This order came into force on 17 December 2002. It applies to Government Departments when they deal with requests from elected representatives where the response would involve the disclosure of sensitive personal data. This paper provides guidance in question and answer form to Government Departments on handling such requests. It should be read in conjunction with Departments' general guidance about the 1998 Act . Any queries about the order or this guidance should be addressed to the Freedom of Information and Data Protection Division (FIDP) of the Lord Chancellor's Department: Email ; telephone: 020 7210 8755.
More general queries about the 1998 Act should be addressed in the first instance to Departments' Data Protection Officers.
The Data Protection Act 1998 prohibits the processing of sensitive personal data unless one of the conditions set out in Schedule 3 to the Act or in subordinate legislation made under paragraph 10 of Schedule 3 applies. Sensitive personal data comprise information about an individual's:
The restriction on processing sensitive personal data applies in addition to the requirement for one of six general conditions (set out in Schedule 2 to the Act) to be met before any personal data (sensitive or non-sensitive) may be processed. "Processing" involves doing anything at all with personal data, from collecting them right through to destroying them and including merely holding them. Disclosing personal data is a form of processing.
Members of Parliament and other elected representatives are often asked by their constituents to take action on the constituents' behalf. Sometimes this may require the elected representative to process sensitive personal data. If the action requires the elected representative to seek information from a third party, for example a Government Department, the third party may need to disclose sensitive personal data to the elected representative. Without the above order, in many cases the only way in which such processing could take place would be if the individual concerned had given his or her explicit consent. While a requirement to seek explicit consent provides a good data protection safeguard for the individual concerned, it can sometimes cause difficulties in practice (for example, if urgent action is needed).
The order does two things.
It provides a condition allowing elected representatives to process sensitive personal data when dealing with requests from individuals without the need to seek explicit consent.
It provides a condition allowing third parties (including Government Departments) to disclose sensitive personal data to elected representatives who are acting at the request of individuals, again without the need to seek explicit consent.
In the Standing Committee Debate on the draft order, the Minister said:
"I agree that the subject is delicate, so perhaps we should discuss keeping an eye on it with the Information Commissioner. We will give the matter thought in future if we think it is not being handled appropriately, that it is causing problems in the other direction, or that constituents and other people feel that their privacy is being affected unreasonably by the order."
If Departments come across cases which they think raise concerns of the kind described by the Minister, they should draw them to the attention of FIDP.
No. The order allows Departments to provide sensitive personal data. It does not require them to do so.
It applies to:
The order applies to them only when they are carrying out their functions as elected representatives. It does not apply in relation to any contact that they might have with Departments in their personal capacity.
Departments can continue to rely on the order in dealing with elected representatives' requests for as long as the order continues to apply to the elected representative in question. When an election is called, the order continues to apply to all elected representatives throughout the pre-election period. It also continues to apply after the election to those who are re-elected. In the case of those who are not re-elected, the order will cease to apply at the end of a short period after the election. The periods are as follows.
Members of the House of Commons, the Scottish Parliament and the Northern Ireland Assembly: The order ceases to apply at the end of the fourth day after the day on which the general election is held.
Members of the National Assembly for Wales: The order ceases to apply at the end of the fourth day after the day on which the ordinary election is held.
UK Members of the European Parliament: The order ceases to apply at the end of the day before the opening of the first session of the European Parliament following the general election. *
Elected members of local authorities and elected Mayors (other than the Mayor of London and members of the London Assembly): The order ceases to apply to elected representatives, except Chairmen and Vice-Chairmen of Committees, on the fourth day after the election. It applies to Chairmen and Vice-Chairmen of Committees until they are replaced following the Council's first annual meeting after the election. *
The Mayor of London and members of the London Assembly: The order ceases to apply at the beginning of the second day after the day on which the last of the successful candidates at the ordinary election is declared to be returned. *
Elected members of the Common Council of the City of London: The order ceases to apply at the end of the fourth day after the day on which the Wardmotes are held.
If Departments receive requests shortly before an election, they should make every effort to send the substantive reply before the election takes place. Elected representatives who lose their seats are covered by the order only for a short time after an election (see above). If substantive replies cannot be prepared in time for them to reach the former elected representative within that period, they should not be sent to him or her. They should only be sent to the outgoing elected representative's successor if Departments have been informed that the outgoing elected representative has asked the successor to take on the case. In such a case the order will apply as normal. In other cases Departments should follow their normal procedures for dealing with outstanding correspondence from former elected representatives, but no sensitive personal data should be disclosed without the individual's explicit consent.
