 | |
| |
Unlawful obtaining etc. of personal data |
| Unlawful obtaining etc. of personal data. |
55. - (1) A person must not knowingly or recklessly, without the consent of the data controller-
|
| |
(a) obtain or disclose personal data or the information contained in personal data, or |
| |
(b) procure the disclosure to another person of the information contained in personal data. |
| |
(2) Subsection (1) does not apply to a person who shows-
|
| |
(a) that the obtaining, disclosing or procuring- |
| |
(i) was necessary for the purpose of preventing or detecting crime, or
|
| |
(ii) was required or authorised by or under any enactment, by any rule of law or by the order of a court,
|
| |
(b) that he acted in the reasonable belief that he had in law the right to obtain or disclose the data or information or, as the case may be, to procure the disclosure of the information to the other person, |
| |
(c) that he acted in the reasonable belief that he would have had the consent of the data controller if the data controller had known of the obtaining, disclosing or procuring and the circumstances of it, or |
| |
(d) that in the particular circumstances the obtaining, disclosing or procuring was justified as being in the public interest. |
| |
(3) A person who contravenes subsection (1) is guilty of an offence.
|
| |
(4) A person who sells personal data is guilty of an offence if he has obtained the data in contravention of subsection (1).
|
| |
(5) A person who offers to sell personal data is guilty of an offence if-
|
| |
(a) he has obtained the data in contravention of subsection (1), or |
| |
(b) he subsequently obtains the data in contravention of that subsection. |
| |
(6) For the purposes of subsection (5), an advertisement indicating that personal data are or may be for sale is an offer to sell the data.
|
| |
(7) Section 1(2) does not apply for the purposes of this section; and for the purposes of subsections (4) to (6), "personal data" includes information extracted from personal data.
|
| |
(8) References in this section to personal data do not include references to personal data which by virtue of section 28 are exempt from this section.
|
| |
Records obtained under data subject's right of access |
| Prohibition of requirement as to production of certain records. |
56. - (1) A person must not, in connection with-
|
| |
(a) the recruitment of another person as an employee, |
| |
(b) the continued employment of another person, or |
| |
(c) any contract for the provision of services to him by another person, |
| |
require that other person or a third party to supply him with a relevant record or to produce a relevant record to him.
|
| |
(2) A person concerned with the provision (for payment or not) of goods, facilities or services to the public or a section of the public must not, as a condition of providing or offering to provide any goods, facilities or services to another person, require that other person or a third party to supply him with a relevant record or to produce a relevant record to him.
|
| |
(3) Subsections (1) and (2) do not apply to a person who shows-
|
| |
(a) that the imposition of the requirement was required or authorised by or under any enactment, by any rule of law or by the order of a court, or |
| |
(b) that in the particular circumstances the imposition of the requirement was justified as being in the public interest. |
| |
(4) Having regard to the provisions of Part V of the Police Act 1997 (certificates of criminal records etc.), the imposition of the requirement referred to in subsection (1) or (2) is not to be regarded as being justified as being in the public interest on the ground that it would assist in the prevention or detection of crime.
|
| |
(5) A person who contravenes subsection (1) or (2) is guilty of an offence.
|
| |
(6) In this section "a relevant record" means any record which-
|
| |
(a) has been or is to be obtained by a data subject from any data controller specified in the first column of the Table below in the exercise of the right conferred by section 7, and |
| |
(b) contains information relating to any matter specified in relation to that data controller in the second column, |
| |
and includes a copy of such a record or a part of such a record.
|
| |
| |
TABLE |
Data controller |
Subject-matter |
1. Any of the following persons-
(a) a chief officer of police of a police force in England and Wales.
(b) a chief constable of a police force in Scotland.
(c) the Chief Constable of the Royal Ulster Constabulary.
(d) the Director General of the National Criminal Intelligence Service.
(e) the Director General of the National Crime Squad. |
(a) Convictions.
