2002 No. 2905

DATA PROTECTION

The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002

Made

Coming into force

Whereas a draft of this Order has been laid before and approved by a resolution of each House of Parliament:

Now, therefore, the Lord Chancellor, in exercise of the powers conferred upon him by section 67(2) of, and paragraph 10 of Schedule 3 to, the Data Protection Act 19981, and after consultation with the Information Commissioner2 in accordance with section 67(3) of that Act, hereby makes the following Order:

1

This Order may be cited as the Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002 and shall come into force on the twenty-eighth day after the day on which it is made.

2

For the purposes of paragraph 10 of Schedule 3 to the Data Protection Act 1998, the circumstances specified in any of paragraphs 3, 4, 5 or 6 in the Schedule to this Order are circumstances in which sensitive personal data may be processed3.

Signed by the authority of the Lord Chancellor

Yvette CooperParliamentary Secretary,Lord Chancellor’s Department

SCHEDULECIRCUMSTANCES IN WHICH SENSITIVE PERSONAL DATA MAY BE PROCESSED

Article 2

Interpretation

1

In this Schedule, “elected representative” means—

a

a Member of the House of Commons, a Member of the National Assembly for Wales, a Member of the Scottish Parliament or a Member of the Northern Ireland Assembly;

b

a Member of the European Parliament elected in the United Kingdom;

c

an elected member of a local authority within the meaning of section 270(1) of the Local Government Act 19724, namely—

i

in England, a county council, a district council, a London borough council or a parish council,

ii

in Wales, a county council, a county borough council or a community council;

d

an elected mayor of a local authority within the meaning of Part II of the Local Government Act 20005;

e

the Mayor of London or an elected member of the London Assembly;

f

an elected member of—

i

the Common Council of the City of London, or

ii

the Council of the Isles of Scilly;

g

an elected member of a council constituted under section 2 of the Local Government etc (Scotland) Act 19946; or

h

an elected member of a district council within the meaning of the Local Government Act (Northern Ireland) 19727.

2

For the purposes of paragraph 1 above—

a

a person who is—

i

a Member of the House of Commons immediately before Parliament is dissolved,

ii

a Member of the Scottish Parliament immediately before that Parliament is dissolved, or

iii

a Member of the Northern Ireland Assembly immediately before that Assembly is dissolved,

shall be treated as if he were such a member until the end of the fourth day after the day on which the subsequent general election in relation to that Parliament or Assembly is held;

b

a person who is a Member of the National Assembly for Wales and whose term of office comes to an end, in accordance with section 2(5)(b) of the Government of Wales Act 19988, at the end of the day preceding an ordinary election (within the meaning of section 2(4) of that Act), shall be treated as if he were such a member until the end of the fourth day after the day on which that ordinary election is held; and

c

a person who is an elected member of the Common Council of the City of London and whose term of office comes to an end at the end of the day preceding the annual Wardmotes9 shall be treated as if he were such a member until the end of the fourth day after the day on which those Wardmotes are held.

Processing by elected representatives

3

The processing—

a

is carried out by an elected representative or a person acting with his authority;

b

is in connection with the discharge of his functions as such a representative;

c

is carried out pursuant to a request made by the data subject to the elected representative to take action on behalf of the data subject or any other individual; and

d

is necessary for the purposes of, or in connection with, the action reasonably taken by the elected representative pursuant to that request.

4

The processing—

a

is carried out by an elected representative or a person acting with his authority;

b

is in connection with the discharge of his functions as such a representative;

c

is carried out pursuant to a request made by an individual other than the data subject to the elected representative to take action on behalf of the data subject or any other individual;

d

is necessary for the purposes of, or in connection with, the action reasonably taken by the elected representative pursuant to that request; and

e

is carried out without the explicit consent of the data subject because the processing—

i

is necessary in a case where explicit consent cannot be given by the data subject,

ii

is necessary in a case where the elected representative cannot reasonably be expected to obtain the explicit consent of the data subject,

iii

must necessarily be carried out without the explicit consent of the data subject being sought so as not to prejudice the action taken by the elected representative, or

iv

is necessary in the interests of another individual in a case where the explicit consent of the data subject has been unreasonably withheld.

