From tomorrow, 10th March 2015, a practice known as ‘enforced subject access’ will become a criminal offence, as section 56 of the Data Protection Act comes into force.

As we originally reported in an update to our Information Hub in June last year, this is an important step in making sure that employers and organisations don’t take part in the unsavoury practice of requiring individuals to provide a copy of their police records through their rights of subject access.

Today, to help people understand what this means in practice, we’re:

1. Publishing brief guidance for individuals on our self-help Information Hub
2. Providing a news update for employers, as well as brief guidance for employers and organisations
3. Highlighting the technical guidance that the Information Commissioners Office has published.

A more detailed news update is available on the main Unlock site.

We’ve learnt from the Information Commissioners Office that section 56 of the Data Protection Act 1998 will be brought into force on the 10th March 2015.

This means that “enforced subject access” will finally become a criminal offence. As we explained back in June 2014 when this was first announced, this is an important development for people with convictions.

Although it doesn’t prevent employers and others from getting access to criminal records through legitimate means (such as a basic disclosure through Disclosure Scotland or a standard/enhanced check through the Disclosure & Barring Service, depending on the job) what section 56 does do is prevent the use of significant amounts of sensitive personal data that can be disclosed as part of a subject access request.

In the past, we’ve come across examples where employers, insurers, education providers and housing providers have required people provide copies of their police record by applying to the police and paying £10 for a subject access request. This type of request discloses all information held on the Police National Computer, including convictions and cautions that are spent, as well as allegations or other ‘local police information’. The introduction of section 56 on the 10th March 2015 will enable a clearer message to be given to any organisation that is found to be undertaking this type of practice.

We will be making some more details available once the changes come into force. In the meantime, the ICO has draft guidance available on their website about what this will mean in practice.

The Ministry of Justice recently announced that the change to the Data Protection Act which makes enforced subject access a criminal offence has been delayed. It was originally meant to come into force on the 1st December 2014. It is now expected to commence early 2015.

As we understand it, the reason for the delay is a technical issue.

We will publish a further update once we have an implementation date.

We’ve learnt today that the Ministry of Justice are planning to bring section 56 of the Data Protection Act (DPA) 1998 into force on the 1^st December 2014.

Section 56 prevents employers from requiring people to use their subject access rights under the DPA to provide certain records, such as police records, as a condition of employment. It also prevents contracts from requiring certain records as a condition for providing or receiving a service, such as housing or insurance. Requiring people to provide these records will become a criminal offence, punishable by a fine. In England and Wales the maximum financial penalty on summary conviction in the magistrates’ court is £5,000 (soon to be unlimited). On indictment in the Crown Court the fine can be unlimited.

We’ve long argued that section 56 needs to be brought into force, but this wasn’t ever possible until reforms to the Rehabilitation of Offenders Act 1974 were brought in on the 10^th March 2014.

For people with convictions, this is an important development. Although it doesn’t prevent employers and others from getting access to criminal records through legitimate means (such as a basic disclosure through Disclosure Scotland or a standard/enhanced check through the Disclosure & Barring Service, depending on the job) what section 56 does do is prevent the use of significant amounts of sensitive personal data that can be disclosed as part of a subject access request.

In the past, we’ve come across examples where employers, insurers, education providers and housing providers have required people provide copies of their police record by applying to the police and paying £10 for a subject access request. This type of request discloses all information held on the Police National Computer, including convictions and cautions that are spent, as well as allegations or other ‘local police information’.

The introduction of section 56 on the 1^st December will enable a clearer message to be given to any organisation that is found to be undertaking this type of practice. The legislation only allows requirements of this type where the record is required by law or is justified in the public interest. We understand that the Information Commissioners Office will be publishing guidance nearer to the date of implementation, to better explain how this will work in practice. In the meantime, there is a helpful blog on the ICO website.

This measure follows on from reforms to the Rehabilitation of Offenders Act 1974 announced in a Written Ministerial Statement on the 13^th February 2014.