2000 No. 415
DATA PROTECTION

The Data Protection (Subject Access Modification) (Social Work) Order 2000

Made
Coming into force

Whereas a draft of this Order has been laid before and approved by a resolution of each House of Parliament:

Whereas the Secretary of State considers that the application of the subject information provisions (or those provisions without modification) in the circumstances and to the extent specified in this Order would be likely to prejudice the carrying out of social work:

Now, therefore, the Secretary of State, in exercise of the powers conferred on him by sections 30(3) and (4) and 67(2) of the Data Protection Act 19981, and after consultation with the Data Protection Commissioner in accordance with section 67(3) of that Act, hereby makes the following Order:

Citation and commencement1.

This Order may be cited as the Data Protection (Subject Access Modification) (Social Work) Order 2000 and shall come into force on 1st March 2000.

Interpretation2.

(1)

In this Order—

“the Act” means the Data Protection Act 1998;

“compulsory school age” in paragraph 1(f) of the Schedule has the same meaning as in section 8 of the Education Act 19962, and in paragraph 1(g) of the Schedule has the same meaning as in Article 46 of the Education and Libraries (Northern Ireland) Order 19863;
“Health and Social Services Board” means a Health and Social Services Board established under Article 16 of the Health and Personal Social Services (Northern Ireland) Order 19724;
“Health and Social Services Trust” means a Health and Social Services Trust established under the Health and Personal Social Services (Northern Ireland) Order 19915;
“Principal Reporter” means the Principal Reporter appointed under section 127 of the Local Government etc. (Scotland) Act 19946 or any officer of the Scottish Children’s Reporter Administration to whom there is delegated under section 131(1) of that Act any function of the Principal Reporter;

“request” means a request made under section 7;

“school age” in paragraph 1(h) of the Schedule has the same meaning as in section 31 of the Education (Scotland) Act 19807;

“section 7” means section 7 of the Act; and

“social work authority” in article 6 means a local authority for the purposes of the Social Work (Scotland) Act 19688.

(2)

Any reference in this Order to a local authority in relation to data processed or formerly processed by it includes a reference to the Council of the Isles of Scilly in relation to data processed or formerly processed by the Council in connection with any functions mentioned in paragraph 1(a)(ii) of the Schedule which are or have been conferred upon the Council by or under any enactment.

Personal data to which Order applies3.

(1)

Subject to paragraph (2), this Order applies to personal data falling within any of the descriptions set out in paragraphs 1 and 2 of the Schedule.

(2)

This Order does not apply—

(a)

to any data consisting of information as to the physical or mental health or condition of the data subject to which the Data Protection (Subject Access Modification) (Health) Order 20009 or the Data Protection (Subject Access Modification) (Education) Order 200010 applies; or

(b)

to any data which are exempted from section 7 by an order made under section 38(1) of the Act.

Exemption from subject information provisions4.

Personal data to which this Order applies by virtue of paragraph 2 of the Schedule are exempt from the subject information provisions.

Exemption from section 75.

(1)

Personal data to which this Order applies by virtue of paragraph 1 of the Schedule are exempt from the obligations in section 7(1)(b) to (d) of the Act in any case to the extent to which the application of those provisions would be likely to prejudice the carrying out of social work by reason of the fact that serious harm to the physical or mental health or condition of the data subject or any other person would be likely to be caused.

(2)

In paragraph (1) the “carrying out of social work” shall be construed as including—

(a)

the exercise of any functions mentioned in paragraph 1(a)(i), (d), (f) to (j), (m) or (o) of the Schedule;

(b)

the provision of any service mentioned in paragraph 1(b), (c) or (k) of the Schedule; and

(c)

the exercise of the functions of any body mentioned in paragraph 1(e) of the Schedule or any person mentioned in paragraph 1(p) or (q) of the Schedule.

(3)

Where any person falling within paragraph (4) is enabled by or under any enactment or rule of law to make a request on behalf of a data subject and has made such a request, personal data to which this Order applies are exempt from section 7 in any case to the extent to which the application of that section would disclose information—

(a)

provided by the data subject in the expectation that it would not be disclosed to the person making the request;

(b)

obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed; or

(c)

which the data subject has expressly indicated should not be so disclosed,

provided that sub-paragraphs (a) and (b) shall not prevent disclosure where the data subject has expressly indicated that he no longer has the expectation referred to therein.

(4)

A person falls within this paragraph if—

(a)

except in relation to Scotland, the data subject is a child, and that person has parental responsibility for that data subject;

(b)

in relation to Scotland, the data subject is a person under the age of sixteen, and that person has parental responsibilities for that data subject; or

(c)

the data subject is incapable of managing his own affairs and that person has been appointed by a court to manage those affairs.

Modification of section 7 relating to Principal Reporter6.