(b) Cautions. |
2. The Secretary of State. |
(a) Convictions.
(b) Cautions.
(c) His functions under section 53 of the Children and Young Persons Act 1933, section 205(2) or 208 of the Criminal Procedure (Scotland) Act 1995 or section 73 of the Children and Young Persons Act (Northern Ireland) 1968 in relation to any person sentenced to detention.
(d) His functions under the Prison Act 1952, the Prisons (Scotland) Act 1989 or the Prison Act (Northern Ireland) 1953 in relation to any person imprisoned or detained.
(e) His functions under the Social Security Contributions and Benefits Act 1992, the Social Security Administration Act 1992 or the Jobseekers Act 1995.
(f) His functions under Part V of the Police Act 1997. |
3. The Department of Health and Social Services for Northern Ireland. |
Its functions under the Social Security Contributions and Benefits (Northern Ireland) Act 1992, the Social Security Administration (Northern Ireland) Act 1992 or the Jobseekers (Northern Ireland) Order 1995. |
|
| |
(7) In the Table in subsection (6)-
|
| |
"caution" means a caution given to any person in England and Wales or Northern Ireland in respect of an offence which, at the time when the caution is given, is admitted; |
| |
"conviction" has the same meaning as in the Rehabilitation of Offenders Act 1974 or the Rehabilitation of Offenders (Northern Ireland) Order 1978 . |
| |
(8) The Secretary of State may by order amend-
|
| |
(a) the Table in subsection (6), and |
| |
|
| |
(9) For the purposes of this section a record which states that a data controller is not processing any personal data relating to a particular matter shall be taken to be a record containing information relating to that matter.
|
| |
(10) In this section "employee" means an individual who-
|
| |
(a) works under a contract of employment, as defined by section 230(2) of the Employment Rights Act 1996 , or |
| |
|
| |
whether or not he is entitled to remuneration; and "employment" shall be construed accordingly.
|
| Avoidance of certain contractual terms relating to health records. |
57. - (1) Any term or condition of a contract is void in so far as it purports to require an individual to supply any other person with a record to which this section applies, or with a copy of such a record or a part of such a record.
|
| |
(2) This section applies to any record which-
|
| |
(a) has been or is to be obtained by a data subject in the exercise of the right conferred by section 7, and |
| |
(b) consists of the information contained in any health record as defined by section 68(2). |
| |
Information provided to Commissioner or Tribunal |
| Disclosure of information. |
58. No enactment or rule of law prohibiting or restricting the disclosure of information shall preclude a person from furnishing the Commissioner or the Tribunal with any information necessary for the discharge of their functions under this Act.
|
| Confidentiality of information. |
59. - (1) No person who is or has been the Commissioner, a member of the Commissioner's staff or an agent of the Commissioner shall disclose any information which-
|
| |
(a) has been obtained by, or furnished to, the Commissioner under or for the purposes of this Act, |
| |
(b) relates to an identified or identifiable individual or business, and |
| |
(c) is not at the time of the disclosure, and has not previously been, available to the public from other sources, |
| |
unless the disclosure is made with lawful authority.
|
| |
(2) For the purposes of subsection (1) a disclosure of information is made with lawful authority only if, and to the extent that-
|
| |
(a) the disclosure is made with the consent of the individual or of the person for the time being carrying on the business, |
| |
(b) the information was provided for the purpose of its being made available to the public (in whatever manner) under any provision of this Act, |
| |
(c) the disclosure is made for the purposes of, and is necessary for, the discharge of- |
| |
(i) any functions under this Act, or
|
| |
(ii) any Community obligation,
|
| |
(d) the disclosure is made for the purposes of any proceedings, whether criminal or civil and whether arising under, or by virtue of, this Act or otherwise, or |
| |
(e) having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary for reasons of substantial public interest. |
| |
(3) Any person who knowingly or recklessly discloses information in contravention of subsection (1) is guilty of an offence.
|
