Criminalising Enforced Subject Access

Enforced subject access will shortly become illegal. Enforced subject access typically occurs where a person wishes to see another individual's criminal record, but chooses not to use the established legal system operated by Disclosure Scotland, the Disclosure and Barring Service and Access Northern Ireland.

Section 56 of the Data Protection Act 1998 (DPA) will finally take effect on 1 December 2014. This means it will be a criminal offence for an employer or a third party to require someone to make a subject access request to access information about their convictions and cautions and provide that information to someone else as a condition of employment, or as part of a contract for the provision of services. A subject access request entitles an individual to know what personal information is being processed in relation to them.