of subsection (4)(c) if he—
(a)is a person referred to in paragraph 4(a) or (b) or paragraph 8(a) or (b) of Schedule 11;
(b)is employed by an education authority (within the meaning of paragraph 6 of Schedule 11) in pursuance of its functions relating to education and the information relates to him, or he supplied the information in his capacity as such an employee; or
(c)is the person making the request.”.
Mike O'Brien
Parliamentary Under-Secretary of State
Home Office
17th February 2000
(This note is not part of the Order)
This Order provides for the partial exemption from the provisions of the Data Protection Act 1998, which confer rights on data subjects to gain access to data held about them, of certain data (education records) where the exercise of those rights would be likely to cause serious harm to the physical or mental health or condition of the data subject or another person, or, in some circumstances, (except in the case of Scotland) would disclose information as to whether the data subject is or has been the subject of or may be at risk of child abuse which disclosure would not be in the best interests of that data subject. The Order does not apply to any data to which the Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413) or any order made under section 38(1) of the Act applies (article 3(2)).
In the case of court reports in certain proceedings where information in the report may be withheld by the court, there is a complete exemption under article 4 of the Order from both section 7 of the Act and the first data protection principle to the extent to which it requires compliance with paragraph 2 of Part II of Schedule 1 to the Act (which confers obligations on data controllers to give certain information to data subjects relating to data held about them). For other personal data to which the Order applies, there is an exemption from section 7 of the Act only (article 5).
Article 7 of the Order also modifies section 7 of the Act so that a data controller cannot refuse access on the grounds that the identity of a third party would be disclosed in cases where the third party is a relevant person (as defined), unless serious harm to that relevant person’s physical or mental health or condition is likely to be caused such that the exemption in article 5(1) applies.
In the case of data controllers which are education authorities in Scotland who receive certain data from the Principal Reporter, article 6 requires such data controllers to obtain the Principal Reporter’s opinion on whether the disclosure of the information might cause serious harm to anyone before responding to any section 7 request.
This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
A Regulatory Impact Assessment was prepared for the Data Protection Bill as it was then and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.homeoffice.gov.uk. Alternatively, copies can be obtained by post from the Home Office, LGDP Unit, 50 Queen Anne’s Gate, London SW1H 9AT.
1998 c. 29; as respects Wales, the functions of the Secretary of State under section 30 were transferred to the National Assembly for Wales by article 2 of, and Schedule 1 to, S.I. 1999/672, but are also exercisable by the Secretary of State by virtue of paragraph 5 of Schedule 3 to the Government of Wales Act 1998 (c. 38) for the purposes set out in that paragraph.
S.I. 2000/413.
S.I. 1997/291 (S. 19).
S.I. 1996/3261 (S. 251).