Enforced Subject Access Requests To Be A Criminal Offence From 1 December 2014
It is being reported that, with effect from 1 December 2014, section 56
of the Data Protection Act 1998 (DPA) will be brought into force, which will
make it a criminal offence to request an enforced subject access request.
Currently, such requests can be used to reveal details of any criminal convictions
that the individual has, which includes information to which employers would
not otherwise have access. For example, a subject access request made to the
Police for information about an individual’s criminal convictions would reveal
more details than the individual would otherwise have to declare to his employer.
For example, that information might include spent convictions under the Rehabilitation
of Offenders Act 1974.
Both the Information Commissioner and the Disclosure and Barring Service
have expressed concern that enforced subject access requests not only represent
an abuse of an individual’s rights but also potentially undermine important
Section 56 will prohibit a person from requiring an individual to produce
certain records as a condition of employment or for providing a service, other
than where the relevant record is required by law or where it is justified
in the public interest.