Where in Scotland a data controller who is a social work authority receives a request relating to information constituting data to which this Order applies and which originated from or was supplied by the Principal Reporter acting in pursuance of his statutory duties, other than information which the data subject is entitled to receive from the Principal Reporter, section 7 shall be modified so that—

(a)

the data controller shall, within fourteen days of the relevant day (within the meaning of section 7(10) of the Act), inform the Principal Reporter that a request has been made; and

(b)

the data controller shall not communicate information to the data subject pursuant to that section unless the Principal Reporter has informed that data controller that, in his opinion, the exemption specified in article 5(1) does not apply with respect to the information.

Further modifications of section 77.

(1)

In relation to data to which this Order applies by virtue of paragraph 1 of the Schedule—

(a)

section 7(4) shall have effect as if there were inserted after paragraph (b) of that subsection

“or,

(c)

the other individual is a relevant person”;

(b)

section 7(9) shall have effect as if—

(i)

there was substituted—

“(9)

If a court is satisfied on the application of—

(a)

any person who has made a request under the foregoing provisions of this section, or

(b)

any person to whom serious harm to his physical or mental health or condition would be likely to be caused by compliance with any such request in contravention of those provisions,

that the data controller in question is about to comply with or has failed to comply with the request in contravention of those provisions, the court may order him not to comply or, as the case may be, to comply with the request.”; and

(ii)

the reference to a contravention of the foregoing provisions of that section included a reference to a contravention of the provisions contained in this Order.

(2)

After section 7(11) of the Act insert—

“(12)

A person is a relevant person for the purposes of subsection (4)(c) if he—

(a)

is a person referred to in paragraph 1(p) or (q) of the Schedule to the Data Protection (Subject Access Modification) (Social Work) Order 2000; or

(b)

is or has been employed by any person or body referred to in paragraph 1 of that Schedule in connection with functions which are or have been exercised in relation to the data consisting of the information; or

(c)

has provided for reward a service similar to a service provided in the exercise of any functions specified in paragraph 1(a)(i), (b), (c) or (d) of that Schedule,

and the information relates to him or he supplied the information in his official capacity or, as the case may be, in connection with the provision of that service.”.

Mike O'Brien
Parliamentary Under-Secretary of State

Home Office

SCHEDULEPERSONAL DATA TO WHICH THIS ORDER APPLIES

Article 3

1.

This paragraph applies to personal data falling within any of the following descriptions—

(a)

data processed by a local authority—

(i)

in connection with its social services functions within the meaning of the Local Authority Social Services Act 197011 or any functions exercised by local authorities under the Social Work (Scotland) Act 1968 or referred to in section 5(1B) of that Act12, or

(ii)

in the exercise of other functions but obtained or consisting of information obtained in connection with any of those functions;

(b)

data processed by a Health and Social Services Board in connection with the provision of personal social services within the meaning of the Health and Personal Social Services (Northern Ireland) Order 1972 or processed by the Health and Social Services Board in the exercise of other functions but obtained or consisting of information obtained in connection with the provision of those services;

(c)

data processed by a Health and Social Services Trust in connection with the provision of personal social services within the meaning of the Health and Personal Social Services (Northern Ireland) Order 1972 on behalf of a Health and Social Services Board by virtue of an authorisation made under Article 3(1) of the Health and Personal Social Services (Northern Ireland) Order 199413 or processed by the Health and Social Services Trust in the exercise of other functions but obtained or consisting of information obtained in connection with the provision of those services;

(d)

data processed by a council in the exercise of its functions under Part II of Schedule 9 to the Health and Social Services and Social Security Adjudications Act 198314;

(e)

data processed by a probation committee established by section 3 of the Probation Service Act 199315 or the Probation Board for Northern Ireland established by the Probation Board (Northern Ireland) Order 198216;

(f)

data processed by a local education authority in the exercise of its functions under section 36 of the Children Act 198917 or Chapter II of Part VI of the Education Act 1996 so far as those functions relate to ensuring that children of compulsory school age receive suitable education whether by attendance at school or otherwise;

(g)

data processed by an education and library board in the exercise of its functions under article 55 of the Children (Northern Ireland) Order 199518 or article 45 of, and Schedule 13 to, the Education and Libraries (Northern Ireland) Order 198619 so far as those functions relate to ensuring that children of compulsory school age receive efficient full-time education suitable to their age, ability and aptitude and to any special educational needs they may have, either by regular attendance at school or otherwise;

(h)

data processed by an education authority in the exercise of its functions under sections 35 to 42 of the Education (Scotland) Act 1980 so far as those functions relate to ensuring that children of school age receive efficient education suitable to their age, ability and aptitude, whether by attendance at school or otherwise;

(i)

data relating to persons detained in a special hospital provided under section 4 of the National Health Service Act 197720 and processed by a special health authority established under section 11 of that Act21 in the exercise of any functions similar to any social services functions of a local authority;

(j)

data relating to persons detained in special accommodation provided under article 110 of the Mental Health (Northern Ireland) Order 198622 and processed by a Health and Social Services Trust in the exercise of any functions similar to any social services functions of a local authority;

