‘Enforced subject access’ (under section 184 of the Data Protection Act 2018) prevents employers from requiring people to use their subject access rights under the DPA to provide certain records, such as police records, as a condition of employment. It also prevents contracts from requiring certain records as a condition for providing or receiving a service, such as housing or insurance. Requiring people to provide these records will become a criminal offence, punishable by a fine. In England and Wales the maximum financial penalty on summary conviction in the magistrates’ court is £5,000 (soon to be unlimited). On indictment in the Crown Court the fine can be unlimited.
We’ve long argued that section 184 needs to be brought into force, but this wasn’t ever possible until reforms to the Rehabilitation of Offenders Act 1974 were brought in on the 10thMarch 2014. Section 184 came into force on the 10th March 2015.
For people with convictions, this is an important development. Although it doesn’t prevent employers and others from getting access to criminal records through legitimate means (such as a basic disclosure through Disclosure Scotland or a standard/enhanced check through the Disclosure & Barring Service, depending on the job) what section 56 does do is prevent the use of significant amounts of sensitive personal data that can be disclosed as part of a subject access request.
In the past, we’ve come across examples where employers, insurers, education providers and housing providers have required people provide copies of their police record by applying to the police and paying £10 for a subject access request. This type of request discloses all information held on the Police National Computer, including convictions and cautions that are spent, as well as allegations or other ‘local police information’.
The introduction of section 184 will enable a clearer message to be given to any organisation that is found to be undertaking this type of practice. The legislation only allows requirements of this type where the record is required by law or is justified in the public interest.
Frequently asked questions
Depending on the job, an employer will still be able (if they wish) to require you to undergo a basic, standard or enhanced criminal record check.
Other useful resources
Below is a webinar that the ICO held on the 18th November 2014