The Data Protection (Subject Access Modification) (Health) Order 2000

Explanatory Note

(This note is not part of the Order)

This Order provides for the partial exemption from the provisions of the Data Protection Act 1998 which confer rights on data subjects to gain access to data held about them of data relating to the physical or mental health or condition of the data subject (article 3(1)). The Order does not apply to any data to which any order made under section 38 (1) of the Act applies (article 3 (2)).

An exemption from section 7 of the Act is conferred by article 5 (1) only to the extent to which the supply to the data subject of particulars of the information constituting the data would be likely to cause serious harm to his or any other person’s physical or mental health or condition. Before deciding whether this exemption applies (and, accordingly, whether to grant or withhold subject access) a data controller who is not a health professional is obliged by articles 5 (2) and 6 (1) to consult the health professional responsible for the clinical care of the data subject or, if there is more than one, the most suitable available health professional or, if there is none available or the data controller is the Secretary of State exercising his functions relating to social security, child support or war pensions, a health professional who has the necessary experience and qualifications to advise on the matters to which the information which is requested relates (definition in article 2). This obligation to consult does not apply where the data subject has already seen or knows about the information which is the subject of the request (article 6 (1)), nor in certain limited circumstances where consultation has been carried out prior to the request being made (article 7 (1) and (2)).

A further exemption from section 7 of the Act is conferred in certain circumstances where a third party is making the request for access on behalf of the data subject and the data subject does not wish that information to be disclosed to that third party (article 5 (3)).

In the case of court reports in certain proceedings where information in the report may be withheld by the court, article 4 provides an exemption from section 7 of the Act and also a complete exemption from the first data protection principle to the extent to which it requires compliance with paragraph 2 of Part II of Schedule 1 to the Act (which confers obligations on data controllers to give certain information to data subjects relating to data held about them).

Article 8 modifies section 7 of the Act so that a data controller cannot refuse access on the grounds that the identity of a third party would be disclosed in cases where the information is contained in a health record and the third party is a health professional who has compiled or contributed to that health record or has been involved in the care of the data subject in his capacity as a health professional, unless serious harm to that health professional’s physical or mental health or condition is likely to be caused by giving access such that the exemption in article 5(1) applies.

This Order contributes to the implementation of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

A Regulatory Impact Assessment was prepared for the Data Protection Bill as it was then and the statutory instruments to be made under it, and was placed in the libraries of both Houses of Parliament. The Regulatory Impact Assessment is now available on the internet at www.homeoffice.gov.uk. Alternatively, copies can be obtained by post from the Home Office, LGDP Unit, 50 Queen Anne’s Gate, London SW1H 9AT.