(k)

data processed by the National Society for the Prevention of Cruelty to Children or by any other voluntary organisation or other body designated under this sub-paragraph by the Secretary of State or the Department of Health, Social Services and Public Safety and appearing to the Secretary of State or the Department, as the case may be, to be processed for the purposes of the provision of any service similar to a service provided in the exercise of any functions specified in sub-paragraphs (a)(i), (b), (c) or (d) above;

(l)

data processed by—

(i)

a Health Authority established under section 8 of the National Health Service Act 197723;

(ii)

an NHS Trust established under section 5 of the National Health Service and Community Care Act 199024; or

(iii)

a Health Board established under section 2 of the National Health Service (Scotland) Act 197825,

which were obtained or consisted of information which was obtained from any authority or body mentioned above or government department and which, whilst processed by that authority or body or government department, fell within any sub-paragraph of this paragraph;

(m)

data processed by an NHS Trust as referred to in sub-paragraph (l)(ii) above in the exercise of any functions similar to any social services functions of a local authority;

(n)

data processed by a government department and obtained or consisting of information obtained from any authority or body mentioned above and which, whilst processed by that authority or body, fell within any of the preceding sub-paragraphs of this paragraph;

(o)

data processed for the purposes of the functions of the Secretary of State pursuant to section 82(5) of the Children Act 1989;

(p)

data processed by any guardian ad litem appointed under section 41 of the Children Act 1989, Article 60 of the Children (Northern Ireland) Order 199526 or Article 66 of the Adoption (Northern Ireland) Order 198727 or by a safeguarder appointed under section 41 of the Children (Scotland) Act 199528;

(q)

data processed by the Principal Reporter.

2.

This paragraph applies to personal data processed by a court and consisting of information supplied in a report or other evidence given to the court by a local authority, Health and Social Services Board, Health and Social Services Trust, probation officer or other person in the course of any proceedings to which the Family Proceedings Courts (Children Act 1989) Rules 199129, the Magistrates' Courts (Children and Young Persons) Rules 199230, the Magistrates' Courts (Criminal Justice (Children)) Rules (Northern Ireland) 199931, the Act of Sederunt (Child Care and Maintenance Rules) 199732 or the Children’s Hearings (Scotland) Rules 199633 apply where, in accordance with a provision of any of those Rules, the information may be withheld by the court in whole or in part from the data subject.
(This note is not part of the Order)

This Order provides for the partial exemption from the provisions of the Data Protection Act 1998, which confer rights on data subjects to gain access to data held about them, of certain data where the exercise of those rights would be likely to prejudice the carrying out of social work by causing serious harm to the physical or mental health or condition of the data subject or another person (article 3(1)). The Order does not apply to any data to which the Data Protection (Subject Access Modification) (Health) Order 2000 (S.I. 2000/413), the Data Protection (Subject Access Modification) (Education) Order 2000 (S.I. 2000/414) or any order made under section 38(1) of the Act applies (article 3(2)).

In the case of court reports in certain proceedings where information in the report may be withheld by the court, article 4 of, and paragraph 2 of the Schedule to, this Order provide a complete exemption from section 7 of the Act and also a complete exemption from the first data protection principle to the extent to which it requires compliance with paragraph 2 of Part II of Schedule 1 to the Act (which confers obligations on data controllers to give certain information to data subjects relating to data held about them). In all other cases, article 5(1) confers an exemption from section 7(1)(b) to (d) of the Act, leaving the right of the data subject to be informed by any data controller whether data about him are being processed by or on behalf of that data controller.

Article 7 modifies section 7 of the Act so that a data controller cannot refuse access on the grounds that the identity of a third party would be disclosed in cases where the third party is a relevant person (as defined), unless serious harm to that relevant person’s physical or mental health or condition is likely to be caused by giving access such that the exemption in article 5(1) applies.

A further exemption from section 7 of the Act is conferred by article 5(3) in certain circumstances where a third party is making the request for access on behalf of the data subject and the data subject does not wish that information to be disclosed to that third party.

By virtue of paragraph 1 of the Schedule to this Order, it principally applies to data processed by local authorities, in relation to their social services and education welfare functions, and health authorities to whom such data are passed and by probation committees and the National Society for the Prevention of Cruelty to Children. This Order also applies to data processed for similar purposes by the corresponding bodies in Northern Ireland. Data processed by government departments for certain purposes connected with social work and by officers such as guardians ad litem and (in Scotland) the Principal Reporter of the Scottish Children’s Reporter Administration are also within the scope of the Order. Provision is made enabling other voluntary organisations or other bodies to be added to the list of bodies whose data are subject to the provisions of the Order where the data are processed for purposes similar to the social services functions (or in Scotland social work functions) of local authorities.

In the case of social work authorities in Scotland who receive certain data from the Principal Reporter, article 6 requires such data controllers to obtain the Principal Reporter’s approval before responding to any section 7 request.

This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

A Regulatory Impact Assessment was prepared for the Data Protection Bill as it was then and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.homeoffice.gov.uk. Alternatively, copies can be obtained by post from the Home Office, LGDP Unit, 50 Queen Anne’s Gate, London SW1H 9AT.