Under the order Departments may only disclose sensitive personal data to an elected representative in response to a request from him or her where
the elected representative is dealing with a request from an individual;
the data are relevant to the elected representative's request to the Department; and
the disclosure of the data is necessary to respond to the elected representative's request.
There is an extra condition where the disclosure is of sensitive personal data of an individual other than the one who made the request to the elected representative (i.e a third party). In such cases the disclosure can only be made
where the third party cannot give explicit consent;
where the Department cannot reasonably be expected to obtain the third party's explicit consent;
because seeking the third party's explicit consent would prejudice the action taken by the elected representative; or
in the interests of another individual (including the individual who made the request to the elected representative) where the third party's explicit consent has been sought and has been unreasonably withheld.
These cases are especially delicate and require particularly careful handling. Departments will wish to pay particular attention to the elected representative's reasons for seeking the sensitive personal data of somebody other than the person who has sought the elected representative's help. If there is uncertainty, Departments should seek more information from the elected representative.
If Departments are uncertain in a particular case whether any of the extra conditions relating to sensitive personal data of third parties applies (see Question 5) they should seek legal advice.
No. The purpose of the order is to ensure that sensitive personal data can be disclosed without seeking the individual's explicit consent. But it does not mean that Departments must not seek consent. It is for Departments to decide whether to check with the individual concerned that he or she is content for his or her sensitive personal data to be disclosed. That would be a good data protection safeguard. But the order means that checking is not essential. For example, if the time taken to do the check would mean that an important deadline was missed, or checking would otherwise cause problems for the constituent or another person, the order allows the data to be disclosed without a check.
NOTE: The order does not override the law of confidence. It may be necessary to seek the individual's consent to the disclosure if confidential information is involved (See Question 11).
Yes. Meeting one of the criteria for processing sensitive personal data is only one of the requirements of the data protection principles. Departments wishing to disclose sensitive personal data to elected representatives also have to comply with all the other requirements. In particular, Departments must ensure that making the disclosure is fair and lawful, and not incompatible with the purpose for which they hold the data.
No. The order does not affect the general rule that Departments may only do things that they have power to do under statute or at common law. If no such power exists, they may not disclose sensitive personal data, despite the existence of the order. This is a complex area of law. If Departments are in any doubt they should seek legal advice.
It does not affect the normal rules on subject access. An individual may ask somebody else, including an elected representative, to exercise his or her subject access right on his or her behalf. If an elected representative makes a subject access request on behalf of another individual, Departments should treat it according to the normal rules that apply to such requests.
No. The order does not affect the law of confidence in any way. Where sensitive personal data are held subject to a duty of confidence, they may only be disclosed without the express consent of the individual concerned if there is a legal requirement to make the disclosure or if the disclosure would be in the overriding public interest. Departments must also continue to respect fully any other legal restriction on disclosure that applies in a particular case. If Departments are in any doubt whether the law of confidence or any other legal restriction on disclosure applies in a particular case, they should seek legal advice.
If the elected representative says that he or she is asking for information on behalf of someone else, Departments should normally be able to take the elected representative's word for it. The elected representative may often provide a letter or other form of written "mandate" from the individual. But there is no requirement for the individual to put the request to the elected representative in writing, and getting a written mandate may not always be possible. For example, in urgent cases the individual's approach to the elected representative may have been made by telephone. If Departments are in particular doubt, they may wish to check the position with the individual.
No, but Departments will need to satisfy themselves that the person making the request to them is an elected representative. Departments are experienced in dealing with requests from elected representatives made in various forms. Requests involving the disclosure of sensitive personal data should be dealt with in accordance with Departments' normal procedures.
No. The order allows requests to be made by, and disclosures to be made to, both elected representatives themselves and people acting with their authority. For example, this would cover members of the elected representatives' staff. Departments are experienced in dealing with requests made on behalf of elected representatives. Requests for sensitive personal data from people other than the elected representatives themselves, should be dealt with in accordance with Departments' normal procedures.
No. But one of the other conditions provided by Schedule 3 to the 1998 Act or the Data Protection (Processing of Sensitive Personal Data) Order 2000 might be relevant. For example, paragraph 7 of Schedule 3 relates to processing which is necessary for statutory or Departmental purposes.
* These periods are not expressly mentioned in the order. The substantive legislation applying to the elections in question has the effect stated.
** NOTE: The law of confidence can apply to any information, not just personal
data. It is a complex legal concept, but broadly it applies where
- the information itself is of a confidential nature and is not publicly
or generally available; and,
- the circumstances in which the information is disclosed from one person
to another impose on the person receiving the information a duty to respect
the confidence (eg if the discloser says the information is not to be disclosed
to anyone else).