Processing limited to disclosures to elected representatives

5

The disclosure—

a

is made to an elected representative or a person acting with his authority;

b

is made in response to a communication to the data controller from the elected representative, or a person acting with his authority, acting pursuant to a request made by the data subject;

c

is of sensitive personal data which are relevant to the subject matter of that communication; and

d

is necessary for the purpose of responding to that communication.

6

The disclosure—

a

is made to an elected representative or a person acting with his authority;

b

is made in response to a communication to the data controller from the elected representative, or a person acting with his authority, acting pursuant to a request made by an individual other than the data subject;

c

is of sensitive personal data which are relevant to the subject matter of that communication;

d

is necessary for the purpose of responding to that communication; and

e

is carried out without the explicit consent of the data subject because the disclosure—

i

is necessary in a case where explicit consent cannot be given by the data subject,

ii

is necessary in a case where the data controller cannot reasonably be expected to obtain the explicit consent of the data subject,

iii

must necessarily be carried out without the explicit consent of the data subject being sought so as not to prejudice the action taken by the elected representative, or

iv

is necessary in the interests of another individual in a case where the explicit consent of the data subject has been unreasonably withheld.

(This note is not part of the Order)

The first data protection principle, set out in paragraph 1of Schedule 1 to the Data Protection Act 1998, prohibits the processing of sensitive personal data unless one of the conditions in Schedule 3 to the Act is met. The condition set out in paragraph 10 of that Schedule is that the personal data are processed in circumstances specified in an order made by the Lord Chancellor.

The Schedule to this Order specifies a number of such circumstances, which relate to the processing of sensitive personal data by, and disclosures of sensitive personal data to, elected representatives.

An “elected representative” is defined for these purposes in paragraph 1 of the Schedule, and includes Members of the House of Commons, Members of the devolved administrations in Wales, Scotland and Northern Ireland, Members of the European Parliament, elected members of local authorities and elected mayors. Paragraph 2 provides that for the purposes of paragraph 1, a person who is a Member of the House of Commons immediately before Parliament is dissolved is to be treated as if he were such a member until the end of the fourth day after the general election, and makes comparable provision in relation to Members of the devolved administrations and elected members of the Common Council of the City of London.

Paragraphs 3 and 4 of the Schedule cover certain processing carried out by an elected representative (or a person acting with his authority) in connection with the discharge of his functions as such.

Paragraph 3 covers processing carried out pursuant to a request made by the data subject to the elected representative to take action on behalf of the data subject or any other individual. The processing must be necessary in connection with the action reasonably taken by the elected representative pursuant to the request.

Paragraph 4 covers processing carried out pursuant to a request made by an individual other than the data subject to the elected representative to take action on behalf of the data subject or any other individual. The processing must be necessary in connection with the action reasonably taken by the elected representative pursuant to the request. Further, one of the specified reasons for carrying out the processing without the explicit consent of the data subject must apply.

Paragraphs 5 and 6 of the Schedule cover certain disclosures made to an elected representative (or a person acting with his authority) by another data controller.

Paragraph 5 covers disclosures made in response to a communication to the data controller from an elected representative (or person acting with his authority) who is acting pursuant to a request made by the data subject. The sensitive personal data disclosed must be relevant to the subject matter of the communication and the disclosure must be necessary for the purpose of responding to the communication.

Paragraph 6 covers disclosures made in response to a communication to the data controller from an elected representative (or person acting with his authority) who is acting pursuant to a request made by an individual other than the data subject. The sensitive personal data disclosed must be relevant to the subject matter of the communication and the disclosure must be necessary for the purpose of responding to the communication. Further, one of the specified reasons for carrying out the processing without the explicit consent of the data subject must apply.

This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

A Regulatory Impact Assessment was prepared for the Data Protection Bill as it then was and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.lcd.gov.uk. Alternatively, copies can be obtained by post from the Lord Chancellor’s Department, FIDP Division, Selborne House, 54-60 Victoria Street, London SW1E 6QW.

This Order will have a negligible effect on business, charities and the voluntary sector, therefore a Regulatory Impact Assessment has not been prepared for this Order